Index: head/security/vuxml/vuln.xml
===================================================================
--- head/security/vuxml/vuln.xml (revision 489328)
+++ head/security/vuxml/vuln.xml (revision 489329)
@@ -1,65595 +1,65685 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd">
<!--
Copyright 2003-2018 Jacques Vidrine and contributors
Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
HTML, PDF, PostScript, RTF and so forth) with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code (VuXML) must retain the above
copyright notice, this list of conditions and the following
disclaimer as the first lines of this file unmodified.
2. Redistributions in compiled form (transformed to other DTDs,
published online in any format, converted to PDF, PostScript,
RTF and other formats) must reproduce the above copyright
notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
$FreeBSD$
QUICK GUIDE TO ADDING A NEW ENTRY
1. run 'make newentry' to add a template to the top of the document
2. fill in the template
3. use 'make validate' to verify syntax correctness (you might need to install
textproc/libxml2 for parser, and this port for catalogs)
4. fix any errors
5. use 'make VID=xxx-yyy-zzz html' to emit the entry's html file for formatting review
6. profit!
Additional tests can be done this way:
$ pkg audit -f ./vuln.xml py26-django-1.6
$ pkg audit -f ./vuln.xml py27-django-1.6.1
Extensive documentation of the format and help with writing and verifying
a new entry is available in The Porter's Handbook at:
http://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html
Help is also available from ports-security@freebsd.org.
Notes:
* Please add new entries to the beginning of this file.
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="546d4dd4-10ea-11e9-b407-080027ef1a23">
+ <topic>chromium -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>chromium</name>
+ <range><lt>71.0.3578.80</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Google Chrome Releases reports:</p>
+ <blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">
+ <p>43 security fixes in this release, including:</p>
+ <ul>
+ <li>High CVE-2018-17480: Out of bounds write in V8</li>
+ <li>High CVE-2018-17481: Use after free in PDFium</li>
+ <li>High CVE-2018-18335: Heap buffer overflow in Skia</li>
+ <li>High CVE-2018-18336: Use after free in PDFium</li>
+ <li>High CVE-2018-18337: Use after free in Blink</li>
+ <li>High CVE-2018-18338: Heap buffer overflow in Canvas</li>
+ <li>High CVE-2018-18339: Use after free in WebAudio</li>
+ <li>High CVE-2018-18340: Use after free in MediaRecorder</li>
+ <li>High CVE-2018-18341: Heap buffer overflow in Blink</li>
+ <li>High CVE-2018-18342: Out of bounds write in V8</li>
+ <li>High CVE-2018-18343: Use after free in Skia</li>
+ <li>High CVE-2018-18344: Inappropriate implementation in Extensions</li>
+ <li>High To be allocated: Multiple issues in SQLite via WebSQL</li>
+ <li>Medium CVE-2018-18345: Inappropriate implementation in Site Isolation</li>
+ <li>Medium CVE-2018-18346: Incorrect security UI in Blink</li>
+ <li>Medium CVE-2018-18347: Inappropriate implementation in Navigation</li>
+ <li>Medium CVE-2018-18348: Inappropriate implementation in Omnibox</li>
+ <li>Medium CVE-2018-18349: Insufficient policy enforcement in Blink</li>
+ <li>Medium CVE-2018-18350: Insufficient policy enforcement in Blink</li>
+ <li>Medium CVE-2018-18351: Insufficient policy enforcement in Navigation</li>
+ <li>Medium CVE-2018-18352: Inappropriate implementation in Media</li>
+ <li>Medium CVE-2018-18353: Inappropriate implementation in Network Authentication</li>
+ <li>Medium CVE-2018-18354: Insufficient data validation in Shell Integration</li>
+ <li>Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter</li>
+ <li>Medium CVE-2018-18356: Use after free in Skia</li>
+ <li>Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter</li>
+ <li>Medium CVE-2018-18358: Insufficient policy enforcement in Proxy</li>
+ <li>Medium CVE-2018-18359: Out of bounds read in V8</li>
+ <li>Low To be allocated: Inappropriate implementation in PDFium</li>
+ <li>Low To be allocated: Use after free in Extensions</li>
+ <li>Low To be allocated: Inappropriate implementation in Navigation</li>
+ <li>Low To be allocated: Inappropriate implementation in Navigation</li>
+ <li>Low To be allocated: Insufficient policy enforcement in Navigation</li>
+ <li>Low To be allocated: Insufficient policy enforcement in URL Formatter</li>
+ <li>Medium To be allocated: Insufficient policy enforcement in Payments</li>
+ <li>Various fixes from internal audits, fuzzing and other initiatives</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2018-17480</cvename>
+ <cvename>CVE-2018-17481</cvename>
+ <cvename>CVE-2018-18335</cvename>
+ <cvename>CVE-2018-18336</cvename>
+ <cvename>CVE-2018-18337</cvename>
+ <cvename>CVE-2018-18338</cvename>
+ <cvename>CVE-2018-18339</cvename>
+ <cvename>CVE-2018-18340</cvename>
+ <cvename>CVE-2018-18341</cvename>
+ <cvename>CVE-2018-18342</cvename>
+ <cvename>CVE-2018-18343</cvename>
+ <cvename>CVE-2018-18344</cvename>
+ <cvename>CVE-2018-18345</cvename>
+ <cvename>CVE-2018-18346</cvename>
+ <cvename>CVE-2018-18347</cvename>
+ <cvename>CVE-2018-18348</cvename>
+ <cvename>CVE-2018-18349</cvename>
+ <cvename>CVE-2018-18350</cvename>
+ <cvename>CVE-2018-18351</cvename>
+ <cvename>CVE-2018-18352</cvename>
+ <cvename>CVE-2018-18353</cvename>
+ <cvename>CVE-2018-18354</cvename>
+ <cvename>CVE-2018-18355</cvename>
+ <cvename>CVE-2018-18356</cvename>
+ <cvename>CVE-2018-18357</cvename>
+ <cvename>CVE-2018-18358</cvename>
+ <cvename>CVE-2018-18359</cvename>
+ <url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</url>
+ </references>
+ <dates>
+ <discovery>2018-12-04</discovery>
+ <entry>2019-01-05</entry>
+ </dates>
+ </vuln>
+
<vuln vid="3e41c1a6-10bc-11e9-bd85-fcaa147e860e">
<topic>Django -- Content spoofing possibility in the default 404 page</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.18</lt></range>
</package>
<package>
<name>py35-django20</name>
<name>py36-django20</name>
<name>py37-django20</name>
<range><lt>2.0.10</lt></range>
</package>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Django security releases issued reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/jan/04/security-releases/">
<p>An attacker could craft a malicious URL that could make spoofed content
appear on the default page generated by the django.views.defaults.page_not_found()
view.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-3498</cvename>
<url>https://www.djangoproject.com/weblog/2019/jan/04/security-releases/</url>
</references>
<dates>
<discovery>2019-01-03</discovery>
<entry>2019-01-05</entry>
</dates>
</vuln>
<vuln vid="b2f4ab91-0e6b-11e9-8700-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.6.0</ge><lt>11.6.1</lt></range>
<range><ge>11.5.0</ge><lt>11.5.6</lt></range>
<range><ge>8.0.0</ge><lt>11.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/">
<p>Source code disclosure merge request diff</p>
<p>Todos improper access control</p>
<p>URL rel attribute not set</p>
<p>Persistent XSS Autocompletion</p>
<p>SSRF repository mirroring</p>
<p>CI job token LFS error message disclosure</p>
<p>Secret CI variable exposure</p>
<p>Guest user CI job disclosure</p>
<p>Persistent XSS label reference</p>
<p>Persistent XSS wiki in IE browser</p>
<p>SSRF in project imports with LFS</p>
<p>Improper access control CI/CD settings</p>
<p>Missing authorization control merge requests</p>
<p>Improper access control branches and tags</p>
<p>Missing authentication for Prometheus alert endpoint</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/</url>
<cvename>CVE-2018-20493</cvename>
<cvename>CVE-2018-20492</cvename>
<cvename>CVE-2018-20489</cvename>
<cvename>CVE-2018-20490</cvename>
<cvename>CVE-2018-20497</cvename>
<cvename>CVE-2018-20495</cvename>
<cvename>CVE-2018-20488</cvename>
<cvename>CVE-2018-20494</cvename>
<cvename>CVE-2018-20496</cvename>
<cvename>CVE-2018-20491</cvename>
<cvename>CVE-2018-20499</cvename>
<cvename>CVE-2018-20500</cvename>
<cvename>CVE-2018-20501</cvename>
<cvename>CVE-2018-20498</cvename>
<cvename>CVE-2018-20507</cvename>
</references>
<dates>
<discovery>2018-12-31</discovery>
<entry>2019-01-02</entry>
</dates>
</vuln>
<vuln vid="29d34524-0542-11e9-a444-080027fee39c">
<topic>gitea -- privilege escalation, XSS</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.6.2">
<p>Security</p>
<ul>
<li>Sanitize uploaded file names</li>
<li>HTMLEncode user added text</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/5569</url>
<url>https://github.com/go-gitea/gitea/issues/5565</url>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-21</entry>
</dates>
</vuln>
<vuln vid="f8fe2905-0918-11e9-a550-00262d164c21">
<topic>rpm4 -- regression in -setperms, -setugids and -restore</topic>
<affects>
<package>
<name>rpm4</name>
<range><lt>4.14.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rpm4 reports:</p>
<blockquote cite="http://rpm.org/wiki/Releases/4.14.2.1">
<p>Regression in -setperms, -setugids and -restore</p>
<p>Note that this update can not automatically fix possible damage
done by using -setperms, -setugids or -restore with rpm 4.14.2, it
merely fixes the functionlity itself. Any damage needs to be
investigated and fixed manually, such as using -verify and -restore
or reinstalling packages.</p>
</blockquote>
</body>
</description>
<references>
<url>http://rpm.org/wiki/Releases/4.14.2.1</url>
</references>
<dates>
<discovery>2018-10-22</discovery>
<entry>2018-12-26</entry>
</dates>
</vuln>
<vuln vid="70b774a8-05bc-11e9-87ad-001b217b3468">
<topic>Gitlab -- Arbitrary File read in Gitlab project import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.5</lt></range>
<range><ge>11.4.0</ge><lt>11.4.12</lt></range>
<range><ge>8.9.0</ge><lt>11.3.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released">
<p>Arbitrary File read in Gitlab project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/</url>
<cvename>CVE-2018-20229</cvename>
</references>
<dates>
<discovery>2018-12-20</discovery>
<entry>2018-12-22</entry>
</dates>
</vuln>
<vuln vid="4f8665d0-0465-11e9-b77a-6cc21735f730">
<topic>shibboleth-sp -- crashes on malformed date/time content</topic>
<affects>
<package>
<name>shibboleth-sp</name>
<range><ge>3.0.0</ge><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Shibboleth Consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20181219a.txt">
<p>SAML messages, assertions, and metadata all commonly contain
date/time information in a standard XML format.</p>
<p>Invalid formatted data in such fields cause an exception of a type
that was not handled properly in the V3 software and causes a crash
(usually to the shibd daemon process, but possibly to Apache in rare
cases). Note that the crash occurs prior to evaluation of a message's
authenticity, so can be exploited by an untrusted attacker.</p>
<p>The problem is believed to be specific to the V3 software and would
not cause a crash in the older, now unsupported, V2 software.</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20181219a.txt</url>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-20</entry>
</dates>
</vuln>
<vuln vid="1999a215-fc6b-11e8-8a95-ac1f6b67e138">
<topic>couchdb -- administrator privilege escalation</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>2.3.0,2</lt></range>
</package>
<package>
<name>couchdb2</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/...">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.couchdb.org/en/stable/cve/2018-17188.html</url>
<cvename>CVE-2018-17188</cvename>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2018-12-13</entry>
</dates>
</vuln>
<vuln vid="b80f039d-579e-4b82-95ad-b534a709f220">
<topic>bro -- "Magellan" remote code execution vulnerability in bundled sqlite</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bro Network security Monitor reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.6.1 updates the embedded SQLite to version 3.26.0
to address the "Magellan" remote code execution vulnerability.
The stock Bro configuration/scripts don't use SQLite by
default, but custom user scripts/packages may.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2018-12-20</entry>
</dates>
</vuln>
<vuln vid="fa6a4a69-03d1-11e9-be12-a4badb2f4699">
<topic>FreeBSD -- bootpd buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_1</lt></range>
<range><ge>11.2</ge><lt>11.2_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient validation of network-provided data
it may be possible for a malicious attacker to craft a bootp
packet which could cause a stack buffer overflow.</p>
<h1>Impact:</h1>
<p>It is possible that the buffer overflow could lead to a
Denial of Service or remote code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1716</cvename>
<freebsdsa>SA-18:15.bootpd</freebsdsa>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-19</entry>
</dates>
</vuln>
<vuln vid="4b98613c-0078-11e9-b05b-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.0.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/">
<p>WordPress versions 5.0 and earlier are affected by the following bugs, which are
fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are
also available, for users who have not yet updated to 5.0.</p>
<p>Karim El Ouerghemmi discovered that authors could alter meta data to delete files
that they weren’t authorized to.</p>
<p>Simon Scannell of RIPS Technologies discovered that authors could create posts of
unauthorized post types with specially crafted input.</p>
<p>Sam Thomas discovered that contributors could craft meta data in a way that resulted
in PHP object injection.</p>
<p>Tim Coen discovered that contributors could edit new comments from higher-privileged
users, potentially leading to a cross-site scripting vulnerability.</p>
<p>Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site
scripting vulnerability in some circumstances. WordPress itself was not affected,
but plugins could be in some situations.</p>
<p>Team Yoast discovered that the user activation screen could be indexed by search
engines in some uncommon configurations, leading to exposure of email addresses,
and in some rare cases, default generated passwords.</p>
<p>Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload
specifically crafted files that bypass MIME verification, leading to a cross-site
scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/</url>
</references>
<dates>
<discovery>2018-12-13</discovery>
<entry>2018-12-15</entry>
</dates>
</vuln>
<vuln vid="293f40a0-ffa1-11e8-b258-0011d823eebd">
<topic>Mbed TLS -- Local timing attack on RSA decryption</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03">
<p>An attacker who can run code on the same machine that is
performing an RSA decryption can potentially recover the plaintext
through a Bleichenbacher-like oracle.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03</url>
<cvename>CVE-2018-19608</cvename>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="bab29816-ff93-11e8-b05b-00e04c1ea73d">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8</name>
<range><lt>8.7.21</lt></range>
</package>
<package>
<name>typo3-9</name>
<range><lt>9.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/">
<p>CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr.
The vulnerability stemmed from the fact that it was possible to execute XSS inside
the CKEditor source area after persuading the victim to: (i) switch CKEditor to
source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker,
into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.
Although this is an unlikely scenario, we recommend to upgrade to the latest editor version.</p>
<p>Failing to properly encode user input, online media asset rendering
(*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user
account or write access on the server system (e.g. SFTP) is needed in order to exploit this
vulnerability.</p>
<p>Failing to properly encode user input, notifications shown in modal windows in the TYPO3
backend are vulnerable to cross-site scripting. A valid backend user account is needed in
order to exploit this vulnerability.</p>
<p>Failing to properly encode user input, login status display is vulnerable to cross-site
scripting in the website frontend. A valid user account is needed in order to exploit this
vulnerability - either a backend user or a frontend user having the possibility to modify
their user profile.</p>
<p>Template patterns that are affected are:</p>
<ul>
<li>###FEUSER_[fieldName]### using system extension felogin</li>
<li><!--###USERNAME###--> for regular frontend rendering
(pattern can be defined individually using TypoScript setting
config.USERNAME_substToken)</li>
</ul>
<p>It has been discovered that cookies created in the Install Tool are not hardened to be
submitted only via HTTP. In combination with other vulnerabilities such as cross-site
scripting it can lead to hijacking an active and valid session in the Install Tool.</p>
<p>The Install Tool exposes the current TYPO3 version number to non-authenticated users.</p>
<p>Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable
to denial of service. Putting large files with according file extensions results in high
consumption of system resources. This can lead to exceeding limits of the current PHP process
which results in a dysfunctional backend component. A valid backend user account or write
access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.</p>
<p>TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs
URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous
user sessions are valid, attackers can use this vulnerability in order to create an arbitrary
amount of individual session-data records in the database.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="757e6ee8-ff91-11e8-a148-001b217b3468">
<topic>Gitlab -- Arbitrary File read in GitLab project import with Git LFS</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.4</lt></range>
<range><ge>11.4.0</ge><lt>11.4.11</lt></range>
<range><ge>11.0.0</ge><lt>11.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/">
<p>Arbitrary File read in GitLab project import with Git LFS</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/</url>
<cvename>CVE-2018-20144</cvename>
</references>
<dates>
<discovery>2018-12-13</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="ed10ed3f-fddc-11e8-94cf-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-6/">
<h3>Summary</h3>
<p>Local file inclusion through transformation feature</p>
<h3>Description</h3>
<p>A flaw has been found where an attacker can exploit
phpMyAdmin to leak the contents of a local file. The
attacker must have access to the phpMyAdmin Configuration
Storage tables, although these can easily be created in any
database to which the attacker has access. An attacker must
have valid credentials to log in to phpMyAdmin; this
vulnerability does not allow an attacker to circumvent the
login system.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be severe.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-7/">
<h3>Summary</h3>
<p>XSRF/CSRF vulnerability in phpMyAdmin</p>
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible to perform harmful SQL operations such as renaming
databases, creating new tables/routines, deleting designer
pages, adding/deleting users, updating user passwords,
killing SQL processes, etc.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-8/">
<h3>Summary</h3>
<p>XSS vulnerability in navigation tree</p>
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
navigation tree, where an attacker can deliver a payload to
a user through a specially-crafted database/table name.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>The stored XSS vulnerabilities can be triggered only by
someone who logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required forms.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-6/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-7/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-8/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-12</entry>
</dates>
</vuln>
<vuln vid="d10b49b2-8d02-49e8-afde-0844626317af">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>64.0_3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/">
<p>CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module</p>
<p>CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11</p>
<p>CVE-2018-18492: Use-after-free with select element</p>
<p>CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia</p>
<p>CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs</p>
<p>CVE-2018-18495: WebExtension content scripts can be loaded in about: pages</p>
<p>CVE-2018-18496: Embedded feed preview page can be abused for clickjacking</p>
<p>CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators</p>
<p>CVE-2018-18498: Integer overflow when calculating buffer sizes for images</p>
<p>CVE-2018-12406: Memory safety bugs fixed in Firefox 64</p>
<p>CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12405</cvename>
<cvename>CVE-2018-12406</cvename>
<cvename>CVE-2018-12407</cvename>
<cvename>CVE-2018-17466</cvename>
<cvename>CVE-2018-18492</cvename>
<cvename>CVE-2018-18493</cvename>
<cvename>CVE-2018-18494</cvename>
<cvename>CVE-2018-18495</cvename>
<cvename>CVE-2018-18496</cvename>
<cvename>CVE-2018-18497</cvename>
<cvename>CVE-2018-18498</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-11</entry>
</dates>
</vuln>
<vuln vid="32498c8f-fc84-11e8-be12-a4badb2f4699">
<topic>FreeBSD -- Insufficient bounds checking in bhyve(8) device model</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient bounds checking in one of the device models
provided by bhyve(8) can permit a guest operating system
to overwrite memory in the bhyve(8) processing possibly
permitting arbitary code execution.</p>
<h1>Impact:</h1>
<p>A guest OS using a firmware image can cause the bhyve
process to crash, or possibly execute arbitrary code on the
host as root.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1716</cvename>
<freebsdsa>SA-18:14.bhyve</freebsdsa>
</references>
<dates>
<discovery>2018-12-04</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="268a4289-fc84-11e8-be12-a4badb2f4699">
<topic>FreeBSD -- Multiple vulnerabilities in NFS server code</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient and improper checking in the NFS server
code could cause a denial of service or possibly remote
code execution via a specially crafted network packet.</p>
<h1>Impact:</h1>
<p>A remote attacker could cause the NFS server to crash,
resulting in a denial of service, or possibly execute
arbitrary code on the server.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1715</cvename>
<freebsdsa>SA-18:13.nfs</freebsdsa>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="2a86f45a-fc3c-11e8-a414-00155d006b02">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node6</name>
<range><lt>6.15.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.14.0</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.14.0</lt></range>
</package>
<package>
<name>node</name>
<range><lt>11.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/">
<p>Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j.</p>
<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
<h1>Debugger port 5858 listens on any interface by default (CVE-2018-12120)</h1>
<p>All versions of Node.js 6 are vulnerable and the severity is HIGH. When the debugger is enabled with <code>node --debug</code> or <code>node debug</code>, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as <code>node --debug=localhost</code>. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.</p>
<h1>Denial of Service with large HTTP headers (CVE-2018-12121)</h1>
<p>All versions of 6 and later are vulnerable and the severity is HIGH. By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
<p>The total size of HTTP headers received by Node.js now must not exceed 8192 bytes.</p>
<h1>"Slowloris" HTTP Denial of Service (CVE-2018-12122)</h1>
<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
<p>A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with <code>server.headersTimeout</code>. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with <code>server.setTimeout()</code>, this aids in protecting against excessive resource retention and possible Denial of Service.</p>
<h1>Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)</h1>
<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using <code>url.parse()</code> to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.</p>
<h1>HTTP request splitting (CVE-2018-12116)</h1>
<p>Node.js 6 and 8 are vulnerable and the severity is MEDIUM. If Node.js can be convinced to use unsanitized user-provided Unicode data for the <code>path</code> option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.</p>
<h1>OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)</h1>
<p>The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
<h1>OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)</h1>
<p>The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
<h1>OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)</h1>
<p>OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side-channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/</url>
<cvename>CVE-2018-12120</cvename>
<cvename>CVE-2018-12121</cvename>
<cvename>CVE-2018-12122</cvename>
<cvename>CVE-2018-12123</cvename>
<cvename>CVE-2018-12116</cvename>
<cvename>CVE-2018-0735</cvename>
<cvename>CVE-2018-0734</cvename>
<cvename>CVE-2018-5407</cvename>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="f6d6308a-f2ec-11e8-b005-6805ca2fa271">
<topic>powerdns-recursor -- Crafted query can cause a denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>powerdns Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2018-16855: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2018-16855</cvename>
</references>
<dates>
<discovery>2018-11-26</discovery>
<entry>2018-12-09</entry>
</dates>
</vuln>
<vuln vid="0e8f496a-b498-11e8-bdcf-74d435e60b7c">
<topic>py-asyncssh -- Allows bypass of authentication</topic>
<affects>
<package>
<name>py-asyncssh</name>
<range><lt>1.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre.org Reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749">
<p>The SSH server implementation of AsyncSSH before 1.12.1 does not properly check
whether authentication is completed before processing other requests
A customized SSH client can simply skip the authentication step.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749</url>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-12-08</entry>
</dates>
</vuln>
<vuln vid="9d3428d4-f98c-11e8-a148-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.3</lt></range>
<range><ge>11.4.0</ge><lt>11.4.10</lt></range>
<range><ge>8.11.0</ge><lt>11.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released">
<p>Directory Traversal in Templates API</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/</url>
<cvename>CVE-2018-19856</cvename>
</references>
<dates>
<discovery>2018-12-06</discovery>
<entry>2018-12-06</entry>
</dates>
</vuln>
<vuln vid="49cbe200-f92a-11e8-a89d-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-42.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2018-15982).</li>
<li>This update resolves an insecure library loading vulnerability that
could lead to privilege escalation (CVE-2018-15983).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15982</cvename>
<cvename>CVE-2018-15983</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-42.html</url>
</references>
<dates>
<discovery>2018-12-05</discovery>
<entry>2018-12-06</entry>
</dates>
</vuln>
<vuln vid="3aa27226-f86f-11e8-a085-3497f683cb16">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.154</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.138.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-12-05/">
<h1>Description</h1>
<h5>(Critical) SECURITY-595</h5>
<p>Code execution through crafted URLs</p>
<h5>(Medium) SECURITY-904</h5>
<p>Forced migration of user records</p>
<h5>(Medium) SECURITY-1072</h5>
<p>Workspace browser allowed accessing files outside the workspace</p>
<h5>(Medium) SECURITY-1193</h5>
<p>Potential denial of service through cron expression form validation</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-12-05/</url>
</references>
<dates>
<discovery>2018-12-05</discovery>
<entry>2018-12-05</entry>
</dates>
</vuln>
<vuln vid="889e35f4-f6a0-11e8-82dc-fcaa147e860e">
<topic>moodle -- Login CSRF vulnerability</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.15</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.9</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.6</lt></range>
</package>
<package>
<name>moodle35</name>
<range><lt>3.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=378731">
<p>The login form is not protected by a token to prevent login cross-site
request forgery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-16854</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=378731</url>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-12-03</entry>
</dates>
</vuln>
<vuln vid="f96044a2-7df9-414b-9f6b-6e5b85d06c86">
<topic>Rails -- Active Job vulnerability</topic>
<affects>
<package>
<name>rubygem-activejob4</name>
<range><lt>4.2.11</lt></range>
</package>
<package>
<name>rubygem-activejob5</name>
<range><lt>5.1.6.1</lt></range>
</package>
<package>
<name>rubygem-activejob50</name>
<range><lt>5.0.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/">
<p>Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These
contain the following important security fixes, and it is recommended
that users upgrade as soon as possible</p>
<p>CVE-2018-16476 Broken Access Control vulnerability in Active Job:
Carefully crafted user input can cause Active Job to deserialize it
using GlobalId and allow an attacker to have access to information that
they should not have.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/</url>
<cvename>CVE-2018-16476</cvename>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-02</entry>
</dates>
</vuln>
<vuln vid="3563fae5-f60c-11e8-b513-5404a68ad561">
<topic>uriparser -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>uriparser</name>
<range><lt>0.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The upstream project reports:</p>
<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog">
<p>* Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx*
Commit 864f5d4c127def386dd5cc926ad96934b297f04e
Thanks to Google Autofuzz team for the report!</p>
<p>* Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
Commit f76275d4a91b28d687250525d3a0c5509bbd666f
Thanks to Google Autofuzz team for the report!</p>
<p>* Fixed: Protect uriResetUri* against acting on NULL input
Commit f58c25069cf4a986fe17a80c5b38687e31feb539</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19198</cvename>
<cvename>CVE-2018-19199</cvename>
<cvename>CVE-2018-19200</cvename>
<url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog</url>
</references>
<dates>
<discovery>2018-10-27</discovery>
<entry>2018-12-02</entry>
</dates>
</vuln>
<vuln vid="c7b1af20-f34f-11e8-9cde-e0d55e2a8bf9">
<topic>messagelib -- HTML email can open browser window automatically</topic>
<affects>
<package>
<name>messagelib</name>
<range><lt>18.08.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20181128-1.txt">
<p>messagelib is the library used by KMail to display emails.</p>
<p>messagelib by default displays emails as plain text, but gives the user
an option to "Prefer HTML to plain text" in the settings and if that option
is not enabled there is way to enable HTML display when an email contains HTML.</p>
<p>Some HTML emails can trick messagelib into opening a new browser window when
displaying said email as HTML.</p>
<p>This happens even if the option to allow the HTML emails to access
remote servers is disabled in KMail settings.</p>
<p>This means that the owners of the servers referred in the email can see
in their access logs your IP address.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19516</cvename>
<url>https://www.kde.org/info/security/advisory-20181128-1.txt</url>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="93f8e0ff-f33d-11e8-be46-0019dbb15b3f">
<topic>payara -- Default typing issue in Jackson Databind</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.181.3</eq></range>
<range><eq>4.1.2.182</eq></range>
<range><eq>5.181.3</eq></range>
<range><eq>5.182</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489">
<p>FasterXML jackson-databind before 2.8.11.1 and 2.9.x before
2.9.5 allows unauthenticated remote code execution because of
an incomplete fix for the CVE-2017-7525 deserialization flaw.
This is exploitable by sending maliciously crafted JSON input
to the readValue method of the ObjectMapper, bypassing a
blacklist that is ineffective if the c3p0 libraries are
available in the classpath.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489</url>
<cvename>CVE-2018-7489</cvename>
</references>
<dates>
<discovery>2018-02-26</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="22bc5327-f33f-11e8-be46-0019dbb15b3f">
<topic>payara -- Code execution via crafted PUT requests to JSPs</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.174</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615">
<p>When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP
PUTs enabled (e.g. via setting the readonly initialisation
parameter of the Default to false) it was possible to upload a
JSP file to the server via a specially crafted request. This
JSP could then be requested and any code it contained would be
executed by the server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615</url>
<cvename>CVE-2017-12615</cvename>
</references>
<dates>
<discovery>2017-08-07</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="d70c9e18-f340-11e8-be46-0019dbb15b3f">
<topic>payara -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.173</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031">
<p>Apache Commons FileUpload before 1.3.3
DiskFileItem File Manipulation Remote Code Execution.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239">
<p>Vulnerability in the Oracle GlassFish Server component of
Oracle Fusion Middleware (subcomponent: Administration).
Supported versions that are affected are 3.0.1 and 3.1.2.
Easily exploitable vulnerability allows low privileged attacker
with logon to the infrastructure where Oracle GlassFish Server
executes to compromise Oracle GlassFish Server. Successful
attacks of this vulnerability can result in unauthorized read
access to a subset of Oracle GlassFish Server accessible data.
CVSS v3.0 Base Score 3.3 (Confidentiality impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Core). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
vulnerability allows unauthenticated attacker with network access
via SMTP to compromise Oracle GlassFish Server. Successful
attacks require human interaction from a person other than the
attacker. Successful attacks of this vulnerability can result in
unauthorized update, insert or delete access to some of Oracle
GlassFish Server accessible data. CVSS v3.0 Base Score 4.3
(Integrity impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249">
<p>Vulnerability in the Oracle GlassFish Server component of
Oracle Fusion Middleware (subcomponent: Security). Supported
versions that are affected are 2.1.1, 3.0.1 and 3.1.2.
Easily exploitable vulnerability allows unauthenticated attacker
with network access via LDAP to compromise Oracle GlassFish Server.
Successful attacks of this vulnerability can result in unauthorized
update, insert or delete access to some of Oracle GlassFish Server
accessible data as well as unauthorized read access to a subset of
Oracle GlassFish Server accessible data and unauthorized ability
to cause a partial denial of service (partial DOS) of Oracle
GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality,
Integrity and Availability impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Security). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
vulnerability allows unauthenticated attacker with network access
via HTTP to compromise Oracle GlassFish Server. Successful attacks
of this vulnerability can result in unauthorized update, insert or
delete access to some of Oracle GlassFish Server accessible data as
well as unauthorized read access to a subset of Oracle GlassFish
Server accessible data and unauthorized ability to cause a partial
denial of service (partial DOS) of Oracle GlassFish Server.
CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and
Availability impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Security). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit
vulnerability allows unauthenticated attacker with network access
via multiple protocols to compromise Oracle GlassFish Server. While
the vulnerability is in Oracle GlassFish Server, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle GlassFish Server.
CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and
Availability impacts).</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031</url>
<cvename>CVE-2016-1000031</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239</url>
<cvename>CVE-2017-3239</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247</url>
<cvename>CVE-2017-3247</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249</url>
<cvename>CVE-2017-3249</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250</url>
<cvename>CVE-2017-3250</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528</url>
<cvename>CVE-2016-5528</cvename>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="8a4aba2d-f33e-11e8-9416-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.1</lt></range>
<range><ge>11.4.0</ge><lt>11.4.8</lt></range>
<range><ge>0</ge><lt>11.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released">
<p>View Names of Private Groups</p>
<p>Persistent XSS in Environments</p>
<p>SSRF in Prometheus integration</p>
<p>Unauthorized Promotion of Milestones</p>
<p>Exposure of Confidential Issue Title</p>
<p>Persisent XSS in Markdown Fields via Mermaid Script</p>
<p>Persistent XSS in Markdown Fields via Unrecognized HTML Tags</p>
<p>Symlink Race Condition in Pages</p>
<p>Unauthorized Changes by Guest User in Issues</p>
<p>Unauthorized Comments on Locked Issues</p>
<p>Improper Enforcement of Token Scope</p>
<p>CRLF Injection in Project Mirroring</p>
<p>XSS in OAuth Authorization</p>
<p>SSRF in Webhooks</p>
<p>Send Email on Email Address Change</p>
<p>Workhorse Logs Contained Tokens</p>
<p>Unauthorized Publishing of Draft Comments</p>
<p>Guest Can Set Weight of a New Issue</p>
<p>Disclosure of Private Group's Members and Milestones</p>
<p>Persisent XSS in Operations</p>
<p>Reporter Can View Operations Page</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/</url>
<cvename>CVE-2018-19494</cvename>
<cvename>CVE-2018-19493</cvename>
<cvename>CVE-2018-19495</cvename>
<cvename>CVE-2018-19496</cvename>
<cvename>CVE-2018-19577</cvename>
<cvename>CVE-2018-19573</cvename>
<cvename>CVE-2018-19570</cvename>
<cvename>CVE-2018-19572</cvename>
<cvename>CVE-2018-19576</cvename>
<cvename>CVE-2018-19575</cvename>
<cvename>CVE-2018-19569</cvename>
<cvename>CVE-2018-19585</cvename>
<cvename>CVE-2018-19574</cvename>
<cvename>CVE-2018-19571</cvename>
<cvename>CVE-2018-19580</cvename>
<cvename>CVE-2018-19583</cvename>
<cvename>CVE-2018-19582</cvename>
<cvename>CVE-2018-19581</cvename>
<cvename>CVE-2018-19584</cvename>
<cvename>CVE-2018-19579</cvename>
<cvename>CVE-2018-19578</cvename>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="54976998-f248-11e8-81e2-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><le>4.6.16</le></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.12</lt></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.7</lt></range>
</package>
<package>
<name>samba49</name>
<range><lt>4.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-14629.html">
<p>All versions of Samba from 4.0.0 onwards are vulnerable to infinite
query recursion caused by CNAME loops. Any dns record can be added via
ldap by an unprivileged user using the ldbadd tool, so this is a
security issue.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16841.html">
<p>When configured to accept smart-card authentication, Samba's KDC will call
talloc_free() twice on the same memory if the principal in a validly signed
certificate does not match the principal in the AS-REQ.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16851.html">
<p>During the processing of an LDAP search before Samba's AD DC returns
the LDAP entries to the client, the entries are cached in a single
memory object with a maximum size of 256MB. When this size is
reached, the Samba process providing the LDAP service will follow the
NULL pointer, terminating the process.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16852.html">
<p>During the processing of an DNS zone in the DNS management DCE/RPC server,
the internal DNS server or the Samba DLZ plugin for BIND9, if the
DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS
property is set, the server will follow a NULL pointer and terminate</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16853.html">
<p>A user in a Samba AD domain can crash the KDC when Samba is built in the
non-default MIT Kerberos configuration.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16857.html">
<p>AD DC Configurations watching for bad passwords (to restrict brute forcing
of passwords) in a window of more than 3 minutes may not watch for bad
passwords at all.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-14629.html</url>
<cvename>CVE-2018-14629</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16841.html</url>
<cvename>CVE-2018-16841</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16851.html</url>
<cvename>CVE-2018-16851</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16852.html</url>
<cvename>CVE-2018-16852</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16853.html</url>
<cvename>CVE-2018-16853</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16857.html</url>
<cvename>CVE-2018-16857</cvename>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="ec49f6b5-ee39-11e8-b2f4-74d435b63d51">
<topic>php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter</topic>
<affects>
<package>
<name>php56-imap</name>
<range><lt>5.6.38_1</lt></range>
</package>
<package>
<name>php70-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php71-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php72-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php73-imap</name>
<range><lt>*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP team reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=77153">
<p>imap_open allows to run arbitrary shell commands via mailbox parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=77153</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-11-22</entry>
<modified>2018-11-22</modified>
</dates>
</vuln>
<vuln vid="b036faba-edd8-11e8-b3b7-00e04c1ea73d">
<topic>phpmailer -- Multiple vulnerability</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.27</lt></range>
</package>
<package>
<name>phpmailer6</name>
<range><lt>6.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6">
<p>CVE-2018-19296:Fix potential object injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27</url>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6</url>
<cvename>CVE-2018-19296</cvename>
</references>
<dates>
<discovery>2018-11-16</discovery>
<entry>2018-11-21</entry>
<modified>2018-11-23</modified>
</dates>
</vuln>
<vuln vid="8f128c72-ecf9-11e8-aa00-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.153</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-44.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-15981).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15981</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-44.html</url>
</references>
<dates>
<discovery>2018-11-20</discovery>
<entry>2018-11-20</entry>
</dates>
</vuln>
<vuln vid="d889d32c-ecd9-11e8-9416-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.6</lt></range>
<range><ge>8.9.0</ge><lt>11.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/">
<p>Persistent XSS Autocompletion</p>
<p>Unauthorized service template creation</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/</url>
<cvename>CVE-2018-18643</cvename>
<cvename>CVE-2018-19359</cvename>
</references>
<dates>
<discovery>2018-11-19</discovery>
<entry>2018-11-20</entry>
</dates>
</vuln>
<vuln vid="0aee2f13-ec1d-11e8-8c92-6805ca2fa271">
<topic>powerdns -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html">
<p>CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing
an authorized user to cause a memory leak by inserting a specially crafted record
in a zone under their control, then sending a DNS query for that record. The issue
is due to the fact that some memory is allocated before the parsing and is not
always properly released if the record is malformed. When the PowerDNS
Authoritative Server is run inside the guardian (--guardian), or inside a
supervisor like supervisord or systemd, an out-of-memory crash will lead to an
automatic restart, limiting the impact to a somewhat degraded service.</p>
<p>CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing
a remote user to craft a DNS query that will cause an answer without DNSSEC
records to be inserted into the packet cache and be returned to clients asking for
DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname
and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients
will consider the answer to be bogus until it expires from the packet cache,
leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/changelog/4.1.html</url>
<cvename>CVE-2018-10851</cvename>
<cvename>CVE-2018-14626</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-19</entry>
</dates>
</vuln>
<vuln vid="e9aa0e4c-ea8b-11e8-a5b7-00e04c1ea73d">
<topic>powerdns-recursor -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.7</lt></range>
</package>
<package>
<name>powerdns-recursor40</name>
<range><lt>4.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>powerdns Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing
a malicious authoritative server to cause a memory leak by sending specially
crafted records. The issue is due to the fact that some memory is allocated
before the parsing and is not always properly released if the record is malformed.
When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd,
an out-of-memory crash will lead to an automatic restart, limiting the impact to
a somewhat degraded service.</p>
<p>CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote
user to craft a DNS query that will cause an answer without DNSSEC records to be
inserted into the packet cache and be returned to clients asking for DNSSEC
records, thus hiding the presence of DNSSEC signatures for a specific qname and
qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC
validation by themselves might consider the answer to be bogus until it expires
from the packet cache, leading to a denial of service.</p>
<p>CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker
sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached
as failing DNSSEC validation. It only arises if the parent zone is signed, and all
the authoritative servers for that parent zone answer with FORMERR to a query for at
least one of the meta-types. As a result, subsequent queries from clients requesting
DNSSEC validation will be answered with a ServFail.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2018-10851</cvename>
<cvename>CVE-2018-14626</cvename>
<cvename>CVE-2018-14644</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-17</entry>
<modified>2018-11-19</modified>
</dates>
</vuln>
<vuln vid="c6fb2734-e835-11e8-b14b-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability DNS SRV and NAPTR lookups</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.6.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>There is a buffer overflow vulnerability in dns_srv
and dns_naptr functions of Asterisk that allows an attacker
to crash Asterisk via a specially crafted DNS SRV or NAPTR
response. The attackers request causes Asterisk to segfault
and crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-010.html</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-11-14</entry>
</dates>
</vuln>
<vuln vid="b69292e8-e798-11e8-ae07-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.148</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-39.html">
<ul>
<li>This update resolves a out-of-bounds vulnerability that
could lead to information disclosure (CVE-2018-15978).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15978</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-39.html</url>
</references>
<dates>
<discovery>2018-11-13</discovery>
<entry>2018-11-13</entry>
</dates>
</vuln>
<vuln vid="6f170cf2-e6b7-11e8-a9a8-b499baebfeaf">
<topic>OpenSSL -- timing vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2p_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20181112.txt">
<p>Microarchitecture timing vulnerability in ECC scalar
multiplication. Severity: Low<br/>
OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has
been shown to be vulnerable to a microarchitecture timing side channel
attack. An attacker with sufficient access to mount local timing
attacks during ECDSA signature generation could recover the private
key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20181112.txt</url>
<cvename>CVE-2018-5407</cvename>
</references>
<dates>
<discovery>2018-11-12</discovery>
<entry>2018-11-12</entry>
</dates>
</vuln>
<vuln vid="1460aa25-e6ab-11e8-a733-e0d55e2a8bf9">
<topic>kio-extras -- HTML Thumbnailer automatic remote file access</topic>
<affects>
<package>
<name>kio-extras</name>
<range><lt>18.08.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20181012-1.txt">
<p>Various KDE applications share a plugin system to create thumbnails
of various file types for displaying in file managers, file dialogs, etc.
kio-extras contains a thumbnailer plugin for HTML files.
</p>
<p>
The HTML thumbnailer was incorrectly accessing some content of
remote URLs listed in HTML files. This meant that the owners of the servers
referred in HTML files in your system could have seen in their access logs
your IP address every time the thumbnailer tried to create the thumbnail.
</p>
<p>
The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0
because it was actually not creating thumbnails for files at all.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19120</cvename>
<url>https://www.kde.org/info/security/advisory-20181012-1.txt</url>
</references>
<dates>
<discovery>2018-11-12</discovery>
<entry>2018-11-12</entry>
</dates>
</vuln>
<vuln vid="791841a3-d484-4878-8909-92ef9ce424f4">
<topic>patch -- multiple vulnerabilities</topic>
<affects>
<package>
<name>patch</name>
<range><lt>2.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6951">
<p>An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6952">
<p>A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000156">
<p>GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6951</cvename>
<cvename>CVE-2018-6952</cvename>
<cvename>CVE-2018-1000156</cvename>
<url>https://savannah.gnu.org/bugs/?53132</url>
<url>https://savannah.gnu.org/bugs/?53133</url>
<url>https://savannah.gnu.org/bugs/?53566</url>
</references>
<dates>
<discovery>2018-04-16</discovery>
<entry>2018-11-11</entry>
<modified>2018-11-11</modified>
</dates>
</vuln>
<vuln vid="92a6efd0-e40d-11e8-ada4-408d5cf35399">
<topic>lighttpd - use-after-free vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd Project reports:</p>
<blockquote cite="https://www.lighttpd.net/2018/10/14/1.4.51/">
<p>Security fixes for Lighttpd:</p>
<ul>
<li><p>security: process headers after combining folded headers</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.lighttpd.net/2018/10/14/1.4.51/</url>
<freebsdpr>ports/232278</freebsdpr>
</references>
<dates>
<discovery>2018-08-26</discovery>
<entry>2018-11-09</entry>
</dates>
</vuln>
<vuln vid="1c27a706-e3aa-11e8-b77a-6cc21735f730">
<topic>PostgreSQL -- SQL injection in pg_upgrade and pg_dump</topic>
<affects>
<package>
<name>postgresql10-server</name>
<range><lt>10.6</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.11</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.15</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.20</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><lt>9.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1878/">
<p>CVE-2018-16850: SQL injection in pg_upgrade and pg_dump,
via CREATE TRIGGER ... REFERENCING.</p>
<p>Using a purpose-crafted trigger definition, an attacker can run
arbitrary SQL statements with superuser privileges when a superuser
runs pg_upgrade on the database or during a pg_dump dump/restore
cycle. This attack requires a CREATE privilege on some non-temporary
schema or a TRIGGER privilege on a table. This is exploitable in the
default PostgreSQL configuration, where all users have CREATE
privilege on public schema.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1905/</url>
<cvename>CVE-2018-16850</cvename>
</references>
<dates>
<discovery>2018-11-08</discovery>
<entry>2018-11-08</entry>
</dates>
</vuln>
<vuln vid="84ca56be-e1de-11e8-bcfd-00e04c1ea73d">
<topic>NGINX -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.14.1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.15.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX Team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>Two security issues were identified in nginx HTTP/2 implementation,
which might cause excessive memory consumption (CVE-2018-16843)
and CPU usage (CVE-2018-16844).</p>
<p>The issues affect nginx compiled with the ngx_http_v2_module (not
compiled by default) if the "http2" option of the "listen" directive is
used in a configuration file.</p>
<p>A security issue was identified in the ngx_http_mp4_module, which might
allow an attacker to cause infinite loop in a worker process, cause a
worker process crash, or might result in worker process memory
isclosure by using a specially crafted mp4 file (CVE-2018-16845).</p>
<p>The issue only affects nginx if it is built with the ngx_http_mp4_module
(the module is not built by default) and the "mp4" directive is used in
the configuration file. Further, the attack is only possible if an
attacker is able to trigger processing of a specially crafted mp4 file
with the ngx_http_mp4_module. </p>
</blockquote>
</body>
</description>
<references>
<url>http://nginx.org/en/security_advisories.html</url>
<cvename>CVE-2018-16843</cvename>
<cvename>CVE-2018-16844</cvename>
<cvename>CVE-2018-16845</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-06</entry>
</dates>
</vuln>
<vuln vid="deb4f633-de1d-11e8-a9fb-080027f43a02">
<topic>gitea -- remote code exeution</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2018/10/gitea-1.5.3-is-released/">
<p>[This release] contains crit[i]cal security fix for vulnerability
that could potentially allow for authorized users to do remote code
ex[e]cution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/5177</url>
<url>https://github.com/go-gitea/gitea/pull/5196</url>
<url>https://github.com/go-macaron/session/commit/084f1e5c1071f585902a7552b483cee04bc00a14</url>
</references>
<dates>
<discovery>2018-10-25</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="e0ab1773-07c1-46c6-9170-4c5e81c00927">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.14.1</ge><lt>7.60.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-16839: SASL password overflow via integer overflow</p>
<p>libcurl contains a buffer overrun in the SASL authentication code.</p>
<p>The internal function Curl_auth_create_plain_message fails to
correctly verify that the passed in lengths for name and password
aren't too long, then calculates a buffer size to allocate.</p>
<p>On systems with a 32 bit size_t, the math to calculate the buffer size
triggers an integer overflow when the user name length exceeds 2GB
(2^31 bytes). This integer overflow usually causes a very small buffer
to actually get allocated instead of the intended very huge one, making
the use of that buffer end up in a heap buffer overflow.</p>
<p>This bug is very similar to CVE-2017-14618.</p>
<p>It affects curl 7.33.0 to 7.61.1.</p>
<p>CVE-2018-16840: use-after-free in handle close</p>
<p>libcurl contains a heap use-after-free flaw in code related to closing
an easy handle.</p>
<p>When closing and cleaning up an "easy" handle in the Curl_close()
function, the library code first frees a struct (without nulling the
pointer) and might then subsequently erroneously write to a struct
field within that already freed struct.</p>
<p>It affects curl 7.59.0 to 7.61.1.</p>
<p>CVE-2018-16842: warning message out-of-buffer read</p>
<p>curl contains a heap out of buffer read vulnerability.</p>
<p>The command line tool has a generic function for displaying warning
and informational messages to stderr for various situations. For
example if an unknown command line argument is used, or passed to it in
a "config" file.</p>
<p>This display function formats the output to wrap at 80 columns. The
wrap logic is however flawed, so if a single word in the message is
itself longer than 80 bytes the buffer arithmetic calculates the
remainder wrong and will end up reading behind the end of the buffer.
This could lead to information disclosure or crash.</p>
<p>This vulnerability could lead to a security issue if used in this or
similar situations:</p>
<p>1. a server somewhere uses the curl command line to run something</p>
<p>2. if it fails, it shows stderr to the user</p>
<p>3. the server takes user input for parts of its command line input</p>
<p>4. user provides something overly long that triggers this crash</p>
<p>5. the stderr output may now contain user memory contents that wasn't
meant to be available</p>
<p>It affects curl 7.14.1 to 7.61.1.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16839.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16840.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16842.html</url>
<cvename>CVE-2018-16839</cvename>
<cvename>CVE-2018-16840</cvename>
<cvename>CVE-2018-16842</cvename>
</references>
<dates>
<discovery>2018-10-31</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="b51d9e83-de08-11e8-9416-001b217b3468">
<topic>Gitlab -- SSRF in Kubernetes integration</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.4</lt></range>
<range><ge>11.3.0</ge><lt>11.3.9</lt></range>
<range><ge>11.0.0</ge><lt>11.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/">
<p>SSRF in Kubernetes integration</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/</url>
<cvename>CVE-2018-18843</cvename>
</references>
<dates>
<discovery>2018-11-01</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="36a2a89e-7ee1-4ea4-ae22-7ca38019c8d0">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/154">
<p>This issue has been created for public disclosure of an XSS
vulnerability that was responsibly reported (independently) by Shubham
Pathak and @yasinS (Yasin Soliman).</p>
<p>In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/154</url>
<cvename>CVE-2018-16468</cvename>
</references>
<dates>
<discovery>2018-10-30</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="b9591212-dba7-11e8-9416-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.3</lt></range>
<range><ge>11.3.0</ge><lt>11.3.8</lt></range>
<range><ge>5.3.0</ge><lt>11.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/">
<p>RCE in Gitlab Wiki API</p>
<p>SSRF in Hipchat integration</p>
<p>Cleartext storage of personal access tokens</p>
<p>Information exposure through stack trace error message</p>
<p>Persistent XSS autocomplete</p>
<p>Information exposure in stored browser history</p>
<p>Information exposure when replying to issues through email</p>
<p>Persistent XSS in License Management and Security Reports</p>
<p>Metrics information disclosure in Prometheus integration</p>
<p>Unauthorized changes to a protected branch's access levels</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/</url>
<cvename>CVE-2018-18649</cvename>
<cvename>CVE-2018-18646</cvename>
<cvename>CVE-2018-18641</cvename>
<cvename>CVE-2018-18648</cvename>
<cvename>CVE-2018-18643</cvename>
<cvename>CVE-2018-18640</cvename>
<cvename>CVE-2018-18645</cvename>
<cvename>CVE-2018-18642</cvename>
<cvename>CVE-2018-18644</cvename>
<cvename>CVE-2018-18647</cvename>
</references>
<dates>
<discovery>2018-10-29</discovery>
<entry>2018-10-29</entry>
</dates>
</vuln>
<vuln vid="238ae7de-dba2-11e8-b713-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities in 1.1 branch</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0i_1</lt></range>
</package>
<package>
<name>openssl111</name>
<range><lt>1.1.1_2</lt></range>
</package>
<package>
<name>libressl</name>
<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20181029.txt">
<p>Timing vulnerability in ECDSA signature generation
(CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been
shown to be vulnerable to a timing side channel attack. An
attacker could use variations in the signing algorithm to
recover the private key (Low).</p>
<p>Timing vulnerability in DSA signature generation (CVE-2018-0734):
Avoid a timing attack that leaks information via a side channel
that triggers when a BN is resized. Increasing the size of the
BNs prior to doing anything with them suppresses the attack (Low).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20181029.txt</url>
<url>https://github.com/openssl/openssl/commit/8abfe72e</url>
<cvename>CVE-2018-0735</cvename>
<cvename>CVE-2018-0734</cvename>
</references>
<dates>
<discovery>2018-10-29</discovery>
<entry>2018-10-29</entry>
<modified>2018-11-10</modified>
</dates>
</vuln>
<vuln vid="fa194483-dabd-11e8-bf39-5404a68ad561">
<topic>liveMedia -- potential remote code execution</topic>
<affects>
<package>
<name>liveMedia</name>
<range><lt>2018.10.17,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684">
<p>An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality
of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer
overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4013</cvename>
<url>https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684</url>
<url>http://lists.live555.com/pipermail/live-devel/2018-October/021071.html</url>
</references>
<dates>
<discovery>2018-10-18</discovery>
<entry>2018-10-28</entry>
</dates>
</vuln>
<vuln vid="33c384f3-5af6-4662-9741-0acb21c7e499">
<topic>mini_httpd -- disclose arbitrary files is some circumstances</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jef Poskanzer reports:</p>
<blockquote cite="http://acme.com/updates/archive/211.html">
<p>Prior versions allowed remote users to read arbitrary files in some circumstances.</p>
</blockquote>
</body>
</description>
<references>
<url>http://acme.com/updates/archive/211.html</url>
</references>
<dates>
<discovery>2018-10-26</discovery>
<entry>2018-10-26</entry>
</dates>
</vuln>
<vuln vid="4f7c6af3-6a2c-4ead-8453-04e509688d45">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<name>py37-salt</name>
<range><lt>2017.7.8</lt></range>
<range><ge>2018.3.0</ge><lt>2018.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html">
<p>Remote command execution and incorrect access control when using
salt-api.</p>
<p>Directory traversal vulnerability when using salt-api. Allows an
attacker to determine what files exist on a server when querying
/run or /events.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15751</cvename>
<cvename>CVE-2018-15750</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html</url>
<url>https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html</url>
</references>
<dates>
<discovery>2018-10-24</discovery>
<entry>2018-10-27</entry>
</dates>
</vuln>
<vuln vid="7c3a02b9-3273-4426-a0ba-f90fad2ff72e">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>63.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.5</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/">
<p>CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin</p>
<p>CVE-2018-12392: Crash with nested event loops</p>
<p>CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript</p>
<p>CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting</p>
<p>CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts</p>
<p>CVE-2018-12397:</p>
<p>CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs</p>
<p>CVE-2018-12399: Spoofing of protocol registration notification bar</p>
<p>CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android</p>
<p>CVE-2018-12401: DOS attack through special resource URI parsing</p>
<p>CVE-2018-12402: SameSite cookies leak when pages are explicitly saved</p>
<p>CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP</p>
<p>CVE-2018-12388: Memory safety bugs fixed in Firefox 63</p>
<p>CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12388</cvename>
<cvename>CVE-2018-12390</cvename>
<cvename>CVE-2018-12391</cvename>
<cvename>CVE-2018-12392</cvename>
<cvename>CVE-2018-12393</cvename>
<cvename>CVE-2018-12395</cvename>
<cvename>CVE-2018-12396</cvename>
<cvename>CVE-2018-12397</cvename>
<cvename>CVE-2018-12398</cvename>
<cvename>CVE-2018-12399</cvename>
<cvename>CVE-2018-12400</cvename>
<cvename>CVE-2018-12401</cvename>
<cvename>CVE-2018-12402</cvename>
<cvename>CVE-2018-12403</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-10-23</entry>
</dates>
</vuln>
<vuln vid="140a14b5-d615-11e8-b3cb-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.60</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-006">
<p>he path module allows users with the 'administer paths' to create pretty URLs
for content. In certain circumstances the user can enter a particular path that
triggers an open redirect to a malicious url.The issue is mitigated by the fact
that the user needs the administer paths permission to exploit.</p>
<p>When sending email some variables were not being sanitized for shell arguments,
which could lead to remote code execution. </p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-006</url>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2018-10-22</entry>
<modified>2018-11-04</modified>
</dates>
</vuln>
<vuln vid="afc60484-0652-440e-b01a-5ef814747f06">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.3.0,1</ge><lt>2.3.8,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.5,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/">
<p>CVE-2018-16395: OpenSSL::X509::Name equality check does not work
correctly</p>
<p>An instance of OpenSSL::X509::Name contains entities such as CN, C and
so on. Some two instances of OpenSSL::X509::Name are equal only when
all entities are exactly equal. However, there is a bug that the
equality check is not correct if the value of an entity of the
argument (right-hand side) starts with the value of the receiver
(left-hand side). So, if a malicious X.509 certificate is passed to
compare with an existing certificate, there is a possibility to be
judged incorrectly that they are equal.</p>
<p>CVE-2018-16396: Tainted flags are not propagated in Array#pack and
String#unpack with some directives</p>
<p>Array#pack method converts the receiver's contents into a string with
specified format. If the receiver contains some tainted objects, the
returned string also should be tainted. String#unpack method which
converts the receiver into an array also should propagate its tainted
flag to the objects contained in the returned array. But, with B, b, H
and h directives, the tainted flags are not propagated. So, if a script
processes unreliable inputs by Array#pack and/or String#unpack with
these directives and checks the reliability with tainted flags, the
check might be wrong.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/</url>
<url>https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/</url>
<cvename>CVE-2018-16395</cvename>
<cvename>CVE-2018-16396</cvename>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2018-10-20</entry>
</dates>
</vuln>
<vuln vid="ec5072b0-d43a-11e8-a6d2-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.37</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.37</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.19</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.11</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.42</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.24</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.13</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.42</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL</url>
<cvename>CVE-2016-9843</cvename>
<cvename>CVE-2018-3155</cvename>
<cvename>CVE-2018-3143</cvename>
<cvename>CVE-2018-3156</cvename>
<cvename>CVE-2018-3251</cvename>
<cvename>CVE-2018-3182</cvename>
<cvename>CVE-2018-3137</cvename>
<cvename>CVE-2018-3203</cvename>
<cvename>CVE-2018-3133</cvename>
<cvename>CVE-2018-3145</cvename>
<cvename>CVE-2018-3144</cvename>
<cvename>CVE-2018-3185</cvename>
<cvename>CVE-2018-3195</cvename>
<cvename>CVE-2018-3247</cvename>
<cvename>CVE-2018-3187</cvename>
<cvename>CVE-2018-3174</cvename>
<cvename>CVE-2018-3171</cvename>
<cvename>CVE-2018-3277</cvename>
<cvename>CVE-2018-3162</cvename>
<cvename>CVE-2018-3173</cvename>
<cvename>CVE-2018-3200</cvename>
<cvename>CVE-2018-3170</cvename>
<cvename>CVE-2018-3212</cvename>
<cvename>CVE-2018-3280</cvename>
<cvename>CVE-2018-3186</cvename>
<cvename>CVE-2018-3161</cvename>
<cvename>CVE-2018-3278</cvename>
<cvename>CVE-2018-3279</cvename>
<cvename>CVE-2018-3282</cvename>
<cvename>CVE-2018-3284</cvename>
<cvename>CVE-2018-3283</cvename>
<cvename>CVE-2018-3286</cvename>
</references>
<dates>
<discovery>2018-10-16</discovery>
<entry>2018-10-20</entry>
<modified>2018-11-08</modified>
</dates>
</vuln>
<vuln vid="44864c84-d3b8-11e8-b3cb-00e04c1ea73d">
<topic>matomo -- XSS vulnerability</topic>
<affects>
<package>
<name>matomo</name>
<range><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matomo reports:</p>
<blockquote cite="https://matomo.org/changelog/matomo-3-6-1/">
<p>Several XSS issues have been fixed thanks to the great work of security
researchers who responsible disclosed issues to us.</p>
</blockquote>
</body>
</description>
<references>
<url>https://matomo.org/changelog/matomo-3-6-1/</url>
</references>
<dates>
<discovery>2018-10-18</discovery>
<entry>2018-10-19</entry>
</dates>
</vuln>
<vuln vid="2383767c-d224-11e8-9623-a4badb2f4699">
<topic>libssh -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>libssh</name>
<range><ge>0.6</ge><lt>0.7.6</lt></range>
<range><ge>0.8</ge><lt>0.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gladiac reports:</p>
<blockquote cite="https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/">
<p>libssh versions 0.6 and above have an authentication bypass
vulnerability in the server code. By presenting the server an
SSH2_MSG_USERAUTH_SUCCESS message in place of the
SSH2_MSG_USERAUTH_REQUEST message which the server would expect to
initiate authentication, the attacker could successfully authentciate
without any credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/</url>
<cvename>CVE-2018-10933</cvename>
</references>
<dates>
<discovery>2018-10-16</discovery>
<entry>2018-10-17</entry>
</dates>
</vuln>
<vuln vid="8c08ab4c-d06c-11e8-b35c-001b217b3468">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.27.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.5">
<p>Multiple vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.5</url>
<cvename>CVE-2018-17456</cvename>
</references>
<dates>
<discovery>2018-10-05</discovery>
<entry>2018-10-15</entry>
</dates>
</vuln>
<vuln vid="4c11b51e-cd8d-11e8-b0cb-a0f3c100ae18">
<topic>Memory leak bug in Toxcore</topic>
<affects>
<package>
<name>toxcore</name>
<range><lt>0.2.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tox project blog reports:</p>
<blockquote cite="https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/">
<p>A memory leak bug was discovered in Toxcore that can be triggered remotely to
exhaust one’s system memory, resulting in a denial of service attack.
The bug is present in the TCP Server module of Toxcore and therefore it
affects mostly bootstrap nodes. Regular Tox clients generally have the
TCP Server functionality disabled by default, leaving them unaffected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/</url>
</references>
<dates>
<discovery>2018-09-29</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="cb539d4e-cd68-11e8-8819-00e04c1ea73d">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/4357">
<p>CSRF Vulnerability on API.</p>
<p>Enforce token on api routes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/4357</url>
<url>ttps://github.com/go-gitea/gitea/pull/4840</url>
</references>
<dates>
<discovery>2018-10-01</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="3350275d-cd5a-11e8-a7be-3497f683cb16">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.146</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.138.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-10-10/">
<h1>Description</h1>
<h5>(Low) SECURITY-867</h5>
<p>Path traversal vulnerability in Stapler allowed accessing internal data</p>
<h5>(Medium) SECURITY-1074</h5>
<p>Arbitrary file write vulnerability using file parameter definitions</p>
<h5>(Medium) SECURITY-1129</h5>
<p>Reflected XSS vulnerability</p>
<h5>(Medium) SECURITY-1162</h5>
<p>Ephemeral user record was created on some invalid authentication attempts</p>
<h5>(Medium) SECURITY-1128</h5>
<p>Ephemeral user record creation</p>
<h5>(Medium) SECURITY-1158</h5>
<p>Session fixation vulnerability on user signup</p>
<h5>(Medium) SECURITY-765</h5>
<p>Failures to process form submission data could result in secrets being displayed or written to logs</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-10-10/</url>
</references>
<dates>
<discovery>2018-10-10</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="a4eb38ea-cc06-11e8-ada4-408d5cf35399">
<topic>tinc -- Buffer overflow</topic>
<affects>
<package>
<name>tinc</name>
<range><lt>1.0.35</lt></range>
</package>
<package>
<name>tinc-devel</name>
<range><lt>1.1pre17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tinc-vpn.org reports:</p>
<blockquote cite="http://www.tinc-vpn.org/news/">
<p>The authentication protocol allows an oracle attack that could
potentially be exploited.</p>
<p>If a man-in-the-middle has intercepted the TCP connection it
might be able to force plaintext UDP packets between two nodes for up to
a PingInterval period.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a</url>
<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=e97943b7cc9c851ae36f5a41e2b6102faa74193f</url>
<cvename>CVE-2018-16737</cvename>
<cvename>CVE-2018-16738</cvename>
<cvename>CVE-2018-16758</cvename>
</references>
<dates>
<discovery>2018-10-08</discovery>
<entry>2018-10-09</entry>
</dates>
</vuln>
<vuln vid="23413442-c8ea-11e8-b35c-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.3.0</ge><lt>11.3.4</lt></range>
<range><ge>11.2.0</ge><lt>11.2.5</lt></range>
<range><ge>10.2.0</ge><lt>11.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/">
<p>Merge request information disclosure</p>
<p>Private project namespace information disclosure</p>
<p>Gitlab Flavored Markdown API information disclosure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/</url>
<cvename>CVE-2018-17939</cvename>
<cvename>CVE-2018-17976</cvename>
<cvename>CVE-2018-17975</cvename>
</references>
<dates>
<discovery>2018-10-05</discovery>
<entry>2018-10-05</entry>
</dates>
</vuln>
<vuln vid="8b812395-c739-11e8-ab5b-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.100.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Joel Esler reports:</p>
<blockquote cite="https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html">
<ul>
<li>CVE-2018-15378:
<ul>
<li>Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.</li>
<li>Reported by Secunia Research at Flexera.</li>
</ul>
</li>
<li>Fix for a 2-byte buffer over-read bug in ClamAV&s PDF parsing code.
<ul>
<li>Reported by Alex Gaynor.</li>
</ul>
</li>
<li>CVE-2018-14680:
<ul>
<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.</li>
</ul>
</li>
<li>CVE-2018-14681:
<ul>
<li>An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.</li>
</ul>
</li>
<li>CVE-2018-14682:
<ul>
<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.</li>
</ul>
</li>
</ul>
<p>.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html</url>
<cvename>CVE-2018-15378</cvename>
<cvename>CVE-2018-14680</cvename>
<cvename>CVE-2018-14681</cvename>
<cvename>CVE-2018-14682</cvename>
</references>
<dates>
<discovery>2018-10-03</discovery>
<entry>2018-10-03</entry>
</dates>
</vuln>
<vuln vid="004d8c23-c710-11e8-98c7-000c29434208">
<topic>Django -- password hash disclosure</topic>
<affects>
<package>
<name>py34-django21</name>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/2.1/releases/2.1.2/">
<p>CVE-2018-16984: Password hash disclosure to "view only" admin users</p>
<p>If an admin user has the change permission to the user model, only part
of the password hash is displayed in the change form. Admin users with the
view (but not change) permission to the user model were displayed the entire
hash. While it's typically infeasible to reverse a strong password hash, if
your site uses weaker password hashing algorithms such as MD5 or SHA1, it
could be a problem.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/2.1/releases/2.1.2/</url>
<cvename>CVE-2018-16984</cvename>
</references>
<dates>
<discovery>2018-10-02</discovery>
<entry>2018-10-03</entry>
</dates>
</vuln>
<vuln vid="c4f39920-781f-4aeb-b6af-17ed566c4272">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0.3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.4</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.2.2,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/">
<h1>CVE-2018-12386: Type confusion in JavaScript</h1>
<p>A vulnerability in register allocation in JavaScript can
lead to type confusion, allowing for an arbitrary read and
write. This leads to remote code execution inside the
sandboxed content process when triggered.</p>
<h1>CVE-2018-12387: </h1>
<p>A vulnerability where the JavaScript JIT compiler inlines
Array.prototype.push with multiple arguments that results
in the stack pointer being off by 8 bytes after a
bailout. This leaks a memory address to the calling
function which can be used as part of an exploit inside
the sandboxed content process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12386</cvename>
<cvename>CVE-2018-12387</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/</url>
</references>
<dates>
<discovery>2018-10-02</discovery>
<entry>2018-10-02</entry>
</dates>
</vuln>
<vuln vid="065b3b72-c5ab-11e8-9ae2-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.3.0</ge><lt>11.3.1</lt></range>
<range><ge>11.2.0</ge><lt>11.2.4</lt></range>
<range><ge>7.6.0</ge><lt>11.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/">
<p>SSRF GCP access token disclosure</p>
<p>Persistent XSS on issue details</p>
<p>Diff formatter DoS in Sidekiq jobs</p>
<p>Confidential information disclosure in events API endpoint</p>
<p>validate_localhost function in url_blocker.rb could be bypassed</p>
<p>Slack integration CSRF Oauth2</p>
<p>GRPC::Unknown logging token disclosure</p>
<p>IDOR merge request approvals</p>
<p>Persistent XSS package.json</p>
<p>Persistent XSS merge request project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/</url>
<cvename>CVE-2018-17450</cvename>
<cvename>CVE-2018-17454</cvename>
<cvename>CVE-2018-15472</cvename>
<cvename>CVE-2018-17449</cvename>
<cvename>CVE-2018-17452</cvename>
<cvename>CVE-2018-17451</cvename>
<cvename>CVE-2018-17453</cvename>
<cvename>CVE-2018-17455</cvename>
<cvename>CVE-2018-17537</cvename>
<cvename>CVE-2018-17536</cvename>
</references>
<dates>
<discovery>2018-10-01</discovery>
<entry>2018-10-01</entry>
</dates>
</vuln>
<vuln vid="5a757a31-f98e-4bd4-8a85-f1c0f3409769">
<topic>pango -- remote DoS vulnerability</topic>
<affects>
<package>
<name>pango</name>
<range><lt>1.42.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120">
<p>libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120</url>
<url>https://www.exploit-db.com/exploits/45263/</url>
<url>https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html</url>
<url>https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f</url>
<cvename>CVE-2018-15120</cvename>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-10-01</entry>
</dates>
</vuln>
<vuln vid="01018916-c47c-11e8-8b07-00e04c1ea73d">
<topic>Serendipity -- multiple vulnerabilities</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Serendipity reports:</p>
<blockquote cite="https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html">
<p>Security: Fix XSS for pagination, when multi-category selection is used.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html</url>
</references>
<dates>
<discovery>2018-09-20</discovery>
<entry>2018-09-30</entry>
</dates>
</vuln>
<vuln vid="40a844bf-c430-11e8-96dc-000743165db0">
<topic>bitcoin -- Denial of Service and Possible Mining Inflation</topic>
<affects>
<package>
<name>bitcoin</name>
<name>bitcoin-daemon</name>
<range><lt>0.16.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bitcoin Core reports:</p>
<blockquote cite="https://bitcoincore.org/en/2018/09/20/notice/">
<p>CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bitcoincore.org/en/2018/09/20/notice/</url>
<cvename>CVE-2018-17144</cvename>
</references>
<dates>
<discovery>2018-09-17</discovery>
<entry>2018-09-29</entry>
</dates>
</vuln>
<vuln vid="613193a0-c1b4-11e8-ae2d-54e1ad3d6335">
<topic>spamassassin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the Apache Spamassassin project reports:</p>
<blockquote cite="https://seclists.org/oss-sec/2018/q3/242">
<p>In Apache SpamAssassin, using HTML::Parser, we setup an object and
hook into the begin and end tag event handlers In both cases, the
"open" event is immediately followed by a "close" event - even if
the tag *does not* close in the HTML being parsed.</p>
<p>Because of this, we are missing the "text" event to deal with
the object normally. This can cause carefully crafted emails that
might take more scan time than expected leading to a Denial of
Service.</p>
<p>Fix a reliance on "." in @INC in one configuration script. Whether
this can be exploited in any way is uncertain.</p>
<p>Fix a potential Remote Code Execution bug with the PDFInfo plugin.
Thanks to cPanel Security Team for their report of this issue.</p>
<p> Fourth, this release fixes a local user code injection in the
meta rule syntax. Thanks again to cPanel Security Team for their
report of this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/oss-sec/2018/q3/242</url>
<cvename>CVE-2017-15705</cvename>
<cvename>CVE-2016-1238</cvename>
<cvename>CVE-2018-11780</cvename>
<cvename>CVE-2018-11781</cvename>
</references>
<dates>
<discovery>2018-09-16</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="bad59128-c188-11e8-9d40-f0def10dca57">
<topic>wesnoth -- Code Injection vulnerability</topic>
<affects>
<package>
<name>wesnoth</name>
<range><ge>1.7.0</ge><lt>1.14.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>shadowm reports:</p>
<blockquote cite="https://forums.wesnoth.org/viewtopic.php?t=48528">
<p>A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0.
Users of all previous version should upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1999023</cvename>
<url>https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380</url>
</references>
<dates>
<discovery>2018-07-14</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="e182c076-c189-11e8-a6d2-b499baebfeaf">
<topic>Apache -- Denial of service vulnerability in HTTP/2</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>low: DoS for HTTP/2 connections by continuous SETTINGS</p>
<p>By sending continous SETTINGS frames of maximum size an ongoing
HTTP/2 connection could be kept busy and would never time out. This
can be abused for a DoS on the server. This only affect a server
that has enabled the h2 protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-11763</cvename>
</references>
<dates>
<discovery>2018-09-25</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="6bf71117-c0c9-11e8-b760-6023b685b1ee">
<topic>mantis -- XSS vulnerability</topic>
<affects>
<package>
<name>mantis-php56</name>
<name>mantis-php70</name>
<name>mantis-php71</name>
<name>mantis-php72</name>
<range><lt>2.17.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brian Carpenter reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=24731">
<p>Reflected XSS in view_filters_page.php via core/filter_form_api.php</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-16514</cvename>
</references>
<dates>
<discovery>2018-09-03</discovery>
<entry>2018-09-25</entry>
</dates>
</vuln>
<vuln vid="2d6de6a8-fb78-4149-aeda-77fc8f140f06">
<topic>smart_proxy_dynflow -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>rubygem-smart_proxy_dynflow</name>
<range><lt>0.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643">
<p>An authentication bypass flaw was found in the smart_proxy_dynflow
component used by Foreman. A malicious attacker can use this flaw to
remotely execute arbitrary commands on machines managed by vulnerable
Foreman instances, in a highly privileged context.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643</url>
<cvename>CVE-2018-14643</cvename>
</references>
<dates>
<discovery>2018-09-20</discovery>
<entry>2018-09-22</entry>
</dates>
</vuln>
<vuln vid="be1aada2-be6c-11e8-8fc6-000c29434208">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki127</name>
<range><lt>1.27.5</lt></range>
</package>
<package>
<name>mediawiki129</name>
<range><le>1.29.3</le></range>
</package>
<package>
<name>mediawiki130</name>
<range><lt>1.30.1</lt></range>
</package>
<package>
<name>mediawiki131</name>
<range><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html">
<p>Security fixes:</p>
<p>T169545: $wgRateLimits entry for 'user' overrides 'newbie'.</p>
<p>T194605: BotPasswords can bypass CentralAuth's account lock.</p>
<p>T187638: When a log event is (partially) hidden Special:Redirect/logid
can link to the incorrect log and reveal hidden</p>
<p>T193237: Special:BotPasswords should require reauthenticate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0503</cvename>
<cvename>CVE-2018-0505</cvename>
<cvename>CVE-2018-0504</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html</url>
</references>
<dates>
<discovery>2018-08-29</discovery>
<entry>2018-09-22</entry>
</dates>
</vuln>
<vuln vid="3284d948-140c-4a3e-aa76-3b440e2006a8">
<topic>firefox -- Crash in TransportSecurityInfo due to cached data</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0.2,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-22/">
<p>A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12385</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-22/</url>
</references>
<dates>
<discovery>2018-09-21</discovery>
<entry>2018-09-21</entry>
</dates>
</vuln>
<vuln vid="77f67b46-bd75-11e8-81b6-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability in HTTP websocket upgrade</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.23.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>There is a stack overflow vulnerability in the
res_http_websocket.so module of Asterisk that allows an
attacker to crash Asterisk via a specially crafted HTTP
request to upgrade the connection to a websocket. The
attackers request causes Asterisk to run out of stack
space and crash.</p>
<p>As a workaround disable HTTP websocket access by not
loading the res_http_websocket.so module.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-009.html</url>
<cvename>CVE-2018-17281</cvename>
</references>
<dates>
<discovery>2018-08-16</discovery>
<entry>2018-09-21</entry>
</dates>
</vuln>
<vuln vid="074cb225-bb2d-11e8-90e1-fcaa147e860e">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.14</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.8</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>moodle35</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=376023">
<p>Moodle XML import of ddwtos could lead to intentional remote code
execution</p>
<p>QuickForm library remote code vulnerability (upstream)</p>
<p>Boost theme - blog search GET parameter insufficiently filtered</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14630</cvename>
<cvename>CVE-2018-1999022</cvename>
<cvename>CVE-2018-14631</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=376023</url>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-18</entry>
</dates>
</vuln>
<vuln vid="bf2b9c56-b93e-11e8-b2a8-a4badb296695">
<topic>joomla3 -- vulnerabilitiesw</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports: Multiple low-priority Vulnerabilities</p>
<blockquote cite="https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html">
<p>Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html">
<p>Inadequate output filtering on the user profile page could lead to a stored XSS attack.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html">
<p>Inadequate checks regarding disabled fields can lead to an ACL violation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15860</cvename>
<cvename>CVE-2018-15881</cvename>
<cvename>CVE-2018-15882</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15880</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15881</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15882</url>
<url>https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html</url>
<url>https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html</url>
<url>https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html</url>
</references>
<dates>
<discovery>2018-08-23</discovery>
<entry>2018-09-15</entry>
</dates>
</vuln>
<vuln vid="ab38d9f8-b787-11e8-8e7a-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/">
<p>High risk: Email field SQL Injection.</p>
<p>Medium risk: Video MyCode Persistent XSS in Visual Editor.</p>
<p>Low risk: Insufficient permission check in User CP’s attachment management.</p>
<p>Low risk: Insufficient email address verification.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-09-11</discovery>
<entry>2018-09-13</entry>
</dates>
</vuln>
<vuln vid="a67c122a-b693-11e8-ac58-a4badb2f4699">
<topic>FreeBSD -- Improper ELF header parsing</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_3</lt></range>
<range><ge>11.1</ge><lt>11.1_14</lt></range>
<range><ge>10.4</ge><lt>10.4_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation was performed in the ELF header
parser, and malformed or otherwise invalid ELF binaries
were not rejected as they should be.</p>
<h1>Impact:</h1>
<p>Execution of a malicious ELF binary may result in a
kernel crash or may disclose kernel memory.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6924</cvename>
<freebsdsa>SA-18:12.elf</freebsdsa>
</references>
<dates>
<discovery>2018-09-12</discovery>
<entry>2018-09-12</entry>
</dates>
</vuln>
<vuln vid="fe818607-b5ff-11e8-856b-485b3931c969">
<topic>Containous Traefik -- exposes the configuration and secret</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>1.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15598">
<p>Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the
configuration and secret if authentication is missing and the API's port
is publicly reachable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15598</cvename>
<url>https://github.com/containous/traefik/pull/3790</url>
<url>https://github.com/containous/traefik/releases/tag/v1.6.6</url>
</references>
<dates>
<discovery>2018-08-20</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="f9d73a20-b5f0-11e8-b1da-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-31.html">
<ul>
<li>This update resolves a privilege escalation vulnerability that
could lead to information disclosure (CVE-2018-15967).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15967</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-31.html</url>
</references>
<dates>
<discovery>2018-09-11</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="337960ec-b5dc-11e8-ac58-a4badb2f4699">
<topic>Plex Media Server -- Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>plexmediaserver</name>
<name>plexmediaserver-plexpass</name>
<range><lt>1.13.5.5332</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris reports:</p>
<blockquote cite="https://seclists.org/fulldisclosure/2018/Aug/1">
<p>The XML parsing engine for Plex Media Server's SSDP/UPNP
functionality is vulnerable to an XML External Entity
Processing (XXE) attack. Unauthenticated attackers on the same LAN can
use this vulnerability to:</p>
<ul>
<li>Access arbitrary files from the filesystem with the same permission as
the user account running Plex.</li>
<li>Initiate SMB connections to capture NetNTLM challenge/response and
crack to clear-text password.</li>
<li>Initiate SMB connections to relay NetNTLM challenge/response and
achieve Remote Command Execution in Windows domains.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/fulldisclosure/2018/Aug/1</url>
<cvename>CVE-2018-13415</cvename>
</references>
<dates>
<discovery>2018-08-01</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="f00acdec-b59f-11e8-805d-001e2a3f778d">
<topic>X11 Session -- SDDM allows unauthorised unlocking</topic>
<affects>
<package>
<name>sddm</name>
<range><lt>0.17.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14345">
<p>An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session.</p>
</blockquote>
<p>The default configuration of SDDM on FreeBSD is not affected, since it has ReuseSession=false.</p>
</body>
</description>
<references>
<url>https://www.suse.com/security/cve/CVE-2018-14345/</url>
<cvename>CVE-2018-14345</cvename>
</references>
<dates>
<discovery>2018-08-13</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="db2acdac-b5a7-11e8-8f6f-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/">
<p>High risk: Image MyCode “alt” attribute persistent XSS.</p>
<p>Medium risk: RSS Atom 1.0 item title persistent XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-08-22</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="7c750960-b129-11e8-9fcd-080027f43a02">
<topic>Information disclosure - Gitea leaks email addresses</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/4417">
<p>[Privacy] Gitea leaks hidden email addresses #4417</p>
<p>A fix has been implemented in Gitea 1.5.1.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/4417</url>
<url>https://github.com/go-gitea/gitea/pull/4784</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-09-05</entry>
</dates>
</vuln>
<vuln vid="2a92555f-a6f8-11e8-8acd-10c37b4ac2ea">
<topic>links -- denial of service</topic>
<affects>
<package>
<name>links</name>
<range><lt>2.16,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-11114">
<p>The put_chars function in html_r.c in Twibright Links 2.14 allows
remote attackers to cause a denial of service (buffer over-read)
via a crafted HTML file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11114</url>
<cvename>CVE-2017-11114</cvename>
</references>
<dates>
<discovery>2017-07-31</discovery>
<entry>2018-08-23</entry>
</dates>
</vuln>
<vuln vid="f4d638b9-e6e5-4dbe-8c70-571dbc116174">
<topic>curl -- password overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.15.4</ge><lt>7.61.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-14618: NTLM password overflow via integer overflow</p>
<p>The internal function Curl_ntlm_core_mk_nt_hash multiplies the length
of the password by two (SUM) to figure out how large temporary storage
area to allocate from the heap.</p>
<p>The length value is then subsequently used to iterate over the
password and generate output into the allocated storage buffer. On
systems with a 32 bit size_t, the math to calculate SUM triggers an
integer overflow when the password length exceeds 2GB (2^31 bytes).
This integer overflow usually causes a very small buffer to actually
get allocated instead of the intended very huge one, making the use of
that buffer end up in a heap buffer overflow.</p>
<p>This bug is almost identical to CVE-2017-8816.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-14618.html</url>
<cvename>CVE-2018-14618</cvename>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-05</entry>
</dates>
</vuln>
<vuln vid="c96d416a-eae7-4d5d-bc84-40deca9329fb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/">
<p>CVE-2018-12377: Use-after-free in refresh driver timers</p>
<p>CVE-2018-12378: Use-after-free in IndexedDB</p>
<p>CVE-2018-12379: Out-of-bounds write with malicious MAR file</p>
<p>CVE-2017-16541: Proxy bypass using automount and autofs</p>
<p>CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation</p>
<p>CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android</p>
<p>CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords</p>
<p>CVE-2018-12375: Memory safety bugs fixed in Firefox 62</p>
<p>CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16541</cvename>
<cvename>CVE-2018-12375</cvename>
<cvename>CVE-2018-12376</cvename>
<cvename>CVE-2018-12377</cvename>
<cvename>CVE-2018-12378</cvename>
<cvename>CVE-2018-12379</cvename>
<cvename>CVE-2018-12381</cvename>
<cvename>CVE-2018-12382</cvename>
<cvename>CVE-2018-12383</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/</url>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-05</entry>
<modified>2018-09-15</modified>
</dates>
</vuln>
<vuln vid="30c0f878-b03e-11e8-be8a-0011d823eebd">
<topic>Ghostscript -- arbitrary code execution</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/332928">
<p>Ghostscript contains an optional -dSAFER option, which is supposed
to prevent unsafe PostScript operations. Multiple PostScript
operations bypass the protections provided by -dSAFER, which can
allow an attacker to execute arbitrary commands with arbitrary
arguments. This vulnerability can also be exploited in applications
that leverage Ghostscript, such as ImageMagick, GraphicsMagick,
evince, Okular, Nautilus, and others.</p>
<p>Exploit code for this vulnerability is publicly available.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/332928</url>
<cvename>CVE-2018-15908</cvename>
<cvename>CVE-2018-15909</cvename>
<cvename>CVE-2018-15910</cvename>
<cvename>CVE-2018-15911</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-09-04</entry>
</dates>
</vuln>
<vuln vid="1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea">
<topic>grafana -- LDAP and OAuth login vulnerability</topic>
<affects>
<package>
<name>grafana5</name>
<range><ge>5.0.0</ge><lt>5.2.3</lt></range>
</package>
<package>
<name>grafana4</name>
<range><ge>4.0.0</ge><lt>4.6.4</lt></range>
</package>
<package>
<name>grafana3</name>
<range><ge>3.0.0</ge></range>
</package>
<package>
<name>grafana2</name>
<range><ge>2.0.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050">
<p>On the 20th of August at 1800 CEST we were contacted about a
potential security issue with the “remember me” cookie Grafana
sets upon login. The issue targeted users without a local Grafana
password (LDAP & OAuth users) and enabled a potential attacker
to generate a valid cookie knowing only a username.</p>
<p>All installations which use the Grafana LDAP or OAuth
authentication features must be upgraded as soon as possible. If
you cannot upgrade, you should switch authentication mechanisms
or put additional protections in front of Grafana such as a
reverse proxy.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050</url>
<cvename>CVE-2018-558213</cvename>
</references>
<dates>
<discovery>2018-08-20</discovery>
<entry>2018-08-31</entry>
</dates>
</vuln>
<vuln vid="ffeb25d0-ac94-11e8-ab15-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.2.0</ge><lt>11.2.3</lt></range>
<range><ge>11.1.0</ge><lt>11.1.6</lt></range>
<range><ge>2.7.0</ge><lt>11.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/">
<p>Persistent XSS in Pipeline Tooltip</p>
<p>GitLab.com GCP Endpoints Exposure</p>
<p>Persistent XSS in Merge Request Changes View</p>
<p>Sensitive Data Disclosure in Sidekiq Logs</p>
<p>Missing CSRF in System Hooks</p>
<p>Orphaned Upload Files Exposure</p>
<p>Missing Authorization Control API Repository Storage</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/</url>
</references>
<dates>
<discovery>2018-08-28</discovery>
<entry>2018-08-30</entry>
</dates>
</vuln>
<vuln vid="d0be41fe-2a20-4633-b057-4e8b25c41780">
<topic>bro -- array bounds and potential DOS issues</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Corelight reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.5.5 primarily addresses security issues:</p>
<ul>
<li>Fix array bounds checking in BinPAC: for arrays
that are fields within a record, the bounds check
was based on a pointer to the start of the record
rather than the start of the array field, potentially
resulting in a buffer over-read.</li>
<li>Fix SMTP command string comparisons: the number
of bytes compared was based on the user-supplied
string length and can lead to incorrect matches.
e.g. giving a command of "X" incorrectly matched
"X-ANONYMOUSTLS" (and an empty commands match
anything).</li>
</ul>
<p>Address potential vectors for Denial of Service:</p>
<ul>
<li>"Weird" events are now generally suppressed/sampled
by default according to some tunable parameters.</li>
<li>Improved handling of empty lines in several text
protocol analyzers that can cause performance issues
when seen in long sequences.</li>
<li>Add `smtp_excessive_pending_cmds' weird which
serves as a notification for when the "pending
command" queue has reached an upper limit and been
cleared to prevent one from attempting to slowly
exhaust memory.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-08-28</discovery>
<entry>2018-08-29</entry>
</dates>
</vuln>
<vuln vid="0904e81f-a89d-11e8-afbb-bc5ff4f77b71">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>10.9.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.4</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.14.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/">
<h1>OpenSSL: Client DoS due to large DH parameter</h1>
<p>This fixes a potential denial of service (DoS) attack
against client connections by a malicious server. During a TLS
communication handshake, where both client and server agree to
use a cipher-suite using DH or DHE (Diffie-Hellman, in both
ephemeral and non-ephemeral modes), a malicious server can
send a very large prime value to the client. Because this has
been unbounded in OpenSSL, the client can be forced to spend
an unreasonably long period of time to generate a key,
potentially causing a denial of service.</p>
<h1>OpenSSL: ECDSA key extraction via local side-channel</h1>
<p>Attackers with access to observe cache-timing may be able
to extract DSA or ECDSA private keys by causing the victim to
create several signatures and watching responses. This flaw
does not have a CVE due to OpenSSL policy to not assign itself
CVEs for local-only vulnerabilities that are more academic
than practical. This vulnerability was discovered by Keegan
Ryan at NCC Group and impacts many cryptographic libraries
including OpenSSL.</p>
<h1>Unintentional exposure of uninitialized memory</h1>
<p>Only Node.js 10 is impacted by this flaw.</p>
<p>Node.js TSC member Nikita Skovoroda discovered an argument
processing flaw that causes Buffer.alloc() to return
uninitialized memory. This method is intended to be safe and
only return initialized, or cleared, memory. The third
argument specifying encoding can be passed as a number, this
is misinterpreted by Buffer's internal "fill" method as the
start to a fill operation. This flaw may be abused where
Buffer.alloc() arguments are derived from user input to return
uncleared memory blocks that may contain sensitive
information.</p>
<h1>Out of bounds (OOB) write</h1>
<p>Node.js TSC member Nikita Skovoroda discovered an OOB write
in Buffer that can be used to write to memory outside of a
Buffer's memory space. This can corrupt unrelated Buffer
objects or cause the Node.js process to crash.</p>
<p>When used with UCS-2 encoding (recognized by Node.js under
the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'),
Buffer#write() can be abused to write outside of the bounds of
a single Buffer. Writes that start from the second-to-last
position of a buffer cause a miscalculation of the maximum
length of the input bytes to be written.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/</url>
<cvename>CVE-2018-0732</cvename>
<cvename>CVE-2018-7166</cvename>
<cvename>CVE-2018-12115</cvename>
</references>
<dates>
<discovery>2018-08-16</discovery>
<entry>2018-08-25</entry>
</dates>
</vuln>
<vuln vid="45671c0e-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
<range><ge>10.4</ge><lt>10.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When using WPA2, EAPOL-Key frames with the Encrypted
flag and without the MIC flag set, the data field was
decrypted first without verifying the MIC. When the dta
field was encrypted using RC4, for example, when negotiating
TKIP as a pairwise cipher, the unauthenticated but decrypted
data was subsequently processed. This opened wpa_supplicant(8)
to abuse by decryption and recovery of sensitive information
contained in EAPOL-Key messages.</p>
<p>See
https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All users of the WPA2 TKIP pairwise cipher are vulnerable
to information, for example, the group key.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1452</cvename>
<freebsdsa>SA-18:11.hostapd</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="359e1548-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in IP fragment reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A researcher has notified us of a DoS attack applicable
to another operating system. While FreeBSD may not be
vulnerable to that exact attack, we have identified several
places where inadequate DoS protection could allow an
attacker to consume system resources.</p>
<p>It is not necessary that the attacker be able to establish
two-way communication to carry out these attacks. These
attacks impact both IPv4 and IPv6 fragment reassembly.</p>
<h1>Impact:</h1>
<p>In the worst case, an attacker could send a stream of
crafted fragments with a low packet rate which would consume
a substantial amount of CPU.</p>
<p>Other attack vectors allow an attacker to send a stream
of crafted fragments which could consume a large amount of
CPU or all available mbuf clusters on the system.</p>
<p>These attacks could temporarily render a system unreachable
through network interfaces or temporarily render a system
unresponsive. The effects of the attack should clear within
60 seconds after the attack stops.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6923</cvename>
<freebsdsa>SA-18:10.ip</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="2310b814-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>On certain Intel 64-bit x86 systems there is a period
of time during terminal fault handling where the CPU may
use speculative execution to try to load data. The CPU may
speculatively access the level 1 data cache (L1D). Data
which would otherwise be protected may then be determined
by using side channel methods.</p>
<p>This issue affects bhyve on FreeBSD/amd64 systems.</p>
<h1>Impact:</h1>
<p>An attacker executing user code, or kernel code inside
of a virtual machine, may be able to read secret data from
the kernel or from another virtual machine.</p>
</body>
</description>
<references>
<cvename>CVE-2018-3620</cvename>
<cvename>CVE-2018-3646</cvename>
<freebsdsa>SA-18:09.l1tf</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="e53a908d-a645-11e8-8acd-10c37b4ac2ea">
<topic>gogs -- open redirect vulnerability</topic>
<affects>
<package>
<name>gogs</name>
<range><lt>0.11.53_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bluecatli (Tencent's Xuanwu Lab) reports:</p>
<blockquote cite="https://github.com/gogs/gogs/issues/5364">
<p>The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site.</p>
<p>If the Location header startswith /\, it will be transformed to // by browsers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/gogs/gogs/issues/5364</url>
<url>https://github.com/gogs/gogs/pull/5365</url>
<url>https://github.com/gogs/gogs/commit/1f247cf8139cb483276cd8dd06385a800ce9d4b2</url>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="9e205ef5-a649-11e8-b1f6-6805ca0b3d42">
<topic>phpmyadmin -- XSS in the import dialog</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-5/">
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
file import feature, where an attacker can deliver a payload
to a user through importing a specially-crafted file.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-5/</url>
<cvename>CVE-2018-15605</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="fe99d3ca-a63a-11e8-a7c6-54e1ad3d6335">
<topic>libX11 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2018-August/002915.html">
<p>The functions XGetFontPath, XListExtensions, and XListFonts are
vulnerable to an off-by-one override on malicious server responses.
The server replies consist of chunks consisting of a length byte
followed by actual string, which is not NUL-terminated.
While parsing the response, the length byte is overridden with '\0',
thus the memory area can be used as storage of C strings later on.
To be able to NUL-terminate the last string, the buffer is reserved
with an additional byte of space. For a boundary check, the variable
chend (end of ch) was introduced, pointing at the end of the buffer
which ch initially points to. Unfortunately there is a difference
in handling "the end of ch". While chend points at the first byte
that must not be written to, the for-loop uses chend as the last
byte that can be written to. Therefore, an off-by-one can occur.</p>
<p>The length value is interpreted as signed char on many systems
(depending on default signedness of char), which can lead to an out
of boundary write up to 128 bytes in front of the allocated storage,
but limited to NUL byte(s).</p>
<p>If the server sends a reply in which even the first string would
overflow the transmitted bytes, list[0] (or flist[0]) will be set to
NULL and a count of 0 is returned. If the resulting list is freed
with XFreeExtensionList or XFreeFontPath later on, the first Xfree
call is turned into Xfree (NULL-1) which will most likely trigger a
segmentation fault. Casting the length value to unsigned char fixes
the problem and allows string values with up to 255 characters.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2018-August/002915.html</url>
<cvename>CVE-2018-14598</cvename>
<cvename>CVE-2018-14599</cvename>
<cvename>CVE-2018-14600</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="9b19b6df-a4be-11e8-9366-0028f8d09152">
<topic>couchdb -- administrator privilege escalation</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>2.2.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75@%3Cdev.couchdb.apache.org%3E">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.couchdb.org/en/stable/cve/2018-11769.html</url>
<cvename>CVE-2018-11769</cvename>
</references>
<dates>
<discovery>2018-06-05</discovery>
<entry>2018-08-08</entry>
</dates>
</vuln>
<vuln vid="7762d7ad-2e38-41d2-9785-c51f653ba8bd">
<topic>botan2 -- ECDSA side channel</topic>
<affects>
<package>
<name>botan2</name>
<range><ge>2.5.0</ge><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>botan2 developers report:</p>
<blockquote cite="https://botan.randombit.net/security.html#id1">
<p>A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.</p>
<p>Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://botan.randombit.net/security.html#id1</url>
<url>https://github.com/randombit/botan/pull/1604</url>
<cvename>CVE-2018-12435</cvename>
</references>
<dates>
<discovery>2018-06-13</discovery>
<entry>2018-08-17</entry>
</dates>
</vuln>
<vuln vid="6905f05f-a0c9-11e8-8335-8c164535ad80">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.138</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.121.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-08-15/">
<h1>Description</h1>
<h5>(Low) SECURITY-637</h5>
<p> Jenkins allowed deserialization of URL objects with host components</p>
<h5>(Medium) SECURITY-672</h5>
<p>Ephemeral user record was created on some invalid authentication attempts</p>
<h5>(Medium) SECURITY-790</h5>
<p>Cron expression form validation could enter infinite loop, potentially resulting in denial of service</p>
<h5>(Low) SECURITY-996</h5>
<p>"Remember me" cookie was evaluated even if that feature is disabled</p>
<h5>(Medium) SECURITY-1071</h5>
<p>Unauthorized users could access agent logs</p>
<h5>(Low) SECURITY-1076</h5>
<p>Unauthorized users could cancel scheduled restarts initiated from the update center</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-08-15/</url>
</references>
<dates>
<discovery>2018-08-15</discovery>
<entry>2018-08-15</entry>
</dates>
</vuln>
<vuln vid="98b603c8-9ff3-11e8-ad63-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.154</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-25.html">
<ul>
<li>This update resolves out-of-bounds read vulnerabilities that
could lead to information disclosure (CVE-2018-12824,
CVE-2018-12826, CVE-2018-12827).</li>
<li>This update resolves a security bypass vulnerability that
could lead to security mitigation bypass (CVE-2018-12825).</li>
<li>This update resolves a component vulnerability that
could lead to privilege escalation (CVE-2018-12828).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12824</cvename>
<cvename>CVE-2018-12825</cvename>
<cvename>CVE-2018-12826</cvename>
<cvename>CVE-2018-12827</cvename>
<cvename>CVE-2018-12828</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-25.html</url>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="c4e9a427-9fc2-11e8-802a-000c29a1e3ec">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><lt>4.6.16</lt></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.9</lt></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1139.html">
<p>Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which
allows authentication using NTLMv1 over an SMB1 transport (either
directory or via NETLOGON SamLogon calls from a member server), even
when NTLMv1 is explicitly disabled on the server.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1140.html">
<p>Missing input sanitization checks on some of the input parameters to
LDB database layer cause the LDAP server and DNS server to crash when
following a NULL pointer.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10858.html">
<p>Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in
libsmbclient that could allow a malicious server to overwrite
client heap memory by returning an extra long filename in a directory
listing.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10918.html">
<p>Missing database output checks on the returned directory attributes
from the LDB database layer cause the DsCrackNames call in the DRSUAPI
server to crash when following a NULL pointer.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10919.html">
<p>All versions of the Samba Active Directory LDAP server from 4.0.0
onwards are vulnerable to the disclosure of confidential attribute
values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL
(0x80) searchFlags bit and where an explicit Access Control Entry has
been specified on the ntSecurityDescriptor.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-1139.html</url>
<cvename>CVE-2018-1139</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-1140.html</url>
<cvename>CVE-2018-1140</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10858.html</url>
<cvename>CVE-2018-10858</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10918.html</url>
<cvename>CVE-2018-10918</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10919.html</url>
<cvename>CVE-2018-10919</cvename>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="e714b7d2-39f6-4992-9f48-e6b2f5f949df">
<topic>GraphicsMagick -- SVG/Rendering vulnerability</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.30,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick News:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Fix heap write overflow of PrimitiveInfo and PointInfo arrays. This is
another manefestation of CVE-2016-2317, which should finally be fixed
correctly due to active detection/correction of pending overflow rather
than using estimation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
<cvename>CVE-2016-2317</cvename>
</references>
<dates>
<discovery>2018-06-23</discovery>
<entry>2018-08-11</entry>
</dates>
</vuln>
<vuln vid="5a771686-9e33-11e8-8b2d-9cf7a8059466">
<topic>chicken -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.13.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CHICKEN reports:</p>
<blockquote cite="https://code.call-cc.org/releases/4.13.0/NEWS">
<ul>
<li>CVE-2017-6949: Unchecked malloc() call in SRFI-4
constructors when allocating in non-GC memory, resulting
in potential 1-word buffer overrun and/or segfault</li>
<li>CVE-2017-9334: "length" crashes on improper lists</li>
<li>CVE-2017-11343: The randomization factor of the symbol
table was set before the random seed was set, causing it
to have a fixed value on many platforms</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://code.call-cc.org/releases/4.13.0/NEWS</url>
<cvename>CVE-2017-6949</cvename>
<cvename>CVE-2017-9334</cvename>
<cvename>CVE-2017-11343</cvename>
</references>
<dates>
<discovery>2017-03-16</discovery>
<entry>2018-08-12</entry>
</dates>
</vuln>
<vuln vid="bcf56a42-9df8-11e8-afb0-589cfc0f81b0">
<topic>gitea -- TOTP passcode reuse</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/">
<p>TOTP passcodes can be reused.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/3878</url>
</references>
<dates>
<discovery>2018-05-01</discovery>
<entry>2018-08-12</entry>
</dates>
</vuln>
<vuln vid="f4876dd4-9ca8-11e8-aa17-0011d823eebd">
<topic>mbed TLS -- plaintext recovery vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02">
<ul>
<li>When using a CBC based ciphersuite, a remote attacker can
partially recover the plaintext.</li>
<li>When using a CBC based ciphersuite, an attacker with the
ability to execute arbitrary code on the machine under attack
can partially recover the plaintext by use of cache based
side-channels.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02</url>
<cvename>CVE-2018-0497</cvename>
<cvename>CVE-2018-0498</cvename>
</references>
<dates>
<discovery>2018-07-24</discovery>
<entry>2018-08-10</entry>
</dates>
</vuln>
<vuln vid="96eab874-9c79-11e8-b34b-6cc21735f730">
<topic>PostgreSQL -- two vulnerabilities</topic>
<affects>
<package>
<name>postgresql10-server</name>
<range><lt>10.5</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.10</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.14</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.19</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><lt>9.3.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1878/">
<p>CVE-2018-10915: Certain host connection parameters defeat
client-side security defenses</p>
<p>libpq, the client connection API for PostgreSQL that is also used
by other connection libraries, had an internal issue where it did not
reset all of its connection state variables when attempting to
reconnect. In particular, the state variable that determined whether
or not a password is needed for a connection would not be reset, which
could allow users of features requiring libpq, such as the "dblink" or
"postgres_fdw" extensions, to login to servers they should not be able
to access.</p>
<p>CVE-2018-10925: Memory disclosure and missing authorization in
`INSERT ... ON CONFLICT DO UPDATE`</p>
<p>An attacker able to issue CREATE TABLE can read arbitrary bytes of
server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`)
query. By default, any user can exploit that. A user that has
specific INSERT privileges and an UPDATE privilege on at least one
column in a given table can also update other columns using a view and
an upsert query.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1878/</url>
<cvename>CVE-2018-10915</cvename>
<cvename>CVE-2018-10925</cvename>
</references>
<dates>
<discovery>2018-08-09</discovery>
<entry>2018-08-10</entry>
</dates>
</vuln>
<vuln vid="909be51b-9b3b-11e8-add2-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.36</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.35</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.17</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.9</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.41</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.23</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.12</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.41</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html">
<p>Multiple vulnerabilities have been disclosed by Oracle without
further detail. CVSS scores 7.1 - 2.7</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html</url>
<cvename>CVE-2018-3064</cvename>
<cvename>CVE-2018-0739</cvename>
<cvename>CVE-2018-3070</cvename>
<cvename>CVE-2018-3060</cvename>
<cvename>CVE-2018-3065</cvename>
<cvename>CVE-2018-3073</cvename>
<cvename>CVE-2018-3074</cvename>
<cvename>CVE-2018-3081</cvename>
<cvename>CVE-2018-3071</cvename>
<cvename>CVE-2018-3079</cvename>
<cvename>CVE-2018-3054</cvename>
<cvename>CVE-2018-3077</cvename>
<cvename>CVE-2018-3078</cvename>
<cvename>CVE-2018-3080</cvename>
<cvename>CVE-2018-3061</cvename>
<cvename>CVE-2018-3067</cvename>
<cvename>CVE-2018-3063</cvename>
<cvename>CVE-2018-3075</cvename>
<cvename>CVE-2018-3058</cvename>
<cvename>CVE-2018-3056</cvename>
<cvename>CVE-2018-3066</cvename>
<cvename>CVE-2018-2767</cvename>
<cvename>CVE-2018-3084</cvename>
<cvename>CVE-2018-3082</cvename>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-08-08</entry>
</dates>
</vuln>
<vuln vid="5786185a-9a43-11e8-b34b-6cc21735f730">
<topic>xml-security-c -- crashes on malformed KeyInfo content</topic>
<affects>
<package>
<name>apache-xml-security-c</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The shibboleth project reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180803.txt">
<p>
SAML messages, assertions, and metadata all commonly make use of the
XML Signature KeyInfo construct, which expresses information about
keys and certificates used in signing or encrypting XML.
</p>
<p>
The Apache Santuario XML Security for C++ library contained code
paths at risk of dereferencing null pointers when processing various
kinds of malformed KeyInfo hints typically found in signed or
encrypted XML. The usual effect is a crash, and in the case of the
Shibboleth SP software, a crash in the shibd daemon, which prevents
access to protected resources until the daemon is restarted.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180803.txt</url>
</references>
<dates>
<discovery>2018-08-03</discovery>
<entry>2018-08-07</entry>
</dates>
</vuln>
<vuln vid="3c2eea8c-99bf-11e8-8bee-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_1</lt></range>
<range><ge>11.1</ge><lt>11.1_12</lt></range>
<range><ge>10.4</ge><lt>10.4_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>One of the data structures that holds TCP segments uses
an inefficient algorithm to reassemble the data. This causes
the CPU time spent on segment processing to grow linearly
with the number of segments in the reassembly queue.</p>
<h1>Impact:</h1>
<p>An attacker who has the ability to send TCP traffic to
a victim system can degrade the victim system's network
performance and/or consume excessive CPU by exploiting the
inefficiency of TCP reassembly handling, with relatively
small bandwidth cost.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6922</cvename>
<freebsdsa>SA-18:08.tcp</freebsdsa>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-08-06</entry>
</dates>
</vuln>
<vuln vid="9e2d0dcf-9926-11e8-a92d-0050562a4d7b">
<topic>py-cryptography -- tag forgery vulnerability</topic>
<affects>
<package>
<name>py27-cryptography</name>
<name>py34-cryptography</name>
<name>py35-cryptography</name>
<name>py36-cryptography</name>
<name>py37-cryptography</name>
<range><lt>2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Python Cryptographic Authority (PyCA) project reports:</p>
<blockquote cite="https://cryptography.io/en/latest/changelog/#v2-3">
<p>finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10903</cvename>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-08-06</entry>
</dates>
</vuln>
<vuln vid="06c4a79b-981d-11e8-b460-9c5c8e75236a">
<topic>cgit -- directory traversal vulnerability</topic>
<affects>
<package>
<name>cgit</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jann Horn reports:</p>
<blockquote cite="https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html">
<p>cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html</url>
<cvename>CVE-2018-14912</cvename>
</references>
<dates>
<discovery>2018-08-03</discovery>
<entry>2018-08-04</entry>
</dates>
</vuln>
<vuln vid="e309a2c7-598b-4fa6-a398-bc72fbd1d167">
<topic>rubygem-doorkeeper -- token revocation vulnerability</topic>
<affects>
<package>
<name>rubygem-doorkeeper</name>
<name>rubygem-doorkeeper43</name>
<name>rubygem-doorkeeper-rails5</name>
<name>rubygem-doorkeeper-rails50</name>
<range><lt>4.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000211">
<p>Doorkeeper version 4.2.0 and later contains a Incorrect Access Control
vulnerability in Token revocation API's authorized method that can
result in Access tokens are not revoked for public OAuth apps, leaking
access until expiry.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-1000211</url>
<url>https://github.com/doorkeeper-gem/doorkeeper/pull/1120</url>
<cvename>CVE-2018-1000211</cvename>
</references>
<dates>
<discovery>2018-07-13</discovery>
<entry>2018-07-31</entry>
<modified>2018-08-03</modified>
</dates>
</vuln>
<vuln vid="ca05d9da-ac1d-4113-8a05-ffe9cd0d6160">
<topic>sinatra -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-sinatra</name>
<range><ge>2.0.0</ge><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sinatra blog:</p>
<blockquote cite="http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html">
<p>Sinatra had a critical vulnerability since v2.0.0. The purpose of this
release is to fix CVE-2018-11627.</p>
<p>The vulnerability is that XSS can be executed by using illegal parameters.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html</url>
<url>https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md</url>
<cvename>CVE-2018-11627</cvename>
</references>
<dates>
<discovery>2018-06-09</discovery>
<entry>2018-07-31</entry>
</dates>
</vuln>
<vuln vid="b4f0ad36-94a5-11e8-9007-080027ac955c">
<topic>mailman -- content spoofing with invalid list names in web UI</topic>
<affects>
<package><name>mailman</name> <range><lt>2.1.28</lt></range></package>
<package><name>mailman-with-htdig</name><range><lt>2.1.28</lt></range></package>
<package><name>ja-mailman</name> <range><lt>2.1.14.j7_6,1</lt></range></package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1780874">
<p>A URL with a very long text listname such as</p>
<pre>http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phishing_text</pre>
<p>will echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site.</p>
<p>This issue was discovered by Hammad Qureshi.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/mailman/+bug/1780874</url>
<url>https://mail.python.org/pipermail/mailman-announce/2018-July/000241.html</url>
<cvename>CVE-2018-13796</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-31</entry>
</dates>
</vuln>
<vuln vid="0822a4cf-9318-11e8-8d88-00e04c1ea73d">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>2.15.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mantis reports:</p>
<blockquote cite="https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f">
<p>Teun Beijers reported a cross-site scripting (XSS) vulnerability in
the Edit Filter page which allows execution of arbitrary code
(if CSP settings permit it) when displaying a filter with a crafted
name. Prevent the attack by sanitizing the filter name before display.</p>
<p>Ömer Cıtak, Security Researcher at Netsparker, reported this
vulnerability, allowing remote attackers to inject arbitrary code
(if CSP settings permit it) through a crafted PATH_INFO on
view_filters_page.php. Prevent the attack by sanitizing the output
of $_SERVER['PHP_SELF'] before display.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f</url>
<url>https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a</url>
<cvename>CVE-2018-14504</cvename>
<cvename>CVE-2018-13066</cvename>
</references>
<dates>
<discovery>2018-07-13</discovery>
<entry>2018-07-29</entry>
<modified>2018-08-24</modified>
</dates>
</vuln>
<vuln vid="e97a8852-32dd-4291-ba4d-92711daff056">
<topic>py-bleach -- unsanitized character entities</topic>
<affects>
<package>
<name>py27-bleach</name>
<name>py36-bleach</name>
<range><ge>2.1.0</ge><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bleach developer reports:</p>
<blockquote cite="https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES">
<p>Attributes that have URI values weren't properly sanitized if the
values contained character entities. Using character entities, it
was possible to construct a URI value with a scheme that was not
allowed that would slide through unsanitized.</p>
<p>This security issue was introduced in Bleach 2.1. Anyone using
Bleach 2.1 is highly encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES</url>
</references>
<dates>
<discovery>2018-03-05</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="07d04eef-d8e2-11e6-a071-001e67f15f5a">
<topic>lshell -- Shell autocomplete reveals forbidden directories</topic>
<affects>
<package>
<name>lshell</name>
<range><lt>0.9.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lshell reports:</p>
<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
<p>The autocomplete feature allows users to list directories, while they do not have access to those paths (issue #109).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ghantoos/lshell/issues/109</url>
</references>
<dates>
<discovery>2015-07-25</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="f353525a-d8b8-11e6-a071-001e67f15f5a">
<topic>lshell -- Multiple security issues</topic>
<affects>
<package>
<name>lshell</name>
<range><le>0.9.18</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lshell reports:</p>
<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
<p>It is possible to escape lshell if an allowed command can execute an arbitrary non allowed one (issue #122).</p>
<p>Inappropriate parsing of commands can lead to arbitrary command execution (issue #147, #149, #151).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ghantoos/lshell/issues/122</url>
<url>https://github.com/ghantoos/lshell/issues/147</url>
<url>https://github.com/ghantoos/lshell/issues/149</url>
<url>https://github.com/ghantoos/lshell/issues/151</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="11dc3890-0e64-11e8-99b0-d017c2987f9a">
<topic>OpenJPEG -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><le>2.3.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenJPEG reports:</p>
<blockquote cite="https://github.com/uclouvain/openjpeg/issues?q=is%3Aissue+CVE-2018-5727+OR+CVE-2018-5785+OR+CVE-2018-6616">
<p>Multiple vulnerabilities have been found in OpenJPEG, the
opensource JPEG 2000 codec. Please consult the CVE list for further
details.</p>
<p>CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.</p>
<p>CVE-2018-5785 was fixed in r480624.</p>
<p>CVE-2018-5727 and CVE-2018-6616 are not fixed yet.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17479</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17480</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5727</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5785</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-6616</url>
<cvename>CVE-2017-17479</cvename>
<cvename>CVE-2017-17480</cvename>
<cvename>CVE-2018-5727</cvename>
<cvename>CVE-2018-5785</cvename>
<cvename>CVE-2018-6616</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2018-07-27</entry>
<modified>2018-11-11</modified>
</dates>
</vuln>
<vuln vid="5ccbb2f8-c798-11e7-a633-009c02a2ab30">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.3.5_1,1</lt></range>
<range><ge>3.4,1</ge><le>3.4.1_4,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://ffmpeg.org/security.html">
<p>Multiple vulnerabilities have been found in FFmpeg. Please refer
to CVE list for details.</p>
<p>Note: CVE-2017-15186 and CVE-2017-15672 affect only the 3.3 branch
before 3.3.5, CVE-2017-16840 and CVE-2017-17081 have been fixed
in 3.4.1. They're listed here for completeness of the record.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16840</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17081</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6392</url>
<url>http://ffmpeg.org/security.html</url>
<cvename>CVE-2017-15186</cvename>
<cvename>CVE-2017-15672</cvename>
<cvename>CVE-2017-16840</cvename>
<cvename>CVE-2017-17081</cvename>
<cvename>CVE-2018-6392</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="bfda2d80-0858-11e8-ad5c-0021ccb9e74d">
<topic>GIMP - Heap Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>gimp</name>
<range><lt>2.8.22,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNOME reports:</p>
<blockquote cite="https://www.securityfocus.com/bid/102765/references">
<p>CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=739134</url>
<cvename>CVE-2017-17786</cvename>
</references>
<dates>
<discovery>2017-12-21</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="b9c525d9-9198-11e8-beba-080027ef1a23">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>68.0.3440.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html">
<p>42 security fixes in this release, including:</p>
<ul>
<li>[850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07</li>
<li>[848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01</li>
<li>[842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11</li>
<li>[841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10</li>
<li>[840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07</li>
<li>[812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15</li>
<li>[805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25</li>
<li>[805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24</li>
<li>[841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09</li>
<li>[837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26</li>
<li>[839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04</li>
<li>[826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27</li>
<li>[804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21</li>
<li>[849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04</li>
<li>[848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01</li>
<li>[847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30</li>
<li>[835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21</li>
<li>[833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15</li>
<li>[828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03</li>
<li>[394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16</li>
<li>[862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10</li>
<li>[851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12</li>
<li>[847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28</li>
<li>[836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25</li>
<li>[835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20</li>
<li>[826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26</li>
<li>[666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18</li>
<li>[826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27</li>
<li>[823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19</li>
<li>[816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26</li>
<li>[797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23</li>
<li>[791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03</li>
<li>[866821] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4117</cvename>
<cvename>CVE-2018-6044</cvename>
<cvename>CVE-2018-6150</cvename>
<cvename>CVE-2018-6151</cvename>
<cvename>CVE-2018-6152</cvename>
<cvename>CVE-2018-6153</cvename>
<cvename>CVE-2018-6154</cvename>
<cvename>CVE-2018-6155</cvename>
<cvename>CVE-2018-6156</cvename>
<cvename>CVE-2018-6157</cvename>
<cvename>CVE-2018-6158</cvename>
<cvename>CVE-2018-6159</cvename>
<cvename>CVE-2018-6160</cvename>
<cvename>CVE-2018-6161</cvename>
<cvename>CVE-2018-6162</cvename>
<cvename>CVE-2018-6163</cvename>
<cvename>CVE-2018-6164</cvename>
<cvename>CVE-2018-6165</cvename>
<cvename>CVE-2018-6166</cvename>
<cvename>CVE-2018-6167</cvename>
<cvename>CVE-2018-6168</cvename>
<cvename>CVE-2018-6169</cvename>
<cvename>CVE-2018-6170</cvename>
<cvename>CVE-2018-6171</cvename>
<cvename>CVE-2018-6172</cvename>
<cvename>CVE-2018-6173</cvename>
<cvename>CVE-2018-6174</cvename>
<cvename>CVE-2018-6175</cvename>
<cvename>CVE-2018-6176</cvename>
<cvename>CVE-2018-6177</cvename>
<cvename>CVE-2018-6178</cvename>
<cvename>CVE-2018-6179</cvename>
<url>https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-07-24</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="3849e28f-8693-11e8-9610-9c5c8e75236a">
<topic>curl -- SMTP send heap buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.54.1</ge><lt>7.61.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Wu reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_2018-70a2.html">
<p>curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_2018-70a2.html</url>
<cvename>CVE-2018-0500</cvename>
</references>
<dates>
<discovery>2018-07-11</discovery>
<entry>2018-07-27</entry>
<modified>2018-07-28</modified>
</dates>
</vuln>
<vuln vid="2da838f9-9168-11e8-8c75-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.1.0</ge><lt>11.1.2</lt></range>
<range><ge>11.0.0</ge><lt>11.0.5</lt></range>
<range><ge>2.7.0</ge><lt>10.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/">
<p>Markdown DoS</p>
<p>Information Disclosure Prometheus Metrics</p>
<p>CSRF in System Hooks</p>
<p>Persistent XSS Pipeline Tooltip</p>
<p>Persistent XSS in Branch Name via Web IDE</p>
<p>Persistent XSS in Branch Name via Web IDE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14601</cvename>
<cvename>CVE-2018-14602</cvename>
<cvename>CVE-2018-14603</cvename>
<cvename>CVE-2018-14604</cvename>
<cvename>CVE-2018-14605</cvename>
<cvename>CVE-2018-14606</cvename>
<url>https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/</url>
</references>
<dates>
<discovery>2018-07-26</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="38fec4bd-90f7-11e8-aafb-1c39475b9f84">
<topic>Fix a buffer overflow in the tiff reader</topic>
<affects>
<package>
<name>vips</name>
<range><lt>8.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libvips reports:</p>
<blockquote cite="https://github.com/jcupitt/libvips/releases/tag/v8.6.5">
<p>A buffer overflow was found and fixed in the libvips code</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jcupitt/libvips/releases/tag/v8.6.5</url>
</references>
<dates>
<discovery>2018-07-22</discovery>
<entry>2018-07-26</entry>
</dates>
</vuln>
<vuln vid="efe43d2b-8f35-11e8-b9e8-dcfe074bd614">
<topic>Memory leak in different components</topic>
<affects>
<package>
<name>libsixel</name>
<range><lt>1.8.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14072">
<p>bsixel 1.8.1 has a memory leak in sixel_decoder_decode in
decoder.c, image_buffer_resize in fromsixel.c, sixel_decode_raw in
fromsixel.c and sixel_allocator_new in allocator.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14072</cvename>
<cvename>CVE-2018-14073</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14072</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14073</url>
</references>
<dates>
<discovery>2018-07-15</discovery>
<entry>2018-07-24</entry>
</dates>
</vuln>
<vuln vid="dc57ad48-ecbb-439b-a4d0-5869be47684e">
<topic>vlc -- Use after free vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><le>2.2.8_6,4</le></range>
</package>
<package>
<name>vlc-qt4</name>
<range><le>2.2.8_6,4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529">
<p>VideoLAN VLC media player 2.2.x is prone to a use after free
vulnerability which an attacker can leverage to execute arbitrary
code via crafted MKV files. Failed exploit attempts will likely
result in denial of service conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-11529</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529</url>
<url>http://seclists.org/fulldisclosure/2018/Jul/28</url>
<url>https://github.com/rapid7/metasploit-framework/pull/10335</url>
<url>https://github.com/videolan/vlc-3.0/commit/c472668ff873cfe29281822b4548715fb7bb0368</url>
<url>https://github.com/videolan/vlc-3.0/commit/d2dadb37e7acc25ae08df71e563855d6e17b5b42</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-07-21</entry>
</dates>
</vuln>
<vuln vid="a2f35081-8a02-11e8-8fa5-4437e6ad11c4">
<topic>mutt -- remote code injection and path traversal vulnerability</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>1.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin J. McCarthy reports:</p>
<blockquote cite="http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html">
<p>Fixes a remote code injection vulnerability when "subscribing"
to an IMAP mailbox, either via $imap_check_subscribed, or via the
<subscribe> function in the browser menu. Mutt was generating a
"mailboxes" command and sending that along to the muttrc parser.
However, it was not escaping "`", which executes code and inserts
the result. This would allow a malicious IMAP server to execute
arbitrary code (for $imap_check_subscribed).</p>
<p>Fixes POP body caching path traversal vulnerability.</p>
<p>Fixes IMAP header caching path traversal vulnerability.</p>
<p>CVE-2018-14349 - NO Response Heap Overflow</p>
<p>CVE-2018-14350 - INTERNALDATE Stack Overflow</p>
<p>CVE-2018-14351 - STATUS Literal Length relative write</p>
<p>CVE-2018-14352 - imap_quote_string off-by-one stack overflow</p>
<p>CVE-2018-14353 - imap_quote_string int underflow</p>
<p>CVE-2018-14354 - imap_subscribe Remote Code Execution</p>
<p>CVE-2018-14355 - STATUS mailbox header cache directory traversal</p>
<p>CVE-2018-14356 - POP empty UID NULL deref</p>
<p>CVE-2018-14357 - LSUB Remote Code Execution</p>
<p>CVE-2018-14358 - RFC822.SIZE Stack Overflow</p>
<p>CVE-2018-14359 - base64 decode Stack Overflow</p>
<p>CVE-2018-14362 - POP Message Cache Directory Traversal</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14349</cvename>
<cvename>CVE-2018-14350</cvename>
<cvename>CVE-2018-14351</cvename>
<cvename>CVE-2018-14352</cvename>
<cvename>CVE-2018-14353</cvename>
<cvename>CVE-2018-14354</cvename>
<cvename>CVE-2018-14355</cvename>
<cvename>CVE-2018-14356</cvename>
<cvename>CVE-2018-14357</cvename>
<cvename>CVE-2018-14358</cvename>
<cvename>CVE-2018-14359</cvename>
<cvename>CVE-2018-14362</cvename>
<url>http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html</url>
</references>
<dates>
<discovery>2018-07-15</discovery>
<entry>2018-07-17</entry>
</dates>
</vuln>
<vuln vid="fe12ef83-8b47-11e8-96cc-001a4a7ec6be">
<topic>mutt/neomutt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>neomutt</name>
<range><lt>20180716</lt></range>
</package>
<package>
<name>mutt</name>
<range><lt>1.10.1</lt></range>
</package>
<package>
<name>mutt14</name>
<range><lt>*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NeoMutt report:</p>
<blockquote cite="https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716">
<h1>Description</h1>
<h5>CVE-2018-14349</h5><p>NO Response Heap Overflow</p>
<h5>CVE-2018-14350</h5><p>INTERNALDATE Stack Overflow</p>
<h5>CVE-2018-14351</h5><p>STATUS Literal Length relative write</p>
<h5>CVE-2018-14352</h5><p>imap_quote_string off-by-one stack overflow</p>
<h5>CVE-2018-14353</h5><p>imap_quote_string int underflow</p>
<h5>CVE-2018-14354</h5><p>imap_subscribe Remote Code Execution</p>
<h5>CVE-2018-14355</h5><p>STATUS mailbox header cache directory traversal</p>
<h5>CVE-2018-14356</h5><p>POP empty UID NULL deref</p>
<h5>CVE-2018-14357</h5><p>LSUB Remote Code Execution</p>
<h5>CVE-2018-14358</h5><p>RFC822.SIZE Stack Overflow</p>
<h5>CVE-2018-14359</h5><p>base64 decode Stack Overflow</p>
<h5>CVE-2018-14360</h5><p>NNTP Group Stack Overflow</p>
<h5>CVE-2018-14361</h5><p>NNTP Write 1 where via GROUP response</p>
<h5>CVE-2018-14362</h5><p>POP Message Cache Directory Traversal</p>
<h5>CVE-2018-14363</h5><p>NNTP Header Cache Directory Traversal</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14349</cvename>
<cvename>CVE-2018-14350</cvename>
<cvename>CVE-2018-14351</cvename>
<cvename>CVE-2018-14352</cvename>
<cvename>CVE-2018-14353</cvename>
<cvename>CVE-2018-14354</cvename>
<cvename>CVE-2018-14355</cvename>
<cvename>CVE-2018-14356</cvename>
<cvename>CVE-2018-14357</cvename>
<cvename>CVE-2018-14358</cvename>
<cvename>CVE-2018-14359</cvename>
<cvename>CVE-2018-14360</cvename>
<cvename>CVE-2018-14361</cvename>
<cvename>CVE-2018-14362</cvename>
<cvename>CVE-2018-14363</cvename>
<url>https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-07-19</entry>
</dates>
</vuln>
<vuln vid="20a1881e-8a9e-11e8-bddf-d017c2ca229d">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.133</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.121.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-07-18/">
<h1>Description</h1>
<h5>(High) SECURITY-897 / CVE-2018-1999001</h5>
<p>Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart </p>
<h5>(High) SECURITY-914 / CVE-2018-1999002</h5>
<p>Arbitrary file read vulnerability</p>
<h5>(Medium) SECURITY-891 / CVE-2018-1999003</h5>
<p>Unauthorized users could cancel queued builds</p>
<h5>(Medium) SECURITY-892 / CVE-2018-1999004</h5>
<p>Unauthorized users could initiate and abort agent launches</p>
<h5>(Medium) SECURITY-944 / CVE-2018-1999005</h5>
<p>Stored XSS vulnerability</p>
<h5>(Medium) SECURITY-925 / CVE-2018-1999006</h5>
<p>Unauthorized users are able to determine when a plugin was extracted from its JPI package</p>
<h5>(Medium) SECURITY-390 / CVE-2018-1999007</h5>
<p>XSS vulnerability in Stapler debug mode</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1999001</cvename>
<cvename>CVE-2018-1999002</cvename>
<cvename>CVE-2018-1999003</cvename>
<cvename>CVE-2018-1999004</cvename>
<cvename>CVE-2018-1999005</cvename>
<cvename>CVE-2018-1999006</cvename>
<cvename>CVE-2018-1999007</cvename>
<url>https://jenkins.io/security/advisory/2018-07-18/</url>
</references>
<dates>
<discovery>2018-07-18</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="c6d1a8a6-8a91-11e8-be4d-005056925db4">
<topic>znc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14055">
<p>ZNC before 1.7.1-rc1 does not properly validate untrusted lines
coming from the network, allowing a non-admin user to escalate his
privilege and inject rogue values into znc.conf.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14056">
<p>ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in
a web skin name to access files outside of the intended skins
directories.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14055</cvename>
<cvename>CVE-2018-14056</cvename>
<url>https://wiki.znc.in/ChangeLog/1.7.1</url>
</references>
<dates>
<discovery>2018-07-14</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="8b1a50ab-8a8e-11e8-add2-b499baebfeaf">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>DoS for HTTP/2 connections by crafted requests
(CVE-2018-1333). By specially crafting HTTP/2 requests, workers
would be allocated 60 seconds longer than necessary, leading to
worker exhaustion and a denial of service. (low)</li>
<li>mod_md, DoS via Coredumps on specially crafted requests
(CVE-2018-8011). By specially crafting HTTP requests, the mod_md
challenge handler would dereference a NULL pointer and cause the
child process to segfault. This could be used to DoS the server.
(moderate)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-1333</cvename>
<cvename>CVE-2018-8011</cvename>
</references>
<dates>
<discovery>2018-07-18</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="8fc615cc-8a66-11e8-8c75-d8cb8abf62dd">
<topic>Gitlab -- Remote Code Execution Vulnerability in GitLab Projects Import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab</name>
<range><ge>11.0.0</ge><lt>11.0.4</lt></range>
<range><ge>10.8.0</ge><lt>10.8.6</lt></range>
<range><ge>8.9.0</ge><lt>10.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/">
<p>Remote Code Execution Vulnerability in GitLab Projects Import</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14364</cvename>
<url>https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/</url>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="ef013039-89cd-11e8-84e9-00e04c1ea73d">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-7</name>
<range><lt>7.6.30</lt></range>
</package>
<package>
<name>typo3-8</name>
<range><lt>8.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-931-8717-and-7630-security-releases-published/">
<p>It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component)
is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance.
In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden
when using MD5 as the default hashing algorithm by just knowing a valid username.
Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.</p>
<p>Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact
that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored
with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way,
Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted
to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by
manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability.
In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit
has been identified so far.</p>
<p>Failing to properly dissociate system related configuration from user generated configuration,
the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation.
Basically instructions can be persisted to a form definition file that were not configured to be modified -
this applies to definitions managed using the form editor module as well as direct file upload using the regular
file list module. A valid backend user account as well as having system extension form activated are needed
in order to exploit this vulnerability.</p>
<p>It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization
when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents
to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed
to exploit this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-001/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-002/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-003/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-004/</url>
</references>
<dates>
<discovery>2018-07-12</discovery>
<entry>2018-07-17</entry>
</dates>
</vuln>
<vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b">
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><lt>1.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/latest_releases.html">
<p>Release 1.60 is now available for download.</p>
<p>CVE-2018-1000180: issue around primality tests for RSA key pair
generation if done using only the low-level API.</p>
<p>CVE-2018-1000613: lack of class checking in deserialization
of XMSS/XMSS^MT private keys with BDS state information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000180</cvename>
<cvename>CVE-2018-1000613</cvename>
<url>https://www.bouncycastle.org/latest_releases.html</url>
</references>
<dates>
<discovery>2018-06-30</discovery>
<entry>2018-07-15</entry>
</dates>
</vuln>
<vuln vid="bd6cf187-8710-11e8-833d-18a6f7016652">
<topic>qutebrowser -- Remote code execution due to CSRF</topic>
<affects>
<package>
<name>qutebrowser</name>
<range><ge>1.4.0</ge><lt>1.4.1</lt></range>
<range><ge>1.0.0</ge><lt>1.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>qutebrowser team reports:</p>
<blockquote cite="https://blog.qutebrowser.org/cve-2018-10895-remote-code-execution-due-to-csrf-in-qutebrowser.html">
<p>Due to a CSRF vulnerability affecting the qute://settings page,
it was possible for websites to modify qutebrowser settings.
Via settings like editor.command, this possibly allowed websites
to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2018/q3/29</url>
<cvename>CVE-2018-10895</cvename>
</references>
<dates>
<discovery>2018-07-11</discovery>
<entry>2018-07-14</entry>
</dates>
</vuln>
<vuln vid="e78732b2-8528-11e8-9c42-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.134</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-24.html">
<ul>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-5008).</li>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-5007).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5007</cvename>
<cvename>CVE-2018-5008</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-24.html</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-07-11</entry>
</dates>
</vuln>
<vuln vid="1e54d140-8493-11e8-a795-0028f8d09152">
<topic>couchdb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>1.7.2,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://blog.couchdb.org/2018/07/10/cve-2018-8007/">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.couchdb.org/2018/07/10/cve-2018-8007/</url>
<cvename>CVE-2018-8007</cvename>
<url>https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/</url>
<cvename>CVE-2017-12636</cvename>
<cvename>CVE-2017-12635</cvename>
<url>https://lists.apache.org/thread.html/6fa798e96686b7b0013ec2088140d00aeb7d34487d3f5ad032af6934@%3Cdev.couchdb.apache.org%3E</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2018-07-10</entry>
</dates>
</vuln>
<vuln vid="3c9b7698-84da-11e8-8c75-d8cb8abf62dd">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.27.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.3">
<p>Out-of-bounds reads when reading objects from a packfile</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.3</url>
<cvename>CVE-2018-10887</cvename>
<cvename>CVE-2018-10888</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-11</entry>
</dates>
</vuln>
<vuln vid="d1e9d8c5-839b-11e8-9610-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.100.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Joel Esler reports:</p>
<blockquote cite="https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html">
<p>3 security fixes in this release:</p>
<ul>
<li>CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).</li>
<li>CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera.</li>
<li>CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report
ed by aCaB.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html</url>
<cvename>CVE-2017-16932</cvename>
<cvename>CVE-2018-0360</cvename>
<cvename>CVE-2018-0361</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-09</entry>
</dates>
</vuln>
<vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374">
<topic>zziplib - multiple vulnerabilities</topic>
<affects>
<package>
<name>zziplib</name>
<range><lt>0.13.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports (by search in the range 2017/01/01 - 2018/07/06):</p>
<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018">
<p>17 security fixes in this release:</p>
<ul>
<li>Heap-based buffer overflow in the __zzip_get32 function in fetch.c.</li>
<li>Heap-based buffer overflow in the __zzip_get64 function in fetch.c.</li>
<li>Heap-based buffer overflow in the zzip_mem_entry_extra_block function
in memdisk.c.</li>
<li>The zzip_mem_entry_new function in memdisk.c allows remote attackers
to cause a denial of service (out-of-bounds read and crash) via a
crafted ZIP file.</li>
<li>The prescan_entry function in fseeko.c allows remote attackers to cause
a denial of service (NULL pointer dereference and crash) via crafted
ZIP file.</li>
<li>The zzip_mem_entry_new function in memdisk.c cause a NULL pointer
dereference and crash via a crafted ZIP file.</li>
<li>seeko.c cause a denial of service (assertion failure and crash) via a
crafted ZIP file.</li>
<li>A segmentation fault caused by invalid memory access in the
zzip_disk_fread function because the size variable is not validated
against the amount of file->stored data.</li>
<li>A memory alignment error and bus error in the __zzip_fetch_disk_trailer
function of zzip/zip.c.</li>
<li>A bus error caused by loading of a misaligned address in the
zzip_disk_findfirst function.</li>
<li>An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory
function.</li>
<li>An invalid memory address dereference was discovered in zzip_disk_fread
in mmapped.c.</li>
<li>A memory leak triggered in the function zzip_mem_disk_new in
memdisk.c.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5974</cvename>
<cvename>CVE-2017-5975</cvename>
<cvename>CVE-2017-5976</cvename>
<cvename>CVE-2017-5977</cvename>
<cvename>CVE-2017-5978</cvename>
<cvename>CVE-2017-5979</cvename>
<cvename>CVE-2017-5980</cvename>
<cvename>CVE-2017-5981</cvename>
<cvename>CVE-2018-6381</cvename>
<cvename>CVE-2018-6484</cvename>
<cvename>CVE-2018-6540</cvename>
<cvename>CVE-2018-6541</cvename>
<cvename>CVE-2018-6542</cvename>
<cvename>CVE-2018-6869</cvename>
<cvename>CVE-2018-7725</cvename>
<cvename>CVE-2018-7726</cvename>
<cvename>CVE-2018-7727</cvename>
<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018"</url>
</references>
<dates>
<discovery>2017-03-01</discovery>
<entry>2018-07-06</entry>
</dates>
</vuln>
<vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.7,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>4.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpressdevelopers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/">
<p>Taxonomy: Improve cache handling for term queries.</p>
<p>Posts, Post Types: Clear post password cookie when logging out.</p>
<p>Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.</p>
<p>Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.</p>
<p>Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-07-05</discovery>
<entry>2018-07-08</entry>
</dates>
</vuln>
<vuln vid="bfd5d004-81d4-11e8-a29a-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/">
<p>High risk: Image and URL MyCode Persistent XSS</p>
<p>Medium risk: Multipage Reflected XSS</p>
<p>Low risk: ACP logs XSS</p>
<p>Low risk: Arbitrary file deletion via ACP’s Settings</p>
<p>Low risk: Login CSRF</p>
<p>Low risk: Non-video content embedding via Video MyCode</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-07-04</discovery>
<entry>2018-07-07</entry>
</dates>
</vuln>
<vuln vid="e375ff3f-7fec-11e8-8088-28d244aee256">
<topic>expat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.2.1</lt></range>
</package>
<package>
<name>libwww</name>
<range><lt>5.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063">
<p>An integer overflow during the parsing of XML using the Expat library.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233">
<p>XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat
XML Parser Library) allows attackers to put the parser in an infinite
loop using a malformed external entity definition from an external DTD.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233</url>
<url>https://libexpat.github.io/doc/cve-2017-9233/</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2018-07-05</entry>
</dates>
</vuln>
<vuln vid="ce39379f-7eb7-11e8-ab03-00bd7f19ff09">
<topic>h2o -- heap buffer overflow during logging</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marlies Ruck reports:</p>
<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.5">
<p>Fix heap buffer overflow while trying to emit access log
- see references for full details.</p>
<p>CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and
earlier allows remote attackers to execute arbitrary code or
cause a denial of service (DoS) via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0608</cvename>
<url>https://github.com/h2o/h2o/issues/1775</url>
<url>https://github.com/h2o/h2o/releases/tag/v2.2.5</url>
</references>
<dates>
<discovery>2018-06-01</discovery>
<entry>2018-07-03</entry>
</dates>
</vuln>
<vuln vid="c1630aa3-7970-11e8-8634-dcfe074bd614">
<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
<affects>
<package>
<name>upp</name>
<range><le>11540</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
statement could cause a NULL pointer dereference, related to build.c
and prepare.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8740</cvename>
<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-07-01</entry>
</dates>
</vuln>
<vuln vid="cd81806c-26e7-4d4a-8425-02724a2f48af">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>61.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.1.19_2</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>60.0,1</ge><lt>60.1.0_1,1</lt></range>
<range><lt>52.9.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/">
<p>CVE-2018-12359: Buffer overflow using computed size of canvas element</p>
<p>CVE-2018-12360: Use-after-free when using focus()</p>
<p>CVE-2018-12361: Integer overflow in SwizzleData</p>
<p>CVE-2018-12358: Same-origin bypass using service worker and redirection</p>
<p>CVE-2018-12362: Integer overflow in SSSE3 scaler</p>
<p>CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture</p>
<p>CVE-2018-12363: Use-after-free when appending DOM nodes</p>
<p>CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins</p>
<p>CVE-2018-12365: Compromised IPC child process can list local filenames</p>
<p>CVE-2018-12371: Integer overflow in Skia library during edge builder allocation</p>
<p>CVE-2018-12366: Invalid data handling during QCMS transformations</p>
<p>CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming</p>
<p>CVE-2018-12368: No warning when opening executable SettingContent-ms files</p>
<p>CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments</p>
<p>CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View</p>
<p>CVE-2018-5186: Memory safety bugs fixed in Firefox 61</p>
<p>CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1</p>
<p>CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5156</cvename>
<cvename>CVE-2018-5186</cvename>
<cvename>CVE-2018-5187</cvename>
<cvename>CVE-2018-5188</cvename>
<cvename>CVE-2018-12358</cvename>
<cvename>CVE-2018-12359</cvename>
<cvename>CVE-2018-12360</cvename>
<cvename>CVE-2018-12361</cvename>
<cvename>CVE-2018-12362</cvename>
<cvename>CVE-2018-12363</cvename>
<cvename>CVE-2018-12364</cvename>
<cvename>CVE-2018-12365</cvename>
<cvename>CVE-2018-12366</cvename>
<cvename>CVE-2018-12367</cvename>
<cvename>CVE-2018-12368</cvename>
<cvename>CVE-2018-12369</cvename>
<cvename>CVE-2018-12370</cvename>
<cvename>CVE-2018-12371</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/</url>
</references>
<dates>
<discovery>2018-06-26</discovery>
<entry>2018-06-26</entry>
<modified>2018-07-07</modified>
</dates>
</vuln>
<vuln vid="739948e3-78bf-11e8-b23c-080027ac955c">
<topic>mailman -- hardening against malicious listowners injecting evil HTML scripts</topic>
<affects>
<package> <name>mailman</name> <range><lt>2.1.27</lt></range> </package>
<package> <name>mailman-with-htdig</name> <range><lt>2.1.27</lt></range> </package>
<package> <name>ja-mailman</name> <range><lt>2.1.14.j7_5,1</lt></range> </package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8">
<p>Existing protections against malicious listowners injecting evil
scripts into listinfo pages have had a few more checks added.
</p>
<p>A few more error messages have had their values HTML escaped.</p>
<p>The hash generated when SUBSCRIBE_FORM_SECRET is set could have been
the same as one generated at the same time for a different list and
IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8</url>
<url>https://www.mail-archive.com/mailman-users@python.org/</url>
<cvename>CVE-2018-0618</cvename>
</references>
<dates>
<discovery>2018-03-09</discovery> <!-- Launchpad rev. 1747 -->
<entry>2018-06-25</entry>
</dates>
</vuln>
<vuln vid="b950a83b-789e-11e8-8545-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>11.0.0</ge><lt>11.0.1</lt></range>
<range><ge>10.8.0</ge><lt>10.8.5</lt></range>
<range><ge>4.1</ge><lt>10.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/">
<p>Wiki XSS</p>
<p>Sanitize gem updates</p>
<p>XSS in url_for(params)</p>
<p>Content injection via username</p>
<p>Activity feed publicly displaying internal project names</p>
<p>Persistent XSS in charts</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12606</cvename>
<cvename>CVE-2018-3740</cvename>
<cvename>CVE-2018-12605</cvename>
<cvename>CVE-2018-12607</cvename>
<url>https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/</url>
</references>
<dates>
<discovery>2018-06-25</discovery>
<entry>2018-06-25</entry>
</dates>
</vuln>
<vuln vid="17cb6ff3-7670-11e8-8854-6805ca0b3d42">
<topic>phpmyadmin -- remote code inclusion and XSS scripting</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><lt>4.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-3/">
<h3>Summary</h3>
<p>XSS in Designer feature</p>
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
Designer feature, where an attacker can deliver a
payload to a user through a specially-crafted database
name.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-4/">
<h3>Summary</h3>
<p>File inclusion and remote code execution attack</p>
<h3>Description</h3>
<p>A flaw has been discovered where an attacker can include
(view and potentially execute) files on the server.</p>
<p>The vulnerability comes from a portion of code where
pages are redirected and loaded within phpMyAdmin, and an
improper test for whitelisted pages.</p>
<p>An attacker must be authenticated, except in these
situations:</p>
<ul>
<li>$cfg['AllowArbitraryServer'] = true: attacker can
specify any host he/she is already in control of, and
execute arbitrary code on phpMyAdmin</li>
<li>$cfg['ServerDefault'] = 0: this bypasses the login and
runs the vulnerable code without any authentication</li>
</ul>
<h3>Severity</h3>
<p>We consider this to be severe.</p> <h3>Mitigation
factor</h3> <p>Configuring PHP with a restrictive
`open_basedir` can greatly restrict an attacker's ability to
view files on the server. Vulnerable systems should not be
run with the phpMyAdmin directives
$cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault']
= 0</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-3/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-4/</url>
<cvename>CVE-2018-12581</cvename>
<cvename>CVE-2018-12613</cvename>
</references>
<dates>
<discovery>2018-06-21</discovery>
<entry>2018-06-22</entry>
</dates>
</vuln>
<vuln vid="4e07d94f-75a5-11e8-85d1-a4badb2f4699">
<topic>FreeBSD -- Lazy FPU State Restore Information Disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A subset of Intel processors can allow a local thread
to infer data from another thread through a speculative
execution side channel when Lazy FPU state restore is
used.</p>
<h1>Impact:</h1>
<p>Any local thread can potentially read FPU state information
from other threads running on the host. This could include
cryptographic keys when the AES-NI CPU feature is present.</p>
</body>
</description>
<references>
<cvename>CVE-2018-3665</cvename>
<freebsdsa>SA-18:07.lazyfpu</freebsdsa>
</references>
<dates>
<discovery>2018-06-21</discovery>
<entry>2018-06-21</entry>
</dates>
</vuln>
<vuln vid="25f73c47-68a8-4a30-9cbc-1ca5eea4d6ba">
<topic>GraphicsMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.26,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick reports:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Multiple vulnerabilities have been found in GraphicsMagick 1.3.26
or earlier. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
<cvename>CVE-2016-7800</cvename>
<cvename>CVE-2016-7996</cvename>
<cvename>CVE-2016-7997</cvename>
<cvename>CVE-2016-9830</cvename>
<cvename>CVE-2017-6335</cvename>
<cvename>CVE-2017-8350</cvename>
<cvename>CVE-2017-10794</cvename>
<cvename>CVE-2017-10799</cvename>
<cvename>CVE-2017-10800</cvename>
</references>
<dates>
<discovery>2017-07-04</discovery>
<entry>2018-06-18</entry>
</dates>
</vuln>
<vuln vid="3a66cb69-716f-11e8-be54-3085a9a47796">
<topic>slurm -- insecure handling of user_name and gid fields</topic>
<affects>
<package>
<name>slurm-wlm</name>
<range><lt>17.02.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SchedMD reports:</p>
<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html">
<h1>Insecure handling of user_name and gid fields (CVE-2018-10995)</h1>
<p>While fixes are only available for the supported 17.02 and 17.11
releases, it is believed that similar vulnerabilities do affect past
versions as well. The only resolution is to upgrade Slurm to a fixed
release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html</url>
</references>
<dates>
<discovery>2018-05-30</discovery>
<entry>2018-06-16</entry>
</dates>
</vuln>
<vuln vid="45b8e2eb-7056-11e8-8fab-63ca6e0e13a2">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node6</name>
<range><lt>6.14.3</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.3</lt></range>
</package>
<package>
<name>node</name>
<range><lt>10.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/">
<h1>Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161)</h1>
<p>All versions of 8.x and later are vulnerable and the severity is
HIGH. An attacker can cause a denial of service (DoS) by causing a
node server providing an http2 server to crash. This can be
accomplished by interacting with the http2 server in a manner that
triggers a cleanup bug where objects are used in native code after
they are no longer available. This has been addressed by updating
the http2 implementation. Thanks to Jordan Zebor at F5 Networks for
reporting this issue.</p>
<h1>Denial of Service, nghttp2 dependency (CVE-2018-1000168)</h1>
<p>All versions of 9.x and later are vulnerable and the severity is
HIGH. Under certain conditions, a malicious client can trigger an
uninitialized read (and a subsequent segfault) by sending a
malformed ALTSVC frame. This has been addressed through an by
updating nghttp2.</p>
<h1>Denial of Service Vulnerability in TLS (CVE-2018-7162)</h1>
<p>All versions of 9.x and later are vulnerable and the severity is
HIGH. An attacker can cause a denial of service (DoS) by causing a
node process which provides an http server supporting TLS server to
crash. This can be accomplished by sending duplicate/unexpected
messages during the handshake. This vulnerability has been addressed
by updating the TLS implementation. Thanks to Jordan Zebor at F5
Networks all of his help investigating this issue with the Node.js
team.</p>
<h1>Memory exhaustion DoS on v9.x (CVE-2018-7164)</h1>
<p>Versions 9.7.0 and later are vulnerable and the severity is MEDIUM.
A bug introduced in 9.7.0 increases the memory consumed when reading
from the network into JavaScript using the net.Socket object
directly as a stream. An attacker could use this cause a denial of
service by sending tiny chunks of data in short succession. This
vulnerability was restored by reverting to the prior behaviour.</p>
<h1>Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167)</h1>
<p>Calling Buffer.fill() or Buffer.alloc() with some parameters can
lead to a hang which could result in a Denial of Service. In order
to address this vulnerability, the implementations of Buffer.alloc()
and Buffer.fill() were updated so that they zero fill instead of
hanging in these cases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/</url>
<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
<cvename>CVE-2018-7161</cvename>
<cvename>CVE-2018-7162</cvename>
<cvename>CVE-2018-7164</cvename>
<cvename>CVE-2018-7167</cvename>
<cvename>CVE-2018-1000168</cvename>
</references>
<dates>
<discovery>2018-06-12</discovery>
<entry>2018-06-15</entry>
</dates>
</vuln>
<vuln vid="53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec">
<topic>password-store -- GPG parsing vulnerabilities</topic>
<affects>
<package>
<name>password-store</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason A. Donenfeld reports:</p>
<blockquote cite="https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html">
<p>Markus Brinkmann discovered that [the] parsing of gpg command line
output with regexes isn't anchored to the beginning of the line,
which means an attacker can generate a malicious key that simply has
the verification string as part of its username.</p>
<p>This has a number of nasty consequences:</p>
<ul>
<li>an attacker who manages to write into your ~/.password-store
and also inject a malicious key into your keyring can replace
your .gpg-id key and have your passwords encrypted under
additional keys;</li>
<li>if you have extensions enabled (disabled by default), an
attacker who manages to write into your ~/.password-store and
also inject a malicious key into your keyring can replace your
extensions and hence execute code.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html</url>
<cvename>CVE-2018-12356</cvename>
</references>
<dates>
<discovery>2018-06-14</discovery>
<entry>2018-06-14</entry>
</dates>
</vuln>
<vuln vid="9b5162de-6f39-11e8-818e-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495">
<p>Mitigate a local side-channel attack on ECDSA signature as described in the white paper "Return on the Hidden Number Problem".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0495</cvename>
<url>https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495</url>
<url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txt</url>
</references>
<dates>
<discovery>2018-06-13</discovery>
<entry>2018-06-13</entry>
<modified>2018-06-14</modified>
</dates>
</vuln>
<vuln vid="c82ecac5-6e3f-11e8-8777-b499baebfeaf">
<topic>OpenSSL -- Client DoS due to large DH parameter</topic>
<affects>
<package>
<name>libressl</name>
<name>libressl-devel</name>
<range><lt>2.6.5</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2o_4,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180612.txt">
<p>During key agreement in a TLS handshake using a DH(E) based
ciphersuite a malicious server can send a very large prime value
to the client. This will cause the client to spend an unreasonably
long period of time generating a key for this prime resulting in a
hang until the client has finished. This could be exploited in a
Denial Of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180612.txt</url>
<cvename>CVE-2018-0732</cvename>
</references>
<dates>
<discovery>2018-06-12</discovery>
<entry>2018-06-12</entry>
<modified>2018-07-24</modified>
</dates>
</vuln>
<vuln vid="0137167b-6dca-11e8-a671-001999f8d30b">
<topic>asterisk -- PJSIP endpoint presence disclosure when using ACL</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.21.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p> When endpoint specific ACL rules block a SIP request
they respond with a 403 forbidden. However, if an endpoint
is not identified then a 401 unauthorized response is
sent. This vulnerability just discloses which requests
hit a defined endpoint. The ACL rules cannot be bypassed
to gain access to the disclosed endpoints.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-008.html</url>
</references>
<dates>
<discovery>2018-06-11</discovery>
<entry>2018-06-11</entry>
</dates>
</vuln>
<vuln vid="f14ce57f-6dc8-11e8-a671-001999f8d30b">
<topic>asterisk -- Infinite loop when reading iostreams</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When connected to Asterisk via TCP/TLS if the client
abruptly disconnects, or sends a specially crafted message
then Asterisk gets caught in an infinite loop while trying
to read the data stream. Thus rendering the system as
unusable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-007.html</url>
</references>
<dates>
<discovery>2018-06-11</discovery>
<entry>2018-06-11</entry>
</dates>
</vuln>
<vuln vid="4cb49a23-6c89-11e8-8b33-e8e0b747a45a">
<topic>chromium -- Incorrect handling of CSP header</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>67.0.3396.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html">
<p>1 security fix contributed by external researchers:</p>
<ul>
<li>[845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6148</cvename>
<url>https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-06-10</entry>
</dates>
</vuln>
<vuln vid="7da0417f-6b24-11e8-84cc-002590acae31">
<topic>gnupg -- unsanitized output (CVE-2018-12020)</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>2.2.8</lt></range>
</package>
<package>
<name>gnupg1</name>
<range><lt>1.4.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html">
<p>GnuPG did not sanitize input file names, which may then be output to
the terminal. This could allow terminal control sequences or fake
status messages to be injected into the output.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020</url>
<cvename>CVE-2018-12020</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526</url>
<cvename>CVE-2017-7526</cvename>
</references>
<dates>
<discovery>2018-06-07</discovery>
<entry>2018-06-08</entry>
</dates>
</vuln>
<vuln vid="e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7">
<topic>firefox -- Heap buffer overflow rasterizing paths in SVG with Skia</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>60.0.2,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.0.13_5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.8.1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/">
<p>A heap buffer overflow can occur in the Skia library when
rasterizing paths using a maliciously crafted SVG file
with anti-aliasing turned off. This results in a
potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2018-14/</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-06-08</entry>
</dates>
</vuln>
<vuln vid="2dde5a56-6ab1-11e8-b639-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-19.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-4945).</li>
<li>This update resolves an integer overflow vulnerability that
could lead to information disclosure (CVE-2018-5000).</li>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-5001).</li>
<li>This update resolves a stack-based buffer overflow vulnerability that
could lead to arbitrary code execution (CVE-2018-5002).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4945</cvename>
<cvename>CVE-2018-5000</cvename>
<cvename>CVE-2018-5001</cvename>
<cvename>CVE-2018-5002</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-19.html</url>
</references>
<dates>
<discovery>2018-06-07</discovery>
<entry>2018-06-07</entry>
<modified>2018-07-11</modified>
</dates>
</vuln>
<vuln vid="2f4fd3aa-32f8-4116-92f2-68f05398348e">
<topic>bro -- multiple memory allocation issues</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Corelight reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.5.4 primarily fixes security issues</p>
<p>Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.</p>
<p>The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow and memory allocations of negative or very large size, leading to a crash or memory exhaustion. The new NCP::max_frame_size tuning option now limits the maximum amount of memory that can be allocated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-06</entry>
</dates>
</vuln>
<vuln vid="5a1589ad-68f9-11e8-83f5-d8cb8abf62dd">
<topic>Libgit2 -- Fixing insufficient validation of submodule names</topic>
<affects>
<package>
<name>libgit2</name>
<name>py-pygit2</name>
<range><lt>0.27.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.1">
<p>Insufficient validation of submodule names</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.1</url>
<cvename>CVE-2018-11235</cvename>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-05</entry>
</dates>
</vuln>
<vuln vid="c7a135f4-66a4-11e8-9e63-3085a9a47796">
<topic>Git -- Fix memory out-of-bounds and remote code execution vulnerabilities (CVE-2018-11233 and CVE-2018-11235)</topic>
<affects>
<package>
<name>git</name>
<name>git-lite</name>
<range><lt>2.13.7</lt></range>
<range><ge>2.14</ge><lt>2.14.4</lt></range>
<range><ge>2.15</ge><lt>2.15.2</lt></range>
<range><ge>2.16</ge><lt>2.16.4</lt></range>
<range><ge>2.17</ge><lt>2.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://marc.info/?l=git&m=152761328506724&=2">
<ul><li>In affected versions of Git, code to sanity-check pathnames on
NTFS can result in reading out-of-bounds memory.</li>
<li>In affected versions of Git, remote code execution can
occur. With a crafted .gitmodules file, a malicious project can
execute an arbitrary script on a machine that runs "git clone
--recurse-submodules" because submodule "names" are obtained from
this file, and then appended to $GIT_DIR/modules, leading to
directory traversal with "../" in a name. Finally, post-checkout
hooks from a submodule are executed, bypassing the intended design
in which hooks are not obtained from a remote server.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233</url>
<cvename>CVE-2018-11233</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235</url>
<cvename>CVE-2018-11235</cvename>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-02</entry>
</dates>
</vuln>
<vuln vid="9557dc72-64da-11e8-bc32-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.8.0</ge><lt>10.8.2</lt></range>
<range><ge>10.7.0</ge><lt>10.7.5</lt></range>
<range><ge>1.0</ge><lt>10.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/">
<p>Removing public deploy keys regression</p>
<p>Users can update their password without entering current password</p>
<p>Persistent XSS - Selecting users as allowed merge request approvers</p>
<p>Persistent XSS - Multiple locations of user selection drop downs</p>
<p>include directive in .gitlab-ci.yml allows SSRF requests</p>
<p>Permissions issue in Merge Requests Create Service</p>
<p>Arbitrary assignment of project fields using "Import project"</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-05-31</entry>
</dates>
</vuln>
<vuln vid="7fc3e827-64a5-11e8-aedb-00224d821998">
<topic>strongswan -- Fix Denial-of-Service Vulnerability strongSwan (CVE-2018-10811, CVE-2018-5388)</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2018/05/28/strongswan-5.6.3-released.html">
<ul><li>A denial-of-service vulnerability in the IKEv2 key derivation was fixed
if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as
PRF (which is not FIPS-compliant). So this should only affect very specific setups,
but in such configurations all strongSwan versions since 5.0.1 may be affected.</li>
<li>A denial-of-service vulnerability in the stroke plugin was fixed.
When reading a message from the socket the plugin did not check the received length.
Unless a group is configured, root privileges are required to access that socket,
so in the default configuration this shouldn't be an issue, but all strongSwan versions may be affected.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-10811).html</url>
<cvename>CVE-2018-10811</cvename>
<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-5388).html</url>
<cvename>CVE-2018-5388</cvename>
</references>
<dates>
<discovery>2018-05-16</discovery>
<entry>2018-05-31</entry>
</dates>
</vuln>
<vuln vid="427b0f58-644c-11e8-9e1b-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>67.0.3396.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html">
<p>34 security fixes in this release, including:</p>
<ul>
<li>[835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22</li>
<li>[840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07</li>
<li>[818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05</li>
<li>[844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18</li>
<li>[842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15</li>
<li>[841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09</li>
<li>[838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01</li>
<li>[838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30</li>
<li>[826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27</li>
<li>[839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04</li>
<li>[817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28</li>
<li>[797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23</li>
<li>[823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19</li>
<li>[831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12</li>
<li>[835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21</li>
<li>[810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08</li>
<li>[805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24</li>
<li>[798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01</li>
<li>[796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19</li>
<li>[837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28</li>
<li>[843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15</li>
<li>[828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02</li>
<li>[805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25</li>
<li>[818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02</li>
<li>[847542] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6123</cvename>
<cvename>CVE-2018-6124</cvename>
<cvename>CVE-2018-6125</cvename>
<cvename>CVE-2018-6126</cvename>
<cvename>CVE-2018-6127</cvename>
<cvename>CVE-2018-6128</cvename>
<cvename>CVE-2018-6129</cvename>
<cvename>CVE-2018-6130</cvename>
<cvename>CVE-2018-6131</cvename>
<cvename>CVE-2018-6132</cvename>
<cvename>CVE-2018-6133</cvename>
<cvename>CVE-2018-6134</cvename>
<cvename>CVE-2018-6135</cvename>
<cvename>CVE-2018-6136</cvename>
<cvename>CVE-2018-6137</cvename>
<cvename>CVE-2018-6138</cvename>
<cvename>CVE-2018-6139</cvename>
<cvename>CVE-2018-6140</cvename>
<cvename>CVE-2018-6141</cvename>
<cvename>CVE-2018-6142</cvename>
<cvename>CVE-2018-6143</cvename>
<cvename>CVE-2018-6144</cvename>
<cvename>CVE-2018-6145</cvename>
<cvename>CVE-2018-6147</cvename>
<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-05-30</entry>
</dates>
</vuln>
<vuln vid="94599fe0-5ca3-11e8-8be1-d05099c0ae8c">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind912</name>
<range><lt>9.12.1P2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01602">
<p>An error in zone database reference counting can
lead to an assertion failure if a server which is
running an affected version of BIND attempts
several transfers of a slave zone in quick
succession.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01606">
<p>A problem with the implementation of the new
serve-stale feature in BIND 9.12 can lead to
an assertion failure in rbtdb.c, even when
stale-answer-enable is off. Additionally,
problematic interaction between the serve-stale
feature and NSEC aggressive negative caching can
in some cases cause undesirable behavior from named,
such as a recursion loop or excessive logging.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5736</cvename>
<cvename>CVE-2018-5737</cvename>
<url>https://kb.isc.org/article/AA-01602</url>
<url>https://kb.isc.org/article/AA-01606</url>
</references>
<dates>
<discovery>2018-05-18</discovery>
<entry>2018-05-21</entry>
</dates>
</vuln>
<vuln vid="04fe6c8d-2a34-4009-a81e-e7a7e759b5d2">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.60.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-1000300: FTP shutdown response buffer overflow</p>
<p>curl might overflow a heap based memory buffer when closing down an
FTP connection with very long server command replies.</p>
<p>When doing FTP transfers, curl keeps a spare "closure handle" around
internally that will be used when an FTP connection gets shut down
since the original curl easy handle is then already removed.</p>
<p>FTP server response data that gets cached from the original transfer
might then be larger than the default buffer size (16 KB) allocated in
the "closure handle", which can lead to a buffer overwrite. The
contents and size of that overwrite is controllable by the server.</p>
<p>This situation was detected by an assert() in the code, but that was
of course only preventing bad stuff in debug builds. This bug is very
unlikely to trigger with non-malicious servers.</p>
<p>We are not aware of any exploit of this flaw.</p>
<p>CVE-2018-1000301: RTSP bad headers buffer over-read</p>
<p>curl can be tricked into reading data beyond the end of a heap based
buffer used to store downloaded content.</p>
<p>When servers send RTSP responses back to curl, the data starts out
with a set of headers. curl parses that data to separate it into a
number of headers to deal with those appropriately and to find the end
of the headers that signal the start of the "body" part.</p>
<p>The function that splits up the response into headers is called
Curl_http_readwrite_headers() and in situations where it can't find a
single header in the buffer, it might end up leaving a pointer pointing
into the buffer instead of to the start of the buffer which then later
on may lead to an out of buffer read when code assumes that pointer
points to a full buffer size worth of memory to use.</p>
<p>This could potentially lead to information leakage but most likely a
crash/denial of service for applications if a server triggers this flaw.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/adv_2018-82c2.html</url>
<url>https://curl.haxx.se/docs/adv_2018-b138.html</url>
<cvename>CVE-2018-1000300</cvename>
<cvename>CVE-2018-1000301</cvename>
</references>
<dates>
<discovery>2018-05-16</discovery>
<entry>2018-05-16</entry>
</dates>
</vuln>
<vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
<topic>wavpack -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wavpack</name>
<range><lt>5.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Ramacher reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
<p>A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
<p>The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
<p>The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.</p>
</blockquote>
<p>Thuan Pham reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
<p>An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
<p>An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
<p>An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
<p>An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
<p>An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6767</cvename>
<cvename>CVE-2018-7253</cvename>
<cvename>CVE-2018-7254</cvename>
<cvename>CVE-2018-10536</cvename>
<cvename>CVE-2018-10537</cvename>
<cvename>CVE-2018-10538</cvename>
<cvename>CVE-2018-10539</cvename>
<cvename>CVE-2018-10540</cvename>
<url>https://www.debian.org/security/2018/dsa-4125</url>
<url>https://www.debian.org/security/2018/dsa-4197</url>
<freebsdpr>228141</freebsdpr>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-11</entry>
</dates>
</vuln>
<vuln vid="e457978b-5484-11e8-9b85-54ee754af08e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.170</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html">
<p>4 security fixes in this release:</p>
<ul>
<li>[835887] Critical: Chain leading to sandbox escape.
Reported by Anonymous on 2018-04-23</li>
<li>[836858] High CVE-2018-6121: Privilege Escalation in extensions</li>
<li>[836141] High CVE-2018-6122: Type confusion in V8</li>
<li>[833721] High CVE-2018-6120: Heap buffer overflow in PDFium.
Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17</li>
<li>[841841] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6120</cvename>
<cvename>CVE-2018-6121</cvename>
<cvename>CVE-2018-6122</cvename>
<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-04-14</discovery>
<entry>2018-05-11</entry>
</dates>
</vuln>
<vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.120</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.107.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-05-09/">
<p>The agent to master security subsystem ensures that the Jenkins
master is protected from maliciously configured agents. A path
traversal vulnerability allowed agents to escape whitelisted
directories to read and write to files they should not be able to
access.</p>
<p>Black Duck Hub Plugin's API endpoint was affected by an XML
External Entity (XXE) processing vulnerability. This allowed an
attacker with Overall/Read access to have Jenkins parse a maliciously
crafted file that uses external entities for extraction of secrets
from the Jenkins master, server-side request forgery, or
denial-of-service attacks.</p>
<p>Several other lower severity issues were reported, see reference
url for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-05-09/</url>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-10</entry>
</dates>
</vuln>
<vuln vid="5aefc41e-d304-4ec8-8c82-824f84f08244">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>60.0,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.1.0_18</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.8.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.8.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">
<p>CVE-2018-5183: Backport critical security fixes in Skia</p>
<p>CVE-2018-5154: Use-after-free with SVG animations and clip paths</p>
<p>CVE-2018-5155: Use-after-free with SVG animations and text paths</p>
<p>CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files</p>
<p>CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer</p>
<p>CVE-2018-5159: Integer overflow and out-of-bounds write in Skia</p>
<p>CVE-2018-5160: Uninitialized memory use by WebRTC encoder</p>
<p>CVE-2018-5152: WebExtensions information leak through webRequest API</p>
<p>CVE-2018-5153: Out-of-bounds read in mixed content websocket messages</p>
<p>CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache</p>
<p>CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace</p>
<p>CVE-2018-5166: WebExtension host permission bypass through filterReponseData</p>
<p>CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger</p>
<p>CVE-2018-5168: Lightweight themes can be installed without user interaction</p>
<p>CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages</p>
<p>CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer</p>
<p>CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters</p>
<p>CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update</p>
<p>CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies</p>
<p>CVE-2018-5176: JSON Viewer script injection</p>
<p>CVE-2018-5177: Buffer overflow in XSLT during number formatting</p>
<p>CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox</p>
<p>CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension</p>
<p>CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced</p>
<p>CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink</p>
<p>CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar</p>
<p>CVE-2018-5151: Memory safety bugs fixed in Firefox 60</p>
<p>CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5150</cvename>
<cvename>CVE-2018-5151</cvename>
<cvename>CVE-2018-5152</cvename>
<cvename>CVE-2018-5153</cvename>
<cvename>CVE-2018-5154</cvename>
<cvename>CVE-2018-5155</cvename>
<cvename>CVE-2018-5157</cvename>
<cvename>CVE-2018-5158</cvename>
<cvename>CVE-2018-5159</cvename>
<cvename>CVE-2018-5160</cvename>
<cvename>CVE-2018-5163</cvename>
<cvename>CVE-2018-5164</cvename>
<cvename>CVE-2018-5165</cvename>
<cvename>CVE-2018-5166</cvename>
<cvename>CVE-2018-5167</cvename>
<cvename>CVE-2018-5168</cvename>
<cvename>CVE-2018-5169</cvename>
<cvename>CVE-2018-5172</cvename>
<cvename>CVE-2018-5173</cvename>
<cvename>CVE-2018-5174</cvename>
<cvename>CVE-2018-5175</cvename>
<cvename>CVE-2018-5176</cvename>
<cvename>CVE-2018-5177</cvename>
<cvename>CVE-2018-5178</cvename>
<cvename>CVE-2018-5180</cvename>
<cvename>CVE-2018-5181</cvename>
<cvename>CVE-2018-5182</cvename>
<cvename>CVE-2018-5183</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-11/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-12/</url>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-09</entry>
</dates>
</vuln>
<vuln vid="5af6378b-bd88-4997-bccc-b9ba2daecdd2">
<topic>kamailio - buffer overflow</topic>
<affects>
<package>
<name>kamailio</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A specially crafted REGISTER message with a malformed branch or
From tag triggers an off-by-one heap-based buffer overflow in the
tmx_check_pretran function in modules/tmx/tmx_pretran.c</p>
</body>
</description>
<references>
<cvename>CVE-2018-8828</cvename>
<url>https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/</url>
<url>https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow</url>
</references>
<dates>
<discovery>2018-02-10</discovery>
<entry>2018-05-06</entry>
</dates>
</vuln>
<vuln vid="7b5a8e3b-52cc-11e8-8c7a-9c5c8e75236a">
<topic>wget -- cookie injection vulnerability</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Harry Sintonen of F-Secure Corporation reports:</p>
<blockquote cite="https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt">
<p>GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt</url>
<cvename>CVE-2018-0494</cvename>
<freebsdpr>ports/228071</freebsdpr>
</references>
<dates>
<discovery>2018-04-26</discovery>
<entry>2018-05-08</entry>
</dates>
</vuln>
<vuln vid="9558d49c-534c-11e8-8177-d43d7ef03aa6">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.171</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-16.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-4944).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4944</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-16.html</url>
</references>
<dates>
<discovery>2018-05-08</discovery>
<entry>2018-05-09</entry>
</dates>
</vuln>
<vuln vid="521ce804-52fd-11e8-9123-a4badb2f4699">
<topic>FreeBSD -- Mishandling of x86 debug exceptions</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_10</lt></range>
<range><ge>10.4</ge><lt>10.4_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The MOV SS and POP SS instructions inhibit debug exceptions
until the instruction boundary following the next instruction.
If that instruction is a system call or similar instruction
that transfers control to the operating system, the debug
exception will be handled in the kernel context instead of
the user context.</p>
<h1>Impact:</h1>
<p>An authenticated local attacker may be able to read
sensitive data in kernel memory, control low-level operating
system functions, or may panic the system.</p>
</body>
</description>
<references>
<cvename>CVE-2018-8897</cvename>
<freebsdsa>SA-18:06.debugreg</freebsdsa>
</references>
<dates>
<discovery>2018-05-08</discovery>
<entry>2018-05-08</entry>
</dates>
</vuln>
<vuln vid="8719b935-8bae-41ad-92ba-3c826f651219">
<topic>python 2.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>python release notes:</p>
<blockquote cite="https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst">
<p>Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst</url>
<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15.rst</url>
<cvename>CVE-2012-0876</cvename>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-4472</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
<cvename>CVE-2018-1060</cvename>
<cvename>CVE-2018-1061</cvename>
</references>
<dates>
<discovery>2018-05-01</discovery>
<entry>2018-05-05</entry>
</dates>
</vuln>
<vuln vid="83a548b5-4fa5-11e8-9a8e-001e2a3f778d">
<topic>KWallet-PAM -- Access to privileged files</topic>
<affects>
<package>
<name>plasma5-kwallet-pam</name>
<range><lt>5.12.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE Community reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20180503-1.txt">
<p>
kwallet-pam was doing file writing and permission changing
as root that with correct timing and use of carefully
crafted symbolic links could allow a non privileged user
to become the owner of any file on the system.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20180503-1.txt</url>
</references>
<dates>
<discovery>2018-05-04</discovery>
<entry>2018-05-04</entry>
</dates>
</vuln>
<vuln vid="89ca6f7d-4f00-11e8-9b1d-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.58</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-004">
<p>A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x.
This potentially allows attackers to exploit multiple attack vectors on a Drupal site,
which could result in the site being compromised. This vulnerability is related to
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002.
Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-004</url>
</references>
<dates>
<discovery>2018-04-25</discovery>
<entry>2018-05-03</entry>
</dates>
</vuln>
<vuln vid="9dfe61c8-4d15-11e8-8f2f-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.7.0</ge><lt>10.7.2</lt></range>
<range><ge>10.6.0</ge><lt>10.6.5</lt></range>
<range><ge>9.5.0</ge><lt>10.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released">
<p>Persistent XSS in Move Issue using project namespace</p>
<p>Download Archive allowing unauthorized private repo access</p>
<p>Mattermost Updates</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10379</cvename>
<url>https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released</url>
</references>
<dates>
<discovery>2018-04-30</discovery>
<entry>2018-05-01</entry>
</dates>
</vuln>
<vuln vid="006bee4e-4c49-11e8-9c32-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.139</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html">
<p>3 security fixes in this release:</p>
<ul>
<li>[831963] Critical CVE-2018-6118: Use after free in Media Cache. Reported by Ned Williamson on 2018-04-12</li>
<li>[837635] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6118</cvename>
<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2018-04-12</discovery>
<entry>2018-04-30</entry>
</dates>
</vuln>
<vuln vid="499f6b41-58db-4f98-b8e7-da8c18985eda">
<topic>quassel -- multiple vulnerabilities</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.5</lt></range>
</package>
<package>
<name>quassel-core</name>
<range><lt>0.12.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="https://bugs.gentoo.org/653834">
<p>quasselcore: corruption of heap metadata caused by qdatastream
leading to preauth remote code execution.</p>
<ul>
<li>Severity: high, by default the server port is publicly open
and the address can be requested using the /WHOIS command of IRC
protocol.</li>
<li>Description: In Qdatastream protocol each object is prepended
with 4 bytes for the object size, this can be used to trigger
allocation errors.</li>
</ul>
<p>quasselcore DDOS</p>
<ul>
<li>Severity: low, only impacts unconfigured quasselcore
instances.</li>
<li>Description: A login attempt causes a NULL pointer dereference
when the database is not initialized.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.gentoo.org/653834</url>
<url>https://github.com/quassel/quassel/commit/08bace4e9ecf08273f094c0c6aa8b3363d38ac3e</url>
<url>https://github.com/quassel/quassel/commit/18389a713a6810f57ab237b945e8ee03df857b8b</url>
</references>
<dates>
<discovery>2018-04-24</discovery>
<entry>2018-04-26</entry>
</dates>
</vuln>
<vuln vid="36ff7a74-47b1-11e8-a7d6-54e1ad544088">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.117</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">
<p>62 security fixes in this release:</p>
<ul>
<li>[826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28</li>
<li>[827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30</li>
<li>[813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20</li>
<li>[822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15</li>
<li>[808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04</li>
<li>[820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12</li>
<li>[771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05</li>
<li>[819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08</li>
<li>[780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01</li>
<li>[633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01</li>
<li>[637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11</li>
<li>[776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19</li>
<li>[806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26</li>
<li>[798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03</li>
<li>[808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03</li>
<li>[811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11</li>
<li>[813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19</li>
<li>[813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20</li>
<li>[816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24</li>
<li>[820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08</li>
<li>[803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18</li>
<li>[805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25</li>
<li>[808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02</li>
<li>[816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27</li>
<li>[710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10</li>
<li>[777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24</li>
<li>[780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02</li>
<li>[798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29</li>
<li>[805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25</li>
<li>[811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13</li>
<li>[819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07</li>
<li>[822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15</li>
<li>[822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15</li>
<li>[822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html</url>
<cvename>CVE-2018-6085</cvename>
<cvename>CVE-2018-6086</cvename>
<cvename>CVE-2018-6087</cvename>
<cvename>CVE-2018-6088</cvename>
<cvename>CVE-2018-6089</cvename>
<cvename>CVE-2018-6090</cvename>
<cvename>CVE-2018-6091</cvename>
<cvename>CVE-2018-6092</cvename>
<cvename>CVE-2018-6093</cvename>
<cvename>CVE-2018-6094</cvename>
<cvename>CVE-2018-6095</cvename>
<cvename>CVE-2018-6096</cvename>
<cvename>CVE-2018-6097</cvename>
<cvename>CVE-2018-6098</cvename>
<cvename>CVE-2018-6099</cvename>
<cvename>CVE-2018-6100</cvename>
<cvename>CVE-2018-6101</cvename>
<cvename>CVE-2018-6102</cvename>
<cvename>CVE-2018-6103</cvename>
<cvename>CVE-2018-6104</cvename>
<cvename>CVE-2018-6105</cvename>
<cvename>CVE-2018-6106</cvename>
<cvename>CVE-2018-6107</cvename>
<cvename>CVE-2018-6108</cvename>
<cvename>CVE-2018-6109</cvename>
<cvename>CVE-2018-6110</cvename>
<cvename>CVE-2018-6111</cvename>
<cvename>CVE-2018-6112</cvename>
<cvename>CVE-2018-6113</cvename>
<cvename>CVE-2018-6114</cvename>
<cvename>CVE-2018-6115</cvename>
<cvename>CVE-2018-6116</cvename>
<cvename>CVE-2018-6117</cvename>
<cvename>CVE-2018-6084</cvename>
</references>
<dates>
<discovery>2017-04-10</discovery>
<entry>2018-04-24</entry>
</dates>
</vuln>
<vuln vid="d8382a69-4728-11e8-ba83-0011d823eebd">
<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.7.2</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released">
<ul>
<li>Defend against Bellcore glitch attacks by verifying the results
of RSA private key operations.</li>
<li>Fix implementation of the truncated HMAC extension. The
previous implementation allowed an offline 2^80 brute force
attack on the HMAC key of a single, uninterrupted connection
(with no resumption of the session).</li>
<li>Reject CRLs containing unsupported critical extensions. Found
by Falko Strenzke and Evangelos Karatsiolis.</li>
<li>Fix a buffer overread in ssl_parse_server_key_exchange() that
could cause a crash on invalid input.</li>
<li>Fix a buffer overread in ssl_parse_server_psk_hint() that could
cause a crash on invalid input.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released</url>
</references>
<dates>
<discovery>2018-03-21</discovery>
<entry>2018-04-23</entry>
</dates>
</vuln>
<vuln vid="57aec168-453e-11e8-8777-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.35</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.33</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.15</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.40</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.22</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.40</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html">
<p>MySQL Multiple Flaws Let Remote Authenticated Users Access and
Modify Data, Remote and Local Users Deny Service, and Local Users
Access Data and Gain Elevated Privileges</p>
<ul>
<li>A local user can exploit a flaw in the Replication component
to gain elevated privileges [CVE-2018-2755].</li>
<li>A remote authenticated user can exploit a flaw in the GIS
Extension component to cause denial of service conditions
[CVE-2018-2805].</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to cause denial of service conditions [CVE-2018-2782,
CVE-2018-2784, CVE-2018-2819].</li>
<li>A remote authenticated user can exploit a flaw in the Security
Privileges component to cause denial of service conditions
[CVE-2018-2758, CVE-2018-2818].</li>
<li>A remote authenticated user can exploit a flaw in the DDL
component to cause denial of service conditions
[CVE-2018-2817].</li>
<li>A remote authenticated user can exploit a flaw in the Optimizer
component to cause denial of service conditions [CVE-2018-2775,
CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781,
CVE-2018-2816].</li>
<li>A remote user can exploit a flaw in the Client programs
component to cause denial of service conditions [CVE-2018-2761,
CVE-2018-2773].</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to partially modify data and cause denial of service
conditions [CVE-2018-2786, CVE-2018-2787].</li>
<li>A remote authenticated user can exploit a flaw in the Optimizer
component to partially modify data and cause denial of service
conditions [CVE-2018-2812].</li>
<li>A local user can exploit a flaw in the Cluster ndbcluster/plugin
component to cause denial of service conditions [CVE-2018-2877].
</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to cause denial of service conditions [CVE-2018-2759,
CVE-2018-2766, CVE-2018-2777, CVE-2018-2810].</li>
<li>A remote authenticated user can exploit a flaw in the DML
component to cause denial of service conditions [CVE-2018-2839].
</li>
<li>A remote authenticated user can exploit a flaw in the
Performance Schema component to cause denial of service conditions
[CVE-2018-2846].</li>
<li>A remote authenticated user can exploit a flaw in the Pluggable
Auth component to cause denial of service conditions
[CVE-2018-2769].</li>
<li>A remote authenticated user can exploit a flaw in the Group
Replication GCS component to cause denial of service conditions
[CVE-2018-2776].</li>
<li>A local user can exploit a flaw in the Connection component to
cause denial of service conditions [CVE-2018-2762].</li>
<li>A remote authenticated user can exploit a flaw in the Locking
component to cause denial of service conditions [CVE-2018-2771].
</li>
<li>A remote authenticated user can exploit a flaw in the DDL
component to partially access data [CVE-2018-2813].</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html</url>
<cvename>CVE-2018-2755</cvename>
<cvename>CVE-2018-2805</cvename>
<cvename>CVE-2018-2782</cvename>
<cvename>CVE-2018-2784</cvename>
<cvename>CVE-2018-2819</cvename>
<cvename>CVE-2018-2758</cvename>
<cvename>CVE-2018-2817</cvename>
<cvename>CVE-2018-2775</cvename>
<cvename>CVE-2018-2780</cvename>
<cvename>CVE-2018-2761</cvename>
<cvename>CVE-2018-2786</cvename>
<cvename>CVE-2018-2787</cvename>
<cvename>CVE-2018-2812</cvename>
<cvename>CVE-2018-2877</cvename>
<cvename>CVE-2018-2759</cvename>
<cvename>CVE-2018-2766</cvename>
<cvename>CVE-2018-2777</cvename>
<cvename>CVE-2018-2810</cvename>
<cvename>CVE-2018-2818</cvename>
<cvename>CVE-2018-2839</cvename>
<cvename>CVE-2018-2778</cvename>
<cvename>CVE-2018-2779</cvename>
<cvename>CVE-2018-2781</cvename>
<cvename>CVE-2018-2816</cvename>
<cvename>CVE-2018-2846</cvename>
<cvename>CVE-2018-2769</cvename>
<cvename>CVE-2018-2776</cvename>
<cvename>CVE-2018-2762</cvename>
<cvename>CVE-2018-2771</cvename>
<cvename>CVE-2018-2813</cvename>
<cvename>CVE-2018-2773</cvename>
</references>
<dates>
<discovery>2018-04-17</discovery>
<entry>2018-04-21</entry>
</dates>
</vuln>
<vuln vid="be38245e-44d9-11e8-a292-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.5,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<range><lt>4.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/">
<p>Don't treat localhost as same host by default.</p>
<p>Use safe redirects when redirecting the login page if SSL is forced.</p>
<p>Make sure the version string is correctly escaped for use in generator tags.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-04-03</discovery>
<entry>2018-04-20</entry>
</dates>
</vuln>
<vuln vid="ac7da39b-4405-11e8-afbe-6805ca0b3d42">
<topic>phpmyadmin -- CSRF vulnerability allowing arbitrary SQL execution</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.8.0</ge><lt>4.8.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-2/">
<h3>Summary</h3>
<p>CSRF vulnerability allowing arbitrary SQL execution</p>
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible for an attacker to execute arbitrary SQL
commands.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-2/</url>
</references>
<dates>
<discovery>2018-04-17</discovery>
<entry>2018-04-19</entry>
</dates>
</vuln>
<vuln vid="33174280-43fa-11e8-aad5-6cf0497db129">
<topic>drupal -- Drupal core - Moderately critical</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal security team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2018-003">
<p>CKEditor, a third-party JavaScript library included in Drupal
core, has fixed a cross-site scripting (XSS) vulnerability. The
vulnerability stemmed from the fact that it was possible to execute
XSS inside CKEditor when using the image2 plugin (which Drupal 8
core also uses).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2018-003</url>
</references>
<dates>
<discovery>2018-04-18</discovery>
<entry>2018-04-19</entry>
</dates>
</vuln>
<vuln vid="8f353420-4197-11e8-8777-b499baebfeaf">
<topic>OpenSSL -- Cache timing vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2o_2,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180416.txt">
<p>The OpenSSL RSA Key generation algorithm has been shown to be
vulnerable to a cache timing side channel attack. An attacker
with sufficient access to mount cache timing attacks during the
RSA key generation process could recover the private key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180416.txt</url>
<cvename>CVE-2018-0737</cvename>
</references>
<dates>
<discovery>2018-04-16</discovery>
<entry>2018-04-16</entry>
</dates>
</vuln>
<vuln vid="a9e466e8-4144-11e8-a292-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/psa-2018-001">
<p>CVE-2018-7600: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6,
and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because
of an issue affecting multiple subsystems with default or common module configurations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-7600</cvename>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-04-16</entry>
</dates>
</vuln>
<vuln vid="41c96ffd-29a6-4dcc-9a88-65f5038fa6eb">
<topic>perl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>perl5</name>
<range><ge>5.24.0</ge><lt>5.24.4</lt></range>
<range><ge>5.26.0</ge><lt>5.26.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>perldelta:</p>
<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.2">
<p>CVE-2018-6797: heap-buffer-overflow (WRITE of size 1) in S_regatom
(regcomp.c)</p>
<p>A crafted regular expression could cause a heap buffer write overflow,
with control over the bytes written. [perl #132227]</p>
<p>CVE-2018-6798: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c)</p>
<p>Matching a crafted locale dependent regular expression could cause a
heap buffer read overflow and potentially information disclosure. [perl
#132063]</p>
<p>CVE-2018-6913: heap-buffer-overflow in S_pack_rec</p>
<p>pack() could cause a heap buffer write overflow with a large item
count. [perl #131844]</p>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/changes/release/SHAY/perl-5.26.2</url>
<url>https://metacpan.org/changes/release/SHAY/perl-5.24.4</url>
<cvename>CVE-2018-6797</cvename>
<cvename>CVE-2018-6798</cvename>
<cvename>CVE-2018-6913</cvename>
</references>
<dates>
<discovery>2018-04-14</discovery>
<entry>2018-04-15</entry>
</dates>
</vuln>
<vuln vid="974a6d32-3fda-11e8-aea4-001b216d295b">
<topic>ipsec-tools -- remotely exploitable computational-complexity attack</topic>
<affects>
<package>
<name>ipsec-tools</name>
<range><lt>0.8.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Robert Foggia via NetBSD GNATS reports:</p>
<blockquote cite="https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682">
<p>The ipsec-tools racoon daemon contains a remotely exploitable computational
complexity attack when parsing and storing isakmp fragments. The implementation
permits a remote attacker to exhaust computational resources on the remote endpoint
by repeatedly sending isakmp fragment packets in a particular order such that
the worst-case computational complexity is realized in the algorithm utilized
to determine if reassembly of the fragments can take place.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682</url>
<cvename>CVE-2016-10396</cvename>
</references>
<dates>
<discovery>2016-12-02</discovery>
<entry>2018-04-14</entry>
</dates>
</vuln>
<vuln vid="1fccb25e-8451-438c-a2b9-6a021e4d7a31">
<topic>nghttp2 -- Denial of service due to NULL pointer dereference</topic>
<affects>
<package>
<name>libnghttp2</name>
<name>nghttp2</name>
<range><ge>1.10.0</ge><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 blog:</p>
<blockquote cite="https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/">
<p>If ALTSVC frame is received by libnghttp2 and it is larger than it can
accept, the pointer field which points to ALTSVC frame payload is left
NULL. Later libnghttp2 attempts to access another field through the
pointer, and gets segmentation fault.</p>
<p>ALTSVC frame is defined by RFC 7838.</p>
<p>The largest frame size libnghttp2 accept is by default 16384 bytes.</p>
<p>Receiving ALTSVC frame is disabled by default. Application has to
enable it explicitly by calling
nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).</p>
<p>Transmission of ALTSVC is always enabled, and it does not cause this
vulnerability.</p>
<p>ALTSVC frame is expected to be sent by server, and received by client
as defined in RFC 7838.</p>
<p>Client and server are both affected by this vulnerability if the
reception of ALTSVC frame is enabled. As written earlier, it is useless
to enable reception of ALTSVC frame on server side. So, server is
generally safe unless application accidentally enabled the reception of
ALTSVC frame.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
<cvename>CVE-2018-1000168</cvename>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-13</entry>
</dates>
</vuln>
<vuln vid="48894ca9-3e6f-11e8-92f0-f0def167eeea">
<topic>roundcube -- IMAP command injection vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><le>1.3.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream reports:</p>
<blockquote cite="https://roundcube.net/news/2018/04/11/security-update-1.3.6">
<p>This update primarily fixes a recently discovered IMAP-cmd-injection
vulnerability caused by insufficient input validation within
the archive plugin.
Details about the vulnerability are published under CVE-2018-9846.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-9846</cvename>
<url>https://roundcube.net/news/2018/04/11/security-update-1.3.6</url>
</references>
<dates>
<discovery>2018-04-11</discovery>
<entry>2018-04-13</entry>
</dates>
</vuln>
<vuln vid="aaba17aa-782e-4843-8a79-7756cfa2bf89">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.115</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.107.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-04-11/">
<p>The Jenkins CLI sent different error responses for commands with
view and agent arguments depending on the existence of the specified
views or agents to unauthorized users. This allowed attackers to
determine whether views or agents with specified names exist.</p>
<p>The Jenkins CLI now returns the same error messages to unauthorized
users independent of the existence of specified view or agent
names</p>
<p>Some JavaScript confirmation dialogs included the item name in an
unsafe manner, resulting in a possible cross-site scripting
vulnerability exploitable by users with permission to create or
configure items.</p>
<p>JavaScript confirmation dialogs that include the item name now
properly escape it, so it can be safely displayed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-04-11/</url>
</references>
<dates>
<discovery>2018-04-11</discovery>
<entry>2018-04-12</entry>
</dates>
</vuln>
<vuln vid="5c6f7482-3ced-11e8-b157-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.140</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-08.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to remote code execution (CVE-2018-4932).</li>
<li>This update resolves out-of-bounds read vulnerabilities that
could lead to information disclosure (CVE-2018-4933,
CVE-2018-4934).</li>
<li>This update resolves out-of-bounds write vulnerabilities that
could lead to remote code execution (CVE-2018-4935,
CVE-2018-4937).</li>
<li>This update resolves a heap overflow vulnerability that
could lead to information disclosure (CVE-2018-4936).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4932</cvename>
<cvename>CVE-2018-4933</cvename>
<cvename>CVE-2018-4934</cvename>
<cvename>CVE-2018-4935</cvename>
<cvename>CVE-2018-4936</cvename>
<cvename>CVE-2018-4937</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-08.html</url>
</references>
<dates>
<discovery>2018-04-10</discovery>
<entry>2018-04-10</entry>
<modified>2018-07-11</modified>
</dates>
</vuln>
<vuln vid="085a087b-3897-11e8-ac53-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.6.0</ge><lt>10.6.3</lt></range>
<range><ge>10.5.0</ge><lt>10.5.7</lt></range>
<range><ge>8.6</ge><lt>10.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/">
<p>Confidential issue comments in Slack, Mattermost, and webhook integrations.</p>
<p>Persistent XSS in milestones data-milestone-id.</p>
<p>Persistent XSS in filename of merge request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/</url>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="c0c5afef-38db-11e8-8b7f-a4badb2f469b">
<topic>FreeBSD -- ipsec crash or denial of service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_9</lt></range>
<range><ge>10.4</ge><lt>10.4_8</lt></range>
<range><ge>10.3</ge><lt>10.3_29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The length field of the option header does not count the
size of the option header itself. This causes a problem
when the length is zero, the count is then incremented by
zero, which causes an infinite loop.</p>
<p>In addition there are pointer/offset mistakes in the
handling of IPv4 options.</p>
<h1>Impact:</h1>
<p>A remote attacker who is able to send an arbitrary packet,
could cause the remote target machine to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6918</cvename>
<freebsdsa>SA-18:05.ipsec</freebsdsa>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="a5cf3ecd-38db-11e8-8b7f-a4badb2f469b">
<topic>FreeBSD -- vt console memory disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_9</lt></range>
<range><ge>10.4</ge><lt>10.4_8</lt></range>
<range><ge>10.3</ge><lt>10.3_29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation of user-provided font parameters
can result in an integer overflow, leading to the use of
arbitrary kernel memory as glyph data. Characters that
reference this data can be displayed on the screen, effectively
disclosing kernel memory.</p>
<h1>Impact:</h1>
<p>Unprivileged users may be able to access privileged
kernel data.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6917</cvename>
<freebsdsa>SA-18:04.vt</freebsdsa>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="cdb4d962-34f9-11e8-92db-080027907385">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.11</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.5</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=367938">
<p>Unauthenticated users can trigger custom messages to admin via
paypal enrol script.</p>
<p>Suspended users with OAuth 2 authentication method can still log in to
the site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1081</cvename>
<cvename>CVE-2018-1082</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=367938</url>
</references>
<dates>
<discovery>2018-03-14</discovery>
<entry>2018-03-31</entry>
</dates>
</vuln>
<vuln vid="eb69bcf2-18ef-4aa2-bb0c-83b263364089">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.3.0,1</ge><lt>2.3.7,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.4,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/">
<p>CVE-2017-17742: HTTP response splitting in WEBrick</p>
<p>If a script accepts an external input and outputs it without
modification as a part of HTTP responses, an attacker can use newline
characters to deceive the clients that the HTTP response header is
stopped at there, and can inject fake HTTP responses after the newline
characters to show malicious contents to the clients.</p>
<p>CVE-2018-6914: Unintentional file and directory creation with
directory traversal in tempfile and tmpdir</p>
<p>Dir.mktmpdir method introduced by tmpdir library accepts the prefix
and the suffix of the directory which is created as the first parameter.
The prefix can contain relative directory specifiers "../", so this
method can be used to target any directory. So, if a script accepts an
external input as the prefix, and the targeted directory has
inappropriate permissions or the ruby process has inappropriate
privileges, the attacker can create a directory or a file at any
directory.</p>
<p>CVE-2018-8777: DoS by large request in WEBrick</p>
<p>If an attacker sends a large request which contains huge HTTP headers,
WEBrick try to process it on memory, so the request causes the
out-of-memory DoS attack.</p>
<p>CVE-2018-8778: Buffer under-read in String#unpack</p>
<p>String#unpack receives format specifiers as its parameter, and can
be specified the position of parsing the data by the specifier @. If a
big number is passed with @, the number is treated as the negative
value, and out-of-buffer read is occurred. So, if a script accepts an
external input as the argument of String#unpack, the attacker can read
data on heaps.</p>
<p>CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
UNIXServer and UNIXSocket</p>
<p>UNIXServer.open accepts the path of the socket to be created at the
first parameter. If the path contains NUL (\0) bytes, this method
recognize that the path is completed before the NUL bytes. So, if a
script accepts an external input as the argument of this method, the
attacker can make the socket file in the unintentional path. And,
UNIXSocket.open also accepts the path of the socket to be created at
the first parameter without checking NUL bytes like UNIXServer.open.
So, if a script accepts an external input as the argument of this
method, the attacker can accepts the socket file in the unintentional
path.</p>
<p>CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte
in Dir</p>
<p>Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
target directory as their parameter. If the parameter contains NUL (\0)
bytes, these methods recognize that the path is completed before the
NUL bytes. So, if a script accepts an external input as the argument of
these methods, the attacker can make the unintentional directory
traversal.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/</url>
<cvename>CVE-2017-17742</cvename>
<cvename>CVE-2018-6914</cvename>
<cvename>CVE-2018-8777</cvename>
<cvename>CVE-2018-8778</cvename>
<cvename>CVE-2018-8779</cvename>
<cvename>CVE-2018-8780</cvename>
</references>
<dates>
<discovery>2018-03-28</discovery>
<entry>2018-03-29</entry>
</dates>
</vuln>
<vuln vid="5a9bbb6e-32d3-11e8-a769-6daaba161086">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node4</name>
<range><lt>4.9.0</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.14.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.0</lt></range>
</package>
<package>
<name>node</name>
<range><lt>9.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/">
<h1>Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160)</h1>
<p>Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.</p>
<h1>'path' module regular expression denial of service (CVE-2018-7158)</h1>
<p>The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x.</p>
<h1>Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159)</h1>
<p>The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/</url>
<cvename>CVE-2018-7158</cvename>
<cvename>CVE-2018-7159</cvename>
<cvename>CVE-2018-7160</cvename>
</references>
<dates>
<discovery>2018-03-21</discovery>
<entry>2018-03-28</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="1ce95bc7-3278-11e8-b527-00012e582166">
<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><ge>2.16.6</ge><lt>2.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKit team reports many vulnerabilities.</p>
<p>Please reference the CVE/URL list for details.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2017-0008.html</url>
<url>https://webkitgtk.org/security/WSA-2017-0009.html</url>
<url>https://webkitgtk.org/security/WSA-2017-0010.html</url>
<url>https://webkitgtk.org/security/WSA-2018-0001.html</url>
<url>https://webkitgtk.org/security/WSA-2018-0002.html</url>
<cvename>CVE-2017-7087</cvename>
<cvename>CVE-2017-7089</cvename>
<cvename>CVE-2017-7090</cvename>
<cvename>CVE-2017-7091</cvename>
<cvename>CVE-2017-7092</cvename>
<cvename>CVE-2017-7092</cvename>
<cvename>CVE-2017-7093</cvename>
<cvename>CVE-2017-7095</cvename>
<cvename>CVE-2017-7096</cvename>
<cvename>CVE-2017-7098</cvename>
<cvename>CVE-2017-7100</cvename>
<cvename>CVE-2017-7102</cvename>
<cvename>CVE-2017-7104</cvename>
<cvename>CVE-2017-7107</cvename>
<cvename>CVE-2017-7109</cvename>
<cvename>CVE-2017-7111</cvename>
<cvename>CVE-2017-7117</cvename>
<cvename>CVE-2017-7120</cvename>
<cvename>CVE-2017-13783</cvename>
<cvename>CVE-2017-13784</cvename>
<cvename>CVE-2017-13785</cvename>
<cvename>CVE-2017-13788</cvename>
<cvename>CVE-2017-13791</cvename>
<cvename>CVE-2017-13792</cvename>
<cvename>CVE-2017-13794</cvename>
<cvename>CVE-2017-13795</cvename>
<cvename>CVE-2017-13796</cvename>
<cvename>CVE-2017-13798</cvename>
<cvename>CVE-2017-13802</cvename>
<cvename>CVE-2017-13803</cvename>
<cvename>CVE-2017-7156</cvename>
<cvename>CVE-2017-7157</cvename>
<cvename>CVE-2017-13856</cvename>
<cvename>CVE-2017-13866</cvename>
<cvename>CVE-2017-13870</cvename>
<cvename>CVE-2017-5753</cvename>
<cvename>CVE-2017-5715</cvename>
<cvename>CVE-2018-4088</cvename>
<cvename>CVE-2018-4089</cvename>
<cvename>CVE-2018-4096</cvename>
<cvename>CVE-2017-7153</cvename>
<cvename>CVE-2017-7160</cvename>
<cvename>CVE-2017-7161</cvename>
<cvename>CVE-2017-7165</cvename>
<cvename>CVE-2017-13884</cvename>
<cvename>CVE-2017-13885</cvename>
</references>
<dates>
<discovery>2017-10-18</discovery>
<entry>2018-03-28</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="3ae21918-31e3-11e8-927b-e8e0b747a45a">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>65.0.3325.181</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html">
<p>1 security fix in this release, including:</p>
<ul>
<li>[823553] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2018-03-20</discovery>
<entry>2018-03-27</entry>
</dates>
</vuln>
<vuln vid="b7cff5a9-31cc-11e8-8f07-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2o,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180327.txt">
<ul><li>Constructed ASN.1 types with a recursive definition could
exceed the stack (CVE-2018-0739)<br/>
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious input
with excessive recursion. This could result in a Denial Of Service
attack. There are no such structures used within SSL/TLS that come from
untrusted sources so this is considered safe.</li>
<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. This only
affects processors that support the AVX2 but not ADX extensions
like Intel Haswell (4th generation).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180327.txt</url>
<cvename>CVE-2018-0739</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2018-03-27</discovery>
<entry>2018-03-27</entry>
</dates>
</vuln>
<vuln vid="dc0c201c-31da-11e8-ac53-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.5.0</ge><lt>10.5.6</lt></range>
<range><ge>10.4.0</ge><lt>10.4.6</lt></range>
<range><ge>8.3</ge><lt>10.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/">
<h1>SSRF in services and web hooks</h1>
<p>There were multiple server-side request forgery issues in the Services feature.
An attacker could make requests to servers within the same network of the GitLab
instance. This could lead to information disclosure, authentication bypass, or
potentially code execution. This issue has been assigned
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8801">CVE-2018-8801</a>.</p>
<h1>Gitlab Auth0 integration issue</h1>
<p>There was an issue with the GitLab <code>omniauth-auth0</code> configuration
which resulted in the Auth0 integration signing in the wrong users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8801</cvename>
<url>https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/</url>
</references>
<dates>
<discovery>2018-03-20</discovery>
<entry>2018-03-27</entry>
<modified>2018-04-07</modified>
</dates>
</vuln>
<vuln vid="23f59689-0152-42d3-9ade-1658d6380567">
<topic>mozilla -- use-after-free in compositor</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>59.0.2,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.3,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>52.7.3</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>52.7.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>52.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/">
<h1>CVE-2018-5148: Use-after-free in compositor</h1>
<p>A use-after-free vulnerability can occur in the
compositor during certain graphics operations when a raw
pointer is used instead of a reference counted one. This
results in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5148</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-10/</url>
</references>
<dates>
<discovery>2018-03-26</discovery>
<entry>2018-03-27</entry>
<modified>2018-03-31</modified>
</dates>
</vuln>
<vuln vid="81946ace-6961-4488-a164-22d58ebc8d66">
<topic>rails-html-sanitizer -- possible XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-rails-html-sanitizer</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSS-Security list:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2018/03/22/4">
<p>There is a possible XSS vulnerability in rails-html-sanitizer. The gem
allows non-whitelisted attributes to be present in sanitized output
when input with specially-crafted HTML fragments, and these attributes
can lead to an XSS attack on target applications.</p>
<p>This issue is similar to CVE-2018-8048 in Loofah.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2018/03/22/4</url>
<cvename>CVE-2018-3741</cvename>
</references>
<dates>
<discovery>2018-03-22</discovery>
<entry>2018-03-24</entry>
</dates>
</vuln>
<vuln vid="f38187e7-2f6e-11e8-8f07-b499baebfeaf">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.30</lt></range>
</package>
<package>
<name>apache22</name>
<range><lt>2.2.34_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd reports:</p>
<blockquote cite="https://www.apache.org/dist/httpd/CHANGES_2.4.33">
<p>Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig
enabled (CVE-2017-15710)</p>
<p>mod_session: CGI-like applications that intend to read from
mod_session's 'SessionEnv ON' could be fooled into reading
user-supplied data instead. (CVE-2018-1283)</p>
<p>mod_cache_socache: Fix request headers parsing to avoid a possible
crash with specially crafted input data. (CVE-2018-1303)</p>
<p>core: Possible crash with excessively long HTTP request headers.
Impractical to exploit with a production build and production
LogLevel. (CVE-2018-1301)</p>
<p>core: Configure the regular expression engine to match '$' to the
end of the input string only, excluding matching the end of any
embedded newline characters. Behavior can be changed with new
directive 'RegexDefaultOptions'. (CVE-2017-15715)</p>
<p>mod_auth_digest: Fix generation of nonce values to prevent replay
attacks across servers using a common Digest domain. This change
may cause problems if used with round robin load balancers.
(CVE-2018-1312)</p>
<p>mod_http2: Potential crash w/ mod_http2. (CVE-2018-1302)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.apache.org/dist/httpd/CHANGES_2.4.33</url>
<cvename>CVE-2017-15710</cvename>
<cvename>CVE-2018-1283</cvename>
<cvename>CVE-2018-1303</cvename>
<cvename>CVE-2018-1301</cvename>
<cvename>CVE-2017-15715</cvename>
<cvename>CVE-2018-1312</cvename>
<cvename>CVE-2018-1302</cvename>
</references>
<dates>
<discovery>2018-03-23</discovery>
<entry>2018-03-24</entry>
<modified>2018-03-27</modified>
</dates>
</vuln>
<vuln vid="d50a50a2-2f3e-11e8-86f8-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/">
<p>Medium risk: Tasks Local File Inclusion</p>
<p>Medium risk: Forum Password Check Bypass</p>
<p>Low risk: Admin Permissions Group Title XSS</p>
<p>Low risk: Attachment types file extension XSS</p>
<p>Low risk: Moderator Tools XSS</p>
<p>Low risk: Security Questions XSS</p>
<p>Low risk: Settings Management XSS</p>
<p>Low risk: Templates Set Name XSS</p>
<p>Low risk: Usergroup Promotions XSS</p>
<p>Low risk: Warning Types XSS</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-24</entry>
</dates>
</vuln>
<vuln vid="6d52bda1-2e54-11e8-a68f-485b3931c969">
<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.22.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
statement could cause a NULL pointer dereference, related to build.c
and prepare.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8740</cvename>
<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-22</entry>
</dates>
</vuln>
<vuln vid="39a30e0a-0c34-431b-9dce-b87cab02412a">
<topic>Sanitize -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-sanitize</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sanitize release:</p>
<blockquote cite="https://github.com/rgrove/sanitize/releases">
<p>Fixed an HTML injection vulnerability that could allow XSS.</p>
<p>When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2,
a specially crafted HTML fragment can cause libxml2 to generate
improperly escaped output, allowing non-whitelisted attributes to be
used on whitelisted elements.</p>
<p>Sanitize now performs additional escaping on affected attributes to
prevent this.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rgrove/sanitize/releases</url>
<url>https://github.com/rgrove/sanitize/issues/176</url>
<cvename>CVE-2018-3740</cvename>
</references>
<dates>
<discovery>2018-03-19</discovery>
<entry>2018-03-21</entry>
</dates>
</vuln>
<vuln vid="ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/144">
<p>This issue has been created for public disclosure of an XSS / code
injection vulnerability that was responsibly reported by the Shopify
Application Security Team.</p>
<p>Loofah allows non-whitelisted attributes to be present in sanitized
output when input with specially-crafted HTML fragments.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/144</url>
<cvename>CVE-2018-8048</cvename>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-20</entry>
</dates>
</vuln>
<vuln vid="b3edc7d9-9af5-4daf-88f1-61f68f4308c2">
<topic>Jupyter Notebook -- vulnerability</topic>
<affects>
<package>
<name>py27-notebook</name>
<name>py34-notebook</name>
<name>py35-notebook</name>
<name>py36-notebook</name>
<range><lt>5.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768">
<p>In Jupyter Notebook before 5.4.1, a maliciously forged notebook file
can bypass sanitization to execute JavaScript in the notebook context.
Specifically, invalid HTML is 'fixed' by jQuery after sanitization,
making it dangerous.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768</url>
<cvename>CVE-2018-8768</cvename>
</references>
<dates>
<discovery>2018-03-18</discovery>
<entry>2018-03-19</entry>
</dates>
</vuln>
<vuln vid="928d5c59-2a5a-11e8-a712-0025908740c2">
<topic>SquirrelMail -- post-authentication access privileges</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><le>20170705</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Grunow reports:</p>
<blockquote cite="https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/">
<p> An attacker able to exploit this vulnerability can extract files
of the server the application is running on. This may include
configuration files, log files and additionally all files that are
readable for all users on the system. This issue is
post-authentication. That means an attacker would need valid
credentials for the application to log in or needs to exploit an
additional vulnerability of which we are not aware of at this point
of time.</p>
<p>An attacker would also be able to delete files on the system, if
the user running the application has the rights to do so.</p>
<p>Does this issue affect me?</p>
<p>Likely yes, if you are using Squirrelmail. We checked the latest
development version, which is 1.5.2-svn and the latest version
available for download at this point of time, 1.4.22. Both contain
the vulnerable code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2018/03/17/2</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-8741</url>
<cvename>CVE-2018-8741</cvename>
</references>
<dates>
<discovery>2017-05-21</discovery>
<entry>2018-03-17</entry>
</dates>
</vuln>
<vuln vid="b3e04661-2a0a-11e8-9e63-3085a9a47796">
<topic>slurm-wlm -- SQL Injection attacks against SlurmDBD</topic>
<affects>
<package>
<name>slurm-wlm</name>
<range><lt>17.02.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SchedMD reports:</p>
<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000006.html">
<p>Several issues were discovered with incomplete sanitization of
user-provided text strings, which could potentially lead to SQL
injection attacks against SlurmDBD itself. Such exploits could lead to a
loss of accounting data, or escalation of user privileges on the cluster.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-7033</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-7033</url>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-17</entry>
</dates>
</vuln>
<vuln vid="64ee858e-e035-4bb4-9c77-2468963dddb8">
<topic>libvorbis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.3.6,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14632">
<p>Xiph.Org libvorbis 1.3.5 allows Remote Code Execution
upon freeing uninitialized memory in the function
vorbis_analysis_headerout() in info.c when
vi->channels<=0, a similar issue to Mozilla bug
550184.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14633">
<p>In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read
vulnerability exists in the function mapping0_forward() in
mapping0.c, which may lead to DoS when operating on a
crafted audio file with vorbis_analysis().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14632</cvename>
<cvename>CVE-2017-14633</cvename>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-16</entry>
</dates>
</vuln>
<vuln vid="7943794f-707f-4e31-9fea-3bbf1ddcedc1">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.3.6,3</lt></range>
</package>
<package>
<name>libtremor</name>
<range><lt>1.2.1.s20180316</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>59.0.1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.2,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>52.7.3</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/">
<h1>CVE-2018-5146: Out of bounds memory write in libvorbis</h1>
<p>An out of bounds memory write while processing Vorbis
audio data was reported through the Pwn2Own contest.</p>
<h1>CVE-2018-5147: Out of bounds memory write in libtremor</h1>
<p>The libtremor library has the same flaw as
CVE-2018-5146. This library is used by Firefox in place of
libvorbis on Android and ARM platforms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5146</cvename>
<cvename>CVE-2018-5147</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-08/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-09/</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-16</entry>
<modified>2018-03-31</modified>
</dates>
</vuln>
<vuln vid="2aa9967c-27e0-11e8-9ae1-080027ac955c">
<topic>e2fsprogs -- potential buffer overrun bugs in the blkid library and in the fsck program</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.44.0</lt></range>
</package>
<package>
<name>e2fsprogs-libblkid</name>
<range><lt>1.44.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Y. Ts'o reports:</p>
<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0">
<p>Fixed some potential buffer overrun bugs in the blkid library and in the fsck program.</p>
</blockquote>
</body>
</description>
<references>
<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0</url>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="74daa370-2797-11e8-95ec-a4badb2f4699">
<topic>FreeBSD -- Speculative Execution Vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A number of issues relating to speculative execution
were found last year and publicly announced January 3rd.
Two of these, known as Meltdown and Spectre V2, are addressed
here.</p>
<p>CVE-2017-5754 (Meltdown) - ------------------------</p>
<p>This issue relies on an affected CPU speculatively
executing instructions beyond a faulting instruction. When
this happens, changes to architectural state are not
committed, but observable changes may be left in micro-
architectural state (for example, cache). This may be used
to infer privileged data.</p>
<p>CVE-2017-5715 (Spectre V2) - --------------------------</p>
<p>Spectre V2 uses branch target injection to speculatively
execute kernel code at an address under the control of an
attacker.</p>
<h1>Impact:</h1>
<p>An attacker may be able to read secret data from the
kernel or from a process when executing untrusted code (for
example, in a web browser).</p>
</body>
</description>
<references>
<cvename>CVE-2017-5715</cvename>
<cvename>CVE-2017-5754</cvename>
<freebsdsa>SA-18:03.speculative_execution</freebsdsa>
</references>
<dates>
<discovery>2018-03-14</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="dca7ced0-2796-11e8-95ec-a4badb2f4699">
<topic>FreeBSD -- ipsec validation and use-after-free</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_7</lt></range>
<range><ge>10.4</ge><lt>10.4_7</lt></range>
<range><ge>10.3</ge><lt>10.3_28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a lack of strict checking, an attacker from a
trusted host can send a specially constructed IP packet
that may lead to a system crash.</p>
<p>Additionally, a use-after-free vulnerability in the AH
handling code could cause unpredictable results.</p>
<h1>Impact:</h1>
<p>Access to out of bounds or freed mbuf data can lead to
a kernel panic or other unpredictable results.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6916</cvename>
<freebsdsa>SA-18:01.ipsec</freebsdsa>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="313078e3-26e2-11e8-9920-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-05.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to remote code execution (CVE-2018-4919).</li>
<li>This update resolves a type confusion vulnerability that
could lead to remote code execution (CVE-2018-4920).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4919</cvename>
<cvename>CVE-2018-4920</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-05.html</url>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-03-13</entry>
</dates>
</vuln>
<vuln vid="c71cdc95-3c18-45b7-866a-af28b59aabb5">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>59.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/">
<p>CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList</p>
<p>CVE-2018-5128: Use-after-free manipulating editor selection ranges</p>
<p>CVE-2018-5129: Out-of-bounds write with malformed IPC messages</p>
<p>CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption</p>
<p>CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources</p>
<p>CVE-2018-5132: WebExtension Find API can search privileged pages</p>
<p>CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized</p>
<p>CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions</p>
<p>CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts</p>
<p>CVE-2018-5136: Same-origin policy violation with data: URL shared workers</p>
<p>CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources</p>
<p>CVE-2018-5138: Android Custom Tab address spoofing through long domain names</p>
<p>CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol</p>
<p>CVE-2018-5141: DOS attack through notifications Push API</p>
<p>CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs</p>
<p>CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar</p>
<p>CVE-2018-5126: Memory safety bugs fixed in Firefox 59</p>
<p>CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5125</cvename>
<cvename>CVE-2018-5126</cvename>
<cvename>CVE-2018-5127</cvename>
<cvename>CVE-2018-5128</cvename>
<cvename>CVE-2018-5129</cvename>
<cvename>CVE-2018-5130</cvename>
<cvename>CVE-2018-5131</cvename>
<cvename>CVE-2018-5132</cvename>
<cvename>CVE-2018-5133</cvename>
<cvename>CVE-2018-5134</cvename>
<cvename>CVE-2018-5135</cvename>
<cvename>CVE-2018-5136</cvename>
<cvename>CVE-2018-5137</cvename>
<cvename>CVE-2018-5138</cvename>
<cvename>CVE-2018-5140</cvename>
<cvename>CVE-2018-5141</cvename>
<cvename>CVE-2018-5142</cvename>
<cvename>CVE-2018-5143</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-06/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-07/</url>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-03-13</entry>
<modified>2018-03-16</modified>
</dates>
</vuln>
<vuln vid="fb26f78a-26a9-11e8-a1c2-00505689d4ae">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba44</name>
<range><lt>4.4.17</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.16</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.14</lt></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1050.html">
<p>Missing null pointer checks may crash the external
print server process.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1057.html">
<p>On a Samba 4 AD DC any authenticated user can change
other user's passwords over LDAP, including the
passwords of administrative users and service accounts.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-1050.html</url>
<cvename>CVE-2018-1050</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-1057.html</url>
<cvename>CVE-2018-1057</cvename>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-03-13</entry>
</dates>
</vuln>
<vuln vid="c2f107e1-2493-11e8-b3e8-001cc0382b2f">
<topic>mbed TLS (PolarSSL) -- remote code execution</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.7.0</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><lt>1.3.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01">
<ul>
<li>When the truncated HMAC extension is enabled and CBC is used,
sending a malicious application packet can be used to selectively
corrupt 6 bytes on the peer's heap, potentially leading to a
crash or remote code execution. This can be triggered remotely
from either side in both TLS and DTLS.</li>
<li>When RSASSA-PSS signature verification is enabled, sending a
maliciously constructed certificate chain can be used to cause a
buffer overflow on the peer's stack, potentially leading to crash
or remote code execution. This can be triggered remotely from
either side in both TLS and DTLS.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01</url>
<cvename>CVE-2018-0487</cvename>
<cvename>CVE-2018-0488</cvename>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-03-10</entry>
</dates>
</vuln>
<vuln vid="555af074-22b9-11e8-9799-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>65.0.3325.146</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html">
<p>45 security fixes in this release:</p>
<ul>
<li>[758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
<li>[758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
<li>[780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02</li>
<li>[794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12</li>
<li>[780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31</li>
<li>[789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30</li>
<li>[792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07</li>
<li>[798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03</li>
<li>[808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01</li>
<li>[799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05</li>
<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
<li>[799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08</li>
<li>[668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25</li>
<li>[777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23</li>
<li>[791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01</li>
<li>[804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20</li>
<li>[809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06</li>
<li>[608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03</li>
<li>[758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24</li>
<li>[778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26</li>
<li>[793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10</li>
<li>[788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24</li>
<li>[792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05</li>
<li>[797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24</li>
<li>[767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21</li>
<li>[771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11215</cvename>
<cvename>CVE-2017-11225</cvename>
<cvename>CVE-2018-6060</cvename>
<cvename>CVE-2018-6061</cvename>
<cvename>CVE-2018-6060</cvename>
<cvename>CVE-2018-6061</cvename>
<cvename>CVE-2018-6062</cvename>
<cvename>CVE-2018-6057</cvename>
<cvename>CVE-2018-6063</cvename>
<cvename>CVE-2018-6064</cvename>
<cvename>CVE-2018-6065</cvename>
<cvename>CVE-2018-6066</cvename>
<cvename>CVE-2018-6067</cvename>
<cvename>CVE-2018-6069</cvename>
<cvename>CVE-2018-6070</cvename>
<cvename>CVE-2018-6071</cvename>
<cvename>CVE-2018-6072</cvename>
<cvename>CVE-2018-6073</cvename>
<cvename>CVE-2018-6074</cvename>
<cvename>CVE-2018-6075</cvename>
<cvename>CVE-2018-6076</cvename>
<cvename>CVE-2018-6077</cvename>
<cvename>CVE-2018-6078</cvename>
<cvename>CVE-2018-6079</cvename>
<cvename>CVE-2018-6080</cvename>
<cvename>CVE-2018-6081</cvename>
<cvename>CVE-2018-6082</cvename>
<cvename>CVE-2018-6083</cvename>
<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2018-03-08</entry>
</dates>
</vuln>
<vuln vid="c5ab620f-4576-4ad5-b51f-93e4fec9cd0e">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="https://www.wireshark.org/security/">
<p>wnpa-sec-2018-05. IEEE 802.11 dissector crash. (CVE-2018-7335)</p>
<p>wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. (CVE-2018-7321 through CVE-2018-7333)</p>
<p>wnpa-sec-2018-07. UMTS MAC dissector crash. (CVE-2018-7334)</p>
<p>wnpa-sec-2018-08. DOCSIS dissector crash. (CVE-2018-7337)</p>
<p>wnpa-sec-2018-09. FCP dissector crash. (CVE-2018-7336)</p>
<p>wnpa-sec-2018-10. SIGCOMP dissector crash. (CVE-2018-7320)</p>
<p>wnpa-sec-2018-11. Pcapng file parser crash.</p>
<p>wnpa-sec-2018-12. IPMI dissector crash.</p>
<p>wnpa-sec-2018-13. SIGCOMP dissector crash.</p>
<p>wnpa-sec-2018-14. NBAP dissector crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/security/</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-05.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-06.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-07.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-08.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-09.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-10.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-11.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-12.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-13.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-14.html</url>
<cvename>CVE-2018-7320</cvename>
<cvename>CVE-2018-7321</cvename>
<cvename>CVE-2018-7322</cvename>
<cvename>CVE-2018-7323</cvename>
<cvename>CVE-2018-7324</cvename>
<cvename>CVE-2018-7325</cvename>
<cvename>CVE-2018-7326</cvename>
<cvename>CVE-2018-7327</cvename>
<cvename>CVE-2018-7328</cvename>
<cvename>CVE-2018-7329</cvename>
<cvename>CVE-2018-7330</cvename>
<cvename>CVE-2018-7331</cvename>
<cvename>CVE-2018-7332</cvename>
<cvename>CVE-2018-7333</cvename>
<cvename>CVE-2018-7334</cvename>
<cvename>CVE-2018-7335</cvename>
<cvename>CVE-2018-7336</cvename>
<cvename>CVE-2018-7337</cvename>
<cvename>CVE-2018-7417</cvename>
</references>
<dates>
<discovery>2018-02-23</discovery>
<entry>2018-03-04</entry>
</dates>
</vuln>
<vuln vid="2040c7f5-1e3a-11e8-8ae9-0050569f0b83">
<topic>isc-dhcp -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>isc-dhcp44-server</name>
<range><lt>4.4.1</lt></range>
</package>
<package>
<name>isc-dhcp44-client</name>
<range><lt>4.4.1</lt></range>
</package>
<package>
<name>isc-dhcp43-server</name>
<range><le>4.3.6</le></range>
</package>
<package>
<name>isc-dhcp43-client</name>
<range><le>4.3.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01565">
<p>Failure to properly bounds check a buffer used for processing
DHCP options allows a malicious server (or an entity
masquerading as a server) to cause a buffer overflow (and
resulting crash) in dhclient by sending a response containing a
specially constructed options section.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01567">
<p>A malicious client which is allowed to send very large amounts
of traffic (billions of packets) to a DHCP server can eventually
overflow a 32-bit reference counter, potentially causing dhcpd
to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5732</cvename>
<cvename>CVE-2018-5733</cvename>
<url>https://kb.isc.org/article/AA-01565</url>
<url>https://kb.isc.org/article/AA-01567</url>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-03-02</entry>
</dates>
</vuln>
<vuln vid="30704aba-1da4-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- out-of-bounds reads</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Xin-Jiang on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/317">
<p>CVE-2017-14245 (Medium): An out of bounds read in the function
d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote
DoS attack or information disclosure, related to mishandling of
the NAN and INFINITY floating-point values.</p>
<p>CVE-2017-14246 (Medium): An out of bounds read in the function
d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote
DoS attack or information disclosure, related to mishandling of the
NAN and INFINITY floating-point values.</p>
</blockquote>
<p>my123px on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/344">
<p>CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of
libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
address 0x000000000000), a different vulnerability than CVE-2017-14245.</p>
<p>CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of
libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
address 0x000000000000), a different vulnerability than CVE-2017-14246.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14245</cvename>
<cvename>CVE-2017-14246</cvename>
<url>https://github.com/erikd/libsndfile/issues/317</url>
<cvename>CVE-2017-17456</cvename>
<cvename>CVE-2017-17457</cvename>
<url>https://github.com/erikd/libsndfile/issues/344</url>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="2b386075-1d9c-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><le>1.0.28</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Agostino Sarubbo, Gentoo reports:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(buffer overflow and application crash) or possibly have unspecified
other impact via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(invalid read and application crash) via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(heap-based buffer over-read and application crash) via a crafted audio
file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/">
<p>CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile
1.0.28 allows remote attackers to cause a denial of service (buffer
over-read and application crash) via a crafted audio file.</p>
</blockquote>
<p>manxorist on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/292">
<p>CVE-2017-12562 (High): Heap-based Buffer Overflow in the
psf_binheader_writef function in common.c in libsndfile through
1.0.28 allows remote attackers to cause a denial of service
(application crash) or possibly have unspecified other impact.</p>
</blockquote>
<p>Xin-Jiang on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/318">
<p>CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero
error exists in the function double64_init() in double64.c, which
may lead to DoS when playing a crafted audio file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8361</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/232</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<cvename>CVE-2017-8362</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/231</url>
<url>https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808</url>
<cvename>CVE-2017-8363</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/233</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<url>https://github.com/erikd/libsndfile/commit/cd7da8dbf6ee4310d21d9e44b385d6797160d9e8</url>
<cvename>CVE-2017-8365</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/</url>
<url>https://github.com/erikd/libsndfile/issues/230</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<cvename>CVE-2017-12562</cvename>
<url>https://github.com/erikd/libsndfile/issues/292/</url>
<url>https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8</url>
<cvename>CVE-2017-14634</cvename>
<url>https://github.com/erikd/libsndfile/issues/318</url>
<url>https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="e3eeda2e-1d67-11e8-a2ec-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.22</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.17</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.12</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.8</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1834/">
<ul>
<li>CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Search_Path</url>
<cvename>CVE-2018-1058</cvename>
</references>
<dates>
<discovery>2018-03-01</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="6a449a37-1570-11e8-8e00-000c294a5758">
<topic>strongswan - Insufficient input validation in RSASSA-PSS signature parser</topic>
<affects>
<package>
<name>strongswan</name>
<range><eq>5.6.1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
<p>Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that
was caused by insufficient input validation. One of the configurable
parameters in algorithm identifier structures for RSASSA-PSS signatures is the
mask generation function (MGF). Only MGF1 is currently specified for this
purpose. However, this in turn takes itself a parameter that specifies the
underlying hash function. strongSwan's parser did not correctly handle the
case of this parameter being absent, causing an undefined data read.
his vulnerability has been registered as CVE-2018-6459.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6459</cvename>
<url>https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f68675eb44806668</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-19</entry>
</dates>
</vuln>
<vuln vid="004debf9-1d16-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- out-of-bounds read memory access</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><le>1.0.28</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Laurent Delosieres, Secunia Research at Flexera Software reports:</p>
<blockquote cite="https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/">
<p>Secunia Research has discovered a vulnerability in libsndfile, which can be
exploited by malicious people to disclose potentially sensitive information.
The vulnerability is caused due to an error in the "aiff_read_chanmap()" function
(src/aiff.c), which can be exploited to cause an out-of-bounds read memory access
via a specially crafted AIFF file. The vulnerability is confirmed in version 1.0.28.
Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6892</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6892</url>
<url>https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/</url>
<url>https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748</url>
</references>
<dates>
<discovery>2017-05-23</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="af485ef4-1c58-11e8-8477-d05099c0ae8c">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_7</lt></range>
<range><ge>10.4</ge><lt>10.4_6</lt></range>
<range><ge>10.3</ge><lt>10.3_27</lt></range>
</package>
<package>
<name>ntp</name>
<range><lt>4.2.8p11</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S">
<p>The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.</p>
<p>This release addresses five security issues in ntpd:</p>
<ul>
<li>LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil
vulnerability: ephemeral association attack</li>
<li>INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909:
ctl_getitem(): buffer read overrun leads to undefined
behavior and information leak</li>
<li>LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple
authenticated ephemeral associations</li>
<li>LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved
symmetric mode cannot recover from bad state</li>
<li>LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909:
Unauthenticated packet can reset authenticated interleaved
association</li>
</ul>
<p>one security issue in ntpq:</p>
<ul>
<li>MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909:
ntpq:decodearr() can write beyond its buffer limit</li>
</ul>
<p>and provides over 33 bugfixes and 32 other improvements.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1549</cvename>
<cvename>CVE-2018-7182</cvename>
<cvename>CVE-2018-7170</cvename>
<cvename>CVE-2018-7184</cvename>
<cvename>CVE-2018-7185</cvename>
<cvename>CVE-2018-7183</cvename>
<freebsdsa>SA-18:02.ntp</freebsdsa>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S</url>
</references>
<dates>
<discovery>2018-02-27</discovery>
<entry>2018-02-28</entry>
<modified>2018-03-14</modified>
</dates>
</vuln>
<vuln vid="abfc932e-1ba8-11e8-a944-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>64.0.3282.167</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html">
<p>1 security fix in this release:</p>
<ul>
<li>[806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6056</cvename>
<url>https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2018-01-26</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>64.0.3282.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html">
<p>Several security fixes in this release, including:</p>
<ul>
<li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li>
<li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li>
<li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li>
<li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li>
<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on
2017-08-09</li>
<li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li>
<li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li>
<li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li>
<li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li>
<li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li>
<li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li>
<li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li>
<li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li>
<li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li>
<li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li>
<li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li>
<li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li>
<li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li>
<li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li>
<li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li>
<li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6031</cvename>
<cvename>CVE-2018-6032</cvename>
<cvename>CVE-2018-6033</cvename>
<cvename>CVE-2018-6034</cvename>
<cvename>CVE-2018-6035</cvename>
<cvename>CVE-2018-6036</cvename>
<cvename>CVE-2018-6037</cvename>
<cvename>CVE-2018-6038</cvename>
<cvename>CVE-2018-6039</cvename>
<cvename>CVE-2018-6040</cvename>
<cvename>CVE-2018-6041</cvename>
<cvename>CVE-2018-6042</cvename>
<cvename>CVE-2018-6043</cvename>
<cvename>CVE-2018-6045</cvename>
<cvename>CVE-2018-6046</cvename>
<cvename>CVE-2018-6047</cvename>
<cvename>CVE-2018-6048</cvename>
<cvename>CVE-2017-15420</cvename>
<cvename>CVE-2018-6049</cvename>
<cvename>CVE-2018-6050</cvename>
<cvename>CVE-2018-6051</cvename>
<cvename>CVE-2018-6052</cvename>
<cvename>CVE-2018-6053</cvename>
<cvename>CVE-2018-6054</cvename>
<url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2017-08-09</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="55c4233e-1844-11e8-a712-0025908740c2">
<topic>tomcat -- Security constraints ignored or applied too late</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>7.0.0</ge><le>7.0.84</le></range>
<range><ge>8.0.0</ge><le>8.0.49</le></range>
<range><ge>8.5.0</ge><le>8.5.27</le></range>
<range><ge>9.0.0</ge><le>9.0.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781@%3Cannounce.tomcat.apache.org%3E">
<p>Security constraints defined by annotations of Servlets were only
applied once a Servlet had been loaded. Because security constraints
defined in this way apply to the URL pattern and any URLs below that
point, it was possible - depending on the order Servlets were loaded -
for some security constraints not to be applied. This could have exposed
resources to users who were not authorised to access them.</p>
</blockquote>
<blockquote cite="https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb@%3Cannounce.tomcat.apache.org%3E">
<p>The URL pattern of "" (the empty string) which exactly maps to the
context root was not correctly handled when used as part of a security
constraint definition. This caused the constraint to be ignored. It was,
therefore, possible for unauthorised users to gain access to web
application resources that should have been protected. Only security
constraints with a URL pattern of the empty string were affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://tomcat.apache.org/security-9.html</url>
<url>http://tomcat.apache.org/security-8.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
<cvename>CVE-2018-1304</cvename>
<cvename>CVE-2018-1305</cvename>
</references>
<dates>
<discovery>2018-02-23</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="22438240-1bd0-11e8-a2ec-6cc21735f730">
<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.6.4</lt></range>
</package>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180227.txt">
<p>
Shibboleth SP software vulnerable to additional data forgery flaws
</p>
<p>
The XML processing performed by the Service Provider software has
been found to be vulnerable to new flaws similar in nature to the
one addressed in an advisory last month.
</p>
<p>
These bugs involve the use of other XML constructs rather than
entity references, and therefore required additional mitigation once
discovered. As with the previous issue, this flaw allows for
changes to an XML document that do not break a digital signature but
can alter the user data passed through to applications behind the SP
and result in impersonation attacks and exposure of protected
information.
</p>
<p>
As before, the use of XML Encryption is a significant mitigation,
but we have not dismissed the possibility that attacks on the
Response "envelope" may be possible, in both the original and this
new case. No actual attacks of this nature are known, so deployers
should prioritize patching systems that expect to handle unencrypted
SAML assertions.
</p>
<p>
An updated version of XMLTooling-C (V1.6.4) is available that
protects against these new attacks, and should help prevent similar
vulnerabilities in the future.
</p>
<p>
Unlike the previous case, these bugs are NOT prevented by any
existing Xerces-C parser version on any platform and cannot be
addressed by any means other than the updated XMLTooling-C library.
</p>
<p>
The Service Provider software relies on a generic XML parser to
process SAML responses and there are limitations in older versions
of the parser that make it impossible to fully disable Document Type
Definition (DTD) processing.
</p>
<p>
Through addition/manipulation of a DTD, it's possible to make
changes to an XML document that do not break a digital signature but
are mishandled by the SP and its libraries. These manipulations can
alter the user data passed through to applications behind the SP and
result in impersonation attacks and exposure of protected
information.
</p>
<p>
While newer versions of the xerces-c3 parser are configured by the
SP into disallowing the use of a DTD via an environment variable,
this feature is not present in the xerces-c3 parser before version
3.1.4, so an additional fix is being provided now that an actual DTD
exploit has been identified. Xerces-c3-3.1.4 was committed to the
ports tree already on 2016-07-26.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180227.txt</url>
<cvename>CVE-2018-0489</cvename>
</references>
<dates>
<discovery>2018-02-27</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="57580fcc-1a61-11e8-97e0-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.56</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-001">
<p>CVE-2017-6926: Comment reply form allows access to restricted content</p>
<p>CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete</p>
<p>CVE-2017-6928: Private file access bypass - Moderately Critical</p>
<p>CVE-2017-6929: jQuery vulnerability with untrusted domains - Moderately Critical</p>
<p>CVE-2017-6930: Language fallback can be incorrect on multilingual sites with node access restrictions</p>
<p>CVE-2017-6931: Settings Tray access bypass</p>
<p>CVE-2017-6932: External link injection on 404 pages when linking to the current page</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6926</cvename>
<cvename>CVE-2017-6927</cvename>
<cvename>CVE-2017-6928</cvename>
<cvename>CVE-2017-6929</cvename>
<cvename>CVE-2017-6930</cvename>
<cvename>CVE-2017-6931</cvename>
<cvename>CVE-2017-6932</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-25</entry>
</dates>
</vuln>
<vuln vid="d9fe59ea-1940-11e8-9eb8-5404a68ad561">
<topic>cvs -- Remote code execution via ssh command injection</topic>
<affects>
<package>
<name>cvs</name>
<range><lt>1.20120905_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hank Leininger reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html">
<p>Bugs in Git, Subversion, and Mercurial were just announced and patched
which allowed arbitrary local command execution if a malicious name was
used for the remote server, such as starting with - to pass options to
the ssh client:
git clone ssh://-oProxyCommand=some-command...
CVS has a similar problem with the -d option:</p>
<p>Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10</url>
<cvename>CVE-2017-12836</cvename>
<freebsdpr>ports/226088</freebsdpr>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2018-02-24</entry>
</dates>
</vuln>
<vuln vid="289269f1-0def-11e8-99b0-d017c2987f9a">
<topic>LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>5.4.5</lt></range>
<range><ge>6.0.0</ge><lt>6.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LibreOffice reports:</p>
<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/">
<p>LibreOffice Calc supports a WEBSERVICE function to obtain data by URL.
Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file
URL (e.g file://) which can be used to inject local files into the
spreadsheet without warning the user. Subsequent formulas can operate on
that inserted data and construct a remote URL whose path leaks the local
data to a remote attacker.</p>
<p>In later versions of LibreOffice without this flaw, WEBSERVICE has now
been limited to accessing http and https URLs along with bringing
WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.</p>
<p><strong>Note:</strong> This vulnerability has been identified upstream
as CVE-2018-1055, but NVD/Mitre are advising it's a reservation
duplicate of CVE-2018-6871 which should be used instead.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/</url>
<url>https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure</url>
<cvename>CVE-2018-6871</cvename>
<freebsdpr>ports/225797</freebsdpr>
</references>
<dates>
<discovery>2018-02-09</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="d5b6d151-1887-11e8-94f7-9c5c8e75236a">
<topic>squid -- Vulnerable to Denial of Service attack</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.27_3</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><lt>4.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Louis Dion-Marcil reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_1.txt">
<p>Due to incorrect pointer handling Squid is vulnerable to denial
of service attack when processing ESI responses.</p>
<p>This problem allows a remote server delivering certain ESI
response syntax to trigger a denial of service for all clients
accessing the Squid service.</p>
<p>Due to unrelated changes Squid-3.5 has become vulnerable to some
regular ESI server responses also triggering this issue.</p>
<p>This problem is limited to the Squid custom ESI parser.
Squid built to use libxml2 or libexpat XML parsers do not have
this problem.</p>
</blockquote>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_2.txt">
<p>Due to incorrect pointer handling Squid is vulnerable to denial
of service attack when processing ESI responses or downloading
intermediate CA certificates.</p>
<p>This problem allows a remote client delivering certain HTTP
requests in conjunction with certain trusted server responses to
trigger a denial of service for all clients accessing the Squid
service.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2018_1.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2018_2.txt</url>
<cvename>CVE-2018-1000024</cvename>
<cvename>CVE-2018-1000027</cvename>
<url>https://www.debian.org/security/2018/dsa-4122</url>
<freebsdpr>ports/226138</freebsdpr>
</references>
<dates>
<discovery>2017-12-13</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="933654ce-17b8-11e8-90b8-001999f8d30b">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2018-004 - When processing a SUBSCRIBE request the
res_pjsip_pubsub module stores the accepted formats present
in the Accept headers of the request. This code did not
limit the number of headers it processed despite having
a fixed limit of 32. If more than 32 Accept headers were
present the code would write outside of its memory and
cause a crash.</p>
<p>AST-2018-005 - A crash occurs when a number of
authenticated INVITE messages are sent over TCP or TLS
and then the connection is suddenly closed. This issue
leads to a segmentation fault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-004.html</url>
<cvename>CVE-2018-7284</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2018-005.html</url>
<cvename>CVE-2018-7286</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
<modified>2018-06-12</modified>
</dates>
</vuln>
<vuln vid="f9f5c5a2-17b5-11e8-90b8-001999f8d30b">
<topic>asterisk and pjsip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.19.2</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.7.2</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>AST-2018-002 - By crafting an SDP message with an
invalid media format description Asterisk crashes when
using the pjsip channel driver because pjproject's sdp
parsing algorithm fails to catch the invalid media format
description.</p>
<p>AST-2018-003 - By crafting an SDP message body with
an invalid fmtp attribute Asterisk crashes when using the
pjsip channel driver because pjproject's fmtp retrieval
function fails to check if fmtp value is empty (set empty
if previously parsed as invalid).</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-002.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2018-003.html</url>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
</dates>
</vuln>
<vuln vid="261ca31c-179f-11e8-b8b9-6805ca0b3d42">
<topic>phpMyAdmin -- self XSS in central columns feature</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-1/">
<h3>Summary</h3>
<p>Self XSS in central columns feature</p>
<h3>Description</h3>
<p>A self-cross site scripting (XSS) vulnerability has been
reported relating to the central columns feature.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>A valid token must be used in the attack</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-1/</url>
<cvename>CVE-2018-7260</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
</dates>
</vuln>
<vuln vid="86291013-16e6-11e8-ae9f-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>6.1.0</ge><le>10.2.7</le></range>
<range><ge>10.3.0</ge><le>10.3.6</le></range>
<range><ge>10.4.0</ge><le>10.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/">
<h1>SnippetFinder information disclosure</h1>
<p>The GitLab SnippetFinder component contained an information disclosure
which allowed access to snippets restricted to Only team members or
configured as disabled. The issue is now resolved in the latest version.</p>
<h1>LDAP API authorization issue</h1>
<p>An LDAP API endpoint contained an authorization vulnerability which
unintentionally disclosed bulk LDAP groups data. This issue is now fixed in
the latest release.</p>
<h1>Persistent XSS mermaid markdown</h1>
<p>The mermaid markdown feature contained a persistent XSS issue that is now
resolved in the latest release.</p>
<h1>Insecure direct object reference Todo API</h1>
<p>The Todo API was vulnerable to an insecure direct object reference issue
which resulted in an information disclosure of confidential data.</p>
<h1>GitHub import access control issue</h1>
<p>An improper access control weakness issue was discovered in the GitHub
import feature. The issue allowed an attacker to create projects under other
accounts which they shouldn't have access to. The issue is now resolved in
the latest version.</p>
<h1>Protected variables information disclosure</h1>
<p>The CI jobs protected tag feature contained a vulnerability which
resulted in an information disclosure of protected variables. The issue is
now resolved in the latest release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/</url>
</references>
<dates>
<discovery>2018-02-07</discovery>
<entry>2018-02-21</entry>
</dates>
</vuln>
<vuln vid="7afc5e56-156d-11e8-95f2-005056925db4">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.1.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2018_02.txt">
<p>Use after free when server is disconnected during netsplits.
Found by Joseph Bisch.</p>
<p>Use after free when SASL messages are received in unexpected order.
Found by Joseph Bisch.</p>
<p>Null pointer dereference when an “empty” nick has been observed by
Irssi. Found by Joseph Bisch.</p>
<p>When the number of windows exceed the available space, Irssi would
crash due to Null pointer dereference. Found by Joseph Bisch.</p>
<p>Certain nick names could result in out of bounds access when printing
theme strings. Found by Oss-Fuzz.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2018_02.txt</url>
<cvename>CVE-2018-7054</cvename>
<cvename>CVE-2018-7053</cvename>
<cvename>CVE-2018-7052</cvename>
<cvename>CVE-2018-7051</cvename>
<cvename>CVE-2018-7050</cvename>
<freebsdpr>ports/226001</freebsdpr>
</references>
<dates>
<discovery>2018-02-15</discovery>
<entry>2018-02-19</entry>
<modified>2018-02-22</modified>
</dates>
</vuln>
<vuln vid="a183acb5-1414-11e8-9542-002590acae31">
<topic>p5-Mojolicious -- cookie-handling vulnerability</topic>
<affects>
<package>
<name>p5-Mojolicious</name>
<range><lt>7.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream commit:</p>
<blockquote cite="https://github.com/kraih/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149">
<p>Vulnerabilities existed in cookie handling.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/kraih/mojo/issues/1185</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-17</entry>
</dates>
</vuln>
<vuln vid="22283b8c-13c5-11e8-a861-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.13</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.4.12/">
<p>A CSRF vulnerability in report.cgi would allow a third-party site
to extract confidential information from a bug the victim had access to.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5123</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1433400</url>
</references>
<dates>
<discovery>2018-02-16</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="044cff62-ed8b-4e72-b102-18a7d58a669f">
<topic>bro -- integer overflow allows remote DOS</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philippe Antoine of Catena cyber:</p>
<blockquote cite="http://blog.bro.org/2018/02/bro-253-released-security-update.html">
<p>This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro (i.e. a DoS attack). There also is a possibility this can be exploited in other ways. (CVE pending.)</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bro.org/2018/02/bro-253-released-security-update.html</url>
</references>
<dates>
<discovery>2018-02-14</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="ad2eeab6-ca68-4f06-9325-1937b237df60">
<topic>consul -- vulnerability in embedded DNS library</topic>
<affects>
<package>
<name>consul</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Consul developers report:</p>
<blockquote cite="https://github.com/hashicorp/consul/issues/3859">
<p>A flaw was found in the embedded DNS library used in consul which
may allow a denial of service attack. Consul was updated to include
the fixed version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/hashicorp/consul/issues/3859</url>
<url>https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#105-february-7-2018</url>
<url>https://github.com/miekg/dns/pull/631</url>
<url>https://github.com/miekg/dns/issues/627</url>
<cvename>CVE-2017-15133</cvename>
</references>
<dates>
<discovery>2018-01-17</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="746d04dc-507e-4450-911f-4c41e48bb07a">
<topic>bro -- out of bounds write allows remote DOS</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Meier:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000458">
<p>Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bro.org/2017/10/bro-252-242-release-security-update.html</url>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="e15a22ce-f16f-446b-9ca7-6859350c2e75">
<topic>quagga -- several security issues</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quagga reports:</p>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-0543.txt">
<p>The Quagga BGP daemon, bgpd, does not properly bounds
check the data sent with a NOTIFY to a peer, if an attribute
length is invalid. Arbitrary data from the bgpd process
may be sent over the network to a peer and/or it may crash.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1114.txt">
<p>The Quagga BGP daemon, bgpd, can double-free memory
when processing certain forms of UPDATE message, containing
cluster-list and/or unknown attributes.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1550.txt">
<p>The Quagga BGP daemon, bgpd, can overrun internal BGP
code-to-string conversion tables used for debug by 1
pointer value, based on input.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1975.txt">
<p>The Quagga BGP daemon, bgpd, can enter an infinite
loop if sent an invalid OPEN message by a configured peer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.quagga.net/security/Quagga-2018-0543.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1114.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1550.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1975.txt</url>
<cvename>CVE-2018-5378</cvename>
<cvename>CVE-2018-5379</cvename>
<cvename>CVE-2018-5380</cvename>
<cvename>CVE-2018-5381</cvename>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="6f0b0cbf-1274-11e8-8b5b-4ccc6adda413">
<topic>libraw -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="https://www.securityfocus.com/archive/1/541732">
<p>CVE-2018-5800: An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()"
function (internal/dcraw_common.cpp) can be exploited to cause a heap-based
buffer overflow and subsequently cause a crash.</p>
<p>CVE-2017-5801: An error within the "LibRaw::unpack()" function
(src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.</p>
<p>CVE-2017-5802: An error within the "kodak_radc_load_raw()" function
(internal/dcraw_common.cpp) related to the "buf" variable can be exploited
to cause an out-of-bounds read memory access and subsequently cause a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.securityfocus.com/archive/1/541732</url>
<cvename>CVE-2018-5800</cvename>
<cvename>CVE-2018-5801</cvename>
<cvename>CVE-2018-5802</cvename>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="c60804f1-126f-11e8-8b5b-4ccc6adda413">
<topic>libraw -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="https://www.securityfocus.com/archive/1/541583">
<p>CVE-2017-16909: An error related to the "LibRaw::panasonic_load_raw()"
function (dcraw_common.cpp) can be exploited to cause a heap-based buffer
overflow and subsequently cause a crash via a specially crafted TIFF image.</p>
<p>CVE-2017-16910: An error within the "LibRaw::xtrans_interpolate()" function
(internal/dcraw_common.cpp) can be exploited to cause an invalid read
memory access.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.securityfocus.com/archive/1/541583</url>
<cvename>CVE-2017-16909</cvename>
<cvename>CVE-2017-16910</cvename>
</references>
<dates>
<discovery>2017-12-04</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="1a75c84a-11c8-11e8-83e7-485b3931c969">
<topic>bitmessage -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bitmessage</name>
<range><le>0.6.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bitmessage developers report:</p>
<blockquote cite="https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3">
<p>A remote code execution vulnerability has been spotted in use
against some users running PyBitmessage v0.6.2. The cause was
identified and a fix has been added and released as 0.6.3.2. (Will be
updated if/when CVE will be available.)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3</url>
<url>https://bitmessage.org/wiki/Main_Page</url>
</references>
<dates>
<discovery>2018-02-13</discovery>
<entry>2018-02-14</entry>
</dates>
</vuln>
<vuln vid="5d374fbb-bae3-45db-afc0-795684ac7353">
<topic>jenkins -- Path traversal vulnerability allows access to files outside plugin resources</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.106</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.89.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-02-14/">
<p>Jenkins did not properly prevent specifying relative paths that
escape a base directory for URLs accessing plugin resource files. This
allowed users with Overall/Read permission to download files from the
Jenkins master they should not have access to.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-02-14/</url>
<url>https://jenkins.io/blog/2018/02/14/security-updates/</url>
<cvename>CVE-2018-6356</cvename>
</references>
<dates>
<discovery>2018-02-14</discovery>
<entry>2018-02-14</entry>
</dates>
</vuln>
<vuln vid="279f682c-0e9e-11e8-83e7-485b3931c969">
<topic>bchunk -- access violation near NULL on destination operand and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15955">
<p>bchunk 1.2.0 and 1.2.1 is vulnerable to an "Access violation near
NULL on destination operand" and crash when processing a malformed CUE
(.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15955</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15955</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="8ba2819c-0e9d-11e8-83e7-485b3931c969">
<topic>bchunk -- heap-based buffer overflow (with invalid free) and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15954">
<p>bchunk 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer
overflow (with a resultant invalid free) and crash when processing a
malformed CUE (.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15954</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15954</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="1ec1c59b-0e98-11e8-83e7-485b3931c969">
<topic>bchunk -- heap-based buffer overflow and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15953">
<p>bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow
and crash when processing a malformed CUE (.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15953</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15953</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="a8f25565-109e-11e8-8d41-97657151f8c2">
<topic>uwsgi -- a stack-based buffer overflow</topic>
<affects>
<package>
<name>uwsgi</name>
<range><lt>2.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Uwsgi developers report:</p>
<blockquote cite="http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html">
<p>It was discovered that the uwsgi_expand_path function in utils.c in
Unbit uWSGI, an application container server, has a stack-based buffer
overflow via a large directory length that can cause a
denial-of-service (application crash) or stack corruption.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html</url>
<url>https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html</url>
<cvename>CVE-2018-6758</cvename>
</references>
<dates>
<discovery>2018-02-06</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="0fe70bcd-2ce3-46c9-a64b-4a7da097db07">
<topic>python -- possible integer overflow vulnerability</topic>
<affects>
<package>
<name>python34</name>
<range><lt>3.4.8</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python issue:</p>
<blockquote cite="https://bugs.python.org/issue30657">
<p>There is a possible integer overflow in PyString_DecodeEscape
function of the file stringobject.c, which can be abused to gain
a heap overflow, possibly leading to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.python.org/issue30657</url>
<url>https://docs.python.org/3.4/whatsnew/changelog.html</url>
<url>https://docs.python.org/3.5/whatsnew/changelog.html</url>
<cvename>CVE-2017-1000158</cvename>
</references>
<dates>
<discovery>2017-06-03</discovery>
<entry>2018-02-11</entry>
</dates>
</vuln>
<vuln vid="aa743ee4-0f16-11e8-8fd2-10bf48e1088e">
<topic>electrum -- JSONRPC vulnerability</topic>
<affects>
<package>
<name>electrum-py36</name>
<range><ge>2.6</ge><lt>3.0.5</lt></range>
</package>
<package>
<name>electrum2</name>
<range><ge>2.6</ge><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6353">
<p>JSONRPC vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6353</cvename>
<url>https://github.com/spesmilo/electrum-docs/blob/master/cve.rst</url>
<url>https://bitcointalk.org/index.php?topic=2702103.0</url>
</references>
<dates>
<discovery>2018-01-27</discovery>
<entry>2018-02-11</entry>
</dates>
</vuln>
<vuln vid="e4dd787e-0ea9-11e8-95f2-005056925db4">
<topic>libtorrent -- remote DoS</topic>
<affects>
<package>
<name>libtorrent</name>
<range><lt>0.13.6_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X-cela reports:</p>
<blockquote cite="https://github.com/rakshasa/libtorrent/pull/99">
<p>Calls into build_benocde that use %zu could crash on 64 bit
machines due to the size change of size_t. Someone can force
READ_ENC_IA to fail allowing an internal_error to be thrown
and bring down the client.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rakshasa/libtorrent/pull/99</url>
<freebsdpr>ports/224664</freebsdpr>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="316b3c3e-0e98-11e8-8d41-97657151f8c2">
<topic>exim -- a buffer overflow vulnerability, remote code execution</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.90.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers report:</p>
<blockquote cite="https://exim.org/static/doc/security/CVE-2018-6789.txt">
<p>There is a buffer overflow in base64d(), if some pre-conditions are met.
Using a handcrafted message, remote code execution seems to be possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://exim.org/static/doc/security/CVE-2018-6789.txt</url>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="7a2e0063-0e4e-11e8-94c0-5453ed2e2b49">
<topic>p7zip-codec-rar -- insufficient error handling</topic>
<affects>
<package>
<name>p7zip-codec-rar</name>
<range><lt>16.02_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996">
<p>Insufficient exception handling in the method
NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip
can lead to multiple memory corruptions within the PPMd code,
alows remote attackers to cause a denial of service (segmentation
fault) or execute arbitrary code via a crafted RAR archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5996</cvename>
<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5996</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="6d337396-0e4a-11e8-94c0-5453ed2e2b49">
<topic>p7zip -- heap-based buffer overflow</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>16.02_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969">
<p>Heap-based buffer overflow in the
NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before
18.00 and p7zip allows remote attackers to cause a denial of
service (out-of-bounds write) or potentially execute arbitrary
code via a crafted ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-17969</cvename>
<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17969</url>
<url>https://marc.info/?l=bugtraq&=151782582216805&=2</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="3ee6e521-0d32-11e8-99b0-d017c2987f9a">
<topic>mpv -- arbitrary code execution via crafted website</topic>
<affects>
<package>
<name>mpv</name>
<range><lt>0.27.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mpv developers report:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6360">
<p>mpv through 0.28.0 allows remote attackers to execute arbitrary code
via a crafted web site, because it reads HTML documents containing
VIDEO elements, and accepts arbitrary URLs in a src attribute without
a protocol whitelist in player/lua/ytdl_hook.lua. For example, an
av://lavfi:ladspa=file= URL signifies that the product should call
dlopen on a shared object file located at an arbitrary local pathname.
The issue exists because the product does not consider that youtube-dl
can provide a potentially unsafe URL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mpv-player/mpv/issues/5456</url>
<cvename>CVE-2018-6360</cvename>
</references>
<dates>
<discovery>2018-01-28</discovery>
<entry>2018-02-09</entry>
<modified>2018-02-11</modified>
</dates>
</vuln>
<vuln vid="3d0eeef8-0cf9-11e8-99b0-d017c2987f9a">
<topic>Mailman -- Cross-site scripting (XSS) vulnerability in the web UI</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.26</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.26</lt></range>
</package>
<package>
<name>ja-mailman</name>
<range><le>2.1.14.j7_3,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://www.mail-archive.com/mailman-users@python.org/msg70478.html">
<p>An XSS vulnerability in the user options CGI could allow a crafted URL
to execute arbitrary javascript in a user's browser. A related issue
could expose information on a user's options page without requiring
login.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/mailman-users@python.org/msg70478.html</url>
<cvename>CVE-2018-5950</cvename>
</references>
<dates>
<discovery>2018-01-20</discovery>
<entry>2018-02-08</entry>
</dates>
</vuln>
<vuln vid="c602c791-0cf4-11e8-a2ec-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.21</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.16</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.11</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.7</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1829/">
<ul>
<li>CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)</li>
<li>CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1052</cvename>
<cvename>CVE-2018-1053</cvename>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-02-08</entry>
</dates>
</vuln>
<vuln vid="b38e8150-0535-11e8-96ab-0800271d4b9c">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<range><le>4.0.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Advisory reports:</p>
<blockquote cite="https://www.debian.org/security/2018/dsa-4100">
<p>Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9935</cvename>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2704</url>
<cvename>CVE-2017-18013</cvename>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2770</url>
<bid>225544</bid>
</references>
<dates>
<discovery>2017-06-22</discovery>
<entry>2018-01-29</entry>
</dates>
</vuln>
<vuln vid="756a8631-0b84-11e8-a986-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>28.0.0.161</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-03.html">
<ul>
<li>This update resolves use-after-free vulnerabilities that
could lead to remote code execution (CVE-2018-4877,
CVE-2018-4878).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4877</cvename>
<cvename>CVE-2018-4878</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsa18-01.html</url>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-03.html</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-06</entry>
</dates>
</vuln>
<vuln vid="f5524753-67b1-4c88-8114-29c2d258b383">
<topic>mini_httpd,thttpd -- Buffer overflow in htpasswd</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.28</lt></range>
</package>
<package>
<name>thttpd</name>
<range><lt>2.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alessio Santoru reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17663">
<p>Buffer overflow in htpasswd.</p>
</blockquote>
</body>
</description>
<references>
<url>http://acme.com/updates/archive/199.html</url>
</references>
<dates>
<discovery>2017-12-13</discovery>
<entry>2018-02-06</entry>
</dates>
</vuln>
<vuln vid="3746de31-0a1a-11e8-83e7-485b3931c969">
<topic>shadowsocks-libev -- command injection via shell metacharacters</topic>
<affects>
<package>
<name>shadowsocks-libev</name>
<range><ge>3.1.0</ge><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15924">
<p>Improper parsing allows command injection via shell metacharacters in
a JSON configuration request received via 127.0.0.1 UDP traffic.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15924</url>
</references>
<dates>
<discovery>2017-10-27</discovery>
<entry>2018-02-05</entry>
</dates>
</vuln>
<vuln vid="5044bd23-08cb-11e8-b08f-00012e582166">
<topic>palemoon -- multiple vulnerabilities</topic>
<affects>
<package>
<name>palemoon</name>
<range><lt>27.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pale Moon reports:</p>
<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5102</cvename>
<cvename>CVE-2018-5122</cvename>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-03</entry>
</dates>
</vuln>
<vuln vid="d696473f-9f32-42c5-a106-bf4536fb1f74">
<topic>Django -- information leakage</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py34-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<range><lt>1.11.10</lt></range>
</package>
<package>
<name>py27-django20</name>
<name>py34-django20</name>
<name>py35-django20</name>
<name>py36-django20</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.10/">
<p>CVE-2018-6188: Information leakage in AuthenticationForm</p>
<p>A regression in Django 1.11.8 made AuthenticationForm run its
confirm_login_allowed() method even if an incorrect password is entered.
This can leak information about a user, depending on what messages
confirm_login_allowed() raises. If confirm_login_allowed() isn't
overridden, an attacker enter an arbitrary username and see if that user
has been set to is_active=False. If confirm_login_allowed() is
overridden, more sensitive details could be leaked.</p>
<p>This issue is fixed with the caveat that AuthenticationForm can no
longer raise the "This account is inactive." error if the authentication
backend rejects inactive users (the default authentication backend,
ModelBackend, has done that since Django 1.10). This issue will be
revisited for Django 2.1 as a fix to address the caveat will likely be too
invasive for inclusion in older versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/1.11/releases/1.11.10/</url>
<url>https://docs.djangoproject.com/en/2.0/releases/2.0.2/</url>
<cvename>CVE-2018-6188</cvename>
</references>
<dates>
<discovery>2018-02-01</discovery>
<entry>2018-02-02</entry>
</dates>
</vuln>
<vuln vid="e72d5bf5-07a0-11e8-8248-0021ccb9e74d">
<topic>w3m - multiple vulnerabilities</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.3.20180125</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tatsuya Kinoshita reports:</p>
<blockquote cite="https://github.com/tats/w3m/commit/01d41d49b273a8cc75b27c6ab42291b46004fc0c">
<p>CVE-2018-6196 * table.c: Prevent negative indent value in feed_table_block_tag().</p>
<p>CVE-2018-6197 * form.c: Prevent invalid columnPos() call in formUpdateBuffer().</p>
<p>CVE-2018-6198 * config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when ~/.w3m is unwritable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/tats/w3m/commit/e773a0e089276f82c546447c0fd1e6c0f9156628</url>
<cvename>CVE-2018-6196</cvename>
<cvename>CVE-2018-6197</cvename>
<cvename>CVE-2018-6198</cvename>
</references>
<dates>
<discovery>2018-01-25</discovery>
<entry>2018-02-01</entry>
<modified>2018-02-03</modified>
</dates>
</vuln>
<vuln vid="103bf96a-6211-45ab-b567-1555ebb3a86a">
<topic>firefox -- Arbitrary code execution through unsanitized browser UI</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>58.0.1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.3.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/">
<p>Mozilla developer <strong>Johann Hofmann</strong> reported that
unsanitized output in the browser UI can lead to arbitrary
code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1432966</url>
</references>
<dates>
<discovery>2018-01-29</discovery>
<entry>2018-01-29</entry>
<modified>2018-01-31</modified>
</dates>
</vuln>
<vuln vid="2cceb80e-c482-4cfd-81b3-2088d2c0ad53">
<topic>gcab -- stack overflow</topic>
<affects>
<package>
<name>gcab</name>
<range><lt>0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5345">
<p>A stack-based buffer overflow within GNOME gcab through
0.7.4 can be exploited by malicious attackers to cause a
crash or, potentially, execute arbitrary code via a
crafted .cab file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5345</url>
<url>https://mail.gnome.org/archives/ftp-release-list/2018-January/msg00066.html</url>
<cvename>CVE-2018-5345</cvename>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-01-27</entry>
</dates>
</vuln>
<vuln vid="92b8b284-a3a2-41b1-956c-f9cf8b74f500">
<topic>dovecot -- abort of SASL authentication results in a memory leak</topic>
<affects>
<package>
<name>dovecot</name>
<range><gt>2.0</gt><le>2.2.33.2_3</le></range>
<range><ge>2.3</ge><le>2.3.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Pedro Sampaio reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1532768">
<p>A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of
SASL authentication results in a memory leak in Dovecot auth client
used by login processes. The leak has impact in high performance
configuration where same login processes are reused and can cause the
process to crash due to memory exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15132</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1532768</url>
<url>https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch</url>
</references>
<dates>
<discovery>2018-01-09</discovery>
<entry>2018-01-26</entry>
<modified>2018-02-01</modified>
</dates>
</vuln>
<vuln vid="0cbf0fa6-dcb7-469c-b87a-f94cffd94583">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.58.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000007">
<p>libcurl 7.1 through 7.57.0 might accidentally leak authentication
data to third parties. When asked to send custom headers in its HTTP
requests, libcurl will send that set of headers first to the host in
the initial URL but also, if asked to follow redirects and a 30X HTTP
response code is returned, to the host mentioned in URL in the
`Location:` response header value. Sending the same set of headers to
subsequest hosts is in particular a problem for applications that pass
on custom `Authorization:` headers, as this header often contains
privacy sensitive information or data that could allow others to
impersonate the libcurl-using client's request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_2018-b3bf.html</url>
<cvename>CVE-2018-1000007</cvename>
</references>
<dates>
<discovery>2018-01-24</discovery>
<entry>2018-01-26</entry>
</dates>
</vuln>
<vuln vid="b464f61b-84c7-4e1c-8ad4-6cf9efffd025">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.99.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ClamAV project reports:</p>
<blockquote cite="http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html">
<p>Join us as we welcome ClamAV 0.99.3 to the family!.</p>
<p>This release is a security release and is recommended for
all ClamAV users.</p>
<p>CVE-2017-12374 ClamAV UAF (use-after-free) Vulnerabilities</p>
<p>CVE-2017-12375 ClamAV Buffer Overflow Vulnerability</p>
<p>CVE-2017-12376 ClamAV Buffer Overflow in handle_pdfname
Vulnerability</p>
<p>CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability</p>
<p>CVE-2017-12378 ClamAV Buffer Over Read Vulnerability</p>
<p>CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument
Vulnerability</p>
<p>CVE-2017-12380 ClamAV Null Dereference Vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html</url>
<cvename>CVE-2017-12374</cvename>
<cvename>CVE-2017-12375</cvename>
<cvename>CVE-2017-12376</cvename>
<cvename>CVE-2017-12377</cvename>
<cvename>CVE-2017-12378</cvename>
<cvename>CVE-2017-12379</cvename>
<cvename>CVE-2017-12380</cvename>
</references>
<dates>
<discovery>2018-01-25</discovery>
<entry>2018-01-26</entry>
</dates>
</vuln>
<vuln vid="a891c5b4-3d7a-4de9-9c71-eef3fd698c77">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>58.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.3.63</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.6.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/">
<p>CVE-2018-5091: Use-after-free with DTMF timers</p>
<p>CVE-2018-5092: Use-after-free in Web Workers</p>
<p>CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing</p>
<p>CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory</p>
<p>CVE-2018-5095: Integer overflow in Skia library during edge builder allocation</p>
<p>CVE-2018-5097: Use-after-free when source document is manipulated during XSLT</p>
<p>CVE-2018-5098: Use-after-free while manipulating form input elements</p>
<p>CVE-2018-5099: Use-after-free with widget listener</p>
<p>CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory</p>
<p>CVE-2018-5101: Use-after-free with floating first-letter style elements</p>
<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
<p>CVE-2018-5103: Use-after-free during mouse event handling</p>
<p>CVE-2018-5104: Use-after-free during font face manipulation</p>
<p>CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts</p>
<p>CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker</p>
<p>CVE-2018-5107: Printing process will follow symlinks for local file access</p>
<p>CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs</p>
<p>CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution</p>
<p>CVE-2018-5110: Cursor can be made invisible on OS X</p>
<p>CVE-2018-5111: URL spoofing in addressbar through drag and drop</p>
<p>CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel</p>
<p>CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow</p>
<p>CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts</p>
<p>CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs</p>
<p>CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access</p>
<p>CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right</p>
<p>CVE-2018-5118: Activity Stream images can attempt to load local content through file:</p>
<p>CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers</p>
<p>CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar</p>
<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
<p>CVE-2018-5090: Memory safety bugs fixed in Firefox 58</p>
<p>CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5089</cvename>
<cvename>CVE-2018-5090</cvename>
<cvename>CVE-2018-5091</cvename>
<cvename>CVE-2018-5092</cvename>
<cvename>CVE-2018-5093</cvename>
<cvename>CVE-2018-5094</cvename>
<cvename>CVE-2018-5095</cvename>
<cvename>CVE-2018-5097</cvename>
<cvename>CVE-2018-5098</cvename>
<cvename>CVE-2018-5099</cvename>
<cvename>CVE-2018-5100</cvename>
<cvename>CVE-2018-5101</cvename>
<cvename>CVE-2018-5102</cvename>
<cvename>CVE-2018-5103</cvename>
<cvename>CVE-2018-5104</cvename>
<cvename>CVE-2018-5105</cvename>
<cvename>CVE-2018-5106</cvename>
<cvename>CVE-2018-5107</cvename>
<cvename>CVE-2018-5108</cvename>
<cvename>CVE-2018-5109</cvename>
<cvename>CVE-2018-5110</cvename>
<cvename>CVE-2018-5111</cvename>
<cvename>CVE-2018-5112</cvename>
<cvename>CVE-2018-5113</cvename>
<cvename>CVE-2018-5114</cvename>
<cvename>CVE-2018-5115</cvename>
<cvename>CVE-2018-5116</cvename>
<cvename>CVE-2018-5117</cvename>
<cvename>CVE-2018-5118</cvename>
<cvename>CVE-2018-5119</cvename>
<cvename>CVE-2018-5121</cvename>
<cvename>CVE-2018-5122</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-02/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-03/</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-01-23</entry>
<modified>2018-01-29</modified>
</dates>
</vuln>
<vuln vid="24a82876-002e-11e8-9a95-0cc47a02c232">
<topic>powerdns-recursor -- insufficient validation of DNSSEC signatures</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html">
<p>An issue has been found in the DNSSEC validation component of
PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3
record to be used to wrongfully prove the non-existence of a RR
below the owner name of that record. This would allow an attacker in
position of man-in-the-middle to send a NXDOMAIN answer for a name
that does exist.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000003</cvename>
<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html</url>
</references>
<dates>
<discovery>2018-01-22</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="e264e74e-ffe0-11e7-8b91-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>63.0.3239.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[788453] High CVE-2017-15429: UXSS in V8. Reported by
Anonymous on 2017-11-24</li>
<li>[794792] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15429</cvename>
<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="1d951e85-ffdb-11e7-8b91-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>63.0.3239.84</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html">
<p>37 security fixes in this release, including:</p>
<ul>
<li>[778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by
Ned Williamson on 2017-10-26</li>
<li>[762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by
Ke Liu of Tencent's Xuanwu LAB on 2017-09-06</li>
<li>[763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by
Anonymous on 2017-09-11</li>
<li>[765921] High CVE-2017-15410: Use after free in PDFium. Reported by
Luat Nguyen of KeenLab, Tencent on 2017-09-16</li>
<li>[770148] High CVE-2017-15411: Use after free in PDFium. Reported by
Luat Nguyen of KeenLab, Tencent on 2017-09-29</li>
<li>[727039] High CVE-2017-15412: Use after free in libXML. Reported by
Nick Wellnhofer on 2017-05-27</li>
<li>[766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by
Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19</li>
<li>[765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call.
Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15</li>
<li>[779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by
Ned Williamson on 2017-10-28</li>
<li>[699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia.
Reported by Max May on 2017-03-07</li>
<li>[765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by
Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15</li>
<li>[780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink.
Reported by Jun Kokatsu on 2017-10-31</li>
<li>[777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23</li>
<li>[774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13</li>
<li>[780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin.
Reported by jinmo123 on 2017-01-11</li>
<li>[778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.
Reported by Greg Hudson on 2017-10-25</li>
<li>[756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by
Khalil Zhani on 2017-08-16</li>
<li>[756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by
xisigr of Tencent's Xuanwu Lab on 2017-08-17</li>
<li>[757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18</li>
<li>[768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox.
Reported by Junaid Farhan on 2017-09-26</li>
<li>[792099] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15407</cvename>
<cvename>CVE-2017-15408</cvename>
<cvename>CVE-2017-15409</cvename>
<cvename>CVE-2017-15410</cvename>
<cvename>CVE-2017-15411</cvename>
<cvename>CVE-2017-15412</cvename>
<cvename>CVE-2017-15413</cvename>
<cvename>CVE-2017-15415</cvename>
<cvename>CVE-2017-15416</cvename>
<cvename>CVE-2017-15417</cvename>
<cvename>CVE-2017-15418</cvename>
<cvename>CVE-2017-15419</cvename>
<cvename>CVE-2017-15420</cvename>
<cvename>CVE-2017-15422</cvename>
<cvename>CVE-2017-15430</cvename>
<cvename>CVE-2017-15423</cvename>
<cvename>CVE-2017-15424</cvename>
<cvename>CVE-2017-15425</cvename>
<cvename>CVE-2017-15426</cvename>
<cvename>CVE-2017-15427</cvename>
<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-12-06</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="82894193-ffd4-11e7-8b91-e8e0b747a45a">
<topic>chromium -- out of bounds read</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html">
<p>1 security fix in this release, including:</p>
<ul>
<li>[782145] High CVE-2017-15428: Out of bounds read in V8. Reported by
Zhao Qixun of Qihoo 360 Vulcan Team on 2017-11-07</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15428</cvename>
<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2017-11-13</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="8d3bae09-fd28-11e7-95f2-005056925db4">
<topic>unbound -- vulnerability in the processing of wildcard synthesized NSEC records</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound reports:</p>
<blockquote cite="https://unbound.net/downloads/CVE-2017-15105.txt">
<p>We discovered a vulnerability in the processing of wildcard synthesized
NSEC records. While synthesis of NSEC records is allowed by RFC4592,
these synthesized owner names should not be used in the NSEC processing.
This does, however, happen in Unbound 1.6.7 and earlier versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://unbound.net/downloads/CVE-2017-15105.txt</url>
<cvename>CVE-2017-15105</cvename>
<freebsdpr>ports/225313</freebsdpr>
</references>
<dates>
<discovery>2017-10-08</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="8e89a89a-fd15-11e7-bdf6-00e04c1ea73d">
<topic>phpbb3 -- multiple issues</topic>
<affects>
<package>
<name>phpbb3</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpbb developers reports:</p>
<blockquote cite="https://wiki.phpbb.com/Release_Highlights/3.2.2">
<p>Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL.</p>
<p>Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them when a large number of orphaned attachments exist.</p>
<p>Multiple bugfixes for retrieving image size - Multiple issues with retrieving the image size of JPEGs and temporary files were resolved.</p>
<p>Issues with updating from phpBB 3.0.6 - Inconsistencies in the way parent modules were treated caused issues with updating from older phpBB 3.0 versions.</p>
<p>Forum / topic icon blurriness - Fixed issues with forum and topic icons looking blurry on some browsers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.phpbb.com/Release_Highlights/3.2.2</url>
</references>
<dates>
<discovery>2018-01-07</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="e3445736-fd01-11e7-ac58-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.34</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.31</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.13</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.39</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.21</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.39</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL">
<p>Not all vulnerabilities are relevant for all flavors/versions of the
servers and clients</p>
<ul>
<li>Vulnerability allows low privileged attacker with network access
via multiple protocols to compromise MySQL Server. Successful attacks
of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MySQL Server.
GIS: CVE-2018-2573, DDL CVE-2018-2622, Optimizer: CVE-2018-2640,
CVE-2018-2665, CVE-2018-2668, Security:Privileges: CVE-2018-2703,
Partition: CVE-2018-2562.</li>
<li>Vulnerability allows high privileged attacker with network access
via multiple protocols to compromise MySQL Server. Successful attacks
of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MySQL Server.
InnoDB: CVE-2018-2565, CVE-2018-2612 DML: CVE-2018-2576,
CVE-2018-2646, Stored Procedure: CVE-2018-2583, Performance Schema:
CVE-2018-2590, Partition: CVE-2018-2591, Optimizer: CVE-2018-2600,
CVE-2018-2667, Security:Privileges: CVE-2018-2696, Replication:
CVE-2018-2647.</li>
<li>Vulnerability allows a low or high privileged attacker with network
access via multiple protocols to compromise MySQL Server with
unauthorized creation, deletion, modification or access to data/
critical data. InnoDB: CVE-2018-2612, Performance Schema:
CVE-2018-2645, Replication: CVE-2018-2647, Partition: CVE-2018-2562.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/library/mariadb-5559-release-notes/</url>
<cvename>CVE-2018-2562</cvename>
<cvename>CVE-2018-2565</cvename>
<cvename>CVE-2018-2573</cvename>
<cvename>CVE-2018-2576</cvename>
<cvename>CVE-2018-2583</cvename>
<cvename>CVE-2018-2586</cvename>
<cvename>CVE-2018-2590</cvename>
<cvename>CVE-2018-2591</cvename>
<cvename>CVE-2018-2600</cvename>
<cvename>CVE-2018-2612</cvename>
<cvename>CVE-2018-2622</cvename>
<cvename>CVE-2018-2640</cvename>
<cvename>CVE-2018-2645</cvename>
<cvename>CVE-2018-2646</cvename>
<cvename>CVE-2018-2647</cvename>
<cvename>CVE-2018-2665</cvename>
<cvename>CVE-2018-2667</cvename>
<cvename>CVE-2018-2668</cvename>
<cvename>CVE-2018-2696</cvename>
<cvename>CVE-2018-2703</cvename>
</references>
<dates>
<discovery>2017-01-18</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="c04dc18f-fcde-11e7-bdf6-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/">
<p>JavaScript errors that prevented saving posts in Firefox have been fixed.</p>
<p>The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.</p>
<p>Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="65fab89f-2231-46db-8541-978f4e87f32a">
<topic>gitlab -- Remote code execution on project import</topic>
<affects>
<package>
<name>gitlab</name>
<range><lt>10.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab developers report:</p>
<blockquote cite="https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/">
<p>Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for
GitLab Community Edition (CE) and Enterprise Edition (EE).</p>
<p>These versions contain a number of important security fixes,
including two that prevent remote code execution, and we strongly
recommend that all GitLab installations be upgraded to one of these
versions immediately.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/</url>
<cvename>CVE-2017-0915</cvename>
<cvename>CVE-2018-3710</cvename>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-01-17</entry>
</dates>
</vuln>
<vuln vid="3e5b8bd3-0c32-452f-a60e-beab7b762351">
<topic>transmission-daemon -- vulnerable to dns rebinding attacks</topic>
<affects>
<package>
<name>transmission-daemon</name>
<range><le>2.92_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Project Zero reports:</p>
<blockquote cite="https://bugs.chromium.org/p/project-zero/issues/detail?id=1447">
<p>The transmission bittorrent client uses a client/server
architecture, the user interface is the client which communicates
to the worker daemon using JSON RPC requests.</p>
<p>As with all HTTP RPC schemes like this, any website can send
requests to the daemon listening on localhost with XMLHttpRequest(),
but the theory is they will be ignored because clients must prove
they can read and set a specific header, X-Transmission-Session-Id.
Unfortunately, this design doesn't work because of an attack called
"DNS rebinding". Any website can simply create a dns name that they
are authorized to communicate with, and then make it resolve to
localhost.</p>
<p>Exploitation is simple, you could set script-torrent-done-enabled
and run any command, or set download-dir to /home/user/ and then
upload a torrent for .bashrc.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1447</url>
<url>https://github.com/transmission/transmission/pull/468</url>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2018-01-14</entry>
</dates>
</vuln>
<vuln vid="3dbe9492-f7b8-11e7-a12d-6cc21735f730">
<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.6.3</lt></range>
</package>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180112.txt">
<p>
Shibboleth SP software vulnerable to forged user attribute data
</p>
<p>
The Service Provider software relies on a generic XML parser to
process SAML responses and there are limitations in older versions
of the parser that make it impossible to fully disable Document Type
Definition (DTD) processing.
</p>
<p>
Through addition/manipulation of a DTD, it's possible to make
changes to an XML document that do not break a digital signature but
are mishandled by the SP and its libraries. These manipulations can
alter the user data passed through to applications behind the SP and
result in impersonation attacks and exposure of protected
information.
</p>
<p>
While newer versions of the xerces-c3 parser are configured by the
SP into disallowing the use of a DTD via an environment variable,
this feature is not present in the xerces-c3 parser before version
3.1.4, so an additional fix is being provided now that an actual DTD
exploit has been identified. Xerces-c3-3.1.4 was committed to the
ports tree already on 2016-07-26.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180112.txt</url>
<cvename>CVE-2018-0486</cvename>
</references>
<dates>
<discovery>2018-01-12</discovery>
<entry>2018-01-12</entry>
</dates>
</vuln>
<vuln vid="9c016563-f582-11e7-b33c-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>28.0.0.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-01.html">
<ul>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-4871).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4871</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-01.html</url>
</references>
<dates>
<discovery>2018-01-09</discovery>
<entry>2018-01-09</entry>
</dates>
</vuln>
<vuln vid="4055aee5-f4c6-11e7-95f2-005056925db4">
<topic>awstats -- remote code execution</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>7.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501">
<p>Awstats version 7.6 and earlier is vulnerable to a path traversal
flaw in the handling of the "config" and "migrate" parameters resulting
in unauthenticated remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501</url>
<cvename>CVE-2017-1000501</cvename>
<freebsdpr>ports/225007</freebsdpr>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-01-08</entry>
</dates>
</vuln>
<vuln vid="a3764767-f31e-11e7-95f2-005056925db4">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2018_01.txt">
<p>When the channel topic is set without specifying a sender, Irssi
may dereference NULL pointer. Found by Joseph Bisch.</p>
<p>When using incomplete escape codes, Irssi may access data beyond
the end of the string. Found by Joseph Bisch.</p>
<p>A calculation error in the completion code could cause a heap
buffer overflow when completing certain strings.
Found by Joseph Bisch.</p>
<p>When using an incomplete variable argument, Irssi may access data
beyond the end of the string. Found by Joseph Bisch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2018_01.txt</url>
<cvename>CVE-2018-5205</cvename>
<cvename>CVE-2018-5206</cvename>
<cvename>CVE-2018-5207</cvename>
<cvename>CVE-2018-5208</cvename>
<freebsdpr>ports/224954</freebsdpr>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-01-06</entry>
</dates>
</vuln>
<vuln vid="8429711b-76ca-474e-94a0-6b980f1e2d47">
<topic>mozilla -- Speculative execution side-channel attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>57.0.4,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/">
<p><strong>Jann Horn</strong> of Google Project Zero
Security reported that speculative execution performed
by modern CPUs could leak information through a timing
side-channel attack. Microsoft Vulnerability Research
extended this attack to browser JavaScript engines and
demonstrated that code on a malicious web page could
read data from other web sites (violating the
same-origin policy) or private data from the browser
itself.</p>
<p>Since this new class of attacks involves measuring
precise time intervals, as a parti al, short-term,
mitigation we are disabling or reducing the precision of
several time sources in Firefox. The precision of
<code>performance.now()</code> has been reduced from 5μs
to 20μs, and the <code>SharedArrayBuffer</code> feature
has been disabled because it can be used to construct a
high-resolution timer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2018-01/</url>
</references>
<dates>
<discovery>2018-01-04</discovery>
<entry>2018-01-05</entry>
</dates>
</vuln>
<vuln vid="cebd05d6-ed7b-11e7-95f2-005056925db4">
<topic>OTRS -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>5.0.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as an agent can request special URLs
from OTRS which can lead to the execution of shell commands with the
permissions of the web server user.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as a customer can use the ticket search
form to disclose internal article information of their customer tickets.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as an agent can manipulate form
parameters and execute arbitrary shell commands with the permissions of the
OTRS or web server user.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/">
<p>An attacker can send a specially prepared email to an OTRS system. If this
system has cookie support disabled, and a logged in agent clicks a link in this
email, the session information could be leaked to external systems, allowing the
attacker to take over the agent’s session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16664</cvename>
<cvename>CVE-2017-16854</cvename>
<cvename>CVE-2017-16921</cvename>
<freebsdpr>ports/224729</freebsdpr>
<url>https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/</url>
</references>
<dates>
<discovery>2017-11-21</discovery>
<entry>2017-12-30</entry>
</dates>
</vuln>
<vuln vid="6a131fbf-ec76-11e7-aa65-001b216d295b">
<topic>The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT")</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><lt>1.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
<p>Release: 1.59</p>
<p>CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS
when RSA key exchange is negotiated. This potentially affected
BCJSSE servers and any other TLS servers configured to use JCE
for the underlying crypto - note the two TLS implementations
using the BC lightweight APIs are not affected by this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-13098</cvename>
<url>https://www.bouncycastle.org/releasenotes.html</url>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-29</entry>
</dates>
</vuln>
<vuln vid="6a09c80e-6ec7-442a-bc65-d72ce69fd887">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/">
<p>CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9</p>
<p>CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin</p>
<p>CVE-2017-7847: Local path string can be leaked from RSS feed</p>
<p>CVE-2017-7848: RSS Feed vulnerable to new line Injection</p>
<p>CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7829</cvename>
<cvename>CVE-2017-7845</cvename>
<cvename>CVE-2017-7846</cvename>
<cvename>CVE-2017-7847</cvename>
<cvename>CVE-2017-7848</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-30/</url>
</references>
<dates>
<discovery>2017-12-22</discovery>
<entry>2017-12-25</entry>
</dates>
</vuln>
<vuln vid="63eb2b11-e802-11e7-a58c-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF/CSRF vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.7.0</ge><lt>4.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-9/">
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible to perform harmful database operations such as
deleting records, dropping/truncating tables etc.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-9/</url>
</references>
<dates>
<discovery>2017-12-23</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="2a3bc6ac-e7c6-11e7-a90b-001999f8d30b">
<topic>asterisk -- Crash in PJSIP resource when missing a contact header</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A select set of SIP messages create a dialog in Asterisk.
Those SIP messages must contain a contact header. For
those messages, if the header was not present and using
the PJSIP channel driver, it would cause Asterisk to
crash. The severity of this vulnerability is somewhat
mitigated if authentication is enabled. If authentication
is enabled a user would have to first be authorized before
reaching the crash point.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-014.html</url>
<cvename>CVE-2017-17850</cvename>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="b7d89082-e7c0-11e7-ac58-b499baebfeaf">
<topic>MariaDB -- unspecified vulnerability</topic>
<affects>
<package>
<name>mariadb101-client</name>
<range><lt>10.1.30</lt></range>
</package>
<package>
<name>mariadb102-client</name>
<range><lt>10.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/library/mariadb-10130-release-notes/">
<p>Fixes for the following security vulnerabilities:
CVE-2017-15365</p>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/library/mariadb-10130-release-notes/</url>
<cvename>CVE-2017-15365</cvename>
</references>
<dates>
<discovery>2017-12-23</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="72fff788-e561-11e7-8097-0800271d4b9c">
<topic>rsync -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rsync</name>
<range><ge>3.1.2</ge><le>3.1.2_7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeriko One reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548">
<p>The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17433">
<p>The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17434">
<p>The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.debian.org/security/2017/dsa-4068</url>
<cvename>CVE-2017-16548</cvename>
<cvename>CVE-2017-17433</cvename>
<cvename>CVE-2017-17434</cvename>
<freebsdpr>ports/224477</freebsdpr>
</references>
<dates>
<discovery>2017-12-17</discovery>
<entry>2017-12-20</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="dd644964-e10e-11e7-8097-0800271d4b9c">
<topic>ruby -- Command injection vulnerability in Net::FTP</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.2.0,1</ge><lt>2.2.9,1</lt></range>
<range><ge>2.3.0,1</ge><lt>2.3.6,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Etienne Stalmans from the Heroku product security team reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/">
<p>There is a command injection vulnerability in Net::FTP bundled with Ruby.</p>
<p><code>Net::FTP#get</code>, <code>getbinaryfile</code>, <code>gettextfile</code>, <code>put</code>, <code>putbinaryfile</code>, and <code>puttextfile</code> use <code>Kernel#open</code> to open a local file. If the <code>localfile</code> argument starts with the pipe character <code>"|"</code>, the command following the pipe character is executed. The default value of <code>localfile</code> is <code>File.basename(remotefile)</code>, so malicious FTP servers could cause arbitrary command execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/</url>
<cvename>CVE-2017-17405</cvename>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="8cf25a29-e063-11e7-9b2c-001e672571bc">
<topic>rubygem-passenger -- arbitrary file read vulnerability</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><ge>5.0.10</ge><lt>5.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Phusion reports:</p>
<blockquote cite="https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/">
<p>The cPanel Security Team discovered a vulnerability in Passenger
that allows users to list the contents of arbitrary files on the
system. CVE-2017-16355 has been assigned to this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/</url>
<cvename>CVE-2017-16355</cvename>
</references>
<dates>
<discovery>2017-10-13</discovery>
<entry>2017-12-18</entry>
</dates>
</vuln>
<vuln vid="08a125f3-e35a-11e7-a293-54e1ad3d6335">
<topic>libXfont -- permission bypass when opening files through symlinks</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.4</lt></range>
</package>
<package>
<name>libXfont2</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the freedesktop.org project reports:</p>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8">
<p>A non-privileged X client can instruct X server running under root
to open any file by creating own directory with "fonts.dir",
"fonts.alias" or any font file being a symbolic link to any other
file in the system. X server will then open it. This can be issue
with special files such as /dev/watchdog.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8</url>
<cvename>CVE-2017-16611</cvename>
</references>
<dates>
<discovery>2017-11-25</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="3b9590a1-e358-11e7-a293-54e1ad3d6335">
<topic>libXfont -- multiple memory leaks</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.3</lt></range>
</package>
<package>
<name>libXfont2</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608">
<p>If a pattern contains '?' character, any character in the string
is skipped, even if it is '\0'. The rest of the matching then reads
invalid memory.</p>
</blockquote>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902906bcd">
<p>Without the checks a malformed PCF file can cause the library to
make atom from random heap memory that was behind the `strings`
buffer. This may crash the process or leak information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608</url>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd</url>
<cvename>CVE-2017-13720</cvename>
<cvename>CVE-2017-13722</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="ddecde18-e33b-11e7-a293-54e1ad3d6335">
<topic>libXcursor -- integer overflow that can lead to heap buffer overflow</topic>
<affects>
<package>
<name>libXcursor</name>
<range><lt>1.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q4/339">
<p>It is possible to trigger heap overflows due to an integer
overflow while parsing images and a signedness issue while
parsing comments.</p>
<p>The integer overflow occurs because the chosen limit 0x10000
for dimensions is too large for 32 bit systems, because each pixel
takes 4 bytes. Properly chosen values allow an overflow which in
turn will lead to less allocated memory than needed for subsequent
reads.</p>
<p>The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows
the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to
allocate less memory than needed for subsequent reads.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q4/339</url>
<url>https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8</url>
<cvename>CVE-2017-16612</cvename>
</references>
<dates>
<discovery>2017-11-28</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="48cca164-e269-11e7-be51-6599c735afc8">
<topic>global -- gozilla vulnerability</topic>
<affects>
<package>
<name>global</name>
<range><ge>4.8.6</ge><lt>6.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531">
<p>gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching
the program specified by the BROWSER environment variable, which might
allow remote attackers to conduct argument-injection attacks via a crafted
URL.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531</url>
<url>http://lists.gnu.org/archive/html/info-global/2017-12/msg00001.html</url>
<cvename>CVE-2017-17531</cvename>
</references>
<dates>
<discovery>2017-12-11</discovery>
<entry>2017-12-16</entry>
</dates>
</vuln>
<vuln vid="7136e6b7-e1b3-11e7-a4d3-000c292ee6b8">
<topic>jenkins -- Two startup race conditions</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.95</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.89.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Jenkins project reports:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-12-14/">
<p>A race condition during Jenkins startup could result in the wrong
order of execution of commands during initialization.</p>
<p>On Jenkins 2.81 and newer, including LTS 2.89.1, this could in
rare cases (we estimate less than 20% of new instances) result in
failure to initialize the setup wizard on the first startup.</p>
<p>There is a very short window of time after startup during which
Jenkins may no longer show the "Please wait while Jenkins is
getting ready to work" message, but Cross-Site Request Forgery
(CSRF) protection may not yet be effective.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-12-14/</url>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2017-12-15</entry>
</dates>
</vuln>
<vuln vid="bea84a7a-e0c9-11e7-b4f3-11baa0c2df21">
<topic>node.js -- Data Confidentiality/Integrity Vulnerability, December 2017</topic>
<affects>
<package>
<name>node4</name>
<range><lt>4.8.7</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.12.2</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.9.3</lt></range>
</package>
<package>
<name>node</name>
<range><lt>9.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/">
<h1>Data Confidentiality/Integrity Vulnerability - CVE-2017-15896</h1>
<p>Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.</p>
<h1>Uninitialized buffer vulnerability - CVE-2017-15897</h1>
<p>Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.</p>
<h1>Also included in OpenSSL update - CVE 2017-3738</h1>
<p>Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/</url>
<cvename>CVE-2017-15896</cvename>
<cvename>CVE-2017-15897</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>4.2.0</ge><le>10.0.6</le></range>
<range><ge>10.1.0</ge><le>10.1.4</le></range>
<range><ge>10.2.0</ge><le>10.2.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/">
<h1>User without access to private Wiki can see it on the project page</h1>
<p>Matthias Burtscher reported that it was possible for a user to see a
private Wiki on the project page without having the corresponding
permission.</p>
<h1>E-mail address disclosure through member search fields</h1>
<p>Hugo Geoffroy reported via HackerOne that it was possible to find out the
full e-mail address of any user by brute-forcing the member search
field.</p>
<h1>Groups API leaks private projects</h1>
<p>An internal code review discovered that users were able to list private
projects they had no access to by using the Groups API.</p>
<h1>Cross-Site Scripting (XSS) possible by editing a comment</h1>
<p>Sylvain Heiniger reported via HackerOne that it was possible for
arbitrary JavaScript code to be executed when editing a comment.</p>
<h1>Issue API allows any user to create a new issue even when issues are
restricted or disabled</h1>
<p>Mohammad Hasbini reported that any user could create a new issues in a
project even when issues were disabled or restricted to team members in the
project settings.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2">
<topic>tor -- Use-after-free in onion service v2</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Torproject.org reports:</p>
<blockquote cite="https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516">
<ul>
<li>TROVE-2017-009: Replay-cache ineffective for v2 onion services</li>
<li>TROVE-2017-010: Remote DoS attack against directory authorities</li>
<li>TROVE-2017-011: An attacker can make Tor ask for a password</li>
<li>TROVE-2017-012: Relays can pick themselves in a circuit path</li>
<li>TROVE-2017-013: Use-after-free in onion service v2</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516</url>
<cvename>CVE-2017-8819</cvename>
</references>
<dates>
<discovery>2017-12-01</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="4a67450a-e044-11e7-accc-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in RTCP Stack</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If a compound RTCP packet is received containing more
than one report (for example a Receiver Report and a
Sender Report) the RTCP stack will incorrectly store
report information outside of allocated memory potentially
causing a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-012.html</url>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-13</entry>
</dates>
</vuln>
<vuln vid="76e59f55-4f7a-4887-bcb0-11604004163a">
<topic>libxml2 -- Multiple Issues</topic>
<affects>
<package>
<name>libxml2</name>
<range><le>2.9.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libxml2 developers report:</p>
<p>The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.</p>
<p>A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.</p>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=775200</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98599</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98556</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98601</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98568</url>
<cvename>CVE-2017-8872</cvename>
<cvename>CVE-2017-9047</cvename>
<cvename>CVE-2017-9048</cvename>
<cvename>CVE-2017-9049</cvename>
<cvename>CVE-2017-9050</cvename>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-12-13</entry>
</dates>
</vuln>
<vuln vid="9f7a0f39-ddc0-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_6</lt></range>
<range><ge>10.4</ge><lt>10.4_5</lt></range>
<range><ge>10.3</ge><lt>10.3_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Invoking SSL_read()/SSL_write() while in an error state
causes data to be passed without being decrypted/encrypted
directly from the SSL/TLS record layer.</p>
<p>In order to exploit this issue an application bug would
have to be present that resulted in a call to
SSL_read()/SSL_write() being issued after having already
received a fatal error. [CVE-2017-3737]</p>
<p>There is an overflow bug in the x86_64 Montgomery
multiplication procedure used in exponentiation with 1024-bit
moduli. This only affects processors that support the AVX2
but not ADX extensions like Intel Haswell (4th generation).
[CVE-2017-3738] This bug only affects FreeBSD 11.x.</p>
<h1>Impact:</h1>
<p>Applications with incorrect error handling may inappropriately
pass unencrypted data. [CVE-2017-3737]</p>
<p>Mishandling of carry propagation will produce incorrect
output, and make it easier for a remote attacker to obtain
sensitive private-key information. No EC algorithms are
affected and analysis suggests that attacks against RSA and
DSA as a result of this defect would be very difficult to
perform and are not believed likely.</p>
<p>Attacks against DH1024 are considered just feasible
(although very difficult) because most of the work necessary
to deduce information about a private key may be performed
offline. The amount of resources required for such an attack
would be very significant and likely only accessible to a
limited number of attackers. However, for an attack on TLS
to be meaningful, the server would have to share the DH1024
private key among multiple clients, which is no longer an
option since CVE-2016-0701. [CVE-2017-3738]</p>
</body>
</description>
<references>
<cvename>CVE-2016-0701</cvename>
<cvename>CVE-2017-3737</cvename>
<cvename>CVE-2017-3738</cvename>
<freebsdsa>SA-17:12.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-12-09</discovery>
<entry>2017-12-10</entry>
</dates>
</vuln>
<vuln vid="4b228e69-22e1-4019-afd0-8aa716d0ec0b">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>tshark</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="https://www.wireshark.org/security/">
<p>wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)</p>
<p>wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)</p>
<p>wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/security/</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-47.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-48.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-49.html</url>
<cvename>CVE-2017-17083</cvename>
<cvename>CVE-2017-17084</cvename>
<cvename>CVE-2017-17085</cvename>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2017-12-10</entry>
</dates>
</vuln>
<vuln vid="3bb451fc-db64-11e7-ac58-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><gt>1.0.2</gt><lt>1.0.2n</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20171207.txt">
<ul><li>Read/write after SSL object in error state (CVE-2017-3737)<br/>
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error
state" mechanism. The intent was that if a fatal error occurred
during a handshake then OpenSSL would move into the error state and
would immediately fail if you attempted to continue the handshake.
This works as designed for the explicit handshake functions
(SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to
a bug it does not work correctly if SSL_read() or SSL_write() is
called directly. In that scenario, if the handshake fails then a
fatal error will be returned in the initial function call. If
SSL_read()/SSL_write() is subsequently called by the application for
the same SSL object then it will succeed and the data is passed
without being decrypted/encrypted directly from the SSL/TLS record
layer.</li>
<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. No EC
algorithms are affected. Analysis suggests that attacks against
RSA and DSA as a result of this defect would be very difficult to
perform and are not believed likely. Attacks against DH1024 are
considered just feasible, because most of the work necessary to
deduce information about a private key may be performed offline.
The amount of resources required for such an attack would be
significant. However, for an attack on TLS to be meaningful, the
server would have to share the DH1024 private key among multiple
clients, which is no longer an option since CVE-2016-0701.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20171207.txt</url>
<cvename>CVE-2017-3737</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2017-12-07</discovery>
<entry>2017-12-07</entry>
</dates>
</vuln>
<vuln vid="9442a811-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_5</lt></range>
<range><ge>11.0</ge><lt>11.0_16</lt></range>
<range><ge>10.4</ge><lt>10.4_4</lt></range>
<range><ge>10.3</ge><lt>10.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If an X.509 certificate has a malformed IPAddressFamily
extension, OpenSSL could do a one-byte buffer overread.
[CVE-2017-3735]</p>
<p>There is a carry propagating bug in the x86_64 Montgomery
squaring procedure. This only affects processors that support
the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th
generation) and later or AMD Ryzen. [CVE-2017-3736] This
bug only affects FreeBSD 11.x.</p>
<h1>Impact:</h1>
<p>Application using OpenSSL may display erroneous certificate
in text format. [CVE-2017-3735]</p>
<p>Mishandling of carry propagation will produce incorrect
output, and make it easier for a remote attacker to obtain
sensitive private-key information. No EC algorithms are
affected, analysis suggests that attacks against RSA and
DSA as a result of this defect would be very difficult to
perform and are not believed likely.</p>
<p>Attacks against DH are considered just feasible (although
very difficult) because most of the work necessary to deduce
information about a private key may be performed offline.
The amount of resources required for such an attack would
be very significant and likely only accessible to a limited
number of attackers. An attacker would additionally need
online access to an unpatched system using the target private
key in a scenario with persistent DH parameters and a private
key that is shared between multiple clients. [CVE-2017-3736]</p>
</body>
</description>
<references>
<cvename>CVE-2017-3735</cvename>
<cvename>CVE-2017-3736</cvename>
<freebsdsa>SA-17:11.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="759059ac-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- Information leak in kldstat(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_4</lt></range>
<range><ge>11.0</ge><lt>11.0_15</lt></range>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel does not properly clear the memory of the
kld_file_stat structure before filling the data. Since the
structure filled by the kernel is allocated on the kernel
stack and copied to userspace, a leak of information from
the kernel stack is possible.</p>
<h1>Impact:</h1>
<p>Some bytes from the kernel stack can be observed in
userspace.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1088</cvename>
<freebsdsa>SA-17:10.kldstat</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="5b1463dd-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- POSIX shm allows jails to access global namespace</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Named paths are globally scoped, meaning a process located
in one jail can read and modify the content of POSIX shared
memory objects created by a process in another jail or the
host system.</p>
<h1>Impact:</h1>
<p>A malicious user that has access to a jailed system is
able to abuse shared memory by injecting malicious content
in the shared memory region. This memory region might be
executed by applications trusting the shared memory, like
Squid.</p>
<p>This issue could lead to a Denial of Service or local
privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1087</cvename>
<freebsdsa>SA-17:09.shm</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="34a3f9b5-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_4</lt></range>
<range><ge>11.0</ge><lt>11.0_15</lt></range>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Not all information in the struct ptrace_lwpinfo is
relevant for the state of any thread, and the kernel does
not fill the irrelevant bytes or short strings. Since the
structure filled by the kernel is allocated on the kernel
stack and copied to userspace, a leak of information of the
kernel stack of the thread is possible from the debugger.</p>
<h1>Impact:</h1>
<p>Some bytes from the kernel stack of the thread using
ptrace(PT_LWPINFO) call can be observed in userspace.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1086</cvename>
<freebsdsa>SA-17:08.ptrace</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="1f8de723-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- WPA2 protocol vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_2</lt></range>
<range><ge>11.0</ge><lt>11.0_13</lt></range>
<range><ge>10.4</ge><lt>10.4_1</lt></range>
<range><ge>10.3</ge><lt>10.3_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A vulnerability was found in how a number of implementations
can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK,
or IGTK) by replaying a specific frame that is used to
manage the keys.</p>
<h1>Impact:</h1>
<p>Such reinstallation of the encryption key can result in
two different types of vulnerabilities: disabling replay
protection and significantly reducing the security of
encryption to the point of allowing frames to be decrypted
or some parts of the keys to be determined by an attacker
depending on which cipher is used.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1307</cvename>
<cvename>CVE-2017-1308</cvename>
<freebsdsa>SA-17:07.wpa</freebsdsa>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="b7e23050-2d5d-4e61-9b48-62e89db222ca">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>57.0,1</ge><lt>57.0.1,1</lt></range>
<range><lt>56.0.2_11,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.s20171130</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.5.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.5.1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-27/">
<p>CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data</p>
<p>CVE-2017-7844: Visited history information leak through SVG image</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7843</cvename>
<cvename>CVE-2017-7844</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-27/</url>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-05</entry>
</dates>
</vuln>
<vuln vid="17133e7e-d764-11e7-b5af-a4badb2f4699">
<topic>varnish -- information disclosure vulnerability</topic>
<affects>
<package>
<name>varnish4</name>
<range><lt>4.1.9</lt></range>
</package>
<package>
<name>varnish5</name>
<range><lt>5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00002.html">
<p>A wrong if statement in the varnishd source code means that
synthetic objects in stevedores which over-allocate, may leak up to page
size of data from a malloc(3) memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00002.html</url>
<cvename>CVE-2017-8807</cvename>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-02</entry>
</dates>
</vuln>
<vuln vid="addad6de-d752-11e7-99bf-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/">
<p>High risk: Language file headers RCE</p>
<p>Low risk: Language Pack Properties XSS</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-27</discovery>
<entry>2017-12-02</entry>
</dates>
</vuln>
<vuln vid="a2589511-d6ba-11e7-88dd-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/">
<p>Use a properly generated hash for the newbloguser key instead of a determinate substring.</p>
<p>Add escaping to the language attributes used on html elements.</p>
<p>Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.</p>
<p>Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-01</entry>
</dates>
</vuln>
<vuln vid="e91cf90c-d6dd-11e7-9d10-001999f8d30b">
<topic>asterisk -- DOS Vulnerability in Asterisk chan_skinny</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If the chan_skinny (AKA SCCP protocol) channel driver
is flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests
of any kind.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-013.html</url>
<cvename>CVE-2017-17090</cvename>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2017-12-01</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- remote DoS attack in BDAT processing</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.88</ge><lt>4.89.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers team reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
<cvename>CVE-2017-16944</cvename>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-30</entry>
</dates>
</vuln>
<vuln vid="a66f9be2-d519-11e7-9866-c85b763a2f96">
<topic>xrdp -- local user can cause a denial of service</topic>
<affects>
<package>
<name>xrdp-devel</name>
<range><le>0.9.3,1</le></range>
<range><gt>0.9.3_1,1</gt><le>0.9.4,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xrdp reports:</p>
<blockquote cite="https://github.com/neutrinolabs/xrdp/pull/958">
<p>The scp_v0s_accept function in the session manager uses an untrusted integer as a write length,
which allows local users to cause a denial of service (buffer overflow and application crash)
or possibly have unspecified other impact via a crafted input stream.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16927</cvename>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-29</entry>
</dates>
</vuln>
<vuln vid="301a01b7-d50e-11e7-ac58-b499baebfeaf">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.21.0</ge><lt>7.57.0</lt></range>
</package>
<package>
<name>linux-c7-curl</name>
<range><ge>7.21.0</ge><lt>7.29.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/changes.html">
<ul><li>NTLM buffer overflow via integer overflow
(CVE-2017-8816)<br/>libcurl contains a buffer overrun flaw
in the NTLM authentication code.
The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up
the lengths of the user name + password (= SUM) and multiplies
the sum by two (= SIZE) to figure out how large storage to
allocate from the heap.</li>
<li>FTP wildcard out of bounds read (CVE-2017-8817)<br/>
libcurl contains a read out of bounds flaw in the FTP wildcard
function.
libcurl's FTP wildcard matching feature, which is enabled with
the CURLOPT_WILDCARDMATCH option can use a built-in wildcard
function or a user provided one. The built-in wildcard function
has a flaw that makes it not detect the end of the pattern
string if it ends with an open bracket ([) but instead it will
continue reading the heap beyond the end of the URL buffer that
holds the wildcard.</li>
<li>SSL out of buffer access (CVE-2017-8818)<br/>
libcurl contains an out boundary access flaw in SSL related code.
When allocating memory for a connection (the internal struct
called connectdata), a certain amount of memory is allocated at
the end of the struct to be used for SSL related structs. Those
structs are used by the particular SSL library libcurl is built
to use. The application can also tell libcurl which specific SSL
library to use if it was built to support more than one.
</li></ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/changes.html</url>
<cvename>CVE-2017-8816</cvename>
<cvename>CVE-2017-8817</cvename>
<cvename>CVE-2017-8818</cvename>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-11-29</entry>
<modified>2017-12-11</modified>
</dates>
</vuln>
<vuln vid="0d369972-d4ba-11e7-bfca-005056925db4">
<topic>borgbackup -- remote users can override repository restrictions</topic>
<affects>
<package>
<name>py34-borgbackup</name>
<name>py35-borgbackup</name>
<name>py36-borgbackup</name>
<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BorgBackup reports:</p>
<blockquote cite="https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27">
<p>Incorrect implementation of access controls allows remote users to
override repository restrictions in Borg servers. A user able to
access a remote Borg SSH server is able to circumvent access controls
post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases
1.0.x are NOT affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15914</cvename>
<url>https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27</url>
</references>
<dates>
<discovery>2017-11-27</discovery>
<entry>2017-11-29</entry>
</dates>
</vuln>
<vuln vid="6056bf68-f570-4e70-b740-b9f606971283">
<topic>palemoon -- multiple vulnerabilities</topic>
<affects>
<package>
<name>palemoon</name>
<range><lt>27.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pale Moon reports:</p>
<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7832</cvename>
<cvename>CVE-2017-7835</cvename>
<cvename>CVE-2017-7840</cvename>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-28</entry>
</dates>
</vuln>
<vuln vid="68b29058-d348-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- remote code execution, deny of service in BDAT</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.88</ge><lt>4.89_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim team reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-27</entry>
</dates>
</vuln>
<vuln vid="7761288c-d148-11e7-87e5-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>myBB Team reports:</p>
<blockquote cite="https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/">
<p>High risk: Installer RCE on configuration file write</p>
<p>High risk: Language file headers RCE</p>
<p>Medium risk: Installer XSS</p>
<p>Medium risk: Mod CP Edit Profile XSS</p>
<p>Low risk: Insufficient moderator permission check in delayed moderation tools</p>
<p>Low risk: Announcements HTML filter bypass</p>
<p>Low risk: Language Pack Properties XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-07</discovery>
<entry>2017-11-24</entry>
</dates>
</vuln>
<vuln vid="50127e44-7b88-4ade-8e12-5d57320823f1">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<range><lt>2016.11.8</lt></range>
<range><ge>2017.7.0</ge><lt>2017.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html">
<p>Directory traversal vulnerability in minion id validation in SaltStack.
Allows remote minions with incorrect credentials to authenticate to a
master via a crafted minion ID. Credit for discovering the security flaw
goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists
because of an incomplete fix for CVE-2017-12791.</p>
<p>Remote Denial of Service with a specially crafted authentication request.
Credit for discovering the security flaw goes to: Julian Brost
(julian@0x4a42.net)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14695</cvename>
<cvename>CVE-2017-14696</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html</url>
<url>https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.8.html</url>
<url>https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d</url>
<url>https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b</url>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-11-23</entry>
</dates>
</vuln>
<vuln vid="ef3423e4-d056-11e7-a52c-002590263bf5">
<topic>codeigniter -- input validation bypass</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Security: Fixed a potential object injection in Cache Library 'apc'
driver when save() is used with $raw = TRUE.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-09-25</discovery>
<entry>2017-11-23</entry>
</dates>
</vuln>
<vuln vid="288f7cee-ced6-11e7-8ae9-0050569f0b83">
<topic>procmail -- Heap-based buffer overflow</topic>
<affects>
<package>
<name>procmail</name>
<range><lt>3.22_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://www.debian.org/security/2017/dsa-4041">
<p>A remote attacker could use a flaw to cause formail to crash,
resulting in a denial of service or data loss.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16844</cvename>
<url>https://www.debian.org/security/2017/dsa-4041</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511</url>
</references>
<dates>
<discovery>2017-11-16</discovery>
<entry>2017-11-21</entry>
<modified>2017-12-08</modified>
</dates>
</vuln>
<vuln vid="bf266183-cec7-11e7-af2d-2047478f2f70">
<topic>frr -- BGP Mishandled attribute length on Error</topic>
<affects>
<package>
<name>frr</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FRR reports:</p>
<blockquote cite="https://frrouting.org/community/security/cve-2017-15865.html">
<p>BGP Mishandled attribute length on Error</p>
<p>A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE
packet can leak information from the BGP daemon and cause a denial of
service by crashing the daemon.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15865</cvename>
<url>https://frrouting.org/community/security/cve-2017-15865.html</url>
</references>
<dates>
<discovery>2017-11-08</discovery>
<entry>2017-11-21</entry>
</dates>
</vuln>
<vuln vid="db570002-ce06-11e7-804e-c85b763a2f96">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.1.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cacti reports:</p>
<blockquote cite="https://www.cacti.net/release_notes.php?version=1.1.28">
<p>Changelog</p>
<p>issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions</p>
<p>issue#1066: CVE-2017-16660 in remote_agent.php logging function</p>
<p>issue#1066: CVE-2017-16661 in view log file</p>
<p>issue#1071: CVE-2017-16785 in global_session.php Reflection XSS</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16641</cvename>
<cvename>CVE-2017-16660</cvename>
<cvename>CVE-2017-16661</cvename>
<cvename>CVE-2017-16785</cvename>
<url>https://sourceforge.net/p/cacti/mailman/message/36122745/</url>
</references>
<dates>
<discovery>2017-11-01</discovery>
<entry>2017-11-20</entry>
</dates>
</vuln>
<vuln vid="298829e2-ccce-11e7-92e4-000c29649f92">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki127</name>
<range><lt>1.27.3</lt></range>
</package>
<package>
<name>mediawiki128</name>
<range><lt>1.28.2</lt></range>
</package>
<package>
<name>mediawiki129</name>
<range><lt>1.29.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html">
<p>security fixes:</p>
<p>T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.</p>
<p>T165846: BotPasswords doesn't throttle login attempts.</p>
<p>T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.</p>
<p>T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.</p>
<p>T176247: It's possible to mangle HTML via raw message parameter expansion.</p>
<p>T125163: id attribute on headlines allow raw.</p>
<p>T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.</p>
<p>T119158: Language converter: unsafe attribute injection via glossary rules.</p>
<p>T180488: api.log contains passwords in plaintext wasn't correctly fixed.</p>
<p>T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8808</cvename>
<cvename>CVE-2017-8809</cvename>
<cvename>CVE-2017-8810</cvename>
<cvename>CVE-2017-8811</cvename>
<cvename>CVE-2017-8812</cvename>
<cvename>CVE-2017-8814</cvename>
<cvename>CVE-2017-8815</cvename>
<cvename>CVE-2017-0361</cvename>
<cvename>CVE-2017-9841</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-19</entry>
</dates>
</vuln>
<vuln vid="52f10525-caff-11e7-b590-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.187</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-33.html">
<ul>
<li>These updates resolve out-of-bounds read vulnerabilities that
could lead to remote code execution (CVE-2017-3112,
CVE-2017-3114, CVE-2017-11213).</li>
<li>These updates resolve use after free vulnerabilities that
could lead to remote code execution (CVE-2017-11215,
CVE-2017-11225).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3112</cvename>
<cvename>CVE-2017-3114</cvename>
<cvename>CVE-2017-11213</cvename>
<cvename>CVE-2017-11215</cvename>
<cvename>CVE-2017-11225</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-33.html</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-16</entry>
</dates>
</vuln>
<vuln vid="b4b7ec7d-ca27-11e7-a12d-6cc21735f730">
<topic>shibboleth2-sp -- "Dynamic" metadata provider plugin issue</topic>
<affects>
<package>
<name>shibboleth2-sp</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Internet2 community reports:</p>
<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20171115.txt">
<p>
The Shibboleth Service Provider software includes a MetadataProvider
plugin with the plugin type "Dynamic" to obtain metadata on demand
from a query server, in place of the more typical mode of
downloading aggregates separately containing all of the metadata to
load.
</p><p>
All the plugin types rely on MetadataFilter plugins to perform
critical security checks such as signature verification, enforcement
of validity periods, and other checks specific to deployments.
</p><p>
Due to a coding error, the "Dynamic" plugin fails to configure
itself with the filters provided to it and thus omits whatever
checks they are intended to perform, which will typically leave
deployments vulnerable to active attacks involving the substitution
of metadata if the network path to the query service is
compromised.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://shibboleth.internet2.edu/secadv/secadv_20171115.txt</url>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-11-15</entry>
</dates>
</vuln>
<vuln vid="f78eac48-c3d1-4666-8de5-63ceea25a578">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<!-- 56.0.2_10,1 unlike 57.0,1 has CVE-2017-7827 partially unfixed:
bug 1384615, 1386490, 1393840, 1403716 -->
<range><lt>56.0.2_10,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/">
<p>CVE-2017-7828: Use-after-free of PressShell while restyling layout</p>
<p>CVE-2017-7830: Cross-origin URL information leak through Resource Timing API</p>
<p>CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects</p>
<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
<p>CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters</p>
<p>CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections</p>
<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
<p>CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X</p>
<p>CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies</p>
<p>CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN</p>
<p>CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism</p>
<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
<p>CVE-2017-7842: Referrer Policy is not always respected for <link> elements</p>
<p>CVE-2017-7827: Memory safety bugs fixed in Firefox 57</p>
<p>CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7826</cvename>
<cvename>CVE-2017-7827</cvename>
<cvename>CVE-2017-7828</cvename>
<cvename>CVE-2017-7830</cvename>
<cvename>CVE-2017-7831</cvename>
<cvename>CVE-2017-7832</cvename>
<cvename>CVE-2017-7833</cvename>
<cvename>CVE-2017-7834</cvename>
<cvename>CVE-2017-7835</cvename>
<cvename>CVE-2017-7836</cvename>
<cvename>CVE-2017-7837</cvename>
<cvename>CVE-2017-7838</cvename>
<cvename>CVE-2017-7839</cvename>
<cvename>CVE-2017-7840</cvename>
<cvename>CVE-2017-7842</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-25/</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-14</entry>
</dates>
</vuln>
<vuln vid="27b38d85-c891-11e7-a7bd-cd1209e563f2">
<topic>rubygem-geminabox -- XSS vulnerabilities</topic>
<affects>
<package>
<name>rubygem-geminabox</name>
<range><lt>0.13.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-16792">
<p>Stored cross-site scripting (XSS) vulnerability in "geminabox"
(Gem in a Box) before 0.13.10 allows attackers to inject arbitrary
web script via the "homepage" value of a ".gemspec" file, related
to views/gem.erb and views/index.erb.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-16792</url>
<cvename>CVE-2017-16792</cvename>
</references>
<dates>
<discovery>2017-11-13</discovery>
<entry>2017-11-13</entry>
</dates>
</vuln>
<vuln vid="795ccee1-c7ed-11e7-ad7d-001e2a3f778d">
<topic>konversation -- crash in IRC message parsing</topic>
<affects>
<package>
<name>konversation</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20171112-1.txt">
<p>Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15923</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15923</url>
<url>https://www.kde.org/info/security/advisory-20171112-1.txt</url>
</references>
<dates>
<discovery>2017-10-27</discovery>
<entry>2017-11-12</entry>
</dates>
</vuln>
<vuln vid="f622608c-c53c-11e7-a633-009c02a2ab30">
<topic>roundcube -- file disclosure vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.3.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16651">
<p>Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before
1.3.3 allows unauthorized access to arbitrary files on the host's filesystem,
including configuration files, as exploited in the wild in November 2017.
The attacker must be able to authenticate at the target system with a valid
username/password as the attack requires an active session.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/roundcube/roundcubemail/issues/6026</url>
<url>https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10</url>
<cvename>CVE-2017-16651</cvename>
<freebsdpr>ports/223557</freebsdpr>
</references>
<dates>
<discovery>2017-11-06</discovery>
<entry>2017-11-11</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="f8e72cd4-c66a-11e7-bb17-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC.
Reported by Ned Williamson on 2017-10-24</li>
<li>[776677] High CVE-2017-15399: Use after free in V8. Reported by
Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15398</cvename>
<cvename>CVE-2017-15399</cvename>
<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-11-06</discovery>
<entry>2017-11-10</entry>
</dates>
</vuln>
<vuln vid="1f02af5d-c566-11e7-a12d-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.24</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.20</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.15</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.10</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.6</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1801/">
<ul>
<li>CVE-2017-15098: Memory disclosure in JSON functions</li>
<li>CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to
enforce SELECT privileges</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15099</cvename>
<cvename>CVE-2017-15098</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-11-09</entry>
</dates>
</vuln>
<vuln vid="1c2a9d76-9d98-43c3-8f5d-8c059b104d99">
<topic>jenkins -- multiple issues</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.89</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.73.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/99574">
<p>Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.</p>
<p>Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-11-08/</url>
</references>
<dates>
<discovery>2017-11-08</discovery>
<entry>2017-11-09</entry>
</dates>
</vuln>
<vuln vid="be261737-c535-11e7-8da5-001999f8d30b">
<topic>asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.5.0</ge><lt>13.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A memory leak occurs when an Asterisk pjsip session
object is created and that call gets rejected before the
session itself is fully established. When this happens
the session object never gets destroyed. This then leads
to file descriptors and RTP ports being leaked as well.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-011.html</url>
<cvename>CVE-2017-16672</cvename>
</references>
<dates>
<discovery>2017-10-15</discovery>
<entry>2017-11-09</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="ab04cb0b-c533-11e7-8da5-001999f8d30b">
<topic>asterisk -- Buffer overflow in CDR's set user</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>No size checking is done when setting the user field
for Party B on a CDR. Thus, it is possible for someone
to use an arbitrarily large string and write past the end
of the user field storage buffer. The earlier AST-2017-001
advisory for the CDR user field overflow was for the Party
A buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-010.html</url>
<cvename>CVE-2017-16671</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-11-09</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="19b052c9-c533-11e7-8da5-001999f8d30b">
<topic>asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.1</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.7.1</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>By carefully crafting invalid values in the Cseq and
the Via header port, pjprojects packet parsing code can
create strings larger than the buffer allocated to hold
them. This will usually cause Asterisk to crash immediately.
The packets do not have to be authenticated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-009.html</url>
</references>
<dates>
<discovery>2017-10-05</discovery>
<entry>2017-11-09</entry>
<modified>2017-11-15</modified>
</dates>
</vuln>
<vuln vid="f40f07aa-c00f-11e7-ac58-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2m,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20171102.txt">
<p>bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)<br/>
Severity: Moderate<br/>
There is a carry propagating bug in the x86_64 Montgomery squaring
procedure. No EC algorithms are affected. Analysis suggests that
attacks against RSA and DSA as a result of this defect would be
very difficult to perform and are not believed likely. Attacks
against DH are considered just feasible (although very difficult)
because most of the work necessary to deduce information about a
private key may be performed offline.</p>
<p>Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)<br/>
Severity: Low<br/>
This issue was previously announced in security advisory
https://www.openssl.org/news/secadv/20170828.txt, but the fix has
not previously been included in a release due to its low severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20171102.txt</url>
<cvename>CVE-2017-3735</cvename>
<cvename>CVE-2017-3736</cvename>
</references>
<dates>
<discovery>2017-11-02</discovery>
<entry>2017-11-02</entry>
</dates>
</vuln>
<vuln vid="cee3d12f-bf41-11e7-bced-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.8.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/">
<p>WordPress versions 4.8.2 and earlier are affected by an issue
where $wpdb->prepare() can create unexpected and unsafe queries
leading to potential SQL injection (SQLi). WordPress core is not
directly vulnerable to this issue, but we've added hardening to
prevent plugins and themes from accidentally causing a vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/</url>
</references>
<dates>
<discovery>2017-10-31</discovery>
<entry>2017-11-01</entry>
</dates>
</vuln>
<vuln vid="4684a426-774d-4390-aa19-b8dd481c4c94">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><le>2.2.9</le></range>
<range><ge>2.4.0</ge><le>2.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/101228">
<p>In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.</p>
<p>In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.</p>
<p>In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.</p>
<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.</p>
<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/101227</url>
<url>http://www.securityfocus.com/bid/101228</url>
<url>http://www.securityfocus.com/bid/101229</url>
<url>http://www.securityfocus.com/bid/101235</url>
<url>http://www.securityfocus.com/bid/101240</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080</url>
<url>https://code.wireshark.org/review/23470</url>
<url>https://code.wireshark.org/review/23537</url>
<url>https://code.wireshark.org/review/23591</url>
<url>https://code.wireshark.org/review/23635</url>
<url>https://code.wireshark.org/review/23663</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-42.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-43.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-44.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-45.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-46.html</url>
<cvename>CVE-2017-15189</cvename>
<cvename>CVE-2017-15190</cvename>
<cvename>CVE-2017-15191</cvename>
<cvename>CVE-2017-15192</cvename>
<cvename>CVE-2017-15193</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-30</entry>
</dates>
</vuln>
<vuln vid="de7a2b32-bd7d-11e7-b627-d43d7e971a1b">
<topic>PHP -- denial of service attack</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.32</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.25</lt></range>
</package>
<package>
<name>php71</name>
<range><lt>7.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-3">
<p>The PHP development team announces the immediate availability of PHP
5.6.32. This is a security release. Several security bugs were fixed in this
release. All PHP 5.6 users are encouraged to upgrade to this version.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-1">
<p>The PHP development team announces the immediate availability of PHP
7.0.25. This is a security release. Several security bugs were fixed in this
release. All PHP 7.0 users are encouraged to upgrade to this version.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-27-1">
<p>The PHP development team announces the immediate availability of PHP
7.1.11. This is a bugfix release, with several bug fixes included. All PHP
7.1 users are encouraged to upgrade to this version. </p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2017.php#id2017-10-26-3</url>
<url>http://php.net/archive/2017.php#id2017-10-26-1</url>
<url>http://php.net/archive/2017.php#id2017-10-27-1</url>
<cvename>CVE-2016-1283</cvename>
</references>
<dates>
<discovery>2017-10-26</discovery>
<entry>2017-10-30</entry>
<modified>2017-11-14</modified>
</dates>
</vuln>
<vuln vid="3cd46257-bbc5-11e7-a3bc-e8e0b747a45a">
<topic>chromium -- Stack overflow in V8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[770452] High CVE-2017-15396: Stack overflow in V8. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
<li>[770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15396</cvename>
<cvename>CVE-2017-15406</cvename>
<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2017-10-26</discovery>
<entry>2017-10-28</entry>
<modified>2018-01-23</modified>
</dates>
</vuln>
<vuln vid="d77ceb8c-bb13-11e7-8357-3065ec6f3643">
<topic>wget -- Heap overflow in HTTP protocol handling</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
<p>Wget contains two vulnerabilities, a stack overflow and a heap
overflow, in the handling of HTTP chunked encoding. By convincing
a user to download a specific link over HTTP, an attacker may be
able to execute arbitrary code with the privileges of the user.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba</url>
<cvename>CVE-2017-13090</cvename>
</references>
<dates>
<discovery>2017-10-20</discovery>
<entry>2017-10-27</entry>
</dates>
</vuln>
<vuln vid="09849e71-bb12-11e7-8357-3065ec6f3643">
<topic>wget -- Stack overflow in HTTP protocol handling</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
<p>Wget contains two vulnerabilities, a stack overflow and a heap
overflow, in the handling of HTTP chunked encoding. By convincing
a user to download a specific link over HTTP, an attacker may be
able to execute arbitrary code with the privileges of the user.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f</url>
<cvename>CVE-2017-13089</cvename>
</references>
<dates>
<discovery>2017-10-20</discovery>
<entry>2017-10-27</entry>
</dates>
</vuln>
<vuln vid="d7d1cc94-b971-11e7-af3a-f1035dd0da62">
<topic>Node.js -- remote DOS security vulnerability</topic>
<affects>
<package>
<name>node</name>
<range><lt>8.8.0</lt></range>
</package>
<package>
<name>node6</name>
<range><ge>6.10.2</ge><lt>6.11.5</lt></range>
</package>
<package>
<name>node4</name>
<range><ge>4.8.2</ge><lt>4.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/oct-2017-dos/">
<p>Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/oct-2017-dos/</url>
<cvename>CVE-2017-14919</cvename>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-25</entry>
</dates>
</vuln>
<vuln vid="418c172b-b96f-11e7-b627-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>2.8.0</ge><le>9.4.6</le></range>
<range><ge>9.5.0</ge><le>9.5.8</le></range>
<range><ge>10.0.0</ge><le>10.0.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/">
<h1>Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization
filter</h1>
<p>Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS)
vulnerability in the GitLab markdown sanitization filter. The sanitization
filter was not properly stripping invalid characters from URL schemes and
was therefore vulnerable to persistent XSS attacks anywhere Markdown was
supported.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in search bar</h1>
<p>Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the
issue search bar. Usernames were not being properly HTML escaped inside the
author filter would could allow arbitrary script execution.</p>
<h1>Open redirect in repository git redirects</h1>
<p>Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an
open redirect vulnerability when redirecting requests for repository names
that include the git extension. GitLab was not properly removing dangerous
parameters from the params field before redirecting which could allow an
attacker to redirect users to arbitrary hosts.</p>
<h1>Username changes could leave repositories behind</h1>
<p>An internal code review discovered that a bug in the code that moves
repositories during a username change could potentially leave behind
projects, allowing an attacker who knows the previous username to
potentially steal the contents of repositories on instances that are not
configured with hashed namespaces.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-25</entry>
</dates>
</vuln>
<vuln vid="27229c67-b8ff-11e7-9f79-ac9e174be3af">
<topic>Apache OpenOffice -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.4</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1810071_1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Openofffice project reports:</p>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-3157.html">
<h1>CVE-2017-3157: Arbitrary file disclosure in Calc and Writer</h1>
<p>By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.</p>
<p>The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-9806.html">
<h1>CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor</h1>
<p>A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12607.html">
<h1>CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter</h1>
<p>A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12608.html">
<h1>CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles</h1>
<p>A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openoffice.org/security/cves/CVE-2017-3157.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-9806.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-12607.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-12608.html</url>
<cvename>CVE-2017-3157</cvename>
<cvename>CVE-2017-9806</cvename>
<cvename>CVE-2017-12607</cvename>
<cvename>CVE-2017-12608</cvename>
</references>
<dates>
<discovery>2016-09-11</discovery>
<entry>2017-10-24</entry>
<modified>2017-10-26</modified>
</dates>
</vuln>
<vuln vid="143ec3d6-b7cf-11e7-ac58-b499baebfeaf">
<topic>cURL -- out of bounds read</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.20</ge><lt>7.56.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20171023.html">
<p>libcurl contains a buffer overrun flaw in the IMAP handler.<br/>
An IMAP FETCH response line indicates the size of the returned data,
in number of bytes. When that response says the data is zero bytes,
libcurl would pass on that (non-existing) data with a pointer and
the size (zero) to the deliver-data function.<br/>
libcurl's deliver-data function treats zero as a magic number and
invokes strlen() on the data to figure out the length. The strlen()
is called on a heap based buffer that might not be zero terminated
so libcurl might read beyond the end of it into whatever memory lies
after (or just crash) and then deliver that to the application as if
it was actually downloaded.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20171023.html</url>
<cvename>CVE-2017-1000257</cvename>
</references>
<dates>
<discovery>2017-10-23</discovery>
<entry>2017-10-23</entry>
</dates>
</vuln>
<vuln vid="10c0fabc-b5da-11e7-816e-00bd5d1fff09">
<topic>h2o -- DoS in workers</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frederik Deweerdt reports:</p>
<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.3">
<p>Multiple Denial-of-Service vulnerabilities exist in h2o workers -
see references for full details.</p>
<p>CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.</p>
<p>CVE-2017-10869: The stack may overflow when proxying huge requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-10868</cvename>
<cvename>CVE-2017-10869</cvename>
<url>https://github.com/h2o/h2o/issues/1459</url>
<url>https://github.com/h2o/h2o/issues/1460</url>
<url>https://github.com/h2o/h2o/releases/tag/v2.2.3</url>
</references>
<dates>
<discovery>2017-07-19</discovery>
<entry>2017-10-17</entry>
</dates>
</vuln>
<vuln vid="85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_10.txt">
<p>When installing themes with unterminated colour formatting
sequences, Irssi may access data beyond the end of the string.</p>
<p>While waiting for the channel synchronisation, Irssi may
incorrectly fail to remove destroyed channels from the query list,
resulting in use after free conditions when updating the state later
on.</p>
<p>Certain incorrectly formatted DCC CTCP messages could cause NULL
pointer dereference.</p>
<p>Overlong nicks or targets may result in a NULL pointer dereference
while splitting the message.</p>
<p>In certain cases Irssi may fail to verify that a Safe channel ID
is long enough, causing reads beyond the end of the string.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_10.txt</url>
<cvename>CVE-2017-15721</cvename>
<cvename>CVE-2017-15722</cvename>
<cvename>CVE-2017-15723</cvename>
<cvename>CVE-2017-15227</cvename>
<cvename>CVE-2017-15228</cvename>
<freebsdpr>ports/223169</freebsdpr>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-22</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="a692bffe-b6ad-11e7-a1c2-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html">
<p>35 security fixes in this release, including:</p>
<ul>
<li>[762930] High CVE-2017-5124: UXSS with MHTML. Reported by
Anonymous on 2017-09-07</li>
<li>[749147] High CVE-2017-5125: Heap overflow in Skia. Reported by
Anonymous on 2017-07-26</li>
<li>[760455] High CVE-2017-5126: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-08-30</li>
<li>[765384] High CVE-2017-5127: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-09-14</li>
<li>[765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by
Omair on 2017-09-14</li>
<li>[765495] High CVE-2017-5129: Use after free in WebAudio. Reported by
Omair on 2017-09-15</li>
<li>[718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by
Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05</li>
<li>[722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by
Pranjal Jumde on 2017-05-14</li>
<li>[744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by
Anonymous on 2017-07-16</li>
<li>[762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by
Aleksandar Nikolic of Cisco Talos on 2017-09-05</li>
<li>[752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03</li>
<li>[756040] Medium CVE-2017-15387: Content security bypass. Reported by
Jun Kokatsu on 2017-08-16</li>
<li>[756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by
Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17</li>
<li>[739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by
xisigr of Tencent's Xuanwu Lab on 2017-07-06</li>
<li>[750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by
Haosheng Wang on 2017-07-28</li>
<li>[598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by
Joao Lucas Melo Brasio on 2016-03-28</li>
<li>[714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration.
Reported by Xiaoyin Liu on 2017-04-22</li>
<li>[732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by
Svyat Mitin on 2017-06-13</li>
<li>[745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by
Sam on 2017-07-18</li>
<li>[759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by
Johannes Bergman on 2017-08-28</li>
<li>[775550] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5124</cvename>
<cvename>CVE-2017-5125</cvename>
<cvename>CVE-2017-5126</cvename>
<cvename>CVE-2017-5127</cvename>
<cvename>CVE-2017-5128</cvename>
<cvename>CVE-2017-5129</cvename>
<cvename>CVE-2017-5132</cvename>
<cvename>CVE-2017-5130</cvename>
<cvename>CVE-2017-5131</cvename>
<cvename>CVE-2017-5133</cvename>
<cvename>CVE-2017-15386</cvename>
<cvename>CVE-2017-15387</cvename>
<cvename>CVE-2017-15388</cvename>
<cvename>CVE-2017-15389</cvename>
<cvename>CVE-2017-15390</cvename>
<cvename>CVE-2017-15391</cvename>
<cvename>CVE-2017-15392</cvename>
<cvename>CVE-2017-15393</cvename>
<cvename>CVE-2017-15394</cvename>
<cvename>CVE-2017-15395</cvename>
<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-21</entry>
</dates>
</vuln>
<vuln vid="e1cb9dc9-daa9-44db-adde-e94d900e2f7f">
<topic>cacti -- Cross Site Scripting issue</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.1.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cacti developers report:</p>
<blockquote cite=" https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd">
<p>The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securitytracker.com/id/1039569</url>
<url>https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd</url>
<url>https://github.com/Cacti/cacti/issues/1010</url>
<cvename>CVE-2017-15194</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-19</entry>
</dates>
</vuln>
<vuln vid="b95e5674-b4d6-11e7-b895-0cc47a494882">
<topic>arj -- multiple vulnerabilities</topic>
<affects>
<package>
<name>arj</name>
<range><lt>3.10.22_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several vulnerabilities: symlink directory traversal, absolute path directory
traversal and buffer overflow were discovered in the arj archiver.</p>
</body>
</description>
<references>
<cvename>CVE-2015-0556</cvename>
<cvename>CVE-2015-0557</cvename>
<cvename>CVE-2015-2782</cvename>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2017-10-19</entry>
</dates>
</vuln>
<vuln vid="3f3837cc-48fb-4414-aa46-5b1c23c9feae">
<topic>krb5 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.14.6</lt></range>
<range><ge>1.15</ge><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-devel</name>
<range><lt>1.14.6</lt></range>
<range><ge>1.15</ge><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-115</name>
<range><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-114</name>
<range><lt>1.14.6</lt></range>
</package>
<package>
<name>krb5-113</name>
<range><lt>1.14.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MIT reports:</p>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8599">
<p>CVE-2017-11368:</p>
<p>In MIT krb5 1.7 and later, an authenticated attacker can cause an
assertion failure in krb5kdc by sending an invalid S4U2Self or
S4U2Proxy request.</p>
</blockquote>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598">
<p>CVE-2017-11462:</p>
<p>RFC 2744 permits a GSS-API implementation to delete an existing
security context on a second or subsequent call to gss_init_sec_context()
or gss_accept_sec_context() if the call results in an error.
This API behavior has been found to be dangerous, leading to the
possibility of memory errors in some callers. For safety, GSS-API
implementations should instead preserve existing security contexts
on error until the caller deletes them.</p>
<p>All versions of MIT krb5 prior to this change may delete acceptor
contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through
1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts
on error.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11368</url>
<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8599</url>
<url>https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11462</url>
<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8598</url>
<url>https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf</url>
<cvename>CVE-2017-11368</cvename>
<cvename>CVE-2017-11462</cvename>
</references>
<dates>
<discovery>2017-07-14</discovery>
<entry>2017-10-18</entry>
</dates>
</vuln>
<vuln vid="c41bedfd-b3f9-11e7-ac58-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.33</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.29</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.10</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.38</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.20</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.38</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL</url>
<cvename>CVE-2017-10155</cvename>
<cvename>CVE-2017-10379</cvename>
<cvename>CVE-2017-10384</cvename>
<cvename>CVE-2017-10276</cvename>
<cvename>CVE-2017-10167</cvename>
<cvename>CVE-2017-10378</cvename>
<cvename>CVE-2017-10277</cvename>
<cvename>CVE-2017-10203</cvename>
<cvename>CVE-2017-10283</cvename>
<cvename>CVE-2017-10313</cvename>
<cvename>CVE-2017-10296</cvename>
<cvename>CVE-2017-10311</cvename>
<cvename>CVE-2017-10320</cvename>
<cvename>CVE-2017-10314</cvename>
<cvename>CVE-2017-10227</cvename>
<cvename>CVE-2017-10279</cvename>
<cvename>CVE-2017-10294</cvename>
<cvename>CVE-2017-10165</cvename>
<cvename>CVE-2017-10284</cvename>
<cvename>CVE-2017-10286</cvename>
<cvename>CVE-2017-10268</cvename>
<cvename>CVE-2017-10365</cvename>
</references>
<dates>
<discovery>2017-10-18</discovery>
<entry>2017-10-18</entry>
<modified>2017-12-23</modified>
</dates>
</vuln>
<vuln vid="ab881a74-c016-4e6d-9f7d-68c8e7cedafb">
<topic>xorg-server -- Multiple Issues</topic>
<affects>
<package>
<name>xorg-server</name>
<range><le>1.18.4_6,1</le></range>
<range><ge>1.19.0,1</ge><le>1.19.3,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xorg-server developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99546">
<p>In the X.Org X server before 2017-06-19, a user authenticated to
an X Session could crash or execute code in the context of the X
Server by exploiting a stack overflow in the endianness conversion
of X Events.</p>
<p>Uninitialized data in endianness conversion in the XEvent handling
of the X.Org X Server before 2017-06-19 allowed authenticated
malicious users to access potentially privileged data from the X
server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99546</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455</url>
<url>http://www.securityfocus.com/bid/99543</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced</url>
<cvename>CVE-2017-10971</cvename>
<cvename>CVE-2017-10972</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-10-17</entry>
<modified>2018-05-20</modified>
</dates>
</vuln>
<vuln vid="a73518da-b2fa-11e7-98ef-d43d7ef03aa6">
<topic>Flash Player -- Remote code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.170</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-32.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to remote code execution (CVE-2017-11292).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11292</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-32.html</url>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-10-17</entry>
</dates>
</vuln>
<vuln vid="d670a953-b2a1-11e7-a633-009c02a2ab30">
<topic>WPA packet number reuse with replayed messages and key reinstallation</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><le>2.6_1</le></range>
</package>
<package>
<name>hostapd</name>
<range><le>2.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wpa_supplicant developers report:</p>
<blockquote cite="http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt">
<p>A vulnerability was found in how a number of implementations can be
triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by
replaying a specific frame that is used to manage the keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt</url>
<url>https://www.kb.cert.org/vuls/id/228519</url>
<cvename>CVE-2017-13077</cvename>
<cvename>CVE-2017-13078</cvename>
<cvename>CVE-2017-13079</cvename>
<cvename>CVE-2017-13080</cvename>
<cvename>CVE-2017-13081</cvename>
<cvename>CVE-2017-13082</cvename>
<cvename>CVE-2017-13084</cvename>
<cvename>CVE-2017-13086</cvename>
<cvename>CVE-2017-13087</cvename>
<cvename>CVE-2017-13088</cvename>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-10-16</entry>
</dates>
</vuln>
<vuln vid="b0628e53-092a-4037-938b-29805a7cd31b">
<topic>mercurial -- multiple issues</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mercurial developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100290">
<p>Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository</p>
<p>Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100290</url>
<url>https://security.gentoo.org/glsa/201709-18</url>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<url>http://www.securityfocus.com/bid/100290</url>
<url>https://security.gentoo.org/glsa/201709-18</url>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<cvename>CVE-2017-1000115</cvename>
<cvename>CVE-2017-1000116</cvename>
</references>
<dates>
<discovery>2017-10-05</discovery>
<entry>2017-10-16</entry>
</dates>
</vuln>
<vuln vid="555cd806-b031-11e7-a369-14dae9d59f67">
<topic>Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco TALOS reports:</p>
<blockquote cite="http://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430">
<p>An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
<blockquote cite="https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431">
<p>An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430</url>
<cvename>CVE-2017-2923</cvename>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431</url>
<cvename>CVE-2017-2924</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="ed73829d-af6d-11e7-a633-009c02a2ab30">
<topic>FFmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.3.4</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-29.x has ffmpeg-3.2 -->
<range><lt>29.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ffmpeg.org/security.html</url>
<cvename>CVE-2017-14054</cvename>
<cvename>CVE-2017-14055</cvename>
<cvename>CVE-2017-14056</cvename>
<cvename>CVE-2017-14057</cvename>
<cvename>CVE-2017-14058</cvename>
<cvename>CVE-2017-14059</cvename>
<cvename>CVE-2017-14169</cvename>
<cvename>CVE-2017-14170</cvename>
<cvename>CVE-2017-14171</cvename>
<cvename>CVE-2017-14222</cvename>
<cvename>CVE-2017-14223</cvename>
<cvename>CVE-2017-14225</cvename>
<cvename>CVE-2017-14767</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-10-12</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="7274e0cc-575f-41bc-8619-14a41b3c2ad0">
<topic>xorg-server -- multiple vulnabilities</topic>
<affects>
<package>
<name>xephyr</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.19.1_2,2</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.19.1_2,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.19.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Jackson reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002814.html">
<p>One regression fix since 1.19.4 (mea culpa), and fixes for
CVEs 2017-12176 through 2017-12187.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2017-October/002814.html</url>
<cvename>CVE-2017-12176</cvename>
<cvename>CVE-2017-12177</cvename>
<cvename>CVE-2017-12178</cvename>
<cvename>CVE-2017-12179</cvename>
<cvename>CVE-2017-12180</cvename>
<cvename>CVE-2017-12181</cvename>
<cvename>CVE-2017-12182</cvename>
<cvename>CVE-2017-12183</cvename>
<cvename>CVE-2017-12184</cvename>
<cvename>CVE-2017-12185</cvename>
<cvename>CVE-2017-12186</cvename>
<cvename>CVE-2017-12187</cvename>
</references>
<dates>
<discovery>2017-10-12</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="e837390d-0ceb-46b8-9b32-29c1195f5dc7">
<topic>solr -- Code execution via entity expansion</topic>
<affects>
<package>
<name>apache-solr</name>
<range><ge>5.1</ge><le>6.6.1</le></range>
<range><ge>7.0.0</ge><lt>7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Solr developers report:</p>
<blockquote cite="http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html">
<p>Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.</p>
<p>Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html</url>
<url>https://marc.info/?l=apache-announce&m=150786685013286</url>
<cvename>CVE-2017-12629</cvename>
</references>
<dates>
<discovery>2017-10-13</discovery>
<entry>2017-10-13</entry>
<modified>2017-10-16</modified>
</dates>
</vuln>
<vuln vid="6dc3c61c-e866-4c27-93f7-ae50908594fd">
<topic>jenkins -- multiple issues</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.83</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.73.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-10-11/">
<p>A total of 11 issues are reported, please see reference URL for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-10-11/</url>
</references>
<dates>
<discovery>2017-10-11</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="da70d472-af59-11e7-ace2-f8b156b439c5">
<topic>xen-kernel -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.2_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-237.html</url>
<url>http://xenbits.xen.org/xsa/advisory-238.html</url>
<url>http://xenbits.xen.org/xsa/advisory-239.html</url>
<url>http://xenbits.xen.org/xsa/advisory-240.html</url>
<url>http://xenbits.xen.org/xsa/advisory-241.html</url>
<url>http://xenbits.xen.org/xsa/advisory-242.html</url>
<url>http://xenbits.xen.org/xsa/advisory-243.html</url>
<url>http://xenbits.xen.org/xsa/advisory-244.html</url>
</references>
<dates>
<discovery>2017-10-12</discovery>
<entry>2017-10-12</entry>
</dates>
</vuln>
<vuln vid="e71fd9d3-af47-11e7-a633-009c02a2ab30">
<topic>nss -- Use-after-free in TLS 1.2 generating handshake hashes</topic>
<affects>
<package>
<name>nss</name>
<range><ge>3.32</ge><lt>3.32.1</lt></range>
<range><ge>3.28</ge><lt>3.28.6</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
</package>
<package>
<name>linux-c7-nss</name>
<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805">
<p>During TLS 1.2 exchanges, handshake hashes are generated which
point to a message buffer. This saved data is used for later
messages but in some cases, the handshake transcript can
exceed the space available in the current buffer, causing the
allocation of a new buffer. This leaves a pointer pointing to
the old, freed buffer, resulting in a use-after-free when
handshake hashes are then calculated afterwards. This can
result in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805</url>
<url>https://hg.mozilla.org/projects/nss/rev/2d7b65b72290</url>
<url>https://hg.mozilla.org/projects/nss/rev/d3865e2957d0</url>
<cvename>CVE-2017-7805</cvename>
</references>
<dates>
<discovery>2017-08-04</discovery>
<entry>2017-10-12</entry>
<modified>2018-01-29</modified>
</dates>
</vuln>
<vuln vid="15a62f22-098a-443b-94e2-2d26c375b993">
<topic>osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer</topic>
<affects>
<package>
<name>libosip2</name>
<range><le>5.0.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>osip developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/97644">
<p>In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/97644</url>
<url>https://savannah.gnu.org/support/index.php?109265</url>
<cvename>CVE-2017-7853</cvename>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="b84dbd94-e894-4c91-b8cd-d328537b1b2b">
<topic>ncurses -- multiple issues</topic>
<affects>
<package>
<name>ncurses</name>
<range><le>6.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ncurses developers reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1484285">
<p>There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484274</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484276</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484284</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484285</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484287</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484290</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484291</url>
<cvename>CVE-2017-13728</cvename>
<cvename>CVE-2017-13729</cvename>
<cvename>CVE-2017-13730</cvename>
<cvename>CVE-2017-13731</cvename>
<cvename>CVE-2017-13732</cvename>
<cvename>CVE-2017-13733</cvename>
<cvename>CVE-2017-13734</cvename>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="9164f51e-ae20-11e7-a633-009c02a2ab30">
<topic>Python 2.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS">
<p>Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS</url>
<cvename>CVE-2012-0876</cvename>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-4472</cvename>
<cvename>CVE-2016-5300</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
</references>
<dates>
<discovery>2017-08-26</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="1257718e-be97-458a-9744-d938b592db42">
<topic>node -- access to unintended files</topic>
<affects>
<package>
<name>node</name>
<range><ge>8.5.0</ge><lt>8.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/101056">
<p>Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/101056</url>
<cvename>CVE-2017-14849</cvename>
</references>
<dates>
<discovery>2017-09-27</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="af61b271-9e47-4db0-a0f6-29fb032236a3">
<topic>zookeeper -- Denial Of Service</topic>
<affects>
<package>
<name>zookeeper</name>
<range><lt>3.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zookeeper developers report:</p>
<blockquote cite="https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E">
<p>Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E</url>
<cvename>CVE-2017-5637</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="9b5a905f-e556-452f-a00c-8f070a086181">
<topic>libtiff -- Improper Input Validation</topic>
<affects>
<package>
<name>libtiff</name>
<range><le>4.0.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtiff developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100524">
<p>There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
<p>There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2727</url>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2728</url>
<url>http://www.securityfocus.com/bid/100524</url>
<cvename>CVE-2017-13726</cvename>
<cvename>CVE-2017-13727</cvename>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="2c8bd00d-ada2-11e7-82af-8dbff7d75206">
<topic>rubygems -- deserialization vulnerability</topic>
<affects>
<package>
<name>ruby22-gems</name>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<range><lt>2.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oss-security mailing list:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/10/10/2">
<p>There is a possible unsafe object desrialization vulnerability in
RubyGems. It is possible for YAML deserialization of gem specifications
to bypass class white lists. Specially crafted serialized objects can
possibly be used to escalate to remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/10/10/2</url>
<url>http://blog.rubygems.org/2017/10/09/2.6.14-released.html</url>
<cvename>CVE-2017-0903</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="4f8ffb9c-f388-4fbd-b90f-b3131559d888">
<topic>xorg-server -- multiple vulnabilities</topic>
<affects>
<package>
<name>xephyr</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.19.1_1,2</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.19.1_1,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.19.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002809.html">
<p>X.Org thanks Michal Srb of SuSE for finding these issues
and bringing them to our attention, Julien Cristau of
Debian for getting the fixes integrated, and Adam Jackson
of Red Hat for publishing the release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2017-October/002809.html</url>
<cvename>CVE-2017-13721</cvename>
<cvename>CVE-2017-13723</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-09</entry>
</dates>
</vuln>
<vuln vid="c0dae634-4820-4505-850d-b1c975d0f67d">
<topic>tomcat -- Remote Code Execution</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>7.0.0</ge><le>7.0.81</le></range>
<range><ge>8.0.0</ge><le>8.0.46</le></range>
<range><ge>8.5.0</ge><le>8.5.22</le></range>
<range><ge>9.0.0</ge><lt>9.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tomcat developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100954">
<p>When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100954</url>
<url>https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E</url>
<cvename>CVE-2017-12617</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-06</entry>
</dates>
</vuln>
<vuln vid="ccace707-a8d8-11e7-ac58-b499baebfeaf">
<topic>cURL -- out of bounds read</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20171004.html">
<p>FTP PWD response parser out of bounds read</p>
<p>libcurl may read outside of a heap allocated buffer when doing FTP.</p>
<p>When libcurl connects to an FTP server and successfully logs in
(anonymous or not), it asks the server for the current directory with
the PWD command. The server then responds with a 257 response containing
the path, inside double quotes. The returned path name is then kept by
libcurl for subsequent uses.</p>
<p>Due to a flaw in the string parser for this directory name, a directory
name passed like this but without a closing double quote would lead to
libcurl not adding a trailing NUL byte to the buffer holding the name.
When libcurl would then later access the string, it could read beyond
the allocated heap buffer and crash or wrongly access data beyond the
buffer, thinking it was part of the path.</p>
<p>A malicious server could abuse this fact and effectively prevent
libcurl-based clients to work with it - the PWD command is always issued
on new FTP connections and the mistake has a high chance of causing a
segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20171004.html</url>
<cvename>CVE-2017-1000254</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-04</entry>
</dates>
</vuln>
<vuln vid="6ed5c5e3-a840-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSH Denial of Service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_1</lt></range>
<range><ge>11.0</ge><lt>11.0_12</lt></range>
<range><ge>10.3</ge><lt>10.3_21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is no limit on the password length.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause an affected SSH
server to use excessive amount of CPU by sending very long
passwords, when PasswordAuthentication is enabled by the
system administrator.</p>
</body>
</description>
<references>
<cvename>CVE-2016-6515</cvename>
<freebsdsa>SA-17:06.openssh</freebsdsa>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-10-03</entry>
</dates>
</vuln>
<vuln vid="420243e9-a840-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- heimdal KDC-REP service name validation vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_11</lt></range>
<range><ge>10.3</ge><lt>10.3_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a programming error in the Heimdal implementation
that used an unauthenticated, plain-text version of the
KDC-REP service name found in a ticket.</p>
<h1>Impact:</h1>
<p>An attacker who has control of the network between a
client and the service it talks to will be able to impersonate
the service, allowing a successful man-in-the-middle (MITM)
attack that circumvents the mutual authentication.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1110</cvename>
<freebsdsa>SA-17:05.heimdal</freebsdsa>
</references>
<dates>
<discovery>2017-07-12</discovery>
<entry>2017-10-03</entry>
</dates>
</vuln>
<vuln vid="b77b5646-a778-11e7-ac58-b499baebfeaf">
<topic>dnsmasq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.78,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Project Zero reports:</p>
<blockquote cite="https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html">
<ul>
<li>CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this
commit overflow was unrestricted.</li>
<li>CVE-2017-14492: Heap based overflow.</li>
<li>CVE-2017-14493: Stack Based overflow.</li>
<li>CVE-2017-14494: Information Leak</li>
<li>CVE-2017-14495: Lack of free()</li>
<li>CVE-2017-14496: Invalid boundary checks. Integer underflow leading
to a huge memcpy.</li>
<li>CVE-2017-13704: Crash on large DNS query</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html</url>
<cvename>CVE-2017-14491</cvename>
<cvename>CVE-2017-14492</cvename>
<cvename>CVE-2017-14493</cvename>
<cvename>CVE-2017-14494</cvename>
<cvename>CVE-2017-14495</cvename>
<cvename>CVE-2017-14496</cvename>
<cvename>CVE-2017-13704</cvename>
</references>
<dates>
<discovery>2017-10-02</discovery>
<entry>2017-10-02</entry>
</dates>
</vuln>
<vuln vid="33888815-631e-4bba-b776-a9b46fe177b5">
<topic>phpmyfaq -- multiple issues</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><le>2.9.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.exploit-db.com/exploits/42761/">
<p>Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.</p>
<p>Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.exploit-db.com/exploits/42761/</url>
<url>https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86</url>
<cvename>CVE-2017-14618</cvename>
<cvename>CVE-2017-14619</cvename>
</references>
<dates>
<discovery>2017-09-20</discovery>
<entry>2017-09-29</entry>
</dates>
</vuln>
<vuln vid="a48d4478-e23f-4085-8ae4-6b3a7b6f016b">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100912">
<p>Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.</p>
<p>Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.</p>
<p>Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.</p>
<p>Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.</p>
<p>Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.</p>
<p>Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.</p>
<p>Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100912</url>
<url>https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/</url>
<url>https://core.trac.wordpress.org/changeset/41393</url>
<url>https://core.trac.wordpress.org/changeset/41395</url>
<url>https://core.trac.wordpress.org/changeset/41397</url>
<url>https://core.trac.wordpress.org/changeset/41412</url>
<url>https://core.trac.wordpress.org/changeset/41448</url>
<url>https://core.trac.wordpress.org/changeset/41457</url>
<url>https://wpvulndb.com/vulnerabilities/8911</url>
<url>https://wpvulndb.com/vulnerabilities/8912</url>
<url>https://wpvulndb.com/vulnerabilities/8913</url>
<url>https://wpvulndb.com/vulnerabilities/8914</url>
<cvename>CVE-2017-14718</cvename>
<cvename>CVE-2017-14719</cvename>
<cvename>CVE-2017-14720</cvename>
<cvename>CVE-2017-14721</cvename>
<cvename>CVE-2017-14722</cvename>
<cvename>CVE-2017-14724</cvename>
<cvename>CVE-2017-14726</cvename>
</references>
<dates>
<discovery>2017-09-23</discovery>
<entry>2017-09-29</entry>
</dates>
</vuln>
<vuln vid="1098a15b-b0f6-42b7-b5c7-8a8646e8be07">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>56.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
<p>CVE-2017-7793: Use-after-free with Fetch API</p>
<p>CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode</p>
<p>CVE-2017-7818: Use-after-free during ARIA array manipulation</p>
<p>CVE-2017-7819: Use-after-free while resizing images in design mode</p>
<p>CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE</p>
<p>CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes</p>
<p>CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files</p>
<p>CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings</p>
<p>CVE-2017-7813: Integer truncation in the JavaScript parser</p>
<p>CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces</p>
<p>CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations</p>
<p>CVE-2017-7816: WebExtensions can load about: URLs in extension UI</p>
<p>CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction</p>
<p>CVE-2017-7823: CSP sandbox directive did not create a unique origin</p>
<p>CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV</p>
<p>CVE-2017-7820: Xray wrapper bypass with new tab and web console</p>
<p>CVE-2017-7811: Memory safety bugs fixed in Firefox 56</p>
<p>CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7793</cvename>
<cvename>CVE-2017-7805</cvename>
<cvename>CVE-2017-7810</cvename>
<cvename>CVE-2017-7811</cvename>
<cvename>CVE-2017-7812</cvename>
<cvename>CVE-2017-7813</cvename>
<cvename>CVE-2017-7814</cvename>
<cvename>CVE-2017-7815</cvename>
<cvename>CVE-2017-7816</cvename>
<cvename>CVE-2017-7817</cvename>
<cvename>CVE-2017-7818</cvename>
<cvename>CVE-2017-7819</cvename>
<cvename>CVE-2017-7820</cvename>
<cvename>CVE-2017-7821</cvename>
<cvename>CVE-2017-7822</cvename>
<cvename>CVE-2017-7823</cvename>
<cvename>CVE-2017-7824</cvename>
<cvename>CVE-2017-7825</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/</url>
</references>
<dates>
<discovery>2017-09-28</discovery>
<entry>2017-09-29</entry>
<modified>2017-10-03</modified>
</dates>
</vuln>
<vuln vid="43a1b8f9-3451-4f3c-b4fc-730c0f5876c1">
<topic>sam2p -- multiple issues</topic>
<affects>
<package>
<name>sam2p</name>
<range><lt>0.49.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sam2p developers report:</p>
<blockquote cite="https://github.com/pts/sam2p/issues/14">
<p>In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.</p>
<p>In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.</p>
<p>In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.</p>
<p>In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.</p>
<p>Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.</p>
<p>In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/pts/sam2p/issues/14</url>
<cvename>CVE-2017-14628</cvename>
<cvename>CVE-2017-14629</cvename>
<cvename>CVE-2017-14630</cvename>
<cvename>CVE-2017-14631</cvename>
<cvename>CVE-2017-14636</cvename>
<cvename>CVE-2017-14637</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-28</entry>
</dates>
</vuln>
<vuln vid="02bee9ae-c5d1-409b-8a79-983a88861509">
<topic>libraw -- Out-of-bounds Read</topic>
<affects>
<package>
<name>libraw</name>
<range><le>0.18.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21">
<p>In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21</url>
<url>https://github.com/LibRaw/LibRaw/issues/101</url>
<cvename>CVE-2017-14608</cvename>
</references>
<dates>
<discovery>2017-09-20</discovery>
<entry>2017-09-28</entry>
</dates>
</vuln>
<vuln vid="3dd6ccf4-a3c6-11e7-a52e-0800279f2ff8">
<topic>OpenVPN -- out-of-bounds write in legacy key-method 1</topic>
<affects>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.18</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
</package>
<package>
<name>openvpn</name>
<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
<range><lt>2.3.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steffan Karger reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2017-12166">
<p>The bounds check in read_key() was performed after using the value,
instead of before. If 'key-method 1' is used, this allowed an
attacker to send a malformed packet to trigger a stack buffer
overflow. [...]</p>
<p>Note that 'key-method 1' has been replaced by 'key method 2' as the
default in OpenVPN 2.0 (released on 2005-04-17), and explicitly
deprecated in 2.4 and marked for removal in 2.5. This should limit
the amount of users impacted by this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/CVE-2017-12166</url>
<url>https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html</url>
<cvename>CVE-2017-12166</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="16fb4f83-a2ab-11e7-9c14-009c02a2ab30">
<topic>ImageMagick -- denial of service via a crafted font file</topic>
<affects>
<package>
<name>ImageMagick7</name>
<range><lt>7.0.7.4</lt></range>
</package>
<package>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.7.4</lt></range>
</package>
<package>
<name>ImageMagick</name>
<range><le>6.9.8.9_1</le></range>
</package>
<package>
<name>ImageMagick-nox11</name>
<range><le>6.9.8.9_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741">
<p>The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741</url>
<url>https://github.com/ImageMagick/ImageMagick/issues/771</url>
<url>https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f</url>
<url>https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d</url>
<cvename>CVE-2017-14741</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="58fafead-cd13-472f-a9bd-d0173ba1b04c">
<topic>libofx -- exploitable buffer overflow</topic>
<affects>
<package>
<name>libofx</name>
<range><le>0.9.11_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100828">
<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100828</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317</url>
<cvename>CVE-2017-2816</cvename>
</references>
<dates>
<discovery>2017-09-13</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="3b776502-f601-44e0-87cd-b63f1b9ae42a">
<topic>sugarcrm -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sugarcrm</name>
<range><le>6.5.26</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sugarcrm developers report:</p>
<blockquote cite="https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/">
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.</p>
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.</p>
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/</url>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/</url>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/</url>
<cvename>CVE-2017-14508</cvename>
<cvename>CVE-2017-14509</cvename>
<cvename>CVE-2017-14510</cvename>
</references>
<dates>
<discovery>2017-09-17</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="b2952517-07e5-4d19-8850-21c5b7e0623f">
<topic>libzip -- denial of service</topic>
<affects>
<package>
<name>libzip</name>
<range><lt>1.1.13_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libzip developers report:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/">
<p>The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/</url>
<url>https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5</url>
<cvename>CVE-2017-14107</cvename>
</references>
<dates>
<discovery>2017-09-01</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="10214bda-0902-4e3b-a2f9-9a68ef206a73">
<topic>libbson -- Denial of Service</topic>
<affects>
<package>
<name>libbson</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mongodb developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100825">
<p>In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100825</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489355</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489356</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489362</url>
<cvename>CVE-2017-14227</cvename>
</references>
<dates>
<discovery>2017-09-09</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="eb03d642-6724-472d-b038-f2bf074e1fc8">
<topic>tcpdump -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tcpdump</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tcpdump developers report:</p>
<blockquote cite="http://www.tcpdump.org/tcpdump-changes.txt">
<p>Too many issues to detail, see CVE references for details.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11541</cvename>
<cvename>CVE-2017-11542</cvename>
<cvename>CVE-2017-11543</cvename>
<cvename>CVE-2017-12893</cvename>
<cvename>CVE-2017-12894</cvename>
<cvename>CVE-2017-12895</cvename>
<cvename>CVE-2017-12896</cvename>
<cvename>CVE-2017-12897</cvename>
<cvename>CVE-2017-12898</cvename>
<cvename>CVE-2017-12899</cvename>
<cvename>CVE-2017-12900</cvename>
<cvename>CVE-2017-12901</cvename>
<cvename>CVE-2017-12902</cvename>
<cvename>CVE-2017-12985</cvename>
<cvename>CVE-2017-12986</cvename>
<cvename>CVE-2017-12987</cvename>
<cvename>CVE-2017-12988</cvename>
<cvename>CVE-2017-12989</cvename>
<cvename>CVE-2017-12990</cvename>
<cvename>CVE-2017-12991</cvename>
<cvename>CVE-2017-12992</cvename>
<cvename>CVE-2017-12993</cvename>
<cvename>CVE-2017-12994</cvename>
<cvename>CVE-2017-12995</cvename>
<cvename>CVE-2017-12996</cvename>
<cvename>CVE-2017-12997</cvename>
<cvename>CVE-2017-12998</cvename>
<cvename>CVE-2017-12999</cvename>
<cvename>CVE-2017-13000</cvename>
<cvename>CVE-2017-13001</cvename>
<cvename>CVE-2017-13002</cvename>
<cvename>CVE-2017-13003</cvename>
<cvename>CVE-2017-13004</cvename>
<cvename>CVE-2017-13005</cvename>
<cvename>CVE-2017-13006</cvename>
<cvename>CVE-2017-13007</cvename>
<cvename>CVE-2017-13008</cvename>
<cvename>CVE-2017-13009</cvename>
<cvename>CVE-2017-13010</cvename>
<cvename>CVE-2017-13011</cvename>
<cvename>CVE-2017-13012</cvename>
<cvename>CVE-2017-13013</cvename>
<cvename>CVE-2017-13014</cvename>
<cvename>CVE-2017-13015</cvename>
<cvename>CVE-2017-13016</cvename>
<cvename>CVE-2017-13017</cvename>
<cvename>CVE-2017-13018</cvename>
<cvename>CVE-2017-13019</cvename>
<cvename>CVE-2017-13020</cvename>
<cvename>CVE-2017-13021</cvename>
<cvename>CVE-2017-13022</cvename>
<cvename>CVE-2017-13023</cvename>
<cvename>CVE-2017-13024</cvename>
<cvename>CVE-2017-13025</cvename>
<cvename>CVE-2017-13026</cvename>
<cvename>CVE-2017-13027</cvename>
<cvename>CVE-2017-13028</cvename>
<cvename>CVE-2017-13029</cvename>
<cvename>CVE-2017-13030</cvename>
<cvename>CVE-2017-13031</cvename>
<cvename>CVE-2017-13032</cvename>
<cvename>CVE-2017-13033</cvename>
<cvename>CVE-2017-13034</cvename>
<cvename>CVE-2017-13035</cvename>
<cvename>CVE-2017-13036</cvename>
<cvename>CVE-2017-13037</cvename>
<cvename>CVE-2017-13038</cvename>
<cvename>CVE-2017-13039</cvename>
<cvename>CVE-2017-13040</cvename>
<cvename>CVE-2017-13041</cvename>
<cvename>CVE-2017-13042</cvename>
<cvename>CVE-2017-13043</cvename>
<cvename>CVE-2017-13044</cvename>
<cvename>CVE-2017-13045</cvename>
<cvename>CVE-2017-13046</cvename>
<cvename>CVE-2017-13047</cvename>
<cvename>CVE-2017-13048</cvename>
<cvename>CVE-2017-13049</cvename>
<cvename>CVE-2017-13050</cvename>
<cvename>CVE-2017-13051</cvename>
<cvename>CVE-2017-13052</cvename>
<cvename>CVE-2017-13053</cvename>
<cvename>CVE-2017-13054</cvename>
<cvename>CVE-2017-13055</cvename>
<cvename>CVE-2017-13687</cvename>
<cvename>CVE-2017-13688</cvename>
<cvename>CVE-2017-13689</cvename>
<cvename>CVE-2017-13690</cvename>
<cvename>CVE-2017-13725</cvename>
</references>
<dates>
<discovery>2017-07-22</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="d9f96741-47bd-4426-9aba-8736c0971b24">
<topic>libraw -- buffer overflow</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100866">
<p>LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100866</url>
<url>https://github.com/LibRaw/LibRaw/issues/100</url>
<cvename>CVE-2017-14348</cvename>
</references>
<dates>
<discovery>2017-09-12</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="4cd857d9-26d2-4417-b765-69701938f9e0">
<topic>libraw -- denial of service and remote code execution</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="https://github.com/LibRaw/LibRaw/issues/99">
<p>A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibRaw/LibRaw/issues/99</url>
<cvename>CVE-2017-14265</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="a60a2e95-acba-4b11-bc32-ffb47364e07d">
<topic>libgd -- Denial of servica via double free</topic>
<affects>
<package>
<name>libgd</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libgd developers report:</p>
<blockquote cite="http://www.debian.org/security/2017/dsa-3961">
<p>Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.debian.org/security/2017/dsa-3961</url>
<url>https://github.com/libgd/libgd/issues/381</url>
<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.5</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP/</url>
<cvename>CVE-2017-6362</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="5033e2fc-98ec-4ef5-8e0b-87cfbbc73081">
<topic>php-gd and gd -- Buffer over-read into uninitialized memory</topic>
<affects>
<package>
<name>libgd</name>
<range><lt>2.2.5</lt></range>
</package>
<package>
<name>php70-gd</name>
<range><lt>7.0.21</lt></range>
</package>
<package>
<name>php71-gd</name>
<range><lt>7.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP developers report:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=74435">
<p>The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=74435</url>
<cvename>CVE-2017-7890</cvename>
</references>
<dates>
<discovery>2017-08-02</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="d843a984-7f22-484f-ba81-483ddbe30dc3">
<topic>ledger -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ledger</name>
<range><le>3.1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100543">
<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.</p>
<p>An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100543</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303</url>
<url>http://www.securityfocus.com/bid/100546</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304</url>
<cvename>CVE-2017-2808</cvename>
<cvename>CVE-2017-2807</cvename>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="7801b1e1-99b4-42ac-ab22-7646235e7c16">
<topic>aacplusenc -- denial of service</topic>
<affects>
<package>
<name>aacplusenc</name>
<range><le>0.17.5_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo developers report:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/">
<p>DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/</url>
<url>https://github.com/teknoraver/aacplusenc/issues/1</url>
<cvename>CVE-2017-14181</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="478d4102-2319-4026-b3b2-a57c48f159ac">
<topic>ansible -- information disclosure flaw</topic>
<affects>
<package>
<name>ansible</name>
<range><le>2.2.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible/issues/22505">
<p>Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ansible/ansible/issues/22505</url>
<cvename>CVE-2017-7473</cvename>
</references>
<dates>
<discovery>2017-07-21</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="b63421b6-a1e0-11e7-ac58-b499baebfeaf">
<topic>weechat -- crash in logger plugin</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WeeChat reports:</p>
<blockquote cite="https://weechat.org/news/98/20170923-Version-1.9.1-security-release/">
<p>security problem: a crash can happen in logger plugin when
converting date/time specifiers in file mask.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/news/98/20170923-Version-1.9.1-security-release/</url>
<cvename>CVE-2017-14727</cvename>
</references>
<dates>
<discovery>2017-09-23</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="d9e82328-a129-11e7-987e-4f174049b30a">
<topic>perl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>perl5</name>
<range><ge>5.24.0</ge><lt>5.24.3</lt></range>
<range><ge>5.26.0</ge><lt>5.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.1#Security">
<p>CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows</p>
<p>A possible stack buffer overflow in the %ENV code on Windows has been
fixed by removing the buffer completely since it was superfluous anyway.</p>
<p>CVE-2017-12837: Heap buffer overflow in regular expression compiler</p>
<p>Compiling certain regular expression patterns with the case-insensitive
modifier could cause a heap buffer overflow and crash perl. This has now
been fixed.</p>
<p>CVE-2017-12883: Buffer over-read in regular expression parser</p>
<p>For certain types of syntax error in a regular expression pattern, the
error message could either contain the contents of a random, possibly
large, chunk of memory, or could crash perl. This has now been fixed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/changes/release/SHAY/perl-5.24.3</url>
<url>https://metacpan.org/changes/release/SHAY/perl-5.26.1</url>
<cvename>CVE-2017-12814</cvename>
<cvename>CVE-2017-12837</cvename>
<cvename>CVE-2017-12883</cvename>
</references>
<dates>
<discovery>2017-09-19</discovery>
<entry>2017-09-24</entry>
</dates>
</vuln>
<vuln vid="917e5519-9fdd-11e7-8b58-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>61.0.3163.100</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by
Jordan Rabet, Microsoft Offensive Security Research and Microsoft
ChakraCore team on 2017-09-14</li>
<li>[752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by
Choongwoo Han of Naver Corporation on 2017-08-04</li>
<li>[767508] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5121</cvename>
<cvename>CVE-2017-5122</cvename>
<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-22</entry>
</dates>
</vuln>
<vuln vid="c2ea3b31-9d75-11e7-bb13-001999f8d30b">
<topic>asterisk -- RTP/RTCP information leak</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.3</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.17.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>This is a follow up advisory to AST-2017-005.</p>
<p>Insufficient RTCP packet validation could allow reading
stale buffer contents and when combined with the "nat"
and "symmetric_rtp" options allow redirecting where
Asterisk sends the next RTCP report.</p>
<p>The RTP stream qualification to learn the source address
of media always accepted the first RTP packet as the new
source and allowed what AST-2017-005 was mitigating. The
intent was to qualify a series of packets before accepting
the new source address.</p>
<p>The RTP/RTCP stack will now validate RTCP packets before processing them.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-008.html</url>
<cvename>CVE-2017-14099</cvename>
</references>
<dates>
<discovery>2017-09-01</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="95b01379-9d52-11e7-a25c-471bafc3262f">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.2.0</ge><lt>2.2.8</lt></range>
<range><ge>2.3.0</ge><lt>2.3.5</lt></range>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby blog:</p>
<blockquote cite="https://www.ruby-lang.org/en/security/">
<p>CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf</p>
<p>If a malicious format string which contains a precious specifier (*)
is passed and a huge minus value is also passed to the specifier,
buffer underrun may be caused. In such situation, the result may
contains heap, or the Ruby interpreter may crash.</p>
<p>CVE-2017-10784: Escape sequence injection vulnerability in the Basic
authentication of WEBrick</p>
<p>When using the Basic authentication of WEBrick, clients can pass an
arbitrary string as the user name. WEBrick outputs the passed user name
intact to its log, then an attacker can inject malicious escape
sequences to the log and dangerous control characters may be executed
on a victim’s terminal emulator.</p>
<p>This vulnerability is similar to a vulnerability already fixed, but
it had not been fixed in the Basic authentication.</p>
<p>CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode</p>
<p>If a malicious string is passed to the decode method of OpenSSL::ASN1,
buffer underrun may be caused and the Ruby interpreter may crash.</p>
<p>CVE-2017-14064: Heap exposure vulnerability in generating JSON</p>
<p>The generate method of JSON module optionally accepts an instance of
JSON::Ext::Generator::State class. If a malicious instance is passed,
the result may include contents of heap.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/security/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/</url>
<cvename>CVE-2017-0898</cvename>
<cvename>CVE-2017-10784</cvename>
<cvename>CVE-2017-14033</cvename>
<cvename>CVE-2017-14064</cvename>
</references>
<dates>
<discovery>2017-09-14</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="2bffdf2f-9d45-11e7-a25c-471bafc3262f">
<topic>rubygem-geminabox -- XSS & CSRF vulnerabilities</topic>
<affects>
<package>
<name>rubygem-geminabox</name>
<range><lt>0.13.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gem in a box XSS vulenrability - CVE-2017-14506:</p>
<blockquote cite="https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html">
<p>Malicious attacker create GEM file with crafted homepage value
(gem.homepage in .gemspec file) includes XSS payload.</p>
<p>The attacker access geminabox system and uploads the gem file
(or uses CSRF/SSRF attack to do so).</p>
<p>From now on, any user access Geminabox web server, executes the
malicious XSS payload, that will delete any gems on the server,
and won't let users use the geminabox anymore. (make victim's
browser crash or redirect them to other hosts).</p>
</blockquote>
</body>
</description>
<references>
<url>https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html</url>
<cvename>CVE-2017-14506</cvename>
<cvename>CVE-2017-14683</cvename>
</references>
<dates>
<discovery>2017-09-18</discovery>
<entry>2017-09-19</entry>
<modified>2017-09-27</modified>
</dates>
</vuln>
<vuln vid="76b085e2-9d33-11e7-9260-000c292ee6b8">
<topic>Apache -- HTTP OPTIONS method can leak server memory</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.27_1</lt></range>
</package>
<package>
<name>apache22</name>
<range><lt>2.2.34_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Fuzzing Project reports:</p>
<blockquote cite="https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html">
<p>Apache httpd allows remote attackers to read secret data from
process memory if the Limit directive can be set in a user's
.htaccess file, or if httpd.conf has certain misconfigurations,
aka Optionsbleed. This affects the Apache HTTP Server through
2.2.34 and 2.4.x through 2.4.27. The attacker sends an
unauthenticated OPTIONS HTTP request when attempting to read
secret data. This is a use-after-free issue and thus secret data
is not always sent, and the specific data depends on many factors
including configuration. Exploitation with .htaccess can be
blocked with a patch to the ap_limit_section function in
server/core.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-9798</url>
<cvename>CVE-2017-9798</cvename>
</references>
<dates>
<discovery>2017-09-18</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="6a177c87-9933-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>1.0.0</ge><le>9.3.10</le></range>
<range><ge>9.4.0</ge><le>9.4.5</le></range>
<range><ge>9.5.0</ge><le>9.5.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/</url>
<cvename>CVE-2017-5029</cvename>
<cvename>CVE-2016-4738</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-14</entry>
</dates>
</vuln>
<vuln vid="531aae08-97f0-11e7-aadd-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.130</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-28.html">
<ul>
<li>These updates resolve memory corruption vulnerabilities that
could lead to remote code execution (CVE-2017-11281,
CVE-2017-11282).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11281</cvename>
<cvename>CVE-2017-11282</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-28.html</url>
</references>
<dates>
<discovery>2017-09-12</discovery>
<entry>2017-09-12</entry>
</dates>
</vuln>
<vuln vid="47e2e52c-975c-11e7-942d-5404a68a61a2">
<topic>emacs -- enriched text remote code execution vulnerability</topic>
<affects>
<package>
<name>emacs25</name>
<name>emacs-nox11</name>
<range><lt>25.3,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<range><lt>26.0.50.20170912,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Eggert reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q3/422">
<p>Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.</p>
<p>When Emacs renders MIME text/enriched data (Internet RFC 1896), it
is vulnerable to arbitrary code execution. Since Emacs-based mail
clients decode "Content-Type: text/enriched", this code is exploitable
remotely. This bug affects GNU Emacs versions 19.29 through 25.2.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q3/422</url>
<url>https://bugs.gnu.org/28350</url>
</references>
<dates>
<discovery>2017-09-04</discovery>
<entry>2017-09-12</entry>
<modified>2017-09-13</modified>
</dates>
</vuln>
<vuln vid="f9f76a50-9642-11e7-ab09-080027b00c2e">
<topic>cyrus-imapd -- broken "other users" behaviour</topic>
<affects>
<package>
<name>cyrus-imapd30</name>
<range><ge>3.0.0</ge><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.0.4 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.html">
<p>Fixed Issue #2132: Broken "Other Users" behaviour</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14230</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14230</url>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-10</entry>
</dates>
</vuln>
<vuln vid="aaab03be-932d-11e7-92d8-4b26fc968492">
<topic>Django -- possible XSS in traceback section of technical 500 debug page</topic>
<affects>
<package>
<name>py27-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<name>py36-django110</name>
<range><lt>1.10.8</lt></range>
</package>
<package>
<name>py27-django111</name>
<name>py34-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<range><lt>1.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django blog:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2017/sep/05/security-releases/">
<p>In older versions, HTML autoescaping was disabled in a portion of the template
for the technical 500 debug page. Given the right circumstances, this allowed a
cross-site scripting attack. This vulnerability shouldn't affect most production
sites since you shouldn't run with DEBUG = True (which makes this page accessible)
in your production settings.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12794</cvename>
<url>https://www.djangoproject.com/weblog/2017/sep/05/security-releases/</url>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-06</entry>
</dates>
</vuln>
<vuln vid="e1100e63-92f7-11e7-bd95-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>61.0.3163.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html">
<p>22 security fixes in this release, including:</p>
<ul>
<li>[737023] High CVE-2017-5111: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-06-27</li>
<li>[740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by
Tobias Klein on 2017-07-10</li>
<li>[747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by
Anonymous on 2017-07-20</li>
<li>[752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by
Ke Liu of Tencent's Xuanwu LAB on 2017-08-07</li>
<li>[744584] High CVE-2017-5115: Type confusion in V8. Reported by
Marco Giovannini on 2017-07-17</li>
<li>[759624] High CVE-2017-5116: Type confusion in V8. Reported by
Anonymous on 2017-08-28</li>
<li>[739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by
Tobias Klein on 2017-07-04</li>
<li>[747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24</li>
<li>[725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by
Anonymous on 2017-05-22</li>
<li>[718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by
Xiaoyin Liu on 2017-05-05</li>
<li>[762099] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5111</cvename>
<cvename>CVE-2017-5112</cvename>
<cvename>CVE-2017-5113</cvename>
<cvename>CVE-2017-5114</cvename>
<cvename>CVE-2017-5115</cvename>
<cvename>CVE-2017-5116</cvename>
<cvename>CVE-2017-5117</cvename>
<cvename>CVE-2017-5118</cvename>
<cvename>CVE-2017-5119</cvename>
<cvename>CVE-2017-5120</cvename>
<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-06</entry>
</dates>
</vuln>
<vuln vid="44101b31-8ffd-11e7-b5af-a4badb2f4699">
<cancelled/>
</vuln>
<vuln vid="5a1f1a86-8f4c-11e7-b5af-a4badb2f4699">
<topic>gdk-pixbuf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gtk-pixbuf2</name>
<range><lt>2.36.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TALOS reports:</p>
<blockquote cite="http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html">
<ul>
<li><p>An exploitable integer overflow vulnerability exists in
the tiff_image_parse functionality.</p></li>
<li><p>An exploitable heap-overflow vulnerability exists in
the gdk_pixbuf__jpeg_image_load_increment functionality.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html</url>
<cvename>CVE-2017-2862</cvename>
<cvename>CVE-2017-2870</cvename>
</references>
<dates>
<discovery>2017-08-30</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="ec1df2a1-8ee6-11e7-8be8-001999f8d30b">
<topic>asterisk -- Remote Crash Vulerability in res_pjsip</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-007.html</url>
<cvename>CVE-2017-14098</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="c599f95c-8ee5-11e7-8be8-001999f8d30b">
<topic>asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.2</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2017-005 - A change was made to the strict RTP
support in the RTP stack to better tolerate late media
when a reinvite occurs. When combined with the symmetric
RTP support this introduced an avenue where media could
be hijacked. Instead of only learning a new address when
expected the new code allowed a new source address to be
learned at all times.</p>
<p>AST-2017-006 - The app_minivm module has an "externnotify"
program configuration option that is executed by the
MinivmNotify dialplan application. The application uses
the caller-id name and number as part of a built string
passed to the OS shell for interpretation and execution.
Since the caller-id name and number can come from an
untrusted source, a crafted caller-id name or number
allows an arbitrary shell command injection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-005.html</url>
<cvename>CVE-2017-14099</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2017-006.html</url>
<cvename>CVE-2017-14100</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="22f28bb3-8d98-11e7-8c37-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379">
<p>Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0379</cvename>
<url>https://eprint.iacr.org/2017/806</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379</url>
</references>
<dates>
<discovery>2017-08-27</discovery>
<entry>2017-08-30</entry>
</dates>
</vuln>
<vuln vid="3f6de636-8cdb-11e7-9c71-f0def1fd7ea2">
<topic>rubygems -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby22-gems</name>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<range><lt>2.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Official blog of RubyGems reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/">
<p>The following vulnerabilities have been reported: a DNS request
hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS
vulnerability in the query command, and a vulnerability in the gem
installer that allowed a malicious gem to overwrite arbitrary
files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/</url>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-08-29</entry>
</dates>
</vuln>
<vuln vid="7d7e05fb-64da-435a-84fb-4061493b89b9">
<topic>kanboard -- multiple privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>kanboard</name>
<range><lt>1.0.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chbi reports:</p>
<blockquote cite="https://kanboard.net/news/version-1.0.46">
<p>an authenticated standard user could reset the password of another
user (including admin) by altering form data.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kanboard.net/news/version-1.0.46</url>
<cvename>CVE-2017-12850</cvename>
<cvename>CVE-2017-12851</cvename>
</references>
<dates>
<discovery>2017-08-15</discovery>
<entry>2017-08-26</entry>
</dates>
</vuln>
<vuln vid="eca2d861-76f4-42ed-89d2-23a2cb396c87">
<topic>poppler -- multiple denial of service issues</topic>
<affects>
<package>
<name>poppler</name>
<range><lt>0.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Poppler developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/99241/discuss">
<p>Poppler is prone to a stack-based buffer-overflow
vulnerability.</p>
<p>Successful exploits may allow attackers to crash the affected
application, resulting in denial-of-service condition. Due to the
nature of this issue, arbitrary code execution may be possible but
this has not been confirmed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99241/discuss</url>
<cvename>CVE-2017-9865</cvename>
<cvename>CVE-2017-9775</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-08-24</entry>
</dates>
</vuln>
<vuln vid="c5d79773-8801-11e7-93f7-d43d7e971a1b">
<topic>phpmailer -- XSS in code example and default exeception handler</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHPMailer reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24">
<p>Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The
code_generator.phps example did not filter user input prior to output. This
file is distributed with a .phps extension, so it it not normally executable
unless it is explicitly renamed, so it is safe by default. There was also an
undisclosed potential XSS vulnerability in the default exception handler
(unused by default). Patches for both issues kindly provided by Patrick
Monnerat of the Fedora Project.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24</url>
<cvename>CVE-2017-11503</cvename>
</references>
<dates>
<discovery>2017-07-27</discovery>
<entry>2017-08-23</entry>
</dates>
</vuln>
<vuln vid="3531141d-a708-477c-954a-2a0549e49ca9">
<topic>salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<range><lt>2016.11.7</lt></range>
<range><ge>2017.7.0</ge><lt>2017.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html">
<p>Correct a flaw in minion id validation which could allow certain
minions to authenticate to a master despite not having the correct
credentials. To exploit the vulnerability, an attacker must create a
salt-minion with an ID containing characters that will cause a
directory traversal.
Credit for discovering the security flaw goes to: Vernhk@qq.com</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12791</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html</url>
<url>https://docs.saltstack.com/en/latest/topics/releases/2016.11.7.html</url>
</references>
<dates>
<discovery>2017-08-16</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="198d82f3-8777-11e7-950a-e8e0b747a45a">
<topic>dnsdist -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dnsdist</name>
<range><lt>1.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="https://dnsdist.org/security-advisories/index.html">
<p>The first issue can lead to a denial of service on 32-bit if a backend
sends crafted answers, and the second to an alteration of dnsdist's ACL
if the API is enabled, writable and an authenticated user is tricked
into visiting a crafted website.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7069</cvename>
<cvename>CVE-2017-7557</cvename>
<url>https://dnsdist.org/security-advisories/index.html</url>
</references>
<dates>
<discovery>2017-08-21</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="01a197ca-67f1-11e7-a266-28924a333806">
<topic>evince and atril -- command injection vulnerability in CBT handler</topic>
<affects>
<package>
<name>evince</name>
<range><le>3.24.0</le></range>
</package>
<package>
<name>evince-lite</name>
<range><le>3.24.0</le></range>
</package>
<package>
<name>atril</name>
<range><lt>1.18.1</lt></range>
<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
</package>
<package>
<name>atril-lite</name>
<range><lt>1.18.1</lt></range>
<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNOME reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=784630">
<p>The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.</p>
<p>The same vulnerability affects atril, the Evince fork.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=784630</url>
<url>https://github.com/mate-desktop/atril/issues/257</url>
<cvename>CVE-2017-1000083</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="e1de77e8-c45e-48d7-8866-5a6f943046de">
<topic>SquirrelMail -- post-authentication remote code execution</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>20170705</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquirrelMail developers report:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2017/Apr/81">
<p>SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN)
allows post-authentication remote code execution via a sendmail.cf
file that is mishandled in a popen call. It's possible to exploit this
vulnerability to execute arbitrary shell commands on the remote
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="6876b163-8708-11e7-8568-e8e0b747a45a">
<topic>pspp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pspp</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE Details reports:</p>
<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html">
<ul>
<li>There is an Integer overflow in the hash_int function of the libpspp library
in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).</li>
<li>There is a NULL Pointer Dereference in the function ll_insert() of the libpspp
library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).</li>
<li>There is an illegal address access in the function output_hex() in data/data-out.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).</li>
<li>There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).</li>
<li>There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).</li>
<li>There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-10791</cvename>
<cvename>CVE-2017-10792</cvename>
<cvename>CVE-2017-12958</cvename>
<cvename>CVE-2017-12959</cvename>
<cvename>CVE-2017-12960</cvename>
<cvename>CVE-2017-12961</cvename>
<url>https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html</url>
</references>
<dates>
<discovery>2017-08-18</discovery>
<entry>2017-08-22</entry>
<modified>2017-08-30</modified>
</dates>
</vuln>
<vuln vid="473b6a9e-8493-11e7-b24b-6cf0497db129">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-004">
<p>CVE-2017-6923: Views - Access Bypass - Moderately Critical</p>
<p>CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica</p>
<p>CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6923</cvename>
<cvename>CVE-2017-6924</cvename>
<cvename>CVE-2017-6925</cvename>
</references>
<dates>
<discovery>2017-08-16</discovery>
<entry>2017-08-19</entry>
</dates>
</vuln>
<vuln vid="8e7bbddd-8338-11e7-867f-b499baebfeaf">
<topic>libsoup -- stack based buffer overflow</topic>
<affects>
<package>
<name>libsoup</name>
<range><lt>2.52.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Mueller reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q3/304">
<p>libsoup is susceptible to a stack based buffer overflow
attack when using chunked encoding. Regardless of libsoup
being used as a server or client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q3/304</url>
<cvename>CVE-2017-2885</cvename>
</references>
<dates>
<discovery>2017-08-17</discovery>
<entry>2017-08-17</entry>
<modified>2017-08-20</modified>
</dates>
</vuln>
<vuln vid="5df8bd95-8290-11e7-93af-005056925db4">
<topic>Zabbix -- Remote code execution</topic>
<affects>
<package>
<name>zabbix2-server</name>
<name>zabbix2-proxy</name>
<range><le>2.0.20</le></range>
</package>
<package>
<name>zabbix22-server</name>
<name>zabbix22-proxy</name>
<range><lt>2.2.19</lt></range>
</package>
<package>
<name>zabbix3-server</name>
<name>zabbix3-proxy</name>
<range><lt>3.0.10</lt></range>
</package>
<package>
<name>zabbix32-server</name>
<name>zabbix32-proxy</name>
<range><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824">
<p>An exploitable code execution vulnerability exists in the trapper command
functionality of Zabbix Server 2.4.X. A specially crafted set of packets
can cause a command injection resulting in remote code execution. An attacker
can make requests from an active Zabbix Proxy to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2824</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824</url>
<url>https://support.zabbix.com/browse/ZBX-12349</url>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-08-16</entry>
</dates>
</vuln>
<vuln vid="c9460380-81e3-11e7-93af-005056925db4">
<topic>Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests</topic>
<affects>
<package>
<name>py27-supervisor</name>
<range><lt>3.3.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mnaberez reports:</p>
<blockquote cite="https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606">
<p>supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket.
The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been
enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been
found where an authenticated client can send a malicious XML-RPC request to supervisord that
will run arbitrary shell commands on the server. The commands will be run as the same user as
supervisord. Depending on how supervisord has been configured, this may be root.</p>
<p>This vulnerability can only be exploited by an authenticated client or if supervisord has been
configured to run an HTTP server without authentication. If authentication has not been enabled,
supervisord will log a message at the critical level every time it starts.</p>
</blockquote>
</body>
</description>
<references>
<url>http://supervisord.org/changes.html</url>
<url>https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606</url>
<cvename>CVE-2017-11610</cvename>
</references>
<dates>
<discovery>2017-07-24</discovery>
<entry>2017-08-15</entry>
</dates>
</vuln>
<vuln vid="79bbec7e-8141-11e7-b5af-a4badb2f4699">
<topic>FreeRadius -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>freeradius3</name>
<range><lt>3.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guido Vranken reports:</p>
<blockquote cite="http://freeradius.org/security/fuzzer-2017.html">
<p>Multiple vulnerabilities found via fuzzing:
FR-GV-201 (v2,v3) Read / write overflow in make_secret()
FR-GV-202 (v2) Write overflow in rad_coalesce()
FR-GV-203 (v2) DHCP - Memory leak in decode_tlv()
FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode()
FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options()
FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
FR-GV-207 (v2) Zero-length malloc in data2vp()
FR-GV-301 (v3) Write overflow in data2vp_wimax()
FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
FR-GV-305 (v3) Decode 'signed' attributes correctly
FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data
FR-AD-002 (v3) String lifetime issues in rlm_python
FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</p>
</blockquote>
</body>
</description>
<references>
<url>http://freeradius.org/security/fuzzer-2017.html</url>
</references>
<dates>
<discovery>2017-06-17</discovery>
<entry>2017-08-14</entry>
</dates>
</vuln>
<vuln vid="1d33cdee-7f6b-11e7-a9b5-3debb10a6871">
<topic>Mercurial -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial Release Notes:</p>
<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29">
<p>CVE-2017-1000115</p>
<p>Mercurial's symlink auditing was incomplete prior to 4.3, and could be
abused to write to files outside the repository.</p>
<p>CVE-2017-1000116</p>
<p>Mercurial was not sanitizing hostnames passed to ssh, allowing shell
injection attacks on clients by specifying a hostname starting with
-oProxyCommand. This is also present in Git (CVE-2017-1000117) and
Subversion (CVE-2017-9800), so please patch those tools as well if you
have them installed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<cvename>CVE-2017-1000115</cvename>
<cvename>CVE-2017-1000116</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-12</entry>
</dates>
</vuln>
<vuln vid="6e80bd9b-7e9b-11e7-abfe-90e2baa3bafc">
<topic>subversion -- Arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><le>1.9.6</le></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.0.0</ge><le>1.8.18</le></range>
</package>
<package>
<name>subversion-static</name>
<range><ge>1.0.0</ge><le>1.8.18</le></range>
<range><ge>1.9.0</ge><le>1.9.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
<p>A Subversion client sometimes connects to URLs provided by the repository.
This happens in two primary cases: during 'checkout', 'export', 'update', and
'switch', when the tree being downloaded contains svn:externals properties;
and when using 'svnsync sync' with one URL argument.</p>
<p>A maliciously constructed svn+ssh:// URL would cause Subversion clients to
run an arbitrary shell command. Such a URL could be generated by a malicious
server, by a malicious user committing to a honest server (to attack another
user of that server's repositories), or by a proxy server.</p>
<p>The vulnerability affects all clients, including those that use file://,
http://, and plain (untunneled) svn://.</p>
<p>An exploit has been tested.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2017-9800-advisory.txt</url>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-11</entry>
</dates>
</vuln>
<vuln vid="abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- two vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>7.9.0</ge><le>8.17.8</le></range>
<range><ge>9.0.0</ge><le>9.0.12</le></range>
<range><ge>9.1.0</ge><le>9.1.9</le></range>
<range><ge>9.2.0</ge><le>9.2.9</le></range>
<range><ge>9.3.0</ge><le>9.3.9</le></range>
<range><ge>9.4.0</ge><le>9.4.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/">
<h1>Remote Command Execution in git client</h1>
<p>An external code review performed by Recurity-Labs identified a remote
command execution vulnerability in git that could be exploited via the "Repo
by URL" import option in GitLab. The command line git client was not
properly escaping command line arguments in URLs using the SSH protocol
before invoking the SSH client. A specially crafted URL could be used to
execute arbitrary shell commands on the GitLab server.<br/>
To fully patch this vulnerability two fixes were needed. The Omnibus
versions of GitLab contain a patched git client. For source users who may
still be running an older version of git, GitLab now also blocks import URLs
containing invalid host and usernames.<br/>
This issue has been assigned CVE-2017-12426.</p>
<h1>Improper sanitization of GitLab export files on import</h1>
<p>GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a
patch for a critical directory traversal vulnerability in the GitLab export
feature that could be exploited by including symlinks in the export file and
then re-importing it to a GitLab instance. This vulnerability was patched by
checking for and removing symlinks in these files on import.<br/>
Recurity-Labs also determined that this fix did not properly remove symlinks for
hidden files. Though not as dangerous as the original vulnerability hidden file
symlinks could still be used to steal copies of git repositories belonging to
other users if the path to the git repository was known by the attacker. An
updated fix has been included in these releases that properly removes all
symlinks.<br/>
This import option was not made available to non-admin users until GitLab
8.13.0.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/</url>
<cvename>CVE-2017-12426</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-11</entry>
</dates>
</vuln>
<vuln vid="982872f1-7dd3-11e7-9736-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.22</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.18</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.8</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1772/">
<ul>
<li>CVE-2017-7546: Empty password accepted in some authentication
methods</li>
<li>CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords
to users lacking server privileges</li>
<li>CVE-2017-7548: lo_put() function ignores ACLs</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7546</cvename>
<cvename>CVE-2017-7547</cvename>
<cvename>CVE-2017-7548</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-10</entry>
</dates>
</vuln>
<vuln vid="7e3d3e9a-7d8f-11e7-a02b-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.151</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-23.html">
<ul>
<li>These updates resolve security bypass vulnerability that
could lead to information disclosure (CVE-2017-3085).</li>
<li>These updates resolve type confusion vulnerability that
could lead to remote code execution (CVE-2017-3106).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3085</cvename>
<cvename>CVE-2017-3106</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-23.html</url>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-10</entry>
</dates>
</vuln>
<vuln vid="69cfa386-7cd0-11e7-867f-b499baebfeaf">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.55.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<ul>
<li>FILE buffer read out of bounds</li>
<li>TFTP sends more than buffer size</li>
<li>URL globbing out of bounds read</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<cvename>CVE-2017-1000099</cvename>
<cvename>CVE-2017-1000100</cvename>
<cvename>CVE-2017-1000101</cvename>
</references>
<dates>
<discovery>2017-08-09</discovery>
<entry>2017-08-09</entry>
</dates>
</vuln>
<vuln vid="c1265e85-7c95-11e7-93af-005056925db4">
<topic>Axis2 -- Security vulnerability on dependency Apache Commons FileUpload</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html">
<p>The commons-fileupload dependency has been updated to a version that fixes
CVE-2016-1000031 (AXIS2-5853).</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5853</url>
<url>https://issues.apache.org/jira/browse/FILEUPLOAD-279</url>
<cvename>CVE-2016-1000031</cvename>
</references>
<dates>
<discovery>2016-11-14</discovery>
<entry>2017-08-09</entry>
</dates>
</vuln>
<vuln vid="555b244e-6b20-4546-851f-d8eb7d6c1ffa">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>55.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7753</cvename>
<cvename>CVE-2017-7779</cvename>
<cvename>CVE-2017-7780</cvename>
<cvename>CVE-2017-7781</cvename>
<cvename>CVE-2017-7782</cvename>
<cvename>CVE-2017-7783</cvename>
<cvename>CVE-2017-7784</cvename>
<cvename>CVE-2017-7785</cvename>
<cvename>CVE-2017-7786</cvename>
<cvename>CVE-2017-7787</cvename>
<cvename>CVE-2017-7788</cvename>
<cvename>CVE-2017-7789</cvename>
<cvename>CVE-2017-7790</cvename>
<cvename>CVE-2017-7791</cvename>
<cvename>CVE-2017-7792</cvename>
<cvename>CVE-2017-7794</cvename>
<cvename>CVE-2017-7796</cvename>
<cvename>CVE-2017-7797</cvename>
<cvename>CVE-2017-7798</cvename>
<cvename>CVE-2017-7799</cvename>
<cvename>CVE-2017-7800</cvename>
<cvename>CVE-2017-7801</cvename>
<cvename>CVE-2017-7802</cvename>
<cvename>CVE-2017-7803</cvename>
<cvename>CVE-2017-7804</cvename>
<cvename>CVE-2017-7806</cvename>
<cvename>CVE-2017-7807</cvename>
<cvename>CVE-2017-7808</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/</url>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-08</entry>
</dates>
</vuln>
<vuln vid="9245681c-7c3c-11e7-b5af-a4badb2f4699">
<topic>sqlite3 -- heap-buffer overflow</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google reports:</p>
<blockquote cite="https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937">
<p>A heap-buffer overflow (sometimes a crash) can arise when
running a SQL request on malformed sqlite3 databases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937</url>
<cvename>CVE-2017-10989</cvename>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-08</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="88a77ad8-77b1-11e7-b5af-a4badb2f4699">
<topic>Varnish -- Denial of service vulnerability</topic>
<affects>
<package>
<name>varnish4</name>
<range><ge>4.0.1</ge><lt>4.0.5</lt></range>
<range><ge>4.1.0</ge><lt>4.1.8</lt></range>
</package>
<package>
<name>varnish5</name>
<range><lt>5.0.1</lt></range>
<range><ge>5.1.0</ge><lt>5.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phk reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00001.html">
<p>A wrong if statement in the varnishd source code means that
particular invalid requests from the client can trigger an assert.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00001.html</url>
</references>
<dates>
<discovery>2017-08-02</discovery>
<entry>2017-08-02</entry>
</dates>
</vuln>
<vuln vid="7d138476-7710-11e7-88a1-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>60.0.3112.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html">
<p>40 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5091</cvename>
<cvename>CVE-2017-5092</cvename>
<cvename>CVE-2017-5093</cvename>
<cvename>CVE-2017-5094</cvename>
<cvename>CVE-2017-5095</cvename>
<cvename>CVE-2017-5096</cvename>
<cvename>CVE-2017-5097</cvename>
<cvename>CVE-2017-5098</cvename>
<cvename>CVE-2017-5099</cvename>
<cvename>CVE-2017-5100</cvename>
<cvename>CVE-2017-5101</cvename>
<cvename>CVE-2017-5102</cvename>
<cvename>CVE-2017-5103</cvename>
<cvename>CVE-2017-5104</cvename>
<cvename>CVE-2017-7000</cvename>
<cvename>CVE-2017-5105</cvename>
<cvename>CVE-2017-5106</cvename>
<cvename>CVE-2017-5107</cvename>
<cvename>CVE-2017-5108</cvename>
<cvename>CVE-2017-5109</cvename>
<cvename>CVE-2017-5110</cvename>
<url>https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-07-25</discovery>
<entry>2017-08-01</entry>
</dates>
</vuln>
<vuln vid="f86d0e5d-7467-11e7-93af-005056925db4">
<topic>Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php</topic>
<affects>
<package>
<name>cacti</name>
<range><eq>1.1.13</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kimiizhang reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/issues/867">
<p>Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti
1.1.13 allows remote authenticated users to inject arbitrary web script
or HTML via specially crafted HTTP Referer headers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/issues/867</url>
<url>https://www.cacti.net/release_notes.php?version=1.1.14</url>
<cvename>CVE-2017-11691</cvename>
</references>
<dates>
<discovery>2017-07-20</discovery>
<entry>2017-07-29</entry>
</dates>
</vuln>
<vuln vid="770d7e91-72af-11e7-998a-08606e47f965">
<topic>proftpd -- user chroot escape vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7418">
<p>ProFTPD ... controls whether the home directory of a user could
contain a symbolic link through the AllowChrootSymlinks
configuration option, but checks only the last path component when
enforcing AllowChrootSymlinks. Attackers with local access could
bypass the AllowChrootSymlinks control by replacing a path
component (other than the last one) with a symbolic link.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.proftpd.org/show_bug.cgi?id=4295</url>
<cvename>CVE-2017-7418</cvename>
</references>
<dates>
<discovery>2017-03-06</discovery>
<entry>2017-07-27</entry>
</dates>
</vuln>
<vuln vid="76d80b33-7211-11e7-998a-08606e47f965">
<topic>jabberd -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99511/discuss">
<p>JabberD is prone to an authentication-bypass vulnerability.
An attacker can exploit this issue to bypass the authentication
mechanism and perform unauthorized actions. This may lead to
further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867032</url>
<url>http://www.securityfocus.com/bid/99511</url>
<cvename>CVE-2017-10807</cvename>
</references>
<dates>
<discovery>2017-07-03</discovery>
<entry>2017-07-26</entry>
</dates>
</vuln>
<vuln vid="0f66b901-715c-11e7-ad1f-bcaec565249c">
<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.16.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Webkit gtk team reports:</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2017-0006.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2017-0006.html</url>
<cvename>CVE-2017-7006</cvename>
<cvename>CVE-2017-7011</cvename>
<cvename>CVE-2017-7012</cvename>
<cvename>CVE-2017-7018</cvename>
<cvename>CVE-2017-7019</cvename>
<cvename>CVE-2017-7020</cvename>
<cvename>CVE-2017-7030</cvename>
<cvename>CVE-2017-7034</cvename>
<cvename>CVE-2017-7037</cvename>
<cvename>CVE-2017-7038</cvename>
<cvename>CVE-2017-7039</cvename>
<cvename>CVE-2017-7040</cvename>
<cvename>CVE-2017-7041</cvename>
<cvename>CVE-2017-7042</cvename>
<cvename>CVE-2017-7043</cvename>
<cvename>CVE-2017-7046</cvename>
<cvename>CVE-2017-7048</cvename>
<cvename>CVE-2017-7049</cvename>
<cvename>CVE-2017-7052</cvename>
<cvename>CVE-2017-7055</cvename>
<cvename>CVE-2017-7056</cvename>
<cvename>CVE-2017-7059</cvename>
<cvename>CVE-2017-7061</cvename>
<cvename>CVE-2017-7064</cvename>
</references>
<dates>
<discovery>2017-07-24</discovery>
<entry>2017-07-25</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="8745c67e-7dd1-4165-96e2-fcf9da2dc5b5">
<topic>gsoap -- remote code execution via via overflow</topic>
<affects>
<package>
<name>gsoap</name>
<range><lt>2.8.47</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Senrio reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99868/discuss">
<p>Genivia gSOAP is prone to a stack-based buffer-overflow
vulnerability because it fails to properly bounds check user-supplied
data before copying it into an insufficiently sized buffer.</p>
<p>A remote attacker may exploit this issue to execute arbitrary code
in the context of the affected device. Failed attempts will likely
cause a denial-of-service condition.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99868/discuss</url>
<url>http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions</url>
<url>http://blog.senr.io/devilsivy.html</url>
<url>https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29</url>
<url>https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29</url>
<cvename>CVE-2017-9765</cvename>
</references>
<dates>
<discovery>2017-07-18</discovery>
<entry>2017-07-25</entry>
</dates>
</vuln>
<vuln vid="92f4191a-6d25-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.0.0</ge><le>8.17.6</le></range>
<range><ge>9.0.0</ge><le>9.0.10</le></range>
<range><ge>9.1.0</ge><le>9.1.7</le></range>
<range><ge>9.2.0</ge><le>9.2.7</le></range>
<range><ge>9.3.0</ge><le>9.3.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/</url>
<cvename>CVE-2017-11438</cvename>
</references>
<dates>
<discovery>2017-07-20</discovery>
<entry>2017-07-20</entry>
<modified>2017-08-15</modified>
</dates>
</vuln>
<vuln vid="cda2f3c2-6c8b-11e7-867f-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.32</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.26</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.6</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.37</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.19</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.37</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL</url>
<cvename>CVE-2017-3529</cvename>
<cvename>CVE-2017-3633</cvename>
<cvename>CVE-2017-3634</cvename>
<cvename>CVE-2017-3635</cvename>
<cvename>CVE-2017-3636</cvename>
<cvename>CVE-2017-3637</cvename>
<cvename>CVE-2017-3638</cvename>
<cvename>CVE-2017-3639</cvename>
<cvename>CVE-2017-3640</cvename>
<cvename>CVE-2017-3641</cvename>
<cvename>CVE-2017-3642</cvename>
<cvename>CVE-2017-3643</cvename>
<cvename>CVE-2017-3644</cvename>
<cvename>CVE-2017-3645</cvename>
<cvename>CVE-2017-3646</cvename>
<cvename>CVE-2017-3647</cvename>
<cvename>CVE-2017-3648</cvename>
<cvename>CVE-2017-3649</cvename>
<cvename>CVE-2017-3650</cvename>
<cvename>CVE-2017-3651</cvename>
<cvename>CVE-2017-3652</cvename>
<cvename>CVE-2017-3653</cvename>
</references>
<dates>
<discovery>2017-07-19</discovery>
<entry>2017-07-19</entry>
<modified>2017-08-12</modified>
</dates>
</vuln>
<vuln vid="08a2df48-6c6a-11e7-9b01-2047478f2f70">
<topic>collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures</topic>
<affects>
<package>
<name>collectd5</name>
<range><lt>5.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>marcinguy reports:</p>
<blockquote cite="https://github.com/collectd/collectd/issues/2174">
<p>After sending this payload, collectd seems to be entering endless while()
loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/collectd/collectd/issues/2174</url>
<cvename>CVE-2017-7401</cvename>
</references>
<dates>
<discovery>2017-02-13</discovery>
<entry>2017-07-19</entry>
</dates>
</vuln>
<vuln vid="e6ccaf8a-6c63-11e7-9b01-2047478f2f70">
<topic>strongswan -- multiple vulnerabilities</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>4.4.0</ge><le>5.5.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2017/05/30/strongswan-5.5.3-released.html">
<ul>
<li>RSA public keys passed to the gmp plugin aren't validated sufficiently
before attempting signature verification, so that invalid input might
lead to a floating point exception. [CVE-2017-9022]</li>
<li>ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when
parsing X.509 certificates with extensions that use such types. This
could lead to infinite looping of the thread parsing a specifically crafted certificate.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html</url>
<cvename>CVE-2017-9022</cvename>
<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html</url>
<cvename>CVE-2017-9023</cvename>
</references>
<dates>
<discovery>2017-05-30</discovery>
<entry>2017-07-19</entry>
</dates>
</vuln>
<vuln vid="c7e8e955-6c61-11e7-9b01-2047478f2f70">
<cancelled superseded="e6ccaf8a-6c63-11e7-9b01-2047478f2f70"/>
</vuln>
<vuln vid="dc3c66e8-6a18-11e7-93af-005056925db4">
<topic>Cacti -- Cross-site scripting (XSS) vulnerability in link.php</topic>
<affects>
<package>
<name>cacti</name>
<range><ge>1.0.0</ge><lt>1.1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kimiizhang reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/issues/838">
<p>Cross-site scripting (XSS) vulnerability in link.php in Cacti<br/>
1.1.12 allows remote anonymous users to inject arbitrary web<br/>
script or HTML via the id parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/issues/838</url>
<url>https://www.cacti.net/release_notes.php?version=1.1.13</url>
<cvename>CVE-2017-10970</cvename>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-07-17</entry>
</dates>
</vuln>
<vuln vid="457ce015-67fa-11e7-867f-b499baebfeaf">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>important: Read after free in mod_http2 (CVE-2017-9789)<br/>
When under stress, closing many connections, the HTTP/2 handling
code would sometimes access memory after it has been freed,
resulting in potentially erratic behaviour.</p>
<p>important: Uninitialized memory reflection in mod_auth_digest
(CVE-2017-9788)<br/>The value placeholder in [Proxy-]Authorization
headers of type 'Digest' was not initialized or reset before or
between successive key=value assignments. by mod_auth_digest.<br/>
Providing an initial key with no '=' assignment could reflect
the stale value of uninitialized pool memory used by the prior
request, leading to leakage of potentially confidential
information, and a segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2017-9789</cvename>
<cvename>CVE-2017-9788</cvename>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="a03e043a-67f1-11e7-beff-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-21.html">
<ul>
<li>These updates resolve security bypass vulnerability that
could lead to information disclosure (CVE-2017-3080).</li>
<li>These updates resolve memory corruption vulnerability that
could lead to remote code execution (CVE-2017-3099).</li>
<li>These updates resolve memory corruption vulnerability that
could lead to memory address disclosure (CVE-2017-3100).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3080</cvename>
<cvename>CVE-2017-3099</cvename>
<cvename>CVE-2017-3100</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-21.html</url>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="85851e4f-67d9-11e7-bc37-00505689d4ae">
<topic>samba -- Orpheus Lyre mutual authentication validation bypass</topic>
<affects>
<package>
<name>samba42</name>
<range><lt>4.2.15</lt></range>
</package>
<package>
<name>samba43</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>samba44</name>
<range><lt>4.4.15</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.12</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-11103.html">
<p>A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by
returning malicious replication or authorization data.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-11103.html</url>
<cvename>CVE-2017-11103</cvename>
</references>
<dates>
<discovery>2017-07-12</discovery>
<entry>2017-07-12</entry>
</dates>
</vuln>
<vuln vid="3eff66c5-66c9-11e7-aa1d-3d2e663cef42">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>8.1.4</lt></range>
</package>
<package>
<name>node4</name>
<range><lt>4.8.4</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Updates are now available for all active Node.js release lines as
well as the 7.x line. These include the fix for the high severity
vulnerability identified in the initial announcement, one additional
lower priority Node.js vulnerability in the 4.x release line, as well
as some lower priority fixes for Node.js dependencies across the
current release lines.</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/">
<h2>Constant Hashtable Seeds (CVE pending)</h2>
<p>Node.js was susceptible to hash flooding remote DoS attacks as the
HashTable seed was constant across a given released version of
Node.js. This was a result of building with V8 snapshots enabled by
default which caused the initially randomized seed to be overwritten
on startup. Thanks to Jann Horn of Google Project Zero for reporting
this vulnerability.</p>
<p>This is a high severity vulnerability and applies to all active
release lines (4.x, 6.x, 8.x) as well as the 7.x line.</p>
<h2>http.get with numeric authorization options creates uninitialized
buffers</h2>
<p>Application code that allows the auth field of the options object
used with http.get() to be set to a number can result in an
uninitialized buffer being created/used as the authentication
string.</p>
<p>This is a low severity defect and only applies to the 4.x release
line.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/</url>
</references>
<dates>
<discovery>2017-06-27</discovery>
<entry>2017-07-12</entry>
</dates>
</vuln>
<vuln vid="b28adc5b-6693-11e7-ad43-f0def16c5c1b">
<topic>nginx -- a specially crafted request might result in an integer overflow</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>0.5.6</ge><lt>1.12.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>0.5.6</ge><lt>1.13.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html">
<p>A security issue was identified in nginx range filter. A specially
crafted request might result in an integer overflow and incorrect
processing of ranges, potentially resulting in sensitive information
leak (CVE-2017-7529).</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html</url>
<cvename>CVE-2017-7529</cvename>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-11</entry>
</dates>
</vuln>
<vuln vid="aaedf196-6436-11e7-8b49-002590263bf5">
<topic>codeigniter -- input validation bypass</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Form Validation Library rule valid_email could be bypassed if
idn_to_ascii() is available.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-06-19</discovery>
<entry>2017-07-08</entry>
</dates>
</vuln>
<vuln vid="31001c6b-63e7-11e7-85aa-a4badb2f4699">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_07.txt">
<p>When receiving messages with invalid time stamps, Irssi
would try to dereference a NULL pointer.</p>
<p>While updating the internal nick list, Irssi may
incorrectly use the GHashTable interface and free the nick while
updating it. This will then result in use-after-free conditions on each
access of the hash table.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_07.txt</url>
<cvename>CVE-2017-10965</cvename>
<cvename>CVE-2017-10966</cvename>
<freebsdpr>ports/220544</freebsdpr>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-07-08</entry>
</dates>
</vuln>
<vuln vid="b396cf6c-62e6-11e7-9def-b499baebfeaf">
<topic>oniguruma -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libevhtp</name>
<range><lt>1.2.14</lt></range>
</package>
<package>
<name>oniguruma4</name>
<range><lt>4.7.2</lt></range>
</package>
<package>
<name>oniguruma5</name>
<range><lt>5.9.7</lt></range>
</package>
<package>
<name>oniguruma6</name>
<range><lt>6.4.0</lt></range>
</package>
<package>
<name>php56-mbstring</name>
<range><lt>5.6.31</lt></range>
</package>
<package>
<name>php70-mbstring</name>
<range><lt>7.0.21</lt></range>
</package>
<package>
<name>php71-mbstring</name>
<range><lt>7.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php">
<ul>
<li>A stack out-of-bounds read occurs in match_at() during regular
expression searching. A logical error involving order of validation
and access in match_at() could result in an out-of-bounds read from
a stack buffer (CVE-2017-9224).</li>
<li>A heap out-of-bounds write or read occurs in next_state_val()
during regular expression compilation. Octal numbers larger than 0xff
are not handled correctly in fetch_token() and fetch_token_in_cc().
A malformed regular expression containing an octal number in the form
of '\700' would produce an invalid code point value larger than 0xff
in next_state_val(), resulting in an out-of-bounds write memory
corruption (CVE-2017-9226).</li>
<li>A stack out-of-bounds read occurs in mbc_enc_len() during regular
expression searching. Invalid handling of reg->dmin in
forward_search_range() could result in an invalid pointer dereference,
as an out-of-bounds read from a stack buffer (CVE-2017-9227).</li>
<li>A heap out-of-bounds write occurs in bitset_set_range() during
regular expression compilation due to an uninitialized variable from
an incorrect state transition. An incorrect state transition in
parse_char_class() could create an execution path that leaves a
critical local variable uninitialized until it's used as an index,
resulting in an out-of-bounds write memory corruption (CVE-2017-9228).</li>
<li>A SIGSEGV occurs in left_adjust_char_head() during regular expression
compilation. Invalid handling of reg->dmax in forward_search_range() could
result in an invalid pointer dereference, normally as an immediate
denial-of-service condition (CVE-2017-9228).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php</url>
<cvename>CVE-2017-9224</cvename>
<cvename>CVE-2017-9226</cvename>
<cvename>CVE-2017-9227</cvename>
<cvename>CVE-2017-9228</cvename>
<cvename>CVE-2017-9228</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-07-07</entry>
<modified>2018-01-04</modified>
</dates>
</vuln>
<vuln vid="4fc2df49-6279-11e7-be0f-6cf0497db129">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.56</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team Reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-003">
<p>CVE-2017-6920: PECL YAML parser unsafe object handling.</p>
<p>CVE-2017-6921: File REST resource does not properly validate</p>
<p>CVE-2017-6922: Files uploaded by anonymous users into a private
file system can be accessed by other anonymous users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6920</cvename>
<cvename>CVE-2017-6921</cvename>
<cvename>CVE-2017-6922</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-07-06</entry>
</dates>
</vuln>
<vuln vid="60931f98-55a7-11e7-8514-589cfc0654e1">
<topic>Dropbear -- two vulnerabilities</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2017.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnston reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Fix double-free in server TCP listener cleanup A double-free in
the server could be triggered by an authenticated user if dropbear
is running with -a (Allow connections to forwarded ports from any
host) This could potentially allow arbitrary code execution as root
by an authenticated user.</p>
<p>Fix information disclosure with ~/.ssh/authorized_keys symlink.
Dropbear parsed authorized_keys as root, even if it were a symlink.
The fix is to switch to user permissions when opening authorized_keys.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2017-9078</cvename>
<cvename>CVE-2017-9079</cvename>
</references>
<dates>
<discovery>2017-05-18</discovery>
<entry>2017-07-03</entry>
</dates>
</vuln>
<vuln vid="6e4e35c3-5fd1-11e7-9def-b499baebfeaf">
<topic>smarty3 -- shell injection in math</topic>
<affects>
<package>
<name>smarty3</name>
<range><lt>3.1.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The smarty project reports:</p>
<blockquote cite="https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt">
<p>bugfix {math} shell injection vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt</url>
</references>
<dates>
<discovery>2016-07-19</discovery>
<entry>2017-07-03</entry>
</dates>
</vuln>
<vuln vid="ed3bf433-5d92-11e7-aa14-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack on RSA secret keys</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html">
<p>Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7526</cvename>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html</url>
</references>
<dates>
<discovery>2017-06-29</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="85ebfa0c-5d8d-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>4.0.0</ge><le>9.0.9</le></range>
<range><ge>9.1.0</ge><le>9.1.6</le></range>
<range><ge>9.2.0</ge><le>9.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/</url>
</references>
<dates>
<discovery>2017-06-07</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="0b9f4b5e-5d82-11e7-85df-14dae9d5a9d2">
<topic>tor -- security regression</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.3.0.9</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.3.1.4.a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html">
<p>Tor 0.3.0.9 fixes a path selection bug that would allow a client
to use a guard that was in the same network family as a chosen exit
relay. This is a security regression; all clients running earlier
versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or
0.3.1.4-alpha.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/blog/tor-0309-released-security-update-clients</url>
<url>https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients</url>
<url>https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html</url>
<cvename>CVE-2017-0377</cvename>
</references>
<dates>
<discovery>2017-06-29</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- Privilege escalation via multiple memory leaks</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.89_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualsys reports:</p>
<blockquote cite="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">
<p>
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369</url>
</references>
<dates>
<discovery>2017-06-19</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="00e4050b-56c1-11e7-8e66-08606e46faad">
<topic>pear-Horde_Image -- DoS vulnerability</topic>
<affects>
<package>
<name>pear-Horde_Image</name>
<range><gt>2.3.0</gt><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael J Rubinsky reports:</p>
<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
<p>The second vulnerability (CVE-2017-9773) is a DOS vulnerability.
This only affects Horde installations that do not have a configured image
handling backend, and thus use the "Null" image driver. It is exploitable by
a logged in user clicking on a maliciously crafted URL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
<cvename>CVE-2017-9773</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="a7003121-56bf-11e7-8e66-08606e46faad">
<topic>pear-Horde_Image -- remote code execution vulnerability</topic>
<affects>
<package>
<name>pear-Horde_Image</name>
<range><ge>2.0.0</ge><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael J Rubinsky reports:</p>
<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
<p>The fist vulnerability (CVE-2017-9774) is a Remote Code Execution
vulnerability and is exploitable by a logged in user sending a
maliciously crafted GET request to the Horde server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
<cvename>CVE-2017-9774</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="9f65d382-56a4-11e7-83e3-080027ef73ec">
<topic>OpenVPN -- several vulnerabilities</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.17</lt></range>
<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243">
<p>In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In
the process he found several vulnerabilities and reported them to
the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.</p>
<p>This is a list of fixed important vulnerabilities:</p>
<ul>
<li>Remotely-triggerable ASSERT() on malformed IPv6 packet</li>
<li>Pre-authentication remote crash/information disclosure for clients</li>
<li>Potential double-free in --x509-alt-username</li>
<li>Remote-triggerable memory leaks</li>
<li>Post-authentication remote DoS when using the --x509-track option</li>
<li>Null-pointer dereference in establish_http_proxy_passthru()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243</url>
<cvename>CVE-2017-7508</cvename>
<cvename>CVE-2017-7512</cvename>
<cvename>CVE-2017-7520</cvename>
<cvename>CVE-2017-7521</cvename>
<cvename>CVE-2017-7522</cvename>
</references>
<dates>
<discovery>2017-05-19</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="0c2db2aa-5584-11e7-9a7d-b499baebfeaf">
<topic>Apache httpd -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><lt>2.2.33</lt></range>
</package>
<package>
<name>apache24</name>
<range><lt>2.4.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):<br/>
Use of the ap_get_basic_auth_pw() by third-party modules outside
of the authentication phase may lead to authentication requirements
being bypassed.</li>
<li>mod_ssl Null Pointer Dereference (CVE-2017-3169):<br/>mod_ssl may
dereference a NULL pointer when third-party modules
call ap_hook_process_connection() during an HTTP request to an HTTPS
port.</li>
<li>mod_http2 Null Pointer Dereference (CVE-2017-7659):<br/> A maliciously
constructed HTTP/2 request could cause mod_http2 to dereference a NULL
pointer and crash the server process.</li>
<li>ap_find_token() Buffer Overread (CVE-2017-7668):<br/>The HTTP strict
parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token
list parsing, which allows ap_find_token() to search past the end of its
input string. By maliciously crafting a sequence of request headers, an
attacker may be able to cause a segmentation fault, or to force
ap_find_token() to return an incorrect value.</li>
<li>mod_mime Buffer Overread (CVE-2017-7679):<br/>mod_mime can read one
byte past the end of a buffer when sending a malicious Content-Type
response header.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<url>https://httpd.apache.org/security/vulnerabilities_22.html</url>
<cvename>CVE-2017-3167</cvename>
<cvename>CVE-2017-3169</cvename>
<cvename>CVE-2017-7659</cvename>
<cvename>CVE-2017-7668</cvename>
<cvename>CVE-2017-7679</cvename>
</references>
<dates>
<discovery>2017-06-20</discovery>
<entry>2017-06-20</entry>
</dates>
</vuln>
<vuln vid="f53dd5cc-527f-11e7-a772-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>59.0.3071.104</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by
Ned Williamson on 2017-05-22</li>
<li>[729991] High CVE-2017-5088: Out of bounds read in V8. Reported by
Xiling Gong of Tencent Security Platform Department on 2017-06-06</li>
<li>[714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by
Michal Bentkowski on 2017-04-21</li>
<li>[732498] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5087</cvename>
<cvename>CVE-2017-5088</cvename>
<cvename>CVE-2017-5089</cvename>
<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html</url>
</references>
<dates>
<discovery>2017-06-15</discovery>
<entry>2017-06-16</entry>
</dates>
</vuln>
<vuln vid="9314058e-5204-11e7-b712-b1a44a034d72">
<topic>cURL -- URL file scheme drive letter buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.53.0</ge><lt>7.54.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170614.html">
<p>When libcurl is given either</p>
<p>1. a file: URL that doesn't use two slashes following the colon, or</p>
<p>2. is told that file is the default scheme to use for URLs without scheme</p>
<p>... and the given path starts with a drive letter and libcurl is built for
Windows or DOS, then libcurl would copy the path with a wrong offset, so that
the end of the given path would write beyond the malloc buffer. Up to seven
bytes too much.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9502</cvename>
<url>https://curl.haxx.se/docs/adv_20170614.html</url>
</references>
<dates>
<discovery>2017-06-14</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="7a92e958-5207-11e7-8d7c-6805ca0b3d42">
<topic>rt and dependent modules -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.13_1</lt></range>
</package>
<package>
<name>rt44</name>
<range><ge>4.4.0</ge><lt>4.4.1_1</lt></range>
</package>
<package>
<name>p5-RT-Authen-ExternalAuth</name>
<range><ge>0.9</ge><lt>0.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical reports:</p>
<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html</url>
<cvename>CVE-2015-7686</cvename>
<cvename>CVE-2016-6127</cvename>
<cvename>CVE-2017-5361</cvename>
<cvename>CVE-2017-5943</cvename>
<cvename>CVE-2017-5944</cvename>
</references>
<dates>
<discovery>2017-06-15</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="cd944b3f-51f6-11e7-b7b2-001c25e46b1d">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.126</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-17.html">
<ul>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2017-3075, CVE-2017-3081,
CVE-2017-3083, CVE-2017-3084).</li>
<li>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2017-3076, CVE-2017-3077,
CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3075</cvename>
<cvename>CVE-2017-3076</cvename>
<cvename>CVE-2017-3077</cvename>
<cvename>CVE-2017-3078</cvename>
<cvename>CVE-2017-3079</cvename>
<cvename>CVE-2017-3081</cvename>
<cvename>CVE-2017-3082</cvename>
<cvename>CVE-2017-3083</cvename>
<cvename>CVE-2017-3084</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-17.html</url>
</references>
<dates>
<discovery>2017-06-13</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="6cec1b0a-da15-467d-8691-1dea392d4c8d">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>54.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5470</cvename>
<cvename>CVE-2017-5471</cvename>
<cvename>CVE-2017-5472</cvename>
<cvename>CVE-2017-7749</cvename>
<cvename>CVE-2017-7750</cvename>
<cvename>CVE-2017-7751</cvename>
<cvename>CVE-2017-7752</cvename>
<cvename>CVE-2017-7754</cvename>
<cvename>CVE-2017-7755</cvename>
<cvename>CVE-2017-7756</cvename>
<cvename>CVE-2017-7757</cvename>
<cvename>CVE-2017-7758</cvename>
<cvename>CVE-2017-7759</cvename>
<cvename>CVE-2017-7760</cvename>
<cvename>CVE-2017-7761</cvename>
<cvename>CVE-2017-7762</cvename>
<cvename>CVE-2017-7763</cvename>
<cvename>CVE-2017-7764</cvename>
<cvename>CVE-2017-7765</cvename>
<cvename>CVE-2017-7766</cvename>
<cvename>CVE-2017-7767</cvename>
<cvename>CVE-2017-7768</cvename>
<cvename>CVE-2017-7778</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/</url>
</references>
<dates>
<discovery>2017-06-13</discovery>
<entry>2017-06-13</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="bce47c89-4d3f-11e7-8080-a4badb2f4699">
<topic>roundcube -- arbitrary password resets</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.2.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11">
<p>Roundcube Webmail allows arbitrary password resets by
authenticated users. The problem is caused by an improperly restricted
exec call in the virtualmin and sasl drivers of the password plugin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11</url>
<cvename>CVE-2017-8114</cvename>
</references>
<dates>
<discovery>2017-04-28</discovery>
<entry>2017-06-09</entry>
</dates>
</vuln>
<vuln vid="b33fb1e0-4c37-11e7-afeb-0011d823eebd">
<topic>GnuTLS -- Denial of service vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2017-4">
<p>It was found using the TLS fuzzer tools that decoding a status
response TLS extension with valid contents could lead to a crash
due to a null pointer dereference. The issue affects GnuTLS server
applications.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2017-4</url>
</references>
<dates>
<discovery>2017-06-07</discovery>
<entry>2017-06-08</entry>
</dates>
</vuln>
<vuln vid="165e8951-4be0-11e7-a539-0050569f7e80">
<topic>irssi -- remote DoS</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joseph Bisch reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_06.txt">
<p>When receiving a DCC message without source nick/host, Irssi would
attempt to dereference a NULL pointer.</p>
<p>When receiving certain incorrectly quoted DCC files, Irssi would
try to find the terminating quote one byte before the allocated
memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9468</cvename>
<cvename>CVE-2017-9469</cvename>
<url>https://irssi.org/security/irssi_sa_2017_06.txt</url>
</references>
<dates>
<discovery>2017-06-06</discovery>
<entry>2017-06-08</entry>
</dates>
</vuln>
<vuln vid="52f4b48b-4ac3-11e7-99aa-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>59.0.3071.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html">
<p>30 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5070</cvename>
<cvename>CVE-2017-5071</cvename>
<cvename>CVE-2017-5072</cvename>
<cvename>CVE-2017-5073</cvename>
<cvename>CVE-2017-5074</cvename>
<cvename>CVE-2017-5075</cvename>
<cvename>CVE-2017-5086</cvename>
<cvename>CVE-2017-5076</cvename>
<cvename>CVE-2017-5077</cvename>
<cvename>CVE-2017-5078</cvename>
<cvename>CVE-2017-5079</cvename>
<cvename>CVE-2017-5080</cvename>
<cvename>CVE-2017-5081</cvename>
<cvename>CVE-2017-5082</cvename>
<cvename>CVE-2017-5083</cvename>
<cvename>CVE-2017-5085</cvename>
<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-06-05</discovery>
<entry>2017-06-06</entry>
</dates>
</vuln>
<vuln vid="15a04b9f-47cb-11e7-a853-001fbc0f280f">
<topic>ansible -- Input validation flaw in jinja2 templating system</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat security team reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/cve-2017-7481">
<p>An input validation flaw was found in Ansible, where it fails to
properly mark lookup-plugin results as unsafe. If an attacker could
control the results of lookup() calls, they could inject Unicode
strings to be parsed by the jinja2 templating system, result in
code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/cve-2017-7481</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481</url>
</references>
<dates>
<discovery>2017-05-09</discovery>
<entry>2017-06-02</entry>
</dates>
</vuln>
<vuln vid="738e8ae1-46dd-11e7-a539-0050569f7e80">
<topic>duo -- Two-factor authentication bypass</topic>
<affects>
<package>
<name>duo</name>
<range><lt>1.9.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The duo security team reports:</p>
<blockquote cite="https://duo.com/labs/psa/duo-psa-2017-002">
<p>An untrusted user may be able to set the http_proxy variable to
an invalid address. If this happens, this will trigger the
configured 'failmode' behavior, which defaults to safe. Safe
mode causes the authentication to report a success.</p>
</blockquote>
</body>
</description>
<references>
<url>https://duo.com/labs/psa/duo-psa-2017-002</url>
</references>
<dates>
<discovery>2017-05-19</discovery>
<entry>2017-06-01</entry>
</dates>
</vuln>
<vuln vid="673dce46-46d0-11e7-a539-0050569f7e80">
<topic>FreeRADIUS -- TLS resumption authentication bypass</topic>
<affects>
<package>
<name>freeradius</name>
<name>freeradius2</name>
<name>freeradius3</name>
<range><lt>3.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Winter reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q2/342">
<p>The TLS session cache in FreeRADIUS before 3.0.14 fails to
reliably prevent resumption of an unauthenticated session, which
allows remote attackers (such as malicious 802.1X supplicants) to
bypass authentication via PEAP or TTLS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9148</cvename>
<url>http://freeradius.org/security.html</url>
<url>http://seclists.org/oss-sec/2017/q2/342</url>
<url>http://www.securityfocus.com/bid/98734</url>
</references>
<dates>
<discovery>2017-02-03</discovery>
<entry>2017-06-01</entry>
</dates>
</vuln>
<vuln vid="40a8d798-4615-11e7-8080-a4badb2f4699">
<topic>heimdal -- bypass of capath policy</topic>
<affects>
<package>
<name>heimdal</name>
<range><lt>7.1.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Viktor Dukhovni reports:</p>
<blockquote cite="https://www.h5l.org/advisories.html?show=2017-04-13">
<p>Commit f469fc6 (2010-10-02) inadvertently caused the
previous hop realm to not be added to the transit path of issued
tickets. This may, in some cases, enable bypass of capath policy in
Heimdal versions 1.5 through 7.2. Note, this may break sites that rely
on the bug. With the bug some incomplete [capaths] worked, that should
not have. These may now break authentication in some cross-realm
configurations. (CVE-2017-6594)</p>
</blockquote>
</body>
</description>
<references>
<url>CVE-2017-6594</url>
<freebsdpr>ports/219657</freebsdpr>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-05-31</entry>
</dates>
</vuln>
<vuln vid="51d1282d-420e-11e7-82c5-14dae9d210b8">
<topic>FreeBSD -- ipfilter(4) fragment handling panic</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_10</lt></range>
<range><ge>10.3</ge><lt>10.3_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>ipfilter(4), capable of stateful packet inspection, using
the "keep state" or "keep frags" rule options, will not
only maintain the state of connections, such as TCP streams
or UDP communication, it also maintains the state of
fragmented packets. When a packet fragments are received
they are cached in a hash table (and linked list). When a
fragment is received it is compared with fragments already
cached in the hash table for a match. If it does not match
the new entry is used to create a new entry in the hash
table. If on the other hand it does match, unfortunately
the wrong entry is freed, the entry in the hash table. This
results in use after free panic (and for a brief moment
prior to the panic a memory leak due to the wrong entry
being freed).</p>
<h1>Impact:</h1>
<p>Carefully feeding fragments that are allowed to pass by
an ipfilter(4) firewall can be used to cause a panic followed
by reboot loop denial of service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1081</cvename>
<freebsdsa>SA-17:04.ipfilter</freebsdsa>
</references>
<dates>
<discovery>2017-04-27</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="3c0237f5-420e-11e7-82c5-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_9</lt></range>
<range><ge>10.3</ge><lt>10.3_18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A vulnerability was discovered in the NTP server's parsing
of configuration directives. [CVE-2017-6464]</p>
<p>A vulnerability was found in NTP, in the parsing of
packets from the DPTS Clock. [CVE-2017-6462]</p>
<p>A vulnerability was discovered in the NTP server's parsing
of configuration directives. [CVE-2017-6463]</p>
<p>A vulnerability was found in NTP, affecting the origin
timestamp check function. [CVE-2016-9042]</p>
<h1>Impact:</h1>
<p>A remote, authenticated attacker could cause ntpd to
crash by sending a crafted message. [CVE-2017-6463,
CVE-2017-6464]</p>
<p>A malicious device could send crafted messages, causing
ntpd to crash. [CVE-2017-6462]</p>
<p>An attacker able to spoof messages from all of the
configured peers could send crafted packets to ntpd, causing
later replies from those peers to be discarded, resulting
in denial of service. [CVE-2016-9042]</p>
</body>
</description>
<references>
<cvename>CVE-2016-9042</cvename>
<cvename>CVE-2017-6462</cvename>
<cvename>CVE-2017-6463</cvename>
<cvename>CVE-2017-6464</cvename>
<freebsdsa>SA-17:03.ntp</freebsdsa>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="ec6aeb8e-41e4-11e7-aa00-5404a68ad561">
<topic>vlc -- remote code execution via crafted subtitles</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.6,4</lt></range>
</package>
<package>
<name>vlc-qt4</name>
<range><lt>2.2.6,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Check Point research team reports:</p>
<blockquote cite="http://blog.checkpoint.com/2017/05/23/hacked-in-translation/">
<p>Remote code execution via crafted subtitles</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.checkpoint.com/2017/05/23/hacked-in-translation/</url>
</references>
<dates>
<discovery>2017-05-23</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="803879e9-4195-11e7-9b08-080027ef73ec">
<topic>OpenEXR -- multiple remote code execution and denial of service vulnerabilities</topic>
<affects>
<package>
<name>OpenEXR</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brandon Perry reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/05/12/5">
<p>[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).</p>
<ul>
<li>CVE-2017-9110
In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9111
In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9112
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9113
In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9114
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9115
In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9116
In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/05/12/5</url>
<cvename>CVE-2017-9110</cvename>
<cvename>CVE-2017-9111</cvename>
<cvename>CVE-2017-9112</cvename>
<cvename>CVE-2017-9113</cvename>
<cvename>CVE-2017-9114</cvename>
<cvename>CVE-2017-9115</cvename>
<cvename>CVE-2017-9116</cvename>
<url>https://github.com/openexr/openexr/issues/232</url>
</references>
<dates>
<discovery>2017-01-12</discovery>
<entry>2017-05-25</entry>
</dates>
</vuln>
<vuln vid="50776801-4183-11e7-b291-b499baebfeaf">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.6.4_2,1</lt></range>
<range><ge>6.9.7.0,1</ge><lt>6.9.8.8,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://nvd.nist.gov/vuln/search/results?query=ImageMagick">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/search/results?query=ImageMagick</url>
<cvename>CVE-2017-5506</cvename>
<cvename>CVE-2017-5507</cvename>
<cvename>CVE-2017-5508</cvename>
<cvename>CVE-2017-5509</cvename>
<cvename>CVE-2017-5510</cvename>
<cvename>CVE-2017-5511</cvename>
<cvename>CVE-2017-6497</cvename>
<cvename>CVE-2017-6498</cvename>
<cvename>CVE-2017-6499</cvename>
<cvename>CVE-2017-6500</cvename>
<cvename>CVE-2017-6501</cvename>
<cvename>CVE-2017-6502</cvename>
<cvename>CVE-2017-7275</cvename>
<cvename>CVE-2017-7606</cvename>
<cvename>CVE-2017-7619</cvename>
<cvename>CVE-2017-7941</cvename>
<cvename>CVE-2017-7942</cvename>
<cvename>CVE-2017-7943</cvename>
<cvename>CVE-2017-8343</cvename>
<cvename>CVE-2017-8344</cvename>
<cvename>CVE-2017-8345</cvename>
<cvename>CVE-2017-8346</cvename>
<cvename>CVE-2017-8347</cvename>
<cvename>CVE-2017-8348</cvename>
<cvename>CVE-2017-8349</cvename>
<cvename>CVE-2017-8350</cvename>
<cvename>CVE-2017-8351</cvename>
<cvename>CVE-2017-8352</cvename>
<cvename>CVE-2017-8353</cvename>
<cvename>CVE-2017-8354</cvename>
<cvename>CVE-2017-8355</cvename>
<cvename>CVE-2017-8356</cvename>
<cvename>CVE-2017-8357</cvename>
<cvename>CVE-2017-8765</cvename>
<cvename>CVE-2017-8830</cvename>
<cvename>CVE-2017-9141</cvename>
<cvename>CVE-2017-9142</cvename>
<cvename>CVE-2017-9143</cvename>
<cvename>CVE-2017-9144</cvename>
</references>
<dates>
<discovery>2017-03-05</discovery>
<entry>2017-05-25</entry>
<modified>2017-05-29</modified>
</dates>
</vuln>
<vuln vid="6f4d96c0-4062-11e7-b291-b499baebfeaf">
<topic>samba -- remote code execution vulnerability</topic>
<affects>
<package>
<name>samba42</name>
<range><lt>4.2.15</lt></range>
</package>
<package>
<name>samba43</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>samba44</name>
<range><lt>4.4.14</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.10</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-7494.html">
<p>Remote code execution from a writable share.</p>
<p>All versions of Samba from 3.5.0 onwards are vulnerable to a remote
code execution vulnerability, allowing a malicious client to upload
a shared library to a writable share, and then cause the server to
load and execute it.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-7494.html</url>
<cvename>CVE-2017-7494</cvename>
</references>
<dates>
<discovery>2017-05-24</discovery>
<entry>2017-05-24</entry>
</dates>
</vuln>
<vuln vid="f52e3a8d-3f7e-11e7-97a9-a0d3c19bfa21">
<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>375.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4462">
<p>NVIDIA GPU Display Driver contains vulnerabilities in the
kernel mode layer handler where not correctly validated user
input, NULL pointer dereference, and incorrect access control
may lead to denial of service or potential escalation of
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0350</cvename>
<cvename>CVE-2017-0351</cvename>
<cvename>CVE-2017-0352</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4462</url>
</references>
<dates>
<discovery>2017-05-15</discovery>
<entry>2017-05-23</entry>
</dates>
</vuln>
<vuln vid="da1d5d2e-3eca-11e7-8861-0018fe623f2b">
<topic>miniupnpc -- integer signedness error</topic>
<affects>
<package>
<name>miniupnpc</name>
<range><lt>2.0.20170509</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tintinweb reports:</p>
<blockquote cite="https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798">
<p>An integer signedness error was found in miniupnp's miniwget
allowing an unauthenticated remote entity typically located on the
local network segment to trigger a heap corruption or an access
violation in miniupnp's http response parser when processing a
specially crafted chunked-encoded response to a request for the
xml root description url.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8798</cvename>
<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798</url>
</references>
<dates>
<discovery>2017-05-09</discovery>
<entry>2017-05-22</entry>
</dates>
</vuln>
<vuln vid="a5bb7ea0-3e58-11e7-94a2-00e04c1ea73d">
<topic>Wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.7.5,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://wordpress.org/news/2017/05/wordpress-4-7-5/">
<p>WordPress versions 4.7.4 and earlier are affected by six security issues</p>
<ul>
<li>Insufficient redirect validation in the HTTP class.</li>
<li>Improper handling of post meta data values in the XML-RPC API.</li>
<li>Lack of capability checks for post meta data in the XML-RPC API.</li>
<li>A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.</li>
<li>A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/05/wordpress-4-7-5/</url>
</references>
<dates>
<discovery>2017-05-16</discovery>
<entry>2017-05-21</entry>
</dates>
</vuln>
<vuln vid="fab87bff-3ce5-11e7-bf9d-001999f8d30b">
<topic>asterisk -- Memory exhaustion on short SCCP packets</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.15.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A remote memory exhaustion can be triggered by sending
an SCCP packet to Asterisk system with "chan_skinny"
enabled that is larger than the length of the SCCP header
but smaller than the packet length specified in the header.
The loop that reads the rest of the packet doesn't detect
that the call to read() returned end-of-file before the
expected number of bytes and continues infinitely. The
"partial data" message logging in that tight loop causes
Asterisk to exhaust all available memory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-004.html</url>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-05-19</entry>
</dates>
</vuln>
<vuln vid="0537afa3-3ce0-11e7-bf9d-001999f8d30b">
<topic>asterisk -- Buffer Overrun in PJSIP transaction layer</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.15.1</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.6_1</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A remote crash can be triggered by sending a SIP packet
to Asterisk with a specially crafted CSeq header and a
Via header with no branch parameter. The issue is that
the PJSIP RFC 2543 transaction key generation algorithm
does not allocate a large enough buffer. By overrunning
the buffer, the memory allocation table becomes corrupted,
leading to an eventual crash.</p>
<p>The multi-part body parser in PJSIP contains a logical
error that can make certain multi-part body parts attempt
to read memory from outside the allowed boundaries. A
specially-crafted packet can trigger these invalid reads
and potentially induce a crash.</p>
<p>This issues is in PJSIP, and so the issue can be fixed
without performing an upgrade of Asterisk at all. However,
we are releasing a new version of Asterisk with the bundled
PJProject updated to include the fix.</p>
<p>If you are running Asterisk with chan_sip, this issue
does not affect you.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-002.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2017-003.html</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-05-19</entry>
</dates>
</vuln>
<vuln vid="3c2549b3-3bed-11e7-a9f0-a4badb296695">
<topic>Joomla3 -- SQL Injection</topic>
<affects>
<package>
<name>joomla3</name>
<range><eq>3.7.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports:</p>
<blockquote cite="https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html">
<p>Inadequate filtering of request data leads to a SQL Injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8917</cvename>
<url>https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html</url>
</references>
<dates>
<discovery>2017-05-11</discovery>
<entry>2017-05-18</entry>
</dates>
</vuln>
<vuln vid="9704930c-3bb7-11e7-93f7-d43d7e971a1b">
<topic>gitlab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>6.6.0</ge><le>8.17.5</le></range>
<range><ge>9.0.0</ge><le>9.0.6</le></range>
<range><ge>9.1.0</ge><le>9.1.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/</url>
</references>
<dates>
<discovery>2017-05-08</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>
<vuln vid="5d62950f-3bb5-11e7-93f7-d43d7e971a1b">
<topic>gitlab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.7.0</ge><le>8.15.7</le></range>
<range><ge>8.16.0</ge><le>8.16.7</le></range>
<range><ge>8.17.0</ge><le>8.17.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/">
<h1>Information Disclosure in Issue and Merge Request Trackers</h1>
<p>During an internal code review a critical vulnerability in the GitLab
Issue and Merge Request trackers was discovered. This vulnerability could
allow a user with access to assign ownership of an issue or merge request to
another user to disclose that user's private token, email token, email
address, and encrypted OTP secret. Reporter-level access to a GitLab project
is required to exploit this flaw.</p>
<h1>SSRF when importing a project from a Repo by URL</h1>
<p>GitLab instances that have enabled project imports using "Repo by URL"
were vulnerable to Server-Side Request Forgery attacks. By specifying a
project import URL of localhost an attacker could target services that are
bound to the local interface of the server. These services often do not
require authentication. Depending on the service an attacker might be able
craft an attack using the project import request URL.</p>
<h1>Links in Environments tab vulnerable to tabnabbing</h1>
<p>edio via HackerOne reported that user-configured Environment links
include target=_blank but do not also include rel: noopener
noreferrer. Anyone clicking on these links may therefore be subjected to
tabnabbing attacks where a link back to the requesting page is maintained
and can be manipulated by the target server.</p>
<h1>Accounts with email set to "Do not show on profile" have addresses
exposed in public atom feed</h1>
<p>Several GitLab users reported that even with "Do not show on profile"
configured for their email addresses those addresses were still being leaked
in Atom feeds if they commented on a public project.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0882</cvename>
<url>https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-03-20</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>
<vuln vid="4a088d67-3af2-11e7-9d75-c86000169601">
<topic>freetype2 -- buffer overflows</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Lemberg reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html">
<p>CVE-2017-8105, CVE-2017-8287: Older FreeType versions have
out-of-bounds writes caused by heap-based buffer overflows
related to Type 1 fonts.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html</url>
<cvename>CVE-2017-8105</cvename>
<cvename>CVE-2017-8287</cvename>
</references>
<dates>
<discovery>2017-05-17</discovery>
<entry>2017-05-17</entry>
</dates>
</vuln>
<vuln vid="04cc7bd2-3686-11e7-aa64-080027ef73ec">
<topic>OpenVPN -- two remote denial-of-service vulnerabilities</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.15</lt></range>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
<package>
<name>openvpn23</name>
<range><lt>2.3.15</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.15</lt></range>
</package>
<package>
<name>openvpn23-polarssl</name>
<range><lt>2.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://openvpn.net/index.php/open-source/downloads.html">
<p>OpenVPN v2.4.0 was audited for security vulnerabilities independently by
Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by
Private Internet Access) between December 2016 and April 2017. The
primary findings were two remote denial-of-service vulnerabilities.
Fixes to them have been backported to v2.3.15.</p>
<p>An authenticated client can do the 'three way handshake'
(P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet
is the first that is allowed to carry payload. If that payload is
too big, the OpenVPN server process will stop running due to an
ASSERT() exception. That is also the reason why servers using
tls-auth/tls-crypt are protected against this attack - the P_CONTROL
packet is only accepted if it contains the session ID we specified,
with a valid HMAC (challenge-response). (CVE-2017-7478)</p>
<p>An authenticated client can cause the server's the packet-id
counter to roll over, which would lead the server process to hit an
ASSERT() and stop running. To make the server hit the ASSERT(), the
client must first cause the server to send it 2^32 packets (at least
196 GB).</p>
</blockquote>
</body>
</description>
<references>
<url>https://openvpn.net/index.php/open-source/downloads.html</url>
<cvename>CVE-2017-7478</cvename>
<cvename>CVE-2017-7479</cvename>
<url>https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits</url>
<url>https://ostif.org/?p=870&preview=true</url>
<url>https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/</url>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-05-11</entry>
</dates>
</vuln>
<vuln vid="414c18bf-3653-11e7-9550-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-client</name>
<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
</package>
<package>
<name>postgresql93-client</name>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
</package>
<package>
<name>postgresql94-client</name>
<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
</package>
<package>
<name>postgresql95-client</name>
<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
</package>
<package>
<name>postgresql96-client</name>
<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1746/">
<p>
Security Fixes nested CASE expressions +
database and role names with embedded special characters
</p>
<ul>
<li>CVE-2017-7484: selectivity estimators bypass SELECT privilege
checks.
</li>
<li>CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
</li>
<li>CVE-2017-7486: pg_user_mappings view discloses foreign server
passwords. This applies to new databases, see the release notes for
the procedure to apply the fix to an existing database.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5423</cvename>
<cvename>CVE-2016-5424</cvename>
</references>
<dates>
<discovery>2017-05-11</discovery>
<entry>2017-05-11</entry>
</dates>
</vuln>
<vuln vid="0baee383-356c-11e7-b9a9-50e549ebab6c">
<topic>kauth: Local privilege escalation</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.30_4</lt></range>
</package>
<package>
<name>kf5-kauth</name>
<range><lt>5.33.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170510-1.txt">
<p>KAuth contains a logic flaw in which the service invoking dbus
is not properly checked.
This allows spoofing the identity of the caller and with some
carefully crafted calls can lead to gaining root from an
unprivileged account.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8422</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2017/05/10/3</mlist>
<url>https://www.kde.org/info/security/advisory-20170510-1.txt</url>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-05-10</entry>
</dates>
</vuln>
<vuln vid="57600032-34fe-11e7-8965-bcaec524bf84">
<topic>libetpan -- null dereference vulnerability in MIME parsing component</topic>
<affects>
<package>
<name>libetpan</name>
<range><lt>1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rwhitworth reports:</p>
<blockquote cite="https://github.com/dinhviethoa/libetpan/issues/274">
<p>I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the
mime-parse test program. Is fixing these crashes something you're
interested in? The input files can be found here:
https://github.com/rwhitworth/libetpan-fuzz/.
The files can be executed as ./mime-parse id_filename to cause
seg faults.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8825</cvename>
<url>http://cve.circl.lu/cve/CVE-2017-8825</url>
</references>
<dates>
<discovery>2017-04-29</discovery>
<entry>2017-05-09</entry>
</dates>
</vuln>
<vuln vid="92e345d0-304d-11e7-8359-e8e0b747a45a">
<topic>chromium -- race condition vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>58.0.3029.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html">
<p>1 security fix in this release:</p>
</blockquote>
<ul>
<li>[679306] High CVE-2017-5068: Race condition in WebRTC. Credit to
Philipp Hancke</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2017-5068</cvename>
<url>https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-05-02</discovery>
<entry>2017-05-03</entry>
</dates>
</vuln>
<vuln vid="a8c8001b-216c-11e7-80aa-005056925db4">
<topic>dovecot -- Dovecot DoS when passdb dict was used for authentication</topic>
<affects>
<package>
<name>dovecot</name>
<name>dovecot2</name>
<range><gt>2.2.25_6</gt><lt>2.2.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports:</p>
<blockquote cite="https://dovecot.org/list/dovecot-news/2017-April/000341.html">
<p>passdb/userdb dict: Don't double-expand %variables in keys. If dict
was used as the authentication passdb, using specially crafted
%variables in the username could be used to cause DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2669</cvename>
<mlist>https://dovecot.org/list/dovecot-news/2017-April/000341.html</mlist>
<mlist>https://dovecot.org/list/dovecot-news/2017-April/000342.html</mlist>
</references>
<dates>
<discovery>2016-12-01</discovery>
<entry>2017-04-30</entry>
</dates>
</vuln>
<vuln vid="24673ed7-2bf3-11e7-b291-b499baebfeaf">
<topic>LibreSSL -- TLS verification vulnerability</topic>
<affects>
<package>
<name>libressl</name>
<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Jakub Jirutka reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q2/145">
<p>LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if
SSL_get_verify_result is relied upon for a later check of a
verification result, in a use case where a user-provided verification
callback returns 1, as demonstrated by acceptance of invalid
certificates by nginx.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q2/145</url>
<url>https://github.com/libressl-portable/portable/issues/307</url>
<cvename>CVE-2017-8301</cvename>
</references>
<dates>
<discovery>2017-04-27</discovery>
<entry>2017-04-28</entry>
</dates>
</vuln>
<vuln vid="631c4710-9be5-4a80-9310-eb2847fe24dd">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.57</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.46.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-04-26/">
<h1>Description</h1>
<h5>SECURITY-412 through SECURITY-420 / CVE-2017-1000356</h5>
<p>CSRF: Multiple vulnerabilities</p>
<h5>SECURITY-429 / CVE-2017-1000353</h5>
<p>CLI: Unauthenticated remote code execution</p>
<h5>SECURITY-466 / CVE-2017-1000354</h5>
<p>CLI: Login command allowed impersonating any Jenkins user</p>
<h5>SECURITY-503 / CVE-2017-1000355</h5>
<p>XStream: Java crash when trying to instantiate void/Void</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-1000356</cvename>
<cvename>CVE-2017-1000353</cvename>
<cvename>CVE-2017-1000354</cvename>
<cvename>CVE-2017-1000355</cvename>
<url>https://jenkins.io/security/advisory/2017-04-26/</url>
</references>
<dates>
<discovery>2017-04-26</discovery>
<entry>2017-04-27</entry>
</dates>
</vuln>
<vuln vid="df0144fb-295e-11e7-970f-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed a header injection vulnerability in common function
set_status_header() under Apache (thanks to Guillermo Caminer from
Flowgate).</p>
<p>Fixed byte-safety issues in Encrypt Library (DEPRECATED) when
mbstring.func_overload is enabled.</p>
<p>Fixed byte-safety issues in Encryption Library when
mbstring.func_overload is enabled.</p>
<p>Fixed byte-safety issues in compatibility functions
password_hash(), hash_pbkdf2() when mbstring.func_overload is
enabled.</p>
<p>Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv()
with MCRYPT_DEV_URANDOM.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-03-23</discovery>
<entry>2017-04-25</entry>
</dates>
</vuln>
<vuln vid="81433129-2916-11e7-ad3e-00e04c1ea73d">
<topic>weechat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Common Vulnerabilities and Exposures:</p>
<blockquote cite="https://weechat.org/download/security/">
<p>WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to
the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes
function during quote removal, with a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/download/security/</url>
<cvename>CVE-2017-8073</cvename>
</references>
<dates>
<discovery>2017-04-23</discovery>
<entry>2017-04-24</entry>
</dates>
</vuln>
<vuln vid="1455c86c-26c2-11e7-9daa-6cf0497db129">
<topic>drupal8 -- Drupal Core - Critical - Access Bypass</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team Reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-002">
<p>CVE-2017-6919: Access bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6919</cvename>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-21</entry>
</dates>
</vuln>
<vuln vid="95a74a48-2691-11e7-9e2d-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>58.0.3029.81</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html">
<p>29 security fixes in this release, including:</p>
<ul>
<li>[695826] High CVE-2017-5057: Type confusion in PDFium. Credit to
Guang Gong of Alpha Team, Qihoo 360</li>
<li>[694382] High CVE-2017-5058: Heap use after free in Print Preview.
Credit to Khalil Zhani</li>
<li>[684684] High CVE-2017-5059: Type confusion in Blink. Credit to
SkyLined working with Trend Micro's Zero Day Initiative</li>
<li>[683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to
Xudong Zheng</li>
<li>[672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to
Haosheng Wang (@gnehsoah)</li>
<li>[702896] Medium CVE-2017-5062: Use after free in Chrome Apps.
Credit to anonymous</li>
<li>[700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to
Sweetchip</li>
<li>[693974] Medium CVE-2017-5064: Use after free in Blink. Credit to
Wadih Matar</li>
<li>[704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to
Khalil Zhani</li>
<li>[690821] Medium CVE-2017-5066: Incorrect signature handing in Networking.
Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen
(ICTT, Xidian University)</li>
<li>[648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to
Khalil Zhani</li>
<li>[691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to
Michael Reizelman</li>
<li>[713205] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5057</cvename>
<cvename>CVE-2017-5058</cvename>
<cvename>CVE-2017-5059</cvename>
<cvename>CVE-2017-5060</cvename>
<cvename>CVE-2017-5061</cvename>
<cvename>CVE-2017-5062</cvename>
<cvename>CVE-2017-5063</cvename>
<cvename>CVE-2017-5064</cvename>
<cvename>CVE-2017-5065</cvename>
<cvename>CVE-2017-5066</cvename>
<cvename>CVE-2017-5067</cvename>
<cvename>CVE-2017-5069</cvename>
<url>https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-21</entry>
</dates>
</vuln>
<vuln vid="607f8b57-7454-42c6-a88a-8706f327076d">
<topic>icu -- multiple vulnerabilities</topic>
<affects>
<package>
<name>icu</name>
<range><lt>58.2_2,1</lt></range>
</package>
<package>
<name>linux-c6-icu</name>
<name>linux-c7-icu</name>
<range><lt>59.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7867">
<p>International Components for Unicode (ICU) for C/C++
before 2017-02-13 has an out-of-bounds write caused by a
heap-based buffer overflow related to the utf8TextAccess
function in common/utext.cpp and the utext_setNativeIndex*
function.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7868">
<p>International Components for Unicode (ICU) for C/C++
before 2017-02-13 has an out-of-bounds write caused by a
heap-based buffer overflow related to the utf8TextAccess
function in common/utext.cpp and the utext_moveIndex32*
function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7867</cvename>
<cvename>CVE-2017-7868</cvename>
<url>http://bugs.icu-project.org/trac/changeset/39671</url>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437</url>
</references>
<dates>
<discovery>2017-01-21</discovery>
<entry>2017-04-20</entry>
<modified>2017-05-04</modified>
</dates>
</vuln>
<vuln vid="2a96e498-3234-4950-a9ad-419bc84a839d">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<name>linux-f8-tiff</name>
<name>linux-f10-tiff</name>
<name>linux-c6-tiff</name>
<name>linux-c7-tiff</name>
<range><lt>4.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-5225">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5225</cvename>
<cvename>CVE-2017-7592</cvename>
<cvename>CVE-2017-7593</cvename>
<cvename>CVE-2017-7594</cvename>
<cvename>CVE-2017-7595</cvename>
<cvename>CVE-2017-7596</cvename>
<cvename>CVE-2017-7597</cvename>
<cvename>CVE-2017-7598</cvename>
<cvename>CVE-2017-7599</cvename>
<cvename>CVE-2017-7600</cvename>
<cvename>CVE-2017-7601</cvename>
<cvename>CVE-2017-7602</cvename>
<url>https://github.com/vadz/libtiff/commit/5c080298d59e</url>
<url>https://github.com/vadz/libtiff/commit/48780b4fcc42</url>
<url>https://github.com/vadz/libtiff/commit/d60332057b95</url>
<url>https://github.com/vadz/libtiff/commit/2ea32f7372b6</url>
<url>https://github.com/vadz/libtiff/commit/8283e4d1b7e5</url>
<url>https://github.com/vadz/libtiff/commit/47f2fb61a3a6</url>
<url>https://github.com/vadz/libtiff/commit/3cfd62d77c2a</url>
<url>https://github.com/vadz/libtiff/commit/3144e57770c1</url>
<url>https://github.com/vadz/libtiff/commit/0a76a8c765c7</url>
<url>https://github.com/vadz/libtiff/commit/66e7bd595209</url>
</references>
<dates>
<discovery>2017-04-01</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="d44129d6-b22e-4e9c-b200-6a46e8bd3e60">
<topic>libsamplerate -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsamplerate</name>
<name>linux-c6-libsamplerate</name>
<name>linux-c7-libsamplerate</name>
<range><lt>0.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7697">
<p>In libsamplerate before 0.1.9, a buffer over-read
occurs in the calc_output_single function in src_sinc.c
via a crafted audio file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7697</cvename>
<url>https://github.com/erikd/libsamplerate/commit/c3b66186656d</url>
</references>
<dates>
<discovery>2017-04-11</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="5a97805e-93ef-4dcb-8d5e-dbcac263bfc2">
<topic>libsndfile -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7585">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a stack-based buffer overflow via a specially crafted
FLAC file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7586">
<p>In libsndfile before 1.0.28, an error in the
"header_read()" function (common.c) when handling ID3 tags
can be exploited to cause a stack-based buffer overflow
via a specially crafted FLAC file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7741">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a segmentation violation (with write memory access)
via a specially crafted FLAC file during a resample
attempt, a similar issue to CVE-2017-7585.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7742">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a segmentation violation (with read memory access)
via a specially crafted FLAC file during a resample
attempt, a similar issue to CVE-2017-7585.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7585</cvename>
<cvename>CVE-2017-7586</cvename>
<cvename>CVE-2017-7741</cvename>
<cvename>CVE-2017-7742</cvename>
<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
<url>https://github.com/erikd/libsndfile/commit/708e996c87c5</url>
<url>https://github.com/erikd/libsndfile/commit/f457b7b5ecfe</url>
<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
</references>
<dates>
<discovery>2017-04-07</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="3e2e9b44-25ce-11e7-a175-939b30e0836d">
<topic>cURL -- TLS session resumption client cert bypass (again)</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.54.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170419.html">
<p>libcurl would attempt to resume a TLS session even if the client
certificate had changed. That is unacceptable since a server by
specification is allowed to skip the client certificate check on
resume, and may instead use the old identity which was established
by the previous certificate (or no certificate).</p>
<p>libcurl supports by default the use of TLS session id/ticket to
resume previous TLS sessions to speed up subsequent TLS handshakes.
They are used when for any reason an existing TLS connection
couldn't be kept alive to make the next handshake faster.</p>
<p>This flaw is a regression and identical to CVE-2016-5419 reported
on August 3rd 2016, but affecting a different version range.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7468</cvename>
<url>https://curl.haxx.se/docs/adv_20170419.html</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="cf133acc-82e7-4755-a66a-5ddf90dacbe6">
<topic>graphite2 -- out-of-bounds write with malicious font</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.9_1</lt></range>
</package>
<package>
<name>linux-c7-graphite2</name>
<range><lt>1.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>An out-of-bounds write in the Graphite 2 library
triggered with a maliciously crafted Graphite font. This
results in a potentially exploitable crash. This issue was
fixed in the Graphite 2 library as well as Mozilla
products.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5436</cvename>
<url>https://github.com/silnrsi/graphite/commit/1ce331d5548b</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
<modified>2017-04-20</modified>
</dates>
</vuln>
<vuln vid="b8ee7a81-a879-4358-9b30-7dd1bd4c14b1">
<topic>libevent -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libevent</name>
<name>libevent2</name>
<name>linux-c6-libevent2</name>
<name>linux-c7-libevent</name>
<range><lt>2.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/DSA-3789-1">
<p>CVE-2016-10195: The name_parse function in evdns.c in
libevent before 2.1.6-beta allows remote attackers to have
unspecified impact via vectors involving the label_len
variable, which triggers an out-of-bounds stack read.</p>
<p>CVE-2016-10196: Stack-based buffer overflow in the
evutil_parse_sockaddr_port function in evutil.c in libevent
before 2.1.6-beta allows attackers to cause a denial of
service (segmentation fault) via vectors involving a long
string in brackets in the ip_as_string argument.</p>
<p>CVE-2016-10197: The search_make_new function in evdns.c
in libevent before 2.1.6-beta allows attackers to cause a
denial of service (out-of-bounds read) via an empty
hostname.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10195</cvename>
<cvename>CVE-2016-10196</cvename>
<cvename>CVE-2016-10197</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/31/17</url>
<url>https://github.com/libevent/libevent/issues/317</url>
<url>https://github.com/libevent/libevent/issues/318</url>
<url>https://github.com/libevent/libevent/issues/332</url>
<url>https://github.com/libevent/libevent/issues/335</url>
</references>
<dates>
<discovery>2017-01-31</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="4cb165f0-6e48-423e-8147-92255d35c0f7">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-f10-nss</name>
<name>linux-c6-nss</name>
<name>linux-c7-nss</name>
<range><ge>3.30</ge><lt>3.30.1</lt></range>
<range><ge>3.29</ge><lt>3.29.5</lt></range>
<range><ge>3.22</ge><lt>3.28.4</lt></range>
<range><lt>3.21.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>An out-of-bounds write during Base64 decoding operation
in the Network Security Services (NSS) library due to
insufficient memory being allocated to the buffer. This
results in a potentially exploitable crash. The NSS library
has been updated to fix this issue to address this issue and
Firefox 53 has been updated with NSS version 3.29.5.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>A flaw in DRBG number generation within the Network
Security Services (NSS) library where the internal state V
does not correctly carry bits over. The NSS library has been
updated to fix this issue to address this issue and Firefox
53 has been updated with NSS version 3.29.5.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5461</cvename>
<cvename>CVE-2017-5462</cvename>
<url>https://hg.mozilla.org/projects/nss/rev/99a86619eac9</url>
<url>https://hg.mozilla.org/projects/nss/rev/e126381a3c29</url>
</references>
<dates>
<discovery>2017-03-17</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="5e0a038a-ca30-416d-a2f5-38cbf5e7df33">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>53.0_2,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>46.0,1</ge><lt>52.1.0_2,1</lt></range>
<range><lt>45.9.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>46.0,2</ge><lt>52.1.0,2</lt></range>
<range><lt>45.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><ge>46.0</ge><lt>52.1.0</lt></range>
<range><lt>45.9.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>46.0</ge><lt>52.1.0</lt></range>
<range><lt>45.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5433</cvename>
<cvename>CVE-2017-5435</cvename>
<cvename>CVE-2017-5436</cvename>
<cvename>CVE-2017-5461</cvename>
<cvename>CVE-2017-5459</cvename>
<cvename>CVE-2017-5466</cvename>
<cvename>CVE-2017-5434</cvename>
<cvename>CVE-2017-5432</cvename>
<cvename>CVE-2017-5460</cvename>
<cvename>CVE-2017-5438</cvename>
<cvename>CVE-2017-5439</cvename>
<cvename>CVE-2017-5440</cvename>
<cvename>CVE-2017-5441</cvename>
<cvename>CVE-2017-5442</cvename>
<cvename>CVE-2017-5464</cvename>
<cvename>CVE-2017-5443</cvename>
<cvename>CVE-2017-5444</cvename>
<cvename>CVE-2017-5446</cvename>
<cvename>CVE-2017-5447</cvename>
<cvename>CVE-2017-5465</cvename>
<cvename>CVE-2017-5448</cvename>
<cvename>CVE-2017-5437</cvename>
<cvename>CVE-2017-5454</cvename>
<cvename>CVE-2017-5455</cvename>
<cvename>CVE-2017-5456</cvename>
<cvename>CVE-2017-5469</cvename>
<cvename>CVE-2017-5445</cvename>
<cvename>CVE-2017-5449</cvename>
<cvename>CVE-2017-5450</cvename>
<cvename>CVE-2017-5451</cvename>
<cvename>CVE-2017-5462</cvename>
<cvename>CVE-2017-5463</cvename>
<cvename>CVE-2017-5467</cvename>
<cvename>CVE-2017-5452</cvename>
<cvename>CVE-2017-5453</cvename>
<cvename>CVE-2017-5458</cvename>
<cvename>CVE-2017-5468</cvename>
<cvename>CVE-2017-5430</cvename>
<cvename>CVE-2017-5429</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="d9e01c35-2531-11e7-b291-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.55</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.31</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.23</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.55</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.36</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html">
<p>This Critical Patch Update contains 39 new security fixes for
Oracle MySQL. 11 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html</url>
<cvename>CVE-2017-3308</cvename>
<cvename>CVE-2017-3309</cvename>
<cvename>CVE-2017-3450</cvename>
<cvename>CVE-2017-3599</cvename>
<cvename>CVE-2017-3329</cvename>
<cvename>CVE-2017-3600</cvename>
<cvename>CVE-2017-3331</cvename>
<cvename>CVE-2017-3453</cvename>
<cvename>CVE-2017-3452</cvename>
<cvename>CVE-2017-3454</cvename>
<cvename>CVE-2017-3455</cvename>
<cvename>CVE-2017-3305</cvename>
<cvename>CVE-2017-3460</cvename>
<cvename>CVE-2017-3456</cvename>
<cvename>CVE-2017-3458</cvename>
<cvename>CVE-2017-3457</cvename>
<cvename>CVE-2017-3459</cvename>
<cvename>CVE-2017-3463</cvename>
<cvename>CVE-2017-3462</cvename>
<cvename>CVE-2017-3461</cvename>
<cvename>CVE-2017-3464</cvename>
<cvename>CVE-2017-3465</cvename>
<cvename>CVE-2017-3467</cvename>
<cvename>CVE-2017-3468</cvename>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="c6861494-1ffb-11e7-934d-d05099c0ae8c">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P8</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P8</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P5</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2017.03.25</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01465/0">
<p>A query with a specific set of characteristics could
cause a server using DNS64 to encounter an assertion
failure and terminate.</p>
<p>An attacker could deliberately construct a query,
enabling denial-of-service against a server if it
was configured to use the DNS64 feature and other
preconditions were met.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01466/0">
<p>Mistaken assumptions about the ordering of records in
the answer section of a response containing CNAME or
DNAME resource records could lead to a situation in
which named would exit with an assertion failure when
processing a response in which records occurred in an
unusual order.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01471/0">
<p>named contains a feature which allows operators to
issue commands to a running server by communicating
with the server process over a control channel,
using a utility program such as rndc.</p>
<p>A regression introduced in a recent feature change
has created a situation under which some versions of
named can be caused to exit with a REQUIRE assertion
failure if they are sent a null command string.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3136</cvename>
<cvename>CVE-2017-3137</cvename>
<cvename>CVE-2017-3138</cvename>
<url>https://kb.isc.org/article/AA-01465/0</url>
<url>https://kb.isc.org/article/AA-01466/0</url>
<url>https://kb.isc.org/article/AA-01471/0</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-04-13</entry>
<modified>2017-04-13</modified>
</dates>
</vuln>
<vuln vid="e48355d7-1548-11e7-8611-0090f5f2f347">
<topic>id Tech 3 -- remote code execution vulnerability</topic>
<affects>
<package>
<name>ioquake3</name>
<range><lt>1.36_16</lt></range>
</package>
<package>
<name>ioquake3-devel</name>
<range><lt>g2930</lt></range>
</package>
<package>
<name>iourbanterror</name>
<range><lt>4.3.2,1</lt></range>
</package>
<package>
<name>openarena</name>
<range><lt>0.8.8.s1910_3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The content auto-download of id Tech 3 can be used to deliver
maliciously crafted content, that triggers downloading of
further content and loading and executing it as native code
with user credentials. This affects ioquake3, ioUrbanTerror,
OpenArena, the original Quake 3 Arena and other forks.</p>
</body>
</description>
<references>
<cvename>CVE-2017-6903</cvename>
<url>https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-04-07</entry>
</dates>
</vuln>
<vuln vid="90becf7c-1acf-11e7-970f-002590263bf5">
<topic>xen-kernel -- broken check in memory_exchange() permits PV guest breakout</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
<p>The XSA-29 fix introduced an insufficient check on XENMEM_exchange
input, allowing the caller to drive hypervisor memory accesses
outside of the guest provided input/output arrays.</p>
<p>A malicious or buggy 64-bit PV guest may be able to access all of
system memory, allowing for all of privilege escalation, host
crashes, and information leaks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7228</cvename>
<url>https://xenbits.xen.org/xsa/advisory-212.html</url>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2017-04-06</entry>
</dates>
</vuln>
<vuln vid="04f29189-1a05-11e7-bc6e-b499baebfeaf">
<topic>cURL -- potential memory disclosure</topic>
<affects>
<package>
<name>curl</name>
<range><ge>6.5</ge><lt>7.53.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170403.html">
<p>There were two bugs in curl's parser for the command line option
--write-out (or -w for short) that would skip the end of string
zero byte if the string ended in a % (percent) or \ (backslash),
and it would read beyond that buffer in the heap memory and it
could then potentially output pieces of that memory to the
terminal or the target file etc..</p>
<p>This flaw only exists in the command line tool.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20170403.html</url>
<cvename>CVE-2017-7407</cvename>
</references>
<dates>
<discovery>2017-04-03</discovery>
<entry>2017-04-05</entry>
<modified>2017-04-06</modified>
</dates>
</vuln>
<vuln vid="dc880d6c-195d-11e7-8c63-0800277dcc69">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<name>py36-django</name>
<range><lt>1.8.18</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<name>py36-django18</name>
<range><lt>1.8.18</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<name>py36-django19</name>
<range><lt>1.9.13</lt></range>
</package>
<package>
<name>py27-django110</name>
<name>py33-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<name>py36-django110</name>
<range><lt>1.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django team reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2017/apr/04/security-releases/">
<p>These release addresses two security issues detailed below. We
encourage all users of Django to upgrade as soon as possible.</p>
<ul>
<li>Open redirect and possible XSS attack via user-supplied numeric
redirect URLs</li>
<li>Open redirect vulnerability in django.views.static.serve()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2017/apr/04/security-releases/</url>
<cvename>CVE-2017-7233</cvename>
<cvename>CVE-2017-7234</cvename>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="356b02e9-1954-11e7-9608-001999f8d30b">
<topic>asterisk -- Buffer overflow in CDR's set user</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>No size checking is done when setting the user field
on a CDR. Thus, it is possible for someone to use an
arbitrarily large string and write past the end of the
user field storage buffer. This allows the possibility
of remote code injection.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-001.html</url>
<url>https://issues.asterisk.org/jira/browse/ASTERISK-26897</url>
</references>
<dates>
<discovery>2017-03-27</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="057e6616-1885-11e7-bb4d-a0d3c19bfa21">
<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>375.39</lt></range>
</package>
<package>
<name>nvidia-driver-340</name>
<range><lt>340.102</lt></range>
</package>
<package>
<name>nvidia-driver-304</name>
<range><lt>304.135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4398">
<p>NVIDIA GPU Display Driver contains vulnerabilities in the
kernel mode layer handler where multiple integer overflows,
improper access control, and improper validation of a user
input may cause a denial of service or potential escalation
of privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0309</cvename>
<cvename>CVE-2017-0310</cvename>
<cvename>CVE-2017-0311</cvename>
<cvename>CVE-2017-0318</cvename>
<cvename>CVE-2017-0321</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4398</url>
</references>
<dates>
<discovery>2017-02-14</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="7cf058d8-158d-11e7-ba2c-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>57.0.2987.133</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[698622] Critical CVE-2017-5055: Use after free in printing. Credit to
Wadih Matar</li>
<li>[699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to
Nicolas Trippar of Zimperium zLabs</li>
<li>[662767] High CVE-2017-5052: Bad cast in Blink. Credit to
JeongHoon Shin</li>
<li>[705445] High CVE-2017-5056: Use after free in Blink. Credit to
anonymous</li>
<li>[702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to
Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5055</cvename>
<cvename>CVE-2017-5054</cvename>
<cvename>CVE-2017-5052</cvename>
<cvename>CVE-2017-5056</cvename>
<cvename>CVE-2017-5053</cvename>
<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2017-03-29</discovery>
<entry>2017-03-30</entry>
</dates>
</vuln>
<vuln vid="47873d72-14eb-11e7-970f-002590263bf5">
<topic>xen-tools -- xenstore denial of service via repeated update</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
<p>Unprivileged guests may be able to stall progress of the control
domain or driver domain, possibly leading to a Denial of Service
(DoS) of the entire host.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-206.html</url>
</references>
<dates>
<discovery>2017-03-28</discovery>
<entry>2017-03-30</entry>
</dates>
</vuln>
<vuln vid="68611303-149e-11e7-b9bb-6805ca0b3d42">
<topic>phpMyAdmin -- bypass 'no password' restriction</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-8/">
<h3>Summary</h3>
<p>Bypass $cfg['Servers'][$i]['AllowNoPassword']</p>
<h3>Description</h3>
<p>A vulnerability was discovered where the restrictions
caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are
bypassed under certain PHP versions. This can allow the
login of users who have no password set even if the
administrator has set $cfg['Servers'][$i]['AllowNoPassword']
to false (which is also the default).</p>
<p>This behavior depends on the PHP version used (it seems
PHP 5 is affected, while PHP 7.0 is not).</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>Set a password for all users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-8/</url>
</references>
<dates>
<discovery>2017-03-28</discovery>
<entry>2017-03-29</entry>
</dates>
</vuln>
<vuln vid="04bc4e23-9a70-42cb-9fec-3613632d34bc">
<cancelled superseded="967b852b-1e28-11e6-8dd3-002590263bf5"/>
</vuln>
<vuln vid="2826317b-10ec-11e7-944e-000c292e4fd8">
<topic>samba -- symlink race allows access outside share definition</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><le>4.2.14</le></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><le>4.3.13</le></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.12</lt></range>
</package>
<package>
<name>samba45</name>
<range><ge>4.5.0</ge><lt>4.5.7</lt></range>
</package>
<package>
<name>samba46</name>
<range><ge>4.6.0</ge><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-2619.html">
<p>A time-of-check, time-of-use race condition
can allow clients to access non-exported parts
of the file system via symlinks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-2619.html</url>
<cvename>CVE-2017-2619</cvename>
</references>
<dates>
<discovery>2017-03-23</discovery>
<entry>2017-03-24</entry>
</dates>
</vuln>
<vuln vid="af19ecd0-0f6a-11e7-970f-002590263bf5">
<topic>xen-tools -- Cirrus VGA Heap overflow via display refresh</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-211.html">
<p>A privileged user within the guest VM can cause a heap overflow in
the device model process, potentially escalating their privileges to
that of the device model process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9603</cvename>
<url>http://xenbits.xen.org/xsa/advisory-211.html</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-03-23</entry>
</dates>
</vuln>
<vuln vid="06f931c0-0be0-11e7-b4bf-5404a68ad561">
<topic>irssi -- use-after-free potential code execution</topic>
<affects>
<package>
<name>irssi</name>
<range><gt>0.8.21,1</gt><lt>1.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The irssi project reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_03.txt">
<p>Use after free while producing list of netjoins (CWE-416).
This issue was found and reported to us by APic.
This issue usually leads to segmentation faults.
Targeted code execution should be difficult.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_03.txt</url>
<cvename>CVE-2017-7191</cvename>
</references>
<dates>
<discovery>2017-03-11</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="7c27192f-0bc3-11e7-9940-b499baebfeaf">
<topic>mysql -- denial of service vulnerability</topic>
<affects>
<package>
<name>mariadb55-client</name>
<range><le>5.5.54</le></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.30</lt></range>
</package>
<package>
<name>mariadb101-client</name>
<range><lt>10.1.22</lt></range>
</package>
<package>
<name>mysql55-client</name>
<range><le>5.5.54</le></range>
</package>
<package>
<name>mysql56-client</name>
<range><lt>5.6.21</lt></range>
</package>
<package>
<name>mysql57-client</name>
<range><lt>5.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openwall reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/02/11/11">
<p>C client library for MySQL (libmysqlclient.so) has
use-after-free defect which can cause crash of applications
using that MySQL client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/02/11/11</url>
<cvename>CVE-2017-3302</cvename>
</references>
<dates>
<discovery>2017-01-27</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="5f453b69-abab-4e76-b6e5-2ed0bafcaee3">
<topic>firefox -- integer overflow in createImageBitmap()</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>52.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/">
<p>An integer overflow in createImageBitmap() was reported
through the Pwn2Own contest. The fix for this vulnerability
disables the experimental extensions to the
createImageBitmap API. This function runs in the content
sandbox, requiring a second vulnerability to compromise a
user's computer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5428</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-08/</url>
</references>
<dates>
<discovery>2017-03-17</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="df45b4bd-0b7f-11e7-970f-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><le>2.9.9</le></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.9</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.5</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/news/#p1408104">
<p>In addition to a number of bug fixes and small improvements,
security vulnerabilities have been discovered and fixed. We highly
recommend that you upgrade your sites as soon as possible.
Upgrading should be very straightforward. As per our usual policy,
admins of all registered Moodle sites will be notified of security
issue details directly via email and we'll publish details more
widely in a week.</p>
</blockquote>
</body>
</description>
<references>
<url>https://moodle.org/news/#p1408104</url>
</references>
<dates>
<discovery>2017-03-13</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="f72d98d1-0b7e-11e7-970f-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><le>2.9.9</le></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.8</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.4</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-17-0001: System file inclusion when adding own preset
file in Boost theme</p></li>
<li><p>MSA-17-0002: Incorrect sanitation of attributes in forums
</p></li>
<li><p>MSA-17-0003: PHPMailer vulnerability in no-reply address
</p></li>
<li><p>MSA-17-0004: XSS in assignment submission page</p></li>
</ul>
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2576</cvename>
<cvename>CVE-2017-2578</cvename>
<cvename>CVE-2016-10045</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2017-01-17</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="2730c668-0b1c-11e7-8d52-6cf0497db129">
<topic>drupal8 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-2017-001">
<p>CVE-2017-6377: Editor module incorrectly checks access to inline private files</p>
<p>CVE-2017-6379: Some admin paths were not protected with a CSRF token</p>
<p>CVE-2017-6381: Remote code execution</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6377</cvename>
<cvename>CVE-2017-6379</cvename>
<cvename>CVE-2017-6381</cvename>
<url>https://www.drupal.org/SA-2017-001</url>
</references>
<dates>
<discovery>2017-03-15</discovery>
<entry>2017-03-17</entry>
</dates>
</vuln>
<vuln vid="9b973e97-0a99-11e7-ace7-080027ef73ec">
<topic>PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon G. Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html">
<p>Many versions of PuTTY prior to 0.68 have a heap-corrupting integer
overflow bug in the ssh_agent_channel_data function which processes
messages sent by remote SSH clients to a forwarded agent connection. [...]</p>
<p>This bug is only exploitable at all if you have enabled SSH
agent forwarding, which is turned off by default. Moreover, an
attacker able to exploit this bug would have to have already be able
to connect to the Unix-domain socket representing the forwarded
agent connection. Since any attacker with that capability would
necessarily already be able to generate signatures with your agent's
stored private keys, you should in normal circumstances be defended
against this vulnerability by the same precautions you and your
operating system were already taking to prevent untrusted people
from accessing your SSH agent.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html</url>
<cvename>CVE-2017-6542</cvename>
</references>
<dates>
<discovery>2017-01-29</discovery>
<entry>2017-03-16</entry>
</dates>
</vuln>
<vuln vid="4ffb633c-0a3b-11e7-a9f2-0011d823eebd">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>25.0.0.127</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-07.html">
<ul>
<li>These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2017-2997).</li>
<li>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2017-2998, CVE-2017-2999).</li>
<li>These updates resolve a random number generator vulnerability
used for constant blinding that could lead to information
disclosure (CVE-2017-3000).</li>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2017-3001, CVE-2017-3002,
CVE-2017-3003).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2997</cvename>
<cvename>CVE-2017-2998</cvename>
<cvename>CVE-2017-2999</cvename>
<cvename>CVE-2017-3000</cvename>
<cvename>CVE-2017-3001</cvename>
<cvename>CVE-2017-3002</cvename>
<cvename>CVE-2017-3003</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-07.html</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-03-16</entry>
</dates>
</vuln>
<vuln vid="f41e3e54-076b-11e7-a9f2-0011d823eebd">
<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.4.2</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><lt>1.3.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01">
<ul>
<li>If a malicious peer supplies a certificate with a specially
crafted secp224k1 public key, then an attacker can cause the
server or client to attempt to free block of memory held on
stack. Depending on the platform, this could result in a Denial
of Service (client crash) or potentially could be exploited to
allow remote code execution with the same privileges as the host
application.</li>
<li>If the client and the server both support MD5 and the client
can be tricked to authenticate to a malicious server, then the
malicious server can impersonate the client. To launch this man
in the middle attack, the adversary has to compute a
chosen-prefix MD5 collision in real time. This is very expensive
computationally, but can be practical. Depending on the
platform, this could result in a Denial of Service (client crash)
or potentially could be exploited to allow remote code execution
with the same privileges as the host application.</li>
<li>A bug in the logic of the parsing of a PEM encoded Certificate
Revocation List in mbedtls_x509_crl_parse() can result in an
infinite loop. In versions before 1.3.10 the same bug results in
an infinite recursion stack overflow that usually crashes the
application. Methods and means of acquiring the CRLs is not part
of the TLS handshake and in the strict TLS setting this
vulnerability cannot be triggered remotely. The vulnerability
cannot be triggered unless the application explicitly calls
mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM
formatted CRL of untrusted origin. In which case the
vulnerability can be exploited to launch a denial of service
attack against the application.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01</url>
</references>
<dates>
<discovery>2017-03-11</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="a505d397-0758-11e7-8d8b-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>57.0.2987.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html">
<p>36 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5030</cvename>
<cvename>CVE-2017-5031</cvename>
<cvename>CVE-2017-5032</cvename>
<cvename>CVE-2017-5029</cvename>
<cvename>CVE-2017-5034</cvename>
<cvename>CVE-2017-5035</cvename>
<cvename>CVE-2017-5036</cvename>
<cvename>CVE-2017-5037</cvename>
<cvename>CVE-2017-5039</cvename>
<cvename>CVE-2017-5040</cvename>
<cvename>CVE-2017-5041</cvename>
<cvename>CVE-2017-5033</cvename>
<cvename>CVE-2017-5042</cvename>
<cvename>CVE-2017-5038</cvename>
<cvename>CVE-2017-5043</cvename>
<cvename>CVE-2017-5044</cvename>
<cvename>CVE-2017-5045</cvename>
<cvename>CVE-2017-5046</cvename>
<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-03-09</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="89cf8cd2-0698-11e7-aa3f-001b216d295b">
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><ge>1.51</ge><lt>1.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
<p>Release: 1.56</p>
<p>2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/215507</freebsdpr>
<url>https://www.bouncycastle.org/releasenotes.html</url>
</references>
<dates>
<discovery>2016-12-23</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="41fe4724-06a2-11e7-8e3e-5453ed2e2b49">
<topic>kde-runtime -- kdesu: displayed command truncated by unicode string terminator</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.14.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20160930-1.txt">
<p>A maliciously crafted command line for kdesu can result in the
user only seeing part of the commands that will actually get executed
as super user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7787</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2016/09/29/7</mlist>
<url>https://www.kde.org/info/security/advisory-20160930-1.txt</url>
</references>
<dates>
<discovery>2016-09-30</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="e550fc62-069a-11e7-8e3e-5453ed2e2b49">
<topic>kdepimlibs -- directory traversal on KTNEF</topic>
<affects>
<package>
<name>kdepimlibs</name>
<range><lt>4.14.10_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170227-1.txt">
<p>A directory traversal issue was found in KTNEF which can be
exploited by tricking a user into opening a malicious winmail.dat
file. The issue allows to write files with the permission of the user
opening the winmail.dat file during extraction.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20170227-1.txt</url>
</references>
<dates>
<discovery>2017-02-27</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="f714d8ab-028e-11e7-8042-50e549ebab6c">
<topic>kio: Information Leak when accessing https when using a malicious PAC file</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.29_10</lt></range>
</package>
<package>
<name>kf5-kio</name>
<range><lt>5.31.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170228-1.txt">
<p>Using a malicious PAC file, and then using exfiltration methods in the PAC
function FindProxyForURL() enables the attacker to expose full https URLs.</p>
<p>This is a security issue since https URLs may contain sensitive
information in the URL authentication part (user:password@host), and in the
path and the query (e.g. access tokens).</p>
<p>This attack can be carried out remotely (over the LAN) since proxy settings
allow "Detect Proxy Configuration Automatically".
This setting uses WPAD to retrieve the PAC file, and an attacker who has access
to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
and inject his/her own malicious PAC instead of the legitimate one.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20170228-1.txt</url>
</references>
<dates>
<discovery>2017-02-28</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="82752070-0349-11e7-b48d-00e04c1ea73d">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/">
<p>WordPress versions 4.7.2 and earlier are affected by six security issues.</p>
<ul>
<li>Cross-site scripting (XSS) via media file metadata.</li>
<li>Control characters can trick redirect URL validation.</li>
<li>Unintended files can be deleted by administrators using the
plugin deletion functionality.</li>
<li>Cross-site scripting (XSS) via video URL in YouTube embeds.</li>
<li>Cross-site scripting (XSS) via taxonomy term names.</li>
<li>Cross-site request forgery (CSRF) in Press This leading to
excessive use of server resources.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/03/07/3</url>
<url>https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-03-07</discovery>
<entry>2017-03-07</entry>
</dates>
</vuln>
<vuln vid="96eca031-1313-4daf-9be2-9d6e1c4f1eb5">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>52.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>46.0,1</ge><lt>52.0,1</lt></range>
<range><lt>45.8.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>46.0,2</ge><lt>52.0,2</lt></range>
<range><lt>45.8.0_1,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><ge>46.0</ge><lt>52.0</lt></range>
<range><lt>45.8.0_1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>46.0</ge><lt>52.0</lt></range>
<range><lt>45.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5400</cvename>
<cvename>CVE-2017-5401</cvename>
<cvename>CVE-2017-5402</cvename>
<cvename>CVE-2017-5403</cvename>
<cvename>CVE-2017-5404</cvename>
<cvename>CVE-2017-5406</cvename>
<cvename>CVE-2017-5407</cvename>
<cvename>CVE-2017-5410</cvename>
<cvename>CVE-2017-5411</cvename>
<cvename>CVE-2017-5409</cvename>
<cvename>CVE-2017-5408</cvename>
<cvename>CVE-2017-5412</cvename>
<cvename>CVE-2017-5413</cvename>
<cvename>CVE-2017-5414</cvename>
<cvename>CVE-2017-5415</cvename>
<cvename>CVE-2017-5416</cvename>
<cvename>CVE-2017-5417</cvename>
<cvename>CVE-2017-5425</cvename>
<cvename>CVE-2017-5426</cvename>
<cvename>CVE-2017-5427</cvename>
<cvename>CVE-2017-5418</cvename>
<cvename>CVE-2017-5419</cvename>
<cvename>CVE-2017-5420</cvename>
<cvename>CVE-2017-5405</cvename>
<cvename>CVE-2017-5421</cvename>
<cvename>CVE-2017-5422</cvename>
<cvename>CVE-2017-5399</cvename>
<cvename>CVE-2017-5398</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-05/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-06/</url>
</references>
<dates>
<discovery>2017-03-07</discovery>
<entry>2017-03-07</entry>
</dates>
</vuln>
<vuln vid="71ebbc50-01c1-11e7-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed an XSS vulnerability in Security Library method xss_clean().
</p>
<p>Fixed a possible file inclusion vulnerability in Loader Library
method vars().</p>
<p>Fixed a possible remote code execution vulnerability in the Email
Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane
from NamePros).</p>
<p>Added protection against timing side-channel attacks in Security
Library method csrf_verify().</p>
<p>Added protection against BREACH attacks targeting the CSRF token
field generated by Form Helper function form_open().</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="7b35a77a-0151-11e7-ae1b-002590263bf5">
<topic>ikiwiki -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20170111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ikiwiki reports:</p>
<blockquote cite="https://ikiwiki.info/security/#index48h2">
<p>The ikiwiki maintainers discovered further flaws similar to
CVE-2016-9646 in the passwordauth plugin's use of
CGI::FormBuilder, with a more serious impact:</p>
<p>An attacker who can log in to a site with a password can log in as
a different and potentially more privileged user.</p>
<p>An attacker who can create a new account can set arbitrary fields
in the user database for that account</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0356</cvename>
<url>https://ikiwiki.info/security/#index48h2</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="5ed094a0-0150-11e7-ae1b-002590263bf5">
<topic>ikiwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20161229</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10026">
<p>ikiwiki 3.20161219 does not properly check if a revision changes
the access permissions for a page on sites with the git and
recentchanges plugins and the CGI interface enabled, which allows
remote attackers to revert certain changes by leveraging permissions
to change the page before the revision was made.</p>
</blockquote>
<blockquote cite="https://ikiwiki.info/security/#index47h2">
<p>When CGI::FormBuilder->field("foo") is called in list context
(and in particular in the arguments to a subroutine that takes named
arguments), it can return zero or more values for foo from the CGI
request, rather than the expected single value. This breaks the
usual Perl parsing convention for named arguments, similar to
CVE-2014-1572 in Bugzilla (which was caused by a similar API design
issue in CGI.pm).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10026</cvename>
<cvename>CVE-2016-9645</cvename>
<cvename>CVE-2016-9646</cvename>
<url>https://ikiwiki.info/security/#index46h2</url>
<url>https://ikiwiki.info/security/#index47h2</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="f4eb9a25-fde0-11e6-9ad0-b8aeed92ecc4">
<topic>potrace -- multiple memory failure</topic>
<affects>
<package>
<name>potrace</name>
<range><lt>1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>potrace reports:</p>
<blockquote cite="https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/">
<p>CVE-2016-8685: invalid memory access in findnext</p>
<p>CVE-2016-8686: memory allocation failure</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/</url>
<cvename>CVE-2016-8685</cvename>
<cvename>CVE-2016-8686</cvename>
</references>
<dates>
<discovery>2016-10-15</discovery>
<entry>2017-02-28</entry>
</dates>
</vuln>
<vuln vid="765d165b-fbfe-11e6-aae7-5404a68ad561">
<topic>MPD -- buffer overflows in http output</topic>
<affects>
<package>
<name>musicpd</name>
<range><lt>0.20.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MPD project reports:</p>
<blockquote cite="http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5">
<p>httpd: fix two buffer overflows in IcyMetaData length calculation</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5</url>
</references>
<dates>
<discovery>2017-02-18</discovery>
<entry>2017-02-26</entry>
</dates>
</vuln>
<vuln vid="311e4b1c-f8ee-11e6-9940-b499baebfeaf">
<topic>cURL -- ocsp status validation error</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.53.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170222.html">
<p>SSL_VERIFYSTATUS ignored<br/>
curl and libcurl support "OCSP stapling", also known as the TLS
Certificate Status Request extension (using the
CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this
feature, it uses that TLS extension to ask for a fresh proof of
the server's certificate's validity. If the server doesn't support
the extension, or fails to provide said proof, curl is expected to
return an error.<br/>
Due to a coding mistake, the code that checks for a test success or
failure, ends up always thinking there's valid proof, even when
there is none or if the server doesn't support the TLS extension in
question. Contrary to how it used to function and contrary to how
this feature is documented to work.<br/>
This could lead to users not detecting when a server's certificate
goes invalid or otherwise be mislead that the server is in a better
shape than it is in reality.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20170222.html</url>
<cvename>CVE-2017-2629</cvename>
</references>
<dates>
<discovery>2017-02-22</discovery>
<entry>2017-02-22</entry>
</dates>
</vuln>
<vuln vid="8cbd9c08-f8b9-11e6-ae1b-002590263bf5">
<topic>xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-209.html">
<p>In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
cirrus_bitblt_cputovideo fails to check whether the specified
memory region is safe. A malicious guest administrator can cause
an out of bounds memory write, very likely exploitable as a
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2620</cvename>
<url>http://xenbits.xen.org/xsa/advisory-209.html</url>
</references>
<dates>
<discovery>2017-02-21</discovery>
<entry>2017-02-22</entry>
</dates>
</vuln>
<vuln vid="786a7d87-f826-11e6-9436-14dae9d5a9d2">
<topic>fbsdmon -- information disclosure vulnerability</topic>
<affects>
<package>
<name>fbsdmon</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Somers reports:</p>
<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099">
<p>The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099</url>
</references>
<dates>
<discovery>2017-02-14</discovery>
<entry>2017-02-21</entry>
</dates>
</vuln>
<vuln vid="f1075415-f5e9-11e6-a4e2-5404a68ad561">
<topic>wavpack -- multiple invalid memory reads</topic>
<affects>
<package>
<name>wavpack</name>
<range><lt>5.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Bryant reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/23/4">
<p>global buffer overread in read_code / read_words.c</p>
<p>heap out of bounds read in WriteCaffHeader / caff.c</p>
<p>heap out of bounds read in unreorder_channels / wvunpack.c</p>
<p>heap oob read in read_new_config_info / open_utils.c</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/01/23/4</url>
<cvename>CVE-2016-10169</cvename>
<cvename>CVE-2016-10170</cvename>
<cvename>CVE-2016-10171</cvename>
<cvename>CVE-2016-10172</cvename>
<url>https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc</url>
</references>
<dates>
<discovery>2017-01-21</discovery>
<entry>2017-02-18</entry>
</dates>
</vuln>
<vuln vid="8fedf75c-ef2f-11e6-900e-003048f78448">
<topic>optipng -- multiple vulnerabilities</topic>
<affects>
<package>
<name>optipng</name>
<range><lt>0.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7802">
<p>ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2191">
<p>The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3981">
<p>Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3982">
<p>Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7802</cvename>
<cvename>CVE-2016-2191</cvename>
<cvename>CVE-2016-3981</cvename>
<cvename>CVE-2016-3982</cvename>
</references>
<dates>
<discovery>2015-10-09</discovery>
<entry>2017-02-16</entry>
</dates>
</vuln>
<vuln vid="1a802ba9-f444-11e6-9940-b499baebfeaf">
<topic>openssl -- crash on handshake</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20170216.txt">
<p>Severity: High<br/>
During a renegotiation handshake if the Encrypt-Then-Mac
extension is negotiated where it was not in the original
handshake (or vice-versa) then this can cause OpenSSL to
crash (dependent on ciphersuite). Both clients and servers
are affected.<br/>
This issue does not affect OpenSSL version 1.0.2.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20170216.txt</url>
<cvename>CVE-2017-3733</cvename>
</references>
<dates>
<discovery>2017-02-16</discovery>
<entry>2017-02-16</entry>
</dates>
</vuln>
<vuln vid="077bbadf-f2f4-11e6-92a7-902b34361349">
<topic>diffoscope -- arbitrary file write</topic>
<affects>
<package>
<name>py34-diffoscope</name>
<name>py35-diffoscope</name>
<name>py36-diffoscope</name>
<range><ge>67</ge><lt>76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ximin Luo reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723">
<p>[v67] introduced a security hole where diffoscope may write to
arbitrary locations on disk depending on the contents of an
untrusted archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0359</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723</url>
</references>
<dates>
<discovery>2017-02-09</discovery>
<entry>2017-02-14</entry>
<modified>2017-02-16</modified>
</dates>
</vuln>
<vuln vid="7f9b696f-f11b-11e6-b50e-5404a68ad561">
<topic>ffmpeg -- heap overflow in lavf/mov.c</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.2.4,1</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-29.x has ffmpeg-3.2 -->
<range><lt>29.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>FFmpeg 3.2.4 fixes the following vulnerabilities:
CVE-2017-5024, CVE-2017-5025</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5024</cvename>
<url>https://www.ffmpeg.org/security.html</url>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
<cvename>CVE-2017-5025</cvename>
<url>https://www.ffmpeg.org/security.html</url>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-01-25</discovery>
<entry>2017-02-12</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="79bbb8f8-f049-11e6-8a6a-bcaec565249c">
<topic>gtk-vnc -- bounds checking vulnerabilities</topic>
<affects>
<package>
<name>gtk-vnc</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel P. Berrange reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html">
<p>CVE-2017-5884 - fix bounds checking for RRE, hextile and
copyrect encodings</p>
<p>CVE-2017-5885 - fix color map index bounds checking.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html</url>
<cvename>CVE-2017-5884</cvename>
<cvename>CVE-2017-5885</cvename>
</references>
<dates>
<discovery>2017-02-09</discovery>
<entry>2017-02-11</entry>
</dates>
</vuln>
<vuln vid="a73aba9a-effe-11e6-ae1b-002590263bf5">
<topic>xen-tools -- oob access in cirrus bitblt copy</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-208.html">
<p>When doing bitblt copy backwards, qemu should negate the blit
width. This avoids an oob access before the start of video
memory.</p>
<p>A malicious guest administrator can cause an out of bounds memory
access, possibly leading to information disclosure or privilege
escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2615</cvename>
<url>http://xenbits.xen.org/xsa/advisory-208.html</url>
</references>
<dates>
<discovery>2017-02-10</discovery>
<entry>2017-02-11</entry>
</dates>
</vuln>
<vuln vid="fb74eacc-ec8a-11e6-bc8a-0011d823eebd">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.7</lt></range>
</package>
<package>
<name>linux-c6-libtiff</name>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_5</lt></range>
</package>
<package>
<name>linux-c7-libtiff</name>
<name>linux-c7-tiff</name>
<range><lt>4.0.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtiff project reports:</p>
<blockquote cite="http://simplesystems.org/libtiff/v4.0.7.html">
<p>Multiple flaws have been discovered in libtiff library and
utilities.</p>
</blockquote>
</body>
</description>
<references>
<url>http://simplesystems.org/libtiff/v4.0.7.html</url>
<cvename>CVE-2016-9533</cvename>
<cvename>CVE-2016-9534</cvename>
<cvename>CVE-2016-9535</cvename>
<cvename>CVE-2015-8870</cvename>
<cvename>CVE-2016-5652</cvename>
<cvename>CVE-2016-9540</cvename>
<cvename>CVE-2016-9537</cvename>
<cvename>CVE-2016-9536</cvename>
</references>
<dates>
<discovery>2016-11-19</discovery>
<entry>2017-02-06</entry>
</dates>
</vuln>
<vuln vid="2b63e964-eb04-11e6-9ac1-a4badb2f4699">
<topic>mantis -- XSS vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wdollman reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=21611">
<p>The value of the view_type parameter on the
view_all_bug_page.php page is not encoded before being displayed on the
page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mantisbt.org/bugs/view.php?id=21611</url>
<cvename>CVE-2016-6837</cvename>
<freebsdpr>ports/216662</freebsdpr>
</references>
<dates>
<discovery>2016-08-15</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="b4ecf774-eb01-11e6-9ac1-a4badb2f4699">
<topic>guile2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>guile2</name>
<range><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ludovic Courtès reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/10/11/1">
<p>The REPL server is vulnerable to
the HTTP inter-protocol attack</p>
<p>The ‘mkdir’ procedure of GNU Guile, an implementation of
the Scheme programming language, temporarily changed the process’ umask
to zero. During that time window, in a multithreaded application, other
threads could end up creating files with insecure permissions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/10/11/1</url>
<url>http://www.openwall.com/lists/oss-security/2016/10/12/2</url>
<cvename>CVE-2016-8605</cvename>
<cvename>CVE-2016-8606</cvename>
<freebsdpr>ports/216663</freebsdpr>
</references>
<dates>
<discovery>2016-10-12</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="c6932dd4-eaff-11e6-9ac1-a4badb2f4699">
<topic>chicken -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Bex reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html">
<p>A buffer overflow error was found in the POSIX unit's procedures
process-execute and process-spawn.</p>
<p>Additionally, a memory leak existed in this code, which would be
triggered when an error is raised during argument and environment
processing.</p>
</blockquote>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-12/msg00000.html">
<p>Irregex versions before 0.9.6 contain a resource exhaustion
vulnerability: when compiling deeply nested regexes containing the
"+" operator due to exponential expansion behaviour.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html</url>
<cvename>CVE-2016-6830</cvename>
<cvename>CVE-2016-6831</cvename>
<cvename>CVE-2016-9954</cvename>
<freebsdpr>ports/216661</freebsdpr>
</references>
<dates>
<discovery>2016-08-12</discovery>
<entry>2017-02-04</entry>
<modified>2017-03-05</modified>
</dates>
</vuln>
<vuln vid="a130bd8c-eafe-11e6-9ac1-a4badb2f4699">
<topic>libebml -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libebml</name>
<range><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mortiz Bunkus reports:</p>
<blockquote cite="https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html">
<p>Multiple invalid memory accesses vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html</url>
<cvename>CVE-2015-8789</cvename>
<cvename>CVE-2015-8790</cvename>
<cvename>CVE-2015-8791</cvename>
<freebsdpr>ports/216659</freebsdpr>
</references>
<dates>
<discovery>2015-10-20</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="5b1631dc-eafd-11e6-9ac1-a4badb2f4699">
<topic>freeimage -- code execution vulnerability</topic>
<affects>
<package>
<name>freeimage</name>
<range><lt>3.16.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TALOS reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0189/">
<p>An exploitable out-of-bounds write vulnerability exists in
the XMP image handling functionality of the FreeImage library.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.talosintelligence.com/reports/TALOS-2016-0189/</url>
<cvename>CVE-2016-5684</cvename>
<freebsdpr>ports/216657</freebsdpr>
</references>
<dates>
<discovery>2016-10-03</discovery>
<entry>2017-02-04</entry>
<modified>2018-04-14</modified>
</dates>
</vuln>
<vuln vid="5a9b3d70-48e2-4267-b196-83064cb14fe0">
<topic>shotwell -- failure to encrypt authentication</topic>
<affects>
<package>
<name>shotwell</name>
<range><lt>0.24.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jens Georg reports:</p>
<blockquote cite="https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html">
<p>I have just released Shotwell 0.24.5 and 0.25.4 which turn
on HTTPS encryption all over the publishing plugins.</p>
<p>Users using Tumblr and Yandex.Fotki publishing are strongly
advised to change their passwords and reauthenticate Shotwell
to those services after upgrade.</p>
<p>Users of Picasa and Youtube publishing are strongly advised
to reauthenticate (Log out and back in) Shotwell to those
services after upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html</url>
</references>
<dates>
<discovery>2017-01-31</discovery>
<entry>2017-02-01</entry>
</dates>
</vuln>
<vuln vid="5cfa9d0c-73d7-4642-af4f-28fbed9e9404">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.44</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.32.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2598</cvename>
<cvename>CVE-2017-2599</cvename>
<cvename>CVE-2017-2600</cvename>
<cvename>CVE-2011-4969</cvename>
<cvename>CVE-2017-2601</cvename>
<cvename>CVE-2015-0886</cvename>
<cvename>CVE-2017-2602</cvename>
<cvename>CVE-2017-2603</cvename>
<cvename>CVE-2017-2604</cvename>
<cvename>CVE-2017-2605</cvename>
<cvename>CVE-2017-2606</cvename>
<cvename>CVE-2017-2607</cvename>
<cvename>CVE-2017-2608</cvename>
<cvename>CVE-2017-2609</cvename>
<cvename>CVE-2017-2610</cvename>
<cvename>CVE-2017-2611</cvename>
<cvename>CVE-2017-2612</cvename>
<cvename>CVE-2017-2613</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01</url>
</references>
<dates>
<discovery>2017-02-01</discovery>
<entry>2017-02-01</entry>
</dates>
</vuln>
<vuln vid="14ea4458-e5cd-11e6-b56d-38d547003487">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron D. Campbell reports:</p>
<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/">
<p>WordPress versions 4.7.1 and earlier are affected by three security
issues:</p>
<ul>
<li>The user interface for assigning taxonomy terms in Press This is
shown to users who do not have permissions to use it.</li>
<li>WP_Query is vulnerable to a SQL injection (SQLi) when passing
unsafe data. WordPress core is not directly vulnerable to this
issue, but we’ve added hardening to prevent plugins and
themes from accidentally causing a vulnerability.</li>
<li>A cross-site scripting (XSS) vulnerability was discovered in the
posts list table.</li>
<li>An unauthenticated privilege escalation vulnerability was
discovered in a REST API endpoint.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5610</cvename>
<cvename>CVE-2017-5611</cvename>
<cvename>CVE-2017-5612</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/28/5</url>
<url>https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/</url>
<url>https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/</url>
</references>
<dates>
<discovery>2017-01-26</discovery>
<entry>2017-01-29</entry>
</dates>
</vuln>
<vuln vid="6e83b2f3-e4e3-11e6-9ac1-a4badb2f4699">
<topic>nfsen -- remote command execution</topic>
<affects>
<package>
<name>nfsen</name>
<range><lt>1.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Haag reports:</p>
<blockquote cite="https://sourceforge.net/p/nfsen/mailman/message/35623845/">
<p>A remote attacker with access to the web interface to
execute arbitrary commands on the host operating system.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/nfsen/mailman/message/35623845/</url>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-27</entry>
</dates>
</vuln>
<vuln vid="4b9ca994-e3d9-11e6-813d-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>56.0.2924.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html">
<p>51 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5007</cvename>
<cvename>CVE-2017-5006</cvename>
<cvename>CVE-2017-5008</cvename>
<cvename>CVE-2017-5010</cvename>
<cvename>CVE-2017-5011</cvename>
<cvename>CVE-2017-5009</cvename>
<cvename>CVE-2017-5012</cvename>
<cvename>CVE-2017-5013</cvename>
<cvename>CVE-2017-5014</cvename>
<cvename>CVE-2017-5015</cvename>
<cvename>CVE-2017-5019</cvename>
<cvename>CVE-2017-5016</cvename>
<cvename>CVE-2017-5017</cvename>
<cvename>CVE-2017-5018</cvename>
<cvename>CVE-2017-2020</cvename>
<cvename>CVE-2017-2021</cvename>
<cvename>CVE-2017-2022</cvename>
<cvename>CVE-2017-2023</cvename>
<cvename>CVE-2017-2024</cvename>
<cvename>CVE-2017-2025</cvename>
<cvename>CVE-2017-2026</cvename>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-01-25</discovery>
<entry>2017-01-26</entry>
</dates>
</vuln>
<vuln vid="d455708a-e3d3-11e6-9940-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2k,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0d</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_13</lt></range>
</package>
<package>
<name>linux-c7-openssl-libs</name>
<range><lt>1.0.1e_3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_8</lt></range>
<range><ge>10.3</ge><lt>10.3_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20170126.txt">
<ul>
<li>Truncated packet could crash via OOB read (CVE-2017-3731)</li>
<li>Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)</li>
<li>BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)</li>
<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20170126.txt</url>
<cvename>CVE-2016-7055</cvename>
<cvename>CVE-2017-3730</cvename>
<cvename>CVE-2017-3731</cvename>
<cvename>CVE-2017-3732</cvename>
<freebsdsa>SA-17:02.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-01-26</discovery>
<entry>2017-01-26</entry>
<modified>2017-05-26</modified>
</dates>
</vuln>
<vuln vid="e60169c4-aa86-46b0-8ae2-0d81f683df09">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>51.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.48</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5373</cvename>
<cvename>CVE-2017-5374</cvename>
<cvename>CVE-2017-5375</cvename>
<cvename>CVE-2017-5376</cvename>
<cvename>CVE-2017-5377</cvename>
<cvename>CVE-2017-5378</cvename>
<cvename>CVE-2017-5379</cvename>
<cvename>CVE-2017-5380</cvename>
<cvename>CVE-2017-5381</cvename>
<cvename>CVE-2017-5382</cvename>
<cvename>CVE-2017-5383</cvename>
<cvename>CVE-2017-5384</cvename>
<cvename>CVE-2017-5385</cvename>
<cvename>CVE-2017-5386</cvename>
<cvename>CVE-2017-5387</cvename>
<cvename>CVE-2017-5388</cvename>
<cvename>CVE-2017-5389</cvename>
<cvename>CVE-2017-5390</cvename>
<cvename>CVE-2017-5391</cvename>
<cvename>CVE-2017-5392</cvename>
<cvename>CVE-2017-5393</cvename>
<cvename>CVE-2017-5394</cvename>
<cvename>CVE-2017-5395</cvename>
<cvename>CVE-2017-5396</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-01/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-02/</url>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-24</entry>
</dates>
</vuln>
<vuln vid="7721562b-e20a-11e6-b2e2-6805ca0b3d42">
<topic>phpMyAdmin -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.6.0</ge><lt>4.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-1/">
<p>Open redirect</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-2/">
<p>php-gettext code execution</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-3/">
<p>DOS vulnerability in table editing</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-4/">
<p>CSS injection in themes</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-5/">
<p>Cookie attribute injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-6/">
<p>SSRF in replication</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-7/">
<p>DOS in replication status</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-1</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-2</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-3</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-4</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-5</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-6</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-7</url>
<cvename>CVE-2015-8980</cvename>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-24</entry>
</dates>
</vuln>
<vuln vid="a4b7def1-e165-11e6-9d84-90e2ba9881c8">
<topic>Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability</topic>
<affects>
<package>
<name>intel-nvmupdate</name>
<range><lt>5.05</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel Corporation reports:</p>
<blockquote cite="https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr">
<p>A security vulnerability in the Intel(R) Ethernet Controller X710
and Intel(R) Ethernet Controller XL710 family of products
(Fortville) has been found in the Non-Volatile Flash Memory (NVM)
image.</p>
</blockquote>
</body>
</description>
<references>
<url>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr</url>
<cvename>CVE-2016-8106</cvename>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-23</entry>
</dates>
</vuln>
<vuln vid="709e025a-de8b-11e6-a9a5-b499baebfeaf">
<topic>PHP -- undisclosed vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-2">
<p>The PHP development team announces the immediate availability of
PHP 7.0.15. This is a security release. Several security bugs were
fixed in this release.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-3">
<p>The PHP development team announces the immediate availability of
PHP 5.6.30. This is a security release. Several security bugs were
fixed in this release.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2017.php#id2017-01-19-2</url>
<url>http://php.net/archive/2017.php#id2017-01-19-3</url>
</references>
<dates>
<discovery>2017-01-19</discovery>
<entry>2017-01-19</entry>
<modified>2017-01-20</modified>
</dates>
</vuln>
<vuln vid="57facd35-ddf6-11e6-915d-001b3856973b">
<topic>icoutils -- check_offset overflow on 64-bit systems</topic>
<affects>
<package>
<name>icoutils</name>
<range><lt>0.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Choongwoo Han reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q1/38">
<p>An exploitable crash exists in the wrestool utility on 64-bit systems
where the result of subtracting two pointers exceeds the size of int.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5208</cvename>
<cvename>CVE-2017-5331</cvename>
<cvename>CVE-2017-5332</cvename>
<cvename>CVE-2017-5333</cvename>
<url>http://seclists.org/oss-sec/2017/q1/38</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-19</entry>
</dates>
</vuln>
<vuln vid="4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf">
<topic>mysql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.54</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.30</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.22</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.54</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.35</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL">
<p>No further details have been provided in the Critical Patch Update</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL</url>
<cvename>CVE-2016-8318</cvename>
<cvename>CVE-2017-3312</cvename>
<cvename>CVE-2017-3258</cvename>
<cvename>CVE-2017-3273</cvename>
<cvename>CVE-2017-3244</cvename>
<cvename>CVE-2017-3257</cvename>
<cvename>CVE-2017-3238</cvename>
<cvename>CVE-2017-3256</cvename>
<cvename>CVE-2017-3291</cvename>
<cvename>CVE-2017-3265</cvename>
<cvename>CVE-2017-3251</cvename>
<cvename>CVE-2017-3313</cvename>
<cvename>CVE-2017-3243</cvename>
<cvename>CVE-2016-8327</cvename>
<cvename>CVE-2017-3317</cvename>
<cvename>CVE-2017-3318</cvename>
<cvename>CVE-2017-3319</cvename>
<cvename>CVE-2017-3320</cvename>
</references>
<dates>
<discovery>2017-01-18</discovery>
<entry>2017-01-18</entry>
<modified>2017-03-14</modified>
</dates>
</vuln>
<vuln vid="e3200958-dd6c-11e6-ae1b-002590263bf5">
<topic>powerdns -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>3.4.11</lt></range>
<range><ge>4.0.0</ge><lt>4.0.2</lt></range>
</package>
<package>
<name>powerdns-recursor</name>
<range><lt>3.7.4</lt></range>
<range><ge>4.0.0</ge><lt>4.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/">
<p>2016-02: Crafted queries can cause abnormal CPU usage</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/">
<p>2016-03: Denial of service via the web server</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/">
<p>2016-04: Insufficient validation of TSIG signatures</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/">
<p>2016-05: Crafted zone record can cause a denial of service</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7068</cvename>
<cvename>CVE-2016-7072</cvename>
<cvename>CVE-2016-7073</cvename>
<cvename>CVE-2016-7074</cvename>
<cvename>CVE-2016-2120</cvename>
<freebsdpr>ports/216135</freebsdpr>
<freebsdpr>ports/216136</freebsdpr>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/</url>
<url>https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/</url>
<url>https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/</url>
</references>
<dates>
<discovery>2016-12-15</discovery>
<entry>2017-01-18</entry>
</dates>
</vuln>
<vuln vid="4af92a40-db33-11e6-ae1b-002590263bf5">
<topic>groovy -- remote execution of untrusted code/DoS vulnerability</topic>
<affects>
<package>
<name>groovy</name>
<range><ge>1.7.0</ge><lt>2.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Groovy project reports:</p>
<blockquote cite="http://groovy-lang.org/security.html">
<p>When an application with Groovy on classpath uses standard Java
serialization mechanisms, e.g. to communicate between servers or to
store local data, it is possible for an attacker to bake a special
serialized object that will execute code directly when deserialized.
All applications which rely on serialization and do not isolate the
code which deserializes objects are subject to this vulnerability.
This is similar to CVE-2015-3253 but this exploit involves extra
wrapping of objects and catching of exceptions which are now safe
guarded against.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6814</cvename>
<url>http://groovy-lang.org/security.html</url>
</references>
<dates>
<discovery>2016-09-20</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="6aa956fb-d97f-11e6-a071-001e67f15f5a">
<topic>RabbitMQ -- Authentication vulnerability</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><ge>3.0.0</ge><lt>3.5.8</lt></range>
<range><ge>3.6.0</ge><lt>3.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pivotal.io reports:</p>
<blockquote cite="https://pivotal.io/security/cve-2016-9877">
<p>MQTT (MQ Telemetry Transport) connection authentication with a
username/password pair succeeds if an existing username is
provided but the password is omitted from the connection
request. Connections that use TLS with a client-provided
certificate are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9877</cvename>
<url>https://pivotal.io/security/cve-2016-9877</url>
<url>https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6</url>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="b180d1fb-dac6-11e6-ae1b-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron D. Campbell reports:</p>
<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/">
<p>WordPress versions 4.7 and earlier are affected by eight security
issues...</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5487</cvename>
<cvename>CVE-2017-5488</cvename>
<cvename>CVE-2017-5489</cvename>
<cvename>CVE-2017-5490</cvename>
<cvename>CVE-2017-5491</cvename>
<cvename>CVE-2017-5492</cvename>
<cvename>CVE-2017-5493</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/14/6</url>
<url>https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="e5186c65-d729-11e6-a9a5-b499baebfeaf">
<topic>mysql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html">
<p>Local security vulnerability in 'Server: Packaging' sub component.</p>
</blockquote>
</body>
</description>
<references>
<bid>93617</bid>
<cvename>CVE-2016-5625</cvename>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html</url>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2017-01-14</entry>
<modified>2017-01-15</modified>
</dates>
</vuln>
<vuln vid="22373c43-d728-11e6-a9a5-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-client</name>
<name>mariadb55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<name>mariadb100-server</name>
<range><lt>10.0.28</lt></range>
</package>
<package>
<name>mariadb101-client</name>
<name>mariadb101-server</name>
<range><lt>10.1.18</lt></range>
</package>
<package>
<name>mysql55-client</name>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mysql56-client</name>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>percona55-client</name>
<name>percona55-server</name>
<range><lt>5.5.51.38.2</lt></range>
</package>
<package>
<name>percona56-client</name>
<name>percona56-server</name>
<range><lt>5.6.32.78.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MySQL project reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL">
<ul>
<li>CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer'
sub component.</li>
<li>CVE-2016-5616, CVE-2016-6663: Race condition allows local users with
certain permissions to gain privileges by leveraging use of my_copystat
by REPAIR TABLE to repair a MyISAM table.</li>
<li>CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based
logging, allows local users with access to the mysql account to gain
root privileges via a symlink attack on error logs and possibly other
files.</li>
<li>CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub
component.</li>
<li>CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub
component.</li>
<li>CVE-2016-5629: Remote security vulnerability in 'Server: Federated'
sub component.</li>
<li>CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub
component.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/</url>
<cvename>CVE-2016-3492</cvename>
<cvename>CVE-2016-5616</cvename>
<cvename>CVE-2016-5617</cvename>
<cvename>CVE-2016-5624</cvename>
<cvename>CVE-2016-5626</cvename>
<cvename>CVE-2016-5629</cvename>
<cvename>CVE-2016-6663</cvename>
<cvename>CVE-2016-6664</cvename>
<cvename>CVE-2016-8283</cvename>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2017-01-14</entry>
</dates>
</vuln>
<vuln vid="a93c3287-d8fd-11e6-be5c-001fbc0f280f">
<topic>Ansible -- Command execution on Ansible controller from host</topic>
<affects>
<package>
<name>ansible</name>
<range><gt>1.9.6_1</gt><lt>2.2.0.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Computest reports:</p>
<blockquote cite="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
<p>Computest found and exploited several issues
that allow a compromised host to execute commands
on the Ansible controller and thus gain access
to other hosts controlled by that controller.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9587</cvename>
<url>https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt</url>
<url>https://lwn.net/Articles/711357/</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="7ae0be99-d8bb-11e6-9b7f-d43d7e971a1b">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.22</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>2017.01.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/95328/discuss">
<p>PHPMailer is prone to an local information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information
that may aid in launching further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/95328/discuss</url>
<cvename>CVE-2017-5223</cvename>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="d4c7e9a9-d893-11e6-9b4d-d050996490d0">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P5</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P5</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.12.28</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01439/0">
<p>A malformed query response received by a recursive
server in response to a query of RTYPE ANY could
trigger an assertion failure while named is attempting
to add the RRs in the query response to the cache.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01440/0">
<p>Depending on the type of query and the EDNS options
in the query they receive, DNSSEC-enabled authoritative
servers are expected to include RRSIG and other RRsets
in their responses to recursive servers.
DNSSEC-validating servers will also make specific queries
for DS and other RRsets.
Whether DNSSEC-validating or not, an error in processing
malformed query responses that contain DNSSEC-related
RRsets that are inconsistent with other RRsets in the
same query response can trigger an assertion failure.
Although the combination of properties which triggers
the assertion should not occur in normal traffic, it
is potentially possible for the assertion to be triggered
deliberately by an attacker sending a specially-constructed
answer.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01441/0">
<p>An unusually-formed answer containing a DS resource
record could trigger an assertion failure. While the
combination of properties which triggers the assertion
should not occur in normal traffic, it is potentially
possible for the assertion to be triggered deliberately
by an attacker sending a specially-constructed answer
having the required properties.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01442/0">
<p>An error in handling certain queries can cause an
assertion failure when a server is using the
nxdomain-redirect feature to cover a zone for which
it is also providing authoritative service.
A vulnerable server could be intentionally stopped
by an attacker if it was using a configuration that
met the criteria for the vulnerability and if the
attacker could cause it to accept a query that
possessed the required attributes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9131</cvename>
<cvename>CVE-2016-9147</cvename>
<cvename>CVE-2016-9444</cvename>
<cvename>CVE-2016-9778</cvename>
<url>https://kb.isc.org/article/AA-01439/0</url>
<url>https://kb.isc.org/article/AA-01440/0</url>
<url>https://kb.isc.org/article/AA-01441/0</url>
<url>https://kb.isc.org/article/AA-01442/0</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="2c948527-d823-11e6-9171-14dae9d210b8">
<topic>FreeBSD -- OpenSSH multiple vulnerabilities</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3.p1_5,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_7</lt></range>
<range><ge>10.3</ge><lt>10.3_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The ssh-agent(1) agent supports loading a PKCS#11 module
from outside a trusted whitelist. An attacker can request
loading of a PKCS#11 module across forwarded agent-socket.
[CVE-2016-10009]</p>
<p>When privilege separation is disabled, forwarded Unix
domain sockets would be created by sshd(8) with the privileges
of 'root' instead of the authenticated user. [CVE-2016-10010]</p>
<h1>Impact:</h1>
<p>A remote attacker who have control of a forwarded
agent-socket on a remote system and have the ability to
write files on the system running ssh-agent(1) agent can
run arbitrary code under the same user credential. Because
the attacker must already have some control on both systems,
it is relatively hard to exploit this vulnerability in a
practical attack. [CVE-2016-10009]</p>
<p>When privilege separation is disabled (on FreeBSD,
privilege separation is enabled by default and has to be
explicitly disabled), an authenticated attacker can potentially
gain root privileges on systems running OpenSSH server.
[CVE-2016-10010]</p>
</body>
</description>
<references>
<cvename>CVE-2016-10009</cvename>
<cvename>CVE-2016-10010</cvename>
<freebsdsa>SA-17:01.openssh</freebsdsa>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-11</entry>
<modified>2017-01-13</modified>
</dates>
</vuln>
<vuln vid="7caebe30-d7f1-11e6-a9a5-b499baebfeaf">
<topic>openssl -- timing attack vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.4.4_1</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.5.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cesar Pereida Garcia reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q1/52">
<p>The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL
versions and forks is vulnerable to timing attacks when signing with the
standardized elliptic curve P-256 despite featuring constant-time curve
operations and modular inversion. A software defect omits setting the
BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in
the BN_mod_inverse method and therefore resulting in a cache-timing attack
vulnerability.<br/>
A malicious user with local access can recover ECDSA P-256 private keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q1/52</url>
<cvename>CVE-2016-7056</cvename>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-11</entry>
<modified>2017-01-11</modified>
</dates>
</vuln>
<vuln vid="2a7bdc56-d7a3-11e6-ae1b-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>24.0.0.194</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-02.html">
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2017-2938).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2017-2932, CVE-2017-2936,
CVE-2017-2937).</p>
<p>These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2017-2927, CVE-2017-2933,
CVE-2017-2934, CVE-2017-2935).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928,
CVE-2017-2930, CVE-2017-2931).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2925</cvename>
<cvename>CVE-2017-2926</cvename>
<cvename>CVE-2017-2927</cvename>
<cvename>CVE-2017-2928</cvename>
<cvename>CVE-2017-2930</cvename>
<cvename>CVE-2017-2931</cvename>
<cvename>CVE-2017-2932</cvename>
<cvename>CVE-2017-2933</cvename>
<cvename>CVE-2017-2934</cvename>
<cvename>CVE-2017-2935</cvename>
<cvename>CVE-2017-2936</cvename>
<cvename>CVE-2017-2937</cvename>
<cvename>CVE-2017-2938</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-02.html</url>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-11</entry>
</dates>
</vuln>
<vuln vid="ab804e60-d693-11e6-9171-14dae9d210b8">
<topic>moinmoin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Waldmann reports:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES">
<ul>
<li><p>fix XSS in AttachFile view (multifile related) CVE-2016-7148</p></li>
<li><p>fix XSS in GUI editor's attachment dialogue CVE-2016-7146</p></li>
<li><p>fix XSS in GUI editor's link dialogue CVE-2016-9119</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES</url>
<cvename>CVE-2016-7148</cvename>
<cvename>CVE-2016-7146</cvename>
<cvename>CVE-2016-9119</cvename>
<freebsdpr>ports/214937</freebsdpr>
</references>
<dates>
<discovery>2016-10-31</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="64be967a-d379-11e6-a071-001e67f15f5a">
<topic>libvncserver -- multiple buffer overflows</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libvnc server reports:</p>
<blockquote cite="https://github.com/LibVNC/libvncserver/pull/137">
<p>Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibVNC/libvncserver/pull/137</url>
<cvename>CVE-2016-9941</cvename>
<cvename>CVE-2016-9942</cvename>
<freebsdpr>ports/215805</freebsdpr>
</references>
<dates>
<discovery>2016-11-24</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="83041ca7-d690-11e6-9171-14dae9d210b8">
<topic>libdwarf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libdwarf</name>
<range><lt>20161124</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Christian Rebischke reports:</p>
<blockquote cite="https://lwn.net/Articles/708092/">
<p>libdwarf is vulnerable to multiple issues including
arbitrary code execution, information disclosure and denial of
service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lwn.net/Articles/708092/</url>
<cvename>CVE-2016-5027</cvename>
<cvename>CVE-2016-5028</cvename>
<cvename>CVE-2016-5029</cvename>
<cvename>CVE-2016-5030</cvename>
<cvename>CVE-2016-5031</cvename>
<cvename>CVE-2016-5032</cvename>
<cvename>CVE-2016-5033</cvename>
<cvename>CVE-2016-5035</cvename>
<cvename>CVE-2016-5037</cvename>
<cvename>CVE-2016-5040</cvename>
<cvename>CVE-2016-5041</cvename>
<cvename>CVE-2016-5043</cvename>
<cvename>CVE-2016-5044</cvename>
<cvename>CVE-2016-7510</cvename>
<cvename>CVE-2016-7511</cvename>
<cvename>CVE-2016-8679</cvename>
<cvename>CVE-2016-8680</cvename>
<cvename>CVE-2016-8681</cvename>
<cvename>CVE-2016-9275</cvename>
<cvename>CVE-2016-9276</cvename>
<cvename>CVE-2016-9480</cvename>
<cvename>CVE-2016-9558</cvename>
</references>
<dates>
<discovery>2016-12-04</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="03532a19-d68e-11e6-9171-14dae9d210b8">
<topic>lynx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lynx</name>
<range><lt>2.8.8.2_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote>
<p>Lynx is vulnerable to POODLE by still supporting vulnerable
version of SSL. Lynx is also vulnerable to URL attacks by incorrectly
parsing hostnames ending with an '?'.</p>
</blockquote>
</body>
</description>
<references>
<url>https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch</url>
<url>https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch</url>
<cvename>CVE-2014-3566</cvename>
<cvename>CVE-2016-9179</cvename>
<freebsdpr>ports/215464</freebsdpr>
</references>
<dates>
<discovery>2016-10-26</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="91e039ed-d689-11e6-9171-14dae9d210b8">
<topic>hdf5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>hdf5</name>
<range><lt>1.10.0</lt></range>
</package>
<package>
<name>hdf5-18</name>
<range><lt>1.8.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos Security reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/11/hdf5-vulns.html">
<ul>
<li><p>CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/11/hdf5-vulns.html</url>
<cvename>CVE-2016-4330</cvename>
<cvename>CVE-2016-4331</cvename>
<cvename>CVE-2016-4332</cvename>
<cvename>CVE-2016-4333</cvename>
</references>
<dates>
<discovery>2016-11-17</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="e1ff4c5e-d687-11e6-9171-14dae9d210b8">
<topic>End of Life Ports</topic>
<affects>
<package>
<name>py27-django16</name>
<name>py33-django16</name>
<name>py34-django16</name>
<name>py35-django16</name>
<range><ge>0</ge></range>
</package>
<package>
<name>drupal6</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>These packages have reached End of Life status and/or have
been removed from the Ports Tree. They may contain undocumented
security issues. Please take caution and find alternative
software as soon as possible.</p>
</body>
</description>
<references>
<freebsdpr>ports/211975</freebsdpr>
</references>
<dates>
<discovery>2017-01-06</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="c218873d-d444-11e6-84ef-f0def167eeea">
<topic>Use-After-Free Vulnerability in pcsc-lite</topic>
<affects>
<package>
<name>pcsc-lite</name>
<range><ge>1.6.0</ge><lt>1.8.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Wu on Openwall mailing-list reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/03/2">
<p>The issue allows a local attacker to cause a Denial of Service,
but can potentially result in Privilege Escalation since
the daemon is running as root. while any local user can
connect to the Unix socket.
Fixed by patch which is released with hpcsc-lite 1.8.20.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10109</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/03/2</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-06</entry>
<modified>2017-01-10</modified>
</dates>
</vuln>
<vuln vid="0c5369fc-d671-11e6-a9a5-b499baebfeaf">
<topic>GnuTLS -- Memory corruption vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="http://www.gnutls.org/news.html#2017-01-09">
<ul>
<li>It was found using the OSS-FUZZ fuzzer infrastructure that
decoding a specially crafted OpenPGP certificate could lead
to heap and stack overflows. (GNUTLS-SA-2017-2)</li>
<li>It was found using the OSS-FUZZ fuzzer infrastructure that
decoding a specially crafted X.509 certificate with Proxy
Certificate Information extension present could lead to a
double free. (GNUTLS-SA-2017-1)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.gnutls.org/news.html#2017-01-09</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-2</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-1</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="e5ec2767-d529-11e6-ae1b-002590263bf5">
<topic>tomcat -- information disclosure vulnerability</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.49</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.74</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40">
<p>Important: Information Disclosure CVE-2016-8745</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8745</cvename>
<freebsdpr>ports/215865</freebsdpr>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40</url>
</references>
<dates>
<discovery>2017-01-05</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="0b9af110-d529-11e6-ae1b-002590263bf5">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.48</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.73</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39">
<p>Important: Remote Code Execution CVE-2016-8735</p>
<p>Important: Information Disclosure CVE-2016-6816</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8735</cvename>
<cvename>CVE-2016-6816</cvename>
<freebsdpr>ports/214599</freebsdpr>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="3ae106e2-d521-11e6-ae1b-002590263bf5">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.47</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.72</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">
<p>Low: Unrestricted Access to Global Resources CVE-2016-6797</p>
<p>Low: Security Manager Bypass CVE-2016-6796</p>
<p>Low: System Property Disclosure CVE-2016-6794</p>
<p>Low: Security Manager Bypass CVE-2016-5018</p>
<p>Low: Timing Attack CVE-2016-0762</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6797</cvename>
<cvename>CVE-2016-6796</cvename>
<cvename>CVE-2016-6794</cvename>
<cvename>CVE-2016-5018</cvename>
<cvename>CVE-2016-0762</cvename>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="3d6be69b-d365-11e6-a071-001e67f15f5a">
<topic>Irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>0.8.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_01.txt">
<p>Five vulnerabilities have been located in Irssi</p>
<ul>
<li>A NULL pointer dereference in the nickcmp function found by
Joseph Bisch. (CWE-690)</li>
<li>Use after free when receiving invalid nick message (Issue #466,
CWE-146)</li>
<li>Out of bounds read in certain incomplete control codes found
by Joseph Bisch. (CWE-126)</li>
<li>Out of bounds read in certain incomplete character sequences
found by Hanno Böck and independently by J. Bisch. (CWE-126)</li>
<li>Out of bounds read when Printing the value '%['. Found by
Hanno Böck. (CWE-126)</li>
</ul>
<p>These issues may result in denial of service (remote crash).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5193</cvename>
<cvename>CVE-2017-5194</cvename>
<cvename>CVE-2017-5195</cvename>
<cvename>CVE-2017-5196</cvename>
<cvename>CVE-2017-5356</cvename>
<freebsdpr>ports/215800</freebsdpr>
<url>https://irssi.org/security/irssi_sa_2017_01.txt</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-05</entry>
<modified>2017-01-15</modified>
</dates>
</vuln>
<vuln vid="496160d3-d3be-11e6-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed a number of new vulnerabilities in Security Library method
xss_clean().</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2016-10-28</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="5e439ee7-d3bd-11e6-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed an SQL injection in the ‘odbc’ database driver.</p>
<p>Updated set_realpath() Path Helper function to filter-out php://
wrapper inputs.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="eafa3aec-211b-4dd4-9b8a-a664a3f0917a">
<topic>w3m -- multiple vulnerabilities</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.3.20170102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple remote code execution and denial of service conditions present.</p>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/452</url>
<url>http://seclists.org/oss-sec/2016/q4/516</url>
<cvename>CVE-2016-9422</cvename>
<cvename>CVE-2016-9423</cvename>
<cvename>CVE-2016-9424</cvename>
<cvename>CVE-2016-9425</cvename>
<cvename>CVE-2016-9426</cvename>
<cvename>CVE-2016-9428</cvename>
<cvename>CVE-2016-9429</cvename>
<cvename>CVE-2016-9430</cvename>
<cvename>CVE-2016-9431</cvename>
<cvename>CVE-2016-9432</cvename>
<cvename>CVE-2016-9433</cvename>
<cvename>CVE-2016-9434</cvename>
<cvename>CVE-2016-9435</cvename>
<cvename>CVE-2016-9436</cvename>
<cvename>CVE-2016-9437</cvename>
<cvename>CVE-2016-9438</cvename>
<cvename>CVE-2016-9439</cvename>
<cvename>CVE-2016-9440</cvename>
<cvename>CVE-2016-9441</cvename>
<cvename>CVE-2016-9442</cvename>
<cvename>CVE-2016-9443</cvename>
<cvename>CVE-2016-9622</cvename>
<cvename>CVE-2016-9623</cvename>
<cvename>CVE-2016-9624</cvename>
<cvename>CVE-2016-9625</cvename>
<cvename>CVE-2016-9626</cvename>
<cvename>CVE-2016-9627</cvename>
<cvename>CVE-2016-9628</cvename>
<cvename>CVE-2016-9629</cvename>
<cvename>CVE-2016-9630</cvename>
<cvename>CVE-2016-9631</cvename>
<cvename>CVE-2016-9632</cvename>
<cvename>CVE-2016-9633</cvename>
</references>
<dates>
<discovery>2016-11-03</discovery>
<entry>2017-01-01</entry>
<modified>2017-01-09</modified>
</dates>
</vuln>
<vuln vid="d0b12952-cb86-11e6-906f-0cc47a065786">
<topic>h2o -- Use-after-free vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.0.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kazuho Oku reports:</p>
<blockquote cite="https://github.com/h2o/h2o/issues?q=label%3Avulnerability">
<p>A use-after-free vulnerability exists in H2O up to and including
version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to
mount DoS attacks and / or information theft.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/releases/tag/v2.0.5</url>
<url>https://github.com/h2o/h2o/issues/1144</url>
</references>
<dates>
<discovery>2016-09-09</discovery>
<entry>2016-12-29</entry>
</dates>
</vuln>
<vuln vid="1b61ecef-cdb9-11e6-a9a5-b499baebfeaf">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Check Point reports:</p>
<blockquote cite="http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/">
<p>... discovered 3 fresh and previously unknown vulnerabilities
(CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7
unserialize mechanism.</p>
<p>The first two vulnerabilities allow attackers to take full control
over servers, allowing them to do anything they want with the
website, from spreading malware to defacing it or stealing customer
data.</p>
<p>The last vulnerability generates a Denial of Service attack which
basically hangs the website, exhausts its memory consumption, and
shuts it down.</p>
<p>The PHP security team issued fixes for two of the vulnerabilities
on the 13th of October and 1st of December.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/</url>
<cvename>CVE-2016-7478</cvename>
<cvename>CVE-2016-7479</cvename>
<cvename>CVE-2016-7480</cvename>
</references>
<dates>
<discovery>2016-12-27</discovery>
<entry>2016-12-29</entry>
<modified>2017-01-04</modified>
</dates>
</vuln>
<vuln vid="6972668d-cdb7-11e6-a9a5-b499baebfeaf">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.14">
<ul>
<li>Use After Free Vulnerability in unserialize() (CVE-2016-9936)</li>
<li>Invalid read when wddx decodes empty boolean element
(CVE-2016-9935)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.14</url>
<cvename>CVE-2016-9935</cvename>
<cvename>CVE-2016-9936</cvename>
</references>
<dates>
<discovery>2016-12-08</discovery>
<entry>2016-12-29</entry>
</dates>
</vuln>
<vuln vid="3c4693de-ccf7-11e6-a9a5-b499baebfeaf">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.20</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>29.12.2016.04.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Legal Hackers reports:</p>
<blockquote cite="https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html">
<p>An independent research uncovered a critical vulnerability in
PHPMailer that could potentially be used by (unauthenticated)
remote attackers to achieve remote arbitrary code execution in
the context of the web server user and remotely compromise the
target web application.</p>
<p>To exploit the vulnerability an attacker could target common
website components such as contact/feedback forms, registration
forms, password email resets and others that send out emails with
the help of a vulnerable version of the PHPMailer class.</p>
<p>The first patch of the vulnerability CVE-2016-10033 was incomplete.
This advisory demonstrates the bypass of the patch. The bypass allows
to carry out Remote Code Execution on all current versions (including
5.2.19).</p>
</blockquote>
</body>
</description>
<references>
<url>https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html</url>
<cvename>CVE-2016-10045</cvename>
</references>
<dates>
<discovery>2016-12-28</discovery>
<entry>2016-12-28</entry>
</dates>
</vuln>
<vuln vid="e4bc323f-cc73-11e6-b704-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><le>4.2.14</le></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.13</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.8</lt></range>
</package>
<package>
<name>samba45</name>
<range><ge>4.5.0</ge><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.5.3">
<p>[CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes
on DNS objects and trigger a controlled memory corruption.</p>
<p>[CVE-2016-2125] Samba client code always requests a forwardable ticket
when using Kerberos authentication. This means the target server, which must be in the current or trusted
domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to
fully impersonate the authenticated user or service.</p>
<p>[CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process
to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum.
A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2123</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2123.html</url>
<cvename>CVE-2016-2125</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2125.html</url>
<cvename>CVE-2016-2126</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2126.html</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2016-12-26</entry>
<modified>2016-12-26</modified>
</dates>
</vuln>
<vuln vid="244c8288-cc4a-11e6-a475-bcaec524bf84">
<topic>upnp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>upnp</name>
<range><lt>1.6.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthew Garett reports:</p>
<blockquote cite="https://twitter.com/mjg59/status/755062278513319936">
<p>Reported this to upstream 8 months ago without response,
so: libupnp's default behaviour allows anyone to write to your
filesystem. Seriously. Find a device running a libupnp based server
(Shodan says there's rather a lot), and POST a file to /testfile.
Then GET /testfile ... and yeah if the server is running as root
(it is) and is using / as the web root (probably not, but maybe)
this gives full host fs access.</p>
</blockquote>
<p>Scott Tenaglia reports:</p>
<blockquote cite="https://sourceforge.net/p/pupnp/bugs/133/">
<p>There is a heap buffer overflow vulnerability in the
create_url_list function in upnp/src/gena/gena_device.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://twitter.com/mjg59/status/755062278513319936</url>
<url>https://sourceforge.net/p/pupnp/bugs/133/</url>
<cvename>CVE-2016-6255</cvename>
<cvename>CVE-2016-8863</cvename>
</references>
<dates>
<discovery>2016-02-23</discovery>
<entry>2016-12-27</entry>
</dates>
</vuln>
<vuln vid="c7656d4c-cb60-11e6-a9a5-b499baebfeaf">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.18</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>26.12.2016.07.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Legal Hackers reports:</p>
<blockquote cite="http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html">
<p>An independent research uncovered a critical vulnerability in
PHPMailer that could potentially be used by (unauthenticated)
remote attackers to achieve remote arbitrary code execution in
the context of the web server user and remotely compromise the
target web application.</p>
<p>To exploit the vulnerability an attacker could target common
website components such as contact/feedback forms, registration
forms, password email resets and others that send out emails with
the help of a vulnerable version of the PHPMailer class.</p>
</blockquote>
</body>
</description>
<references>
<url>http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html</url>
<url>https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md</url>
<cvename>CVE-2016-10033</cvename>
</references>
<dates>
<discovery>2016-12-26</discovery>
<entry>2016-12-26</entry>
</dates>
</vuln>
<vuln vid="e7002b26-caaa-11e6-a76a-9f7324e5534e">
<topic>exim -- DKIM private key leak</topic>
<affects>
<package>
<name>exim</name>
<range><gt>4.69</gt><lt>4.87.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Exim project reports:</p>
<blockquote cite="https://exim.org/static/doc/CVE-2016-9963.txt">
<p>Exim leaks the private DKIM signing key to the log files.
Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used,
the key material is included in the bounce message.</p>
</blockquote>
</body>
</description>
<references>
<url>https://exim.org/static/doc/CVE-2016-9963.txt</url>
<cvename>CVE-2016-9963</cvename>
</references>
<dates>
<discovery>2016-12-15</discovery>
<entry>2016-12-25</entry>
</dates>
</vuln>
<vuln vid="2aedd15f-ca8b-11e6-a9a5-b499baebfeaf">
<cancelled superseded="2c948527-d823-11e6-9171-14dae9d210b8"/>
</vuln>
<vuln vid="c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4">
<topic>cURL -- uninitialized random vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.52.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Project curl Security Advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20161223.html">
<p>libcurl's (new) internal function that returns a good 32bit
random value was implemented poorly and overwrote the pointer
instead of writing the value into the buffer the pointer
pointed to.</p>
<p>This random value is used to generate nonces for Digest and
NTLM authentication, for generating boundary strings in HTTP
formposts and more. Having a weak or virtually non-existent
random there makes these operations vulnerable.</p>
<p>This function is brand new in 7.52.0 and is the result of an
overhaul to make sure libcurl uses strong random as much as
possible - provided by the backend TLS crypto libraries when
present. The faulty function was introduced in this commit.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20161223.html</url>
<cvename>CVE-2016-9594</cvename>
</references>
<dates>
<discovery>2016-12-23</discovery>
<entry>2016-12-24</entry>
</dates>
</vuln>
<vuln vid="41f8af15-c8b9-11e6-ae1b-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.1</ge><lt>3.5.23</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><ge>4.0</ge><lt>4.0.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:10 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_10.txt">
<p>Due to incorrect comparison of request headers Squid can deliver
responses containing private data to clients it should not have
reached.</p>
<p>This problem allows a remote attacker to discover private and
sensitive information about another clients browsing session.
Potentially including credentials which allow access to further
sensitive resources. This problem only affects Squid configured
to use the Collapsed Forwarding feature. It is of particular
importance for HTTPS reverse-proxy sites with Collapsed
Forwarding.</p>
</blockquote>
<p>Squid security advisory 2016:11 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_11.txt">
<p>Due to incorrect HTTP conditional request handling Squid can
deliver responses containing private data to clients it should not
have reached.</p>
<p>This problem allows a remote attacker to discover private and
sensitive information about another clients browsing session.
Potentially including credentials which allow access to further
sensitive resources..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10002</cvename>
<cvename>CVE-2016-10003</cvename>
<freebsdpr>ports/215416</freebsdpr>
<freebsdpr>ports/215418</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_10.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_11.txt</url>
</references>
<dates>
<discovery>2016-12-16</discovery>
<entry>2016-12-23</entry>
</dates>
</vuln>
<vuln vid="c11629d3-c8ad-11e6-ae1b-002590263bf5">
<topic>vim -- arbitrary command execution</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<range><lt>8.0.0056</lt></range>
</package>
<package>
<name>neovim</name>
<range><lt>0.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248">
<p>vim before patch 8.0.0056 does not properly validate values for the
'filetype', 'syntax' and 'keymap' options, which may result in the
execution of arbitrary code if a file with a specially crafted
modeline is opened.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1248</cvename>
<bid>94478</bid>
<url>https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a</url>
<url>https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-23</entry>
</dates>
</vuln>
<vuln vid="c290f093-c89e-11e6-821e-68f7288bdf41">
<topic>Pligg CMS -- XSS Vulnerability</topic>
<affects>
<package>
<name>pligg</name>
<range><le>2.0.2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Netsparker reports: </p>
<blockquote cite="https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/">
<p>Proof of Concept URL for XSS in Pligg CMS:</p>
<p>Page: groups.php</p>
<p>Parameter Name: keyword</p>
<p>Parameter Type: GET</p>
<p>Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&keyword='+alert(0x000D82)+'</p>
<p>For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/</url>
</references>
<dates>
<discovery>2015-05-13</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="fcedcdbb-c86e-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_6</lt></range>
<range><ge>10.3</ge><lt>10.3_15</lt></range>
<range><ge>10.2</ge><lt>10.2_28</lt></range>
<range><ge>10.1</ge><lt>10.1_45</lt></range>
<range><ge>9.3</ge><lt>9.3_53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple vulnerabilities have been discovered in the NTP
suite:</p>
<p>CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy
of Cisco ASIG.</p>
<p>CVE-2016-9310: Mode 6 unauthenticated trap information
disclosure and DDoS vector. Reported by Matthew Van Gundy
of Cisco ASIG.</p>
<p>CVE-2016-7427: Broadcast Mode Replay Prevention DoS.
Reported by Matthew Van Gundy of Cisco ASIG.</p>
<p>CVE-2016-7428: Broadcast Mode Poll Interval Enforcement
DoS. Reported by Matthew Van Gundy of Cisco ASIG.</p>
<p>CVE-2016-7431: Regression: 010-origin: Zero Origin
Timestamp Bypass. Reported by Sharon Goldberg and Aanchal
Malhotra of Boston University.</p>
<p>CVE-2016-7434: Null pointer dereference in
_IO_str_init_static_internal(). Reported by Magnus Stubman.</p>
<p>CVE-2016-7426: Client rate limiting and server responses.
Reported by Miroslav Lichvar of Red Hat.</p>
<p>CVE-2016-7433: Reboot sync calculation problem. Reported
independently by Brian Utterback of Oracle, and by Sharon
Goldberg and Aanchal Malhotra of Boston University.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send a specially crafted packet
to cause a NULL pointer dereference that will crash ntpd,
resulting in a Denial of Service. [CVE-2016-9311]</p>
<p>An exploitable configuration modification vulnerability
exists in the control mode (mode 6) functionality of ntpd.
If, against long-standing BCP recommendations, "restrict
default noquery ..." is not specified, a specially crafted
control mode packet can set ntpd traps, providing information
disclosure and DDoS amplification, and unset ntpd traps,
disabling legitimate monitoring by an attacker from remote.
[CVE-2016-9310]</p>
<p>An attacker with access to the NTP broadcast domain can
periodically inject specially crafted broadcast mode NTP
packets into the broadcast domain which, while being logged
by ntpd, can cause ntpd to reject broadcast mode packets
from legitimate NTP broadcast servers. [CVE-2016-7427]</p>
<p>An attacker with access to the NTP broadcast domain can
send specially crafted broadcast mode NTP packets to the
broadcast domain which, while being logged by ntpd, will
cause ntpd to reject broadcast mode packets from legitimate
NTP broadcast servers. [CVE-2016-7428]</p>
<p>Origin timestamp problems were fixed in ntp 4.2.8p6.
However, subsequent timestamp validation checks introduced
a regression in the handling of some Zero origin timestamp
checks. [CVE-2016-7431]</p>
<p>If ntpd is configured to allow mrulist query requests
from a server that sends a crafted malicious packet, ntpd
will crash on receipt of that crafted malicious mrulist
query packet. [CVE-2016-7434]</p>
<p>An attacker who knows the sources (e.g., from an IPv4
refid in server response) and knows the system is (mis)configured
in this way can periodically send packets with spoofed
source address to keep the rate limiting activated and
prevent ntpd from accepting valid responses from its sources.
[CVE-2016-7426]</p>
<p>Ntp Bug 2085 described a condition where the root delay
was included twice, causing the jitter value to be higher
than expected. Due to a misinterpretation of a small-print
variable in The Book, the fix for this problem was incorrect,
resulting in a root distance that did not include the peer
dispersion. The calculations and formulas have been reviewed
and reconciled, and the code has been updated accordingly.
[CVE-2016-7433]</p>
</body>
</description>
<references>
<cvename>CVE-2016-7426</cvename>
<cvename>CVE-2016-7427</cvename>
<cvename>CVE-2016-7428</cvename>
<cvename>CVE-2016-7431</cvename>
<cvename>CVE-2016-7433</cvename>
<cvename>CVE-2016-7434</cvename>
<cvename>CVE-2016-9310</cvename>
<cvename>CVE-2016-9311</cvename>
<freebsdsa>SA-16:39.ntp</freebsdsa>
</references>
<dates>
<discovery>2016-12-22</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="42880202-c81c-11e6-a9a5-b499baebfeaf">
<topic>cURL -- buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.1</ge><lt>7.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/vuln-7.51.0.html">
<h2>printf floating point buffer overflow</h2>
<p>libcurl's implementation of the printf() functions triggers a
buffer overflow when doing a large floating point output. The bug
occurs when the conversion outputs more than 255 bytes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/vuln-7.51.0.html</url>
<cvename>CVE-2016-9586</cvename>
</references>
<dates>
<discovery>2016-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="624b45c0-c7f3-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.6.0</ge><lt>3.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html">
<h2>[20161201] - Core - Elevated Privileges</h2>
<p>Incorrect use of unfiltered data stored to the session on a form
validation failure allows for existing user accounts to be modified;
to include resetting their username, password, and user group
assignments.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html">
<h2>[20161202] - Core - Shell Upload</h2>
<p>Inadequate filesystem checks allowed files with alternative PHP
file extensions to be uploaded.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html">
<h2>[20161203] - Core - Information Disclosure</h2>
<p>Inadequate ACL checks in the Beez3 com_content article layout
override enables a user to view restricted content.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9836</cvename>
<cvename>CVE-2016-9837</cvename>
<cvename>CVE-2016-9838</cvename>
<url>https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html</url>
<url>https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html</url>
<url>https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html</url>
<url>https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html</url>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="a27d234a-c7f2-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.4.4</ge><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html">
<h2>[20161001] - Core - Account Creation</h2>
<p>Inadequate checks allows for users to register on a site when
registration has been disabled.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html">
<h2>[20161002] - Core - Elevated Privilege</h2>
<p>Incorrect use of unfiltered data allows for users to register on a
site with elevated privileges.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html">
<h2>[20161003] - Core - Account Modifications</h2>
<p>Incorrect use of unfiltered data allows for existing user accounts
to be modified; to include resetting their username, password, and
user group assignments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8869</cvename>
<cvename>CVE-2016-8870</cvename>
<cvename>CVE-2016-9081</cvename>
<url>https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html</url>
<url>https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html</url>
<url>https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html</url>
<url>https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html</url>
</references>
<dates>
<discovery>2016-10-25</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="f0806cad-c7f1-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.6.0</ge><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html">
<h2>[20160801] - Core - ACL Violation</h2>
<p>Inadequate ACL checks in com_content provide potential read access
to data which should be access restricted to users with edit_own
level.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html">
<h2>[20160802] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in mail component.
</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/654-20160803-core-csrf.html">
<h2>[20160803] - Core - CSRF</h2>
<p>Add additional CSRF hardening in com_joomlaupdate.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html</url>
<url>https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html</url>
<url>https://developer.joomla.org/security-centre/654-20160803-core-csrf.html</url>
<url>https://www.joomla.org/announcements/release-news/5665-joomla-3-6-1-released.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="c0ef061a-c7f0-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.5.0</ge><lt>3.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html">
<h2>[20151206] - Core - Session Hardening</h2>
<p>The Joomla Security Strike team has been following up on the
critical security vulnerability patched last week. Since the recent
update it has become clear that the root cause is a bug in PHP
itself. This was fixed by PHP in September of 2015 with the releases
of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all
versions of PHP 7 and has been back-ported in some specific Linux
LTS versions of PHP 5.3). This fixes the bug across all supported
PHP versions.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html">
<h2>[20151207] - Core - SQL Injection</h2>
<p>Inadequate filtering of request data leads to a SQL Injection
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html</url>
<url>https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html</url>
<url>https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html</url>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="3ae078ca-c7eb-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 PV guests may be able to mask interrupts</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-202.html">
<p>Certain PV guest kernel operations (page table writes in
particular) need emulation, and use Xen's general x86 instruction
emulator. This allows a malicious guest kernel which asynchronously
modifies its instruction stream to effect the clearing of EFLAGS.IF
from the state used to return to guest context.</p>
<p>A malicious guest kernel administrator can cause a host hang or
crash, resulting in a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10024</cvename>
<url>https://xenbits.xen.org/xsa/advisory-202.html</url>
</references>
<dates>
<discovery>2016-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="862d6ab3-c75e-11e6-9f98-20cf30e32f6d">
<topic>Apache httpd -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2016-8743</cvename>
<cvename>CVE-2016-2161</cvename>
<cvename>CVE-2016-0736</cvename>
<cvename>CVE-2016-8740</cvename>
<cvename>CVE-2016-5387</cvename>
</references>
<dates>
<discovery>2016-12-20</discovery>
<entry>2016-12-21</entry>
<modified>2016-12-22</modified>
</dates>
</vuln>
<vuln vid="942433db-c661-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-204.html">
<p>The typical behaviour of singlestepping exceptions is determined at
the start of the instruction, with a #DB trap being raised at the
end of the instruction. SYSCALL (and SYSRET, although we don't
implement it) behave differently because the typical behaviour
allows userspace to escalate its privilege. (This difference in
behaviour seems to be undocumented.) Xen wrongly raised the
exception based on the flags at the start of the instruction.</p>
<p>Guest userspace which can invoke the instruction emulator can use
this flaw to escalate its privilege to that of the guest kernel.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10013</cvename>
<url>http://xenbits.xen.org/xsa/advisory-204.html</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2016-12-20</entry>
</dates>
</vuln>
<vuln vid="e47ab5db-c333-11e6-ae1b-002590263bf5">
<topic>atheme-services -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atheme-services</name>
<range><lt>7.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9773">
<p>modules/chanserv/flags.c in Atheme before 7.2.7 allows remote
attackers to modify the Anope FLAGS behavior by registering and
dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4478">
<p>Buffer overflow in the xmlrpc_char_encode function in
modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows
remote attackers to cause a denial of service via vectors related
to XMLRPC response encoding.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/209217</freebsdpr>
<cvename>CVE-2014-9773</cvename>
<cvename>CVE-2016-4478</cvename>
<url>https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e</url>
<url>https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b</url>
</references>
<dates>
<discovery>2016-01-09</discovery>
<entry>2016-12-16</entry>
</dates>
</vuln>
<vuln vid="512c0ffd-cd39-4da4-b2dc-81ff4ba8e238">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.1.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.47</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/">
<p>CVE-2016-9894: Buffer overflow in SkiaGL</p>
<p>CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements</p>
<p>CVE-2016-9895: CSP bypass using marquee tag</p>
<p>CVE-2016-9896: Use-after-free with WebVR</p>
<p>CVE-2016-9897: Memory corruption in libGLES</p>
<p>CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees</p>
<p>CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs</p>
<p>CVE-2016-9904: Cross-origin information leak in shared atoms</p>
<p>CVE-2016-9901: Data from Pocket server improperly sanitized before execution</p>
<p>CVE-2016-9902: Pocket extension does not validate the origin of events</p>
<p>CVE-2016-9903: XSS injection vulnerability in add-ons SDK</p>
<p>CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1</p>
<p>CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9894</cvename>
<cvename>CVE-2016-9899</cvename>
<cvename>CVE-2016-9895</cvename>
<cvename>CVE-2016-9896</cvename>
<cvename>CVE-2016-9897</cvename>
<cvename>CVE-2016-9898</cvename>
<cvename>CVE-2016-9900</cvename>
<cvename>CVE-2016-9904</cvename>
<cvename>CVE-2016-9901</cvename>
<cvename>CVE-2016-9902</cvename>
<cvename>CVE-2016-9903</cvename>
<cvename>CVE-2016-9080</cvename>
<cvename>CVE-2016-9893</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-94/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-95/</url>
</references>
<dates>
<discovery>2016-12-13</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="54e50cd9-c1a8-11e6-ae1b-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.6.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeremy Felt reports:</p>
<blockquote cite="https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/">
<p>WordPress versions 4.6 and earlier are affected by two security
issues: a cross-site scripting vulnerability via image filename,
reported by SumOfPwn researcher Cengiz Han Sahin; and a path
traversal vulnerability in the upgrade package uploader, reported
by Dominik Schilling from the WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-09-07</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="80a897a2-c1a6-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 CMPXCHG8B emulation fails to ignore operand size override</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-200.html">
<p>The x86 instruction CMPXCHG8B is supposed to ignore legacy operand
size overrides; it only honors the REX.W override (making it
CMPXCHG16B). So, the operand size is always 8 or 16. When support
for CMPXCHG16B emulation was added to the instruction emulator,
this restriction on the set of possible operand sizes was relied on
in some parts of the emulation; but a wrong, fully general, operand
size value was used for other parts of the emulation. As a result,
if a guest uses a supposedly-ignored operand size prefix, a small
amount of hypervisor stack data is leaked to the guests: a 96 bit
leak to guests running in 64-bit mode; or, a 32 bit leak to other
guests.</p>
<p>A malicious unprivileged guest may be able to obtain sensitive
information from the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9932</cvename>
<url>http://xenbits.xen.org/xsa/advisory-200.html</url>
</references>
<dates>
<discovery>2016-12-13</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="2d56308b-c0a8-11e6-a9a5-b499baebfeaf">
<topic>PHP -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.29</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2016.php#id2016-12-08-1">
<p>This is a security release. Several security bugs were fixed in
this release.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2016.php#id2016-12-08-1</url>
<url>http://php.net/archive/2016.php#id2016-12-08-2</url>
</references>
<dates>
<discovery>2016-12-12</discovery>
<entry>2016-12-12</entry>
</dates>
</vuln>
<vuln vid="c0b13887-be44-11e6-b04f-001999f8d30b">
<topic>asterisk -- Authentication Bypass</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The chan_sip channel driver has a liberal definition
for whitespace when attempting to strip the content between
a SIP header name and a colon character. Rather than
following RFC 3261 and stripping only spaces and horizontal
tabs, Asterisk treats any non-printable ASCII character
as if it were whitespace.</p>
<p>This mostly does not pose a problem until Asterisk is
placed in tandem with an authenticating SIP proxy. In
such a case, a crafty combination of valid and invalid
To headers can cause a proxy to allow an INVITE request
into Asterisk without authentication since it believes
the request is an in-dialog request. However, because of
the bug described above, the request will look like an
out-of-dialog request to Asterisk. Asterisk will then
process the request as a new call. The result is that
Asterisk can process calls from unvetted sources without
any authentication.</p>
<p>If you do not use a proxy for authentication, then
this issue does not affect you.</p>
<p>If your proxy is dialog-aware (meaning that the proxy
keeps track of what dialogs are currently valid), then
this issue does not affect you.</p>
<p>If you use chan_pjsip instead of chan_sip, then this
issue does not affect you.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.digium.com/pub/security/ASTERISK-2016-009.html</url>
</references>
<dates>
<discovery>2016-11-28</discovery>
<entry>2016-12-09</entry>
</dates>
</vuln>
<vuln vid="9e6640fe-be3a-11e6-b04f-001999f8d30b">
<topic>asterisk -- Crash on SDP offer or answer from endpoint using Opus</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.12.0</ge><lt>13.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>If an SDP offer or answer is received with the Opus
codec and with the format parameters separated using a
space the code responsible for parsing will recursively
call itself until it crashes. This occurs as the code
does not properly handle spaces separating the parameters.
This does NOT require the endpoint to have Opus configured
in Asterisk. This also does not require the endpoint to
be authenticated. If guest is enabled for chan_sip or
anonymous in chan_pjsip an SDP offer or answer is still
processed and the crash occurs.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-008.html</url>
</references>
<dates>
<discovery>2016-11-11</discovery>
<entry>2016-12-09</entry>
</dates>
</vuln>
<vuln vid="eab68cff-bc0c-11e6-b2ca-001b3856973b">
<topic>cryptopp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cryptopp</name>
<range><lt>5.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple sources report:</p>
<blockquote cite="https://eprint.iacr.org/2015/368">
<p>CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function
in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key
operations for the Rabin-Williams digital signature algorithm, which
allows remote attackers to obtain private keys via a timing attack.
Fixed in 5.6.3.</p>
</blockquote>
<blockquote cite="https://github.com/weidai11/cryptopp/issues/146">
<p>CVE-2016-3995: Incorrect implementation of Rijndael timing attack
countermeasure. Fixed in 5.6.4.</p>
</blockquote>
<blockquote cite="https://github.com/weidai11/cryptopp/issues/277">
<p>CVE-2016-7420: Library built without -DNDEBUG could egress sensitive
information to the filesystem via a core dump if an assert was triggered.
Fixed in 5.6.5.</p>
</blockquote>
</body>
</description>
<references>
<url>https://eprint.iacr.org/2015/368</url>
<url>https://github.com/weidai11/cryptopp/issues/146</url>
<url>https://github.com/weidai11/cryptopp/issues/277</url>
<cvename>CVE-2015-2141</cvename>
<cvename>CVE-2016-3995</cvename>
<cvename>CVE-2016-7420</cvename>
</references>
<dates>
<discovery>2015-02-27</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="e722e3c6-bbee-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- bhyve(8) virtual machine escape</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_4</lt></range>
<range><ge>10.3</ge><lt>10.3_13</lt></range>
<range><ge>10.2</ge><lt>10.2_26</lt></range>
<range><ge>10.1</ge><lt>10.1_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The bounds checking of accesses to guest memory greater
than 4GB by device emulations is subject to integer
overflow.</p>
<h1>Impact:</h1>
<p>For a bhyve virtual machine with more than 3GB of guest
memory configured, a malicious guest could craft device
descriptors that could give it access to the heap of the
bhyve process. Since the bhyve process is running as root,
this may allow guests to obtain full control of the hosts
they're running on.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1889</cvename>
<freebsdsa>SA-16:38.bhyve</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="0282269d-bbee-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- link_ntoa(3) buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_5</lt></range>
<range><ge>10.3</ge><lt>10.3_14</lt></range>
<range><ge>10.2</ge><lt>10.2_27</lt></range>
<range><ge>10.1</ge><lt>10.1_44</lt></range>
<range><ge>9.3</ge><lt>9.3_52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A specially crafted argument can trigger a static buffer
overflow in the library, with possibility to rewrite following
static buffers that belong to other library functions.</p>
<h1>Impact:</h1>
<p>Due to very limited use of the function in the existing
applications, and limited length of the overflow, exploitation
of the vulnerability does not seem feasible. None of the
utilities and daemons in the base system are known to be
vulnerable. However, careful review of third party software
that may use the function was not performed.</p>
</body>
</description>
<references>
<cvename>CVE-2016-6559</cvename>
<freebsdsa>SA-16:37.libc</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
<modified>2016-12-08</modified>
</dates>
</vuln>
<vuln vid="e00304d2-bbed-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- Possible login(1) argument injection in telnetd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_4</lt></range>
<range><ge>10.3</ge><lt>10.3_13</lt></range>
<range><ge>10.2</ge><lt>10.2_26</lt></range>
<range><ge>10.1</ge><lt>10.1_43</lt></range>
<range><ge>9.3</ge><lt>9.3_51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An unexpected sequence of memory allocation failures
combined with insufficient error checking could result in
the construction and execution of an argument sequence that
was not intended.</p>
<h1>Impact:</h1>
<p>An attacker who controls the sequence of memory allocation
failures and success may cause login(1) to run without
authentication and may be able to cause misbehavior of
login(1) replacements.</p>
<p>No practical way of controlling these memory allocation
failures is known at this time.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1888</cvename>
<freebsdsa>SA-16:36.telnetd</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="cb0bf1ec-bb92-11e6-a9a5-b499baebfeaf">
<topic>Apache httpd -- denial of service in HTTP/2</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.17</ge><le>2.4.23_1</le></range>
</package>
<package>
<name>mod_http2-devel</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mod_http2 reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E">
<p>The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply
limitations on request headers correctly when experimental module
for the HTTP/2 protocol is used to access a resource.</p>
<p>The net result is that a the server allocates too much memory
instead of denying the request. This can lead to memory exhaustion
of the server by a properly crafted request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E</url>
<url>https://github.com/icing/mod_h2/releases/tag/v1.8.3</url>
<cvename>CVE-2016-8740</cvename>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="603fe0a1-bb26-11e6-8e5a-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>55.0.2883.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html">
<p>36 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9651</cvename>
<cvename>CVE-2016-5208</cvename>
<cvename>CVE-2016-5207</cvename>
<cvename>CVE-2016-5206</cvename>
<cvename>CVE-2016-5205</cvename>
<cvename>CVE-2016-5204</cvename>
<cvename>CVE-2016-5209</cvename>
<cvename>CVE-2016-5203</cvename>
<cvename>CVE-2016-5210</cvename>
<cvename>CVE-2016-5212</cvename>
<cvename>CVE-2016-5211</cvename>
<cvename>CVE-2016-5213</cvename>
<cvename>CVE-2016-5214</cvename>
<cvename>CVE-2016-5216</cvename>
<cvename>CVE-2016-5215</cvename>
<cvename>CVE-2016-5217</cvename>
<cvename>CVE-2016-5218</cvename>
<cvename>CVE-2016-5219</cvename>
<cvename>CVE-2016-5221</cvename>
<cvename>CVE-2016-5220</cvename>
<cvename>CVE-2016-5222</cvename>
<cvename>CVE-2016-9650</cvename>
<cvename>CVE-2016-5223</cvename>
<cvename>CVE-2016-5226</cvename>
<cvename>CVE-2016-5225</cvename>
<cvename>CVE-2016-5224</cvename>
<cvename>CVE-2016-9652</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-12-01</discovery>
<entry>2016-12-05</entry>
</dates>
</vuln>
<vuln vid="e1f67063-aab4-11e6-b2d3-60a44ce6887b">
<topic>ImageMagick7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple sources report:</p>
<blockquote cite="https://github.com/ImageMagick/ImageMagick/issues/296">
<p>CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/">
<p>CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/">
<p>CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
<url>https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/</url>
<url>https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/</url>
<cvename>CVE-2016-9298</cvename>
<cvename>CVE-2016-8866</cvename>
<cvename>CVE-2016-8862</cvename>
<freebsdpr>ports/214514</freebsdpr>
</references>
<dates>
<discovery>2016-09-14</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="bc4898d5-a794-11e6-b2d3-60a44ce6887b">
<topic>Pillow -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>3.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pillow reports:</p>
<blockquote cite="http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html">
<p>Pillow prior to 3.3.2 may experience integer overflow
errors in map.c when reading specially crafted image files. This may
lead to memory disclosure or corruption.</p>
<p>Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check
for negative image sizes in ImagingNew in Storage.c. A negative image
size can lead to a smaller allocation than expected, leading to arbi
trary writes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html</url>
<url>https://github.com/python-pillow/Pillow/issues/2105</url>
<cvename>CVE-2016-9189</cvename>
<cvename>CVE-2016-9190</cvename>
<freebsdpr>ports/214410</freebsdpr>
</references>
<dates>
<discovery>2016-09-06</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="19d35b0f-ba73-11e6-b1cf-14dae9d210b8">
<topic>ImageMagick -- heap overflow vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.6.4,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bastien Roucaries reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q4/413">
<p>Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b
suffer from a heap overflow in WaveletDenoiseImage(). This problem is
easily trigerrable from a Perl script.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/413</url>
<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
<cvename>CVE-2016-9298</cvename>
<freebsdpr>ports/214517</freebsdpr>
<freebsdpr>ports/214511</freebsdpr>
<freebsdpr>ports/214520</freebsdpr>
</references>
<dates>
<discovery>2016-11-13</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="e5dcb942-ba6f-11e6-b1cf-14dae9d210b8">
<topic>py-cryptography -- vulnerable HKDF key generation</topic>
<affects>
<package>
<name>py27-cryptography</name>
<name>py33-cryptography</name>
<name>py34-cryptography</name>
<name>py35-cryptography</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alex Gaynor reports:</p>
<blockquote cite="https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d">
<p>Fixed a bug where ``HKDF`` would return an empty
byte-string if used with a ``length`` less than
``algorithm.digest_size``.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d</url>
<cvename>CVE-2016-9243</cvename>
<freebsdpr>ports/214915</freebsdpr>
</references>
<dates>
<discovery>2016-11-05</discovery>
<entry>2016-12-04</entry>
<modified>2016-12-06</modified>
</dates>
</vuln>
<vuln vid="a228c7a0-ba66-11e6-b1cf-14dae9d210b8">
<topic>qemu -- denial of service vulnerability</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<name>qemu-sbruno</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel P. Berrange reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html">
<p>The VNC server websockets decoder will read and buffer data
from websockets clients until it sees the end of the HTTP headers,
as indicated by \r\n\r\n. In theory this allows a malicious to
trick QEMU into consuming an arbitrary amount of RAM.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html</url>
<cvename>CVE-2015-1779</cvename>
<freebsdpr>ports/206725</freebsdpr>
</references>
<dates>
<discovery>2015-03-23</discovery>
<entry>2016-12-04</entry>
<modified>2016-12-06</modified>
</dates>
</vuln>
<vuln vid="59f79c99-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-tools -- delimiter injection vulnerabilities in pygrub</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-198.html">
<p>pygrub, the boot loader emulator, fails to quote (or sanity check)
its results when reporting them to its caller.</p>
<p>A malicious guest administrator can obtain the contents of
sensitive host files (an information leak). Additionally, a
malicious guest administrator can cause files on the host to be
removed, causing a denial of service. In some unusual host
configurations, ability to remove certain files may be usable for
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9379</cvename>
<cvename>CVE-2016-9380</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-198.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="58685e23-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-tools -- qemu incautious about shared ring processing</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-197.html">
<p>The compiler can emit optimizations in qemu which can lead to
double fetch vulnerabilities. Specifically data on the rings shared
between qemu and the hypervisor (which the guest under control can
obtain mappings of) can be fetched twice (during which time the
guest can alter the contents) possibly leading to arbitrary code
execution in qemu.</p>
<p>Malicious administrators can exploit this vulnerability to take
over the qemu process, elevating its privilege to that of the qemu
process.</p>
<p>In a system not using a device model stub domain (or other
techniques for deprivileging qemu), malicious guest administrators
can thus elevate their privilege to that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9381</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-197.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="56f0f11e-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 64-bit bit test instruction emulation broken</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-195.html">
<p>The x86 instructions BT, BTC, BTR, and BTS, when used with a
destination memory operand and a source register rather than an
immediate operand, access a memory location offset from that
specified by the memory operand as specified by the high bits of
the register source.</p>
<p>A malicious guest can modify arbitrary memory, allowing for
arbitrary code execution (and therefore privilege escalation
affecting the whole host), a crash of the host (leading to a DoS),
or information leaks. The vulnerability is sometimes exploitable
by unprivileged guest user processes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9383</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-195.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="5555120d-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- guest 32-bit ELF symbol table load leaking host data</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.7</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-194.html">
<p>Along with their main kernel binary, unprivileged guests may
arrange to have their Xen environment load (kernel) symbol tables
for their use. The ELF image metadata created for this purpose has a
few unused bytes when the symbol table binary is in 32-bit ELF
format. These unused bytes were not properly cleared during symbol
table loading.</p>
<p>A malicious unprivileged guest may be able to obtain sensitive
information from the host.</p>
<p>The information leak is small and not under the control of the
guest, so effectively exploiting this vulnerability is probably
difficult.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9384</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-194.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="53dbd096-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 segment base write emulation lacking canonical address checks</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-193.html">
<p>Both writes to the FS and GS register base MSRs as well as the
WRFSBASE and WRGSBASE instructions require their input values to be
canonical, or a #GP fault will be raised. When the use of those
instructions by the hypervisor was enabled, the previous guard
against #GP faults (having recovery code attached) was accidentally
removed.</p>
<p>A malicious guest administrator can crash the host, leading to a
DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9385</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-193.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="523bb0b7-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 task switch to VM86 mode mis-handled</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-192.html">
<p>LDTR, just like TR, is purely a protected mode facility. Hence even
when switching to a VM86 mode task, LDTR loading needs to follow
protected mode semantics. This was violated by the code.</p>
<p>On SVM (AMD hardware): a malicious unprivileged guest process can
escalate its privilege to that of the guest operating system.</p>
<p>On both SVM and VMX (Intel hardware): a malicious unprivileged
guest process can crash the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9382</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-192.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="50ac2e96-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 null segments not always treated as unusable</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-191.html">
<p>The Xen x86 emulator erroneously failed to consider the unusability
of segments when performing memory accesses.</p>
<p> The intended behaviour is as follows: The user data segment (%ds,
%es, %fs and %gs) selectors may be NULL in 32-bit to prevent access.
In 64-bit, NULL has a special meaning for user segments, and there
is no way of preventing access. However, in both 32-bit and 64-bit,
a NULL LDT system segment is intended to prevent access.</p>
<p>On Intel hardware, loading a NULL selector zeros the base as well
as most attributes, but sets the limit field to its largest possible
value. On AMD hardware, loading a NULL selector zeros the attributes,
leaving the stale base and limit intact.</p>
<p>Xen may erroneously permit the access using unexpected base/limit
values.</p>
<p>Ability to exploit this vulnerability on Intel is easy, but on AMD
depends in a complicated way on how the guest kernel manages LDTs.
</p>
<p>An unprivileged guest user program may be able to elevate its
privilege to that of the guest operating system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9386</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-191.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4d7cf654-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-190.html">
<p>Instructions touching FPU, MMX, or XMM registers are required to
raise a Device Not Available Exception (#NM) when either CR0.EM or
CR0.TS are set. (Their AVX or AVX-512 extensions would consider only
CR0.TS.) While during normal operation this is ensured by the
hardware, if a guest modifies instructions while the hypervisor is
preparing to emulate them, the #NM delivery could be missed.</p>
<p>Guest code in one task may thus (unintentionally or maliciously)
read or modify register state belonging to another task in the same
VM.</p>
<p>A malicious unprivileged guest user may be able to obtain or
corrupt sensitive information (including cryptographic material) in
other programs in the same guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7777</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-190.html</url>
</references>
<dates>
<discovery>2016-10-04</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4bf57137-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- use after free in FIFO event channel code</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-188.html">
<p>When the EVTCHNOP_init_control operation is called with a bad guest
frame number, it takes an error path which frees a control structure
without also clearing the corresponding pointer. Certain subsequent
operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control),
upon finding the non-NULL pointer, continue operation assuming it
points to allocated memory.</p>
<p>A malicious guest administrator can crash the host, leading to a
DoS. Arbitrary code execution (and therefore privilege escalation),
and information leaks, cannot be excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7154</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-188.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4aae54be-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[]</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-187.html">
<p>x86 HVM guests running with shadow paging use a subset of the x86
emulator to handle the guest writing to its own pagetables. There
are situations a guest can provoke which result in exceeding the
space allocated for internal state.</p>
<p>A malicious HVM guest administrator can cause Xen to fail a bug
check, causing a denial of service to the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7094</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-187.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="49211361-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><eq>4.5.3</eq></range>
<range><eq>4.6.3</eq></range>
<range><ge>4.7.0</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-186.html">
<p>When emulating HVM instructions, Xen uses a small i-cache for
fetches from guest memory. The code that handles cache misses does
not check if the address from which it fetched lies within the cache
before blindly writing to it. As such it is possible for the guest
to overwrite hypervisor memory.</p>
<p>It is currently believed that the only way to trigger this bug is
to use the way that Xen currently incorrectly wraps CS:IP in 16 bit
modes. The included patch prevents such wrapping.</p>
<p>A malicious HVM guest administrator can escalate their privilege to
that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7093</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-186.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="45ca25b5-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-185.html">
<p>On real hardware, a 32-bit PAE guest must leave the USER and RW bit
clear in L3 pagetable entries, but the pagetable walk behaves as if
they were set. (The L3 entries are cached in processor registers,
and don't actually form part of the pagewalk.)</p>
<p>When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR
in the USER and RW bits for L3 updates for the guest to observe
architectural behaviour. This is unsafe in combination with
recursive pagetables.</p>
<p>As there is no way to construct an L3 recursive pagetable in native
32-bit PAE mode, disallow this option in 32-bit PV guests.</p>
<p>A malicious 32-bit PV guest administrator can escalate their
privilege to that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7092</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-185.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="7fff2b16-b0ee-11e6-86b8-589cfc054129">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tshark</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark project reports:</p>
<blockquote cite="://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html">
<p>Wireshark project is releasing Wireshark 2.2.2, which addresses:</p>
<ul>
<li>wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372</li>
<li>wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374</li>
<li>wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376</li>
<li>wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373</li>
<li>wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html</url>
<cvename>CVE-2016-9372</cvename>
<cvename>CVE-2016-9373</cvename>
<cvename>CVE-2016-9374</cvename>
<cvename>CVE-2016-9375</cvename>
<cvename>CVE-2016-9376</cvename>
</references>
<dates>
<discovery>2016-11-16</discovery>
<entry>2016-12-01</entry>
</dates>
</vuln>
<vuln vid="18f39fb6-7400-4063-acaf-0806e92c094f">
<topic>Mozilla -- SVG Animation Remote Code Execution</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0.2,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.5.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.5.1,2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>45.5.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>45.5.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>45.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/">
<p>A use-after-free vulnerability in SVG Animation has been
discovered. An exploit built on this vulnerability has been
discovered in the wild targeting Firefox and Tor Browser
users on Windows.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9079</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/</url>
</references>
<dates>
<discovery>2016-11-30</discovery>
<entry>2016-12-01</entry>
<modified>2016-12-16</modified>
</dates>
</vuln>
<vuln vid="479c5b91-b6cc-11e6-a04e-3417eb99b9a0">
<topic>wget -- Access List Bypass / Race Condition</topic>
<affects>
<package>
<name>wget</name>
<range><le>1.17</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dawid Golunski reports:</p>
<blockquote cite="https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html">
<p>GNU wget in version 1.17 and earlier, when used in
mirroring/recursive mode, is affected by a Race Condition
vulnerability that might allow remote attackers to bypass intended
wget access list restrictions specified with -A parameter.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7098</url>
<cvename>CVE-2016-7098</cvename>
</references>
<dates>
<discovery>2016-11-24</discovery>
<entry>2016-11-30</entry>
</dates>
</vuln>
<vuln vid="48e83187-b6e9-11e6-b6cf-5453ed2e2b49">
<topic>p7zip -- Null pointer dereference</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9296">
<p>A null pointer dereference bug affects the 16.02 and many old
versions of p7zip. A lack of null pointer check for the variable
<code>folders.PackPositions</code> in function
<code>CInArchive::ReadAndDecodePackedStreams</code>, as used in
the 7z.so library and in 7z applications, will cause a crash and a
denial of service when decoding malformed 7z files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9296</cvename>
<url>https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/</url>
<url>https://sourceforge.net/p/p7zip/bugs/185/</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9296</url>
</references>
<dates>
<discovery>2016-07-17</discovery>
<entry>2016-11-30</entry>
</dates>
</vuln>
<vuln vid="ac256985-b6a9-11e6-a3bf-206a8a720317">
<topic>subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s)</topic>
<affects>
<package>
<name>subversion18</name>
<range><lt>1.8.17</lt></range>
</package>
<package>
<name>subversion</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-8734-advisory.txt">
<p>The mod_dontdothat module of subversion and subversion clients using
http(s):// are vulnerable to a denial-of-service attack, caused by
exponential XML entity expansion. The attack targets XML parsers
causing targeted process to consume excessive amounts of resources.
The attack is also known as the "billions of laughs attack."</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2016-8734-advisory.txt</url>
<cvename>CVE-2016-8734</cvename>
</references>
<dates>
<discovery>2016-11-29</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="18449f92-ab39-11e6-8011-005056925db4">
<topic>libwww -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libwww</name>
<range><lt>5.4.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3183">
<p>The HTBoundary_put_block function in HTBound.c for W3C libwww
(w3c-libwww) allows remote servers to cause a denial of service
(segmentation fault) via a crafted multipart/byteranges MIME message
that triggers an out-of-bounds read.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
<p>The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
as used in the XML-Twig module for Perl, allows context-dependent
attackers to cause a denial of service (application crash) via an XML
document with malformed UTF-8 sequences that trigger a buffer
over-read, related to the doProlog function in lib/xmlparse.c, a
different vulnerability than CVE-2009-2625 and CVE-2009-3720.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
<p>The updatePosition function in lib/xmltok_impl.c in libexpat in
Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other
software, allows context-dependent attackers to cause a denial of
service (application crash) via an XML document with crafted UTF-8
sequences that trigger a buffer over-read, a different vulnerability
than CVE-2009-2625.</p>
</blockquote>
</body>
</description>
<references>
<bid>15035</bid>
<cvename>CVE-2005-3183</cvename>
<cvename>CVE-2009-3560</cvename>
<cvename>CVE-2009-3720</cvename>
<freebsdpr>ports/214546</freebsdpr>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=170518</url>
</references>
<dates>
<discovery>2005-10-12</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e">
<topic>mozilla -- data: URL can inherit wrong origin after an HTTP redirect</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-91/">
<p>Redirection from an HTTP connection to a data: URL
assigns the referring site's origin to the data: URL in some
circumstances. This can result in same-origin violations
against a domain if it loads resources from malicious
sites. Cross-origin setting of cookies has been demonstrated
without the ability to read them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9078</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-91/</url>
</references>
<dates>
<discovery>2016-11-28</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="125f5958-b611-11e6-a9a5-b499baebfeaf">
<topic>Roundcube -- arbitrary command execution</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.2.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-9920">
<p>steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before
1.2.3, when no SMTP server is configured and the sendmail program is
enabled, does not properly restrict the use of custom envelope-from
addresses on the sendmail command line, which allows remote
authenticated users to execute arbitrary code via a modified HTTP
request that sends a crafted e-mail message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9920</cvename>
<bid>94858</bid>
<url>http://www.openwall.com/lists/oss-security/2016/12/08/17</url>
<url>https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123</url>
</references>
<dates>
<discovery>2016-11-29</discovery>
<entry>2016-11-29</entry>
<modified>2016-12-14</modified>
</dates>
</vuln>
<vuln vid="8db24888-b2f5-11e6-8153-00248c0c745d">
<topic>Drupal Code -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><ge>7.0</ge><lt>7.52</lt></range>
</package>
<package>
<name>drupal8</name>
<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-005">
<h3>Inconsistent name for term access query (Less critical - Drupal
7 and Drupal 8)</h3>
<p>Drupal provides a mechanism to alter database SELECT queries before
they are executed. Contributed and custom modules may use this
mechanism to restrict access to certain entities by implementing
hook_query_alter() or hook_query_TAG_alter() in order to add
additional conditions. Queries can be distinguished by means of
query tags. As the documentation on EntityFieldQuery::addTag()
suggests, access-tags on entity queries normally follow the form
ENTITY_TYPE_access (e.g. node_access). However, the taxonomy
module's access query tag predated this system and used term_access
as the query tag instead of taxonomy_term_access.</p>
<p>As a result, before this security release modules wishing to
restrict access to taxonomy terms may have implemented an
unsupported tag, or needed to look for both tags (term_access and
taxonomy_term_access) in order to be compatible with queries
generated both by Drupal core as well as those generated by
contributed modules like Entity Reference. Otherwise information
on taxonomy terms might have been disclosed to unprivileged users.
</p>
<h3>Incorrect cache context on password reset page (Less critical -
Drupal 8)</h3>
<p>The user password reset form does not specify a proper cache
context, which can lead to cache poisoning and unwanted content on
the page.</p>
<h3>Confirmation forms allow external URLs to be injected (Moderately
critical - Drupal 7)</h3>
<p>Under certain circumstances, malicious users could construct a URL
to a confirmation form that would trick users into being redirected
to a 3rd party website after interacting with the form, thereby
exposing the users to potential social engineering attacks.</p>
<h3>Denial of service via transliterate mechanism (Moderately critical
- Drupal 8)</h3>
<p>A specially crafted URL can cause a denial of service via the
transliterate mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9449</cvename>
<cvename>CVE-2016-9450</cvename>
<cvename>CVE-2016-9451</cvename>
<cvename>CVE-2016-9452</cvename>
</references>
<dates>
<discovery>2016-11-16</discovery>
<entry>2016-11-25</entry>
<modified>2016-11-27</modified>
</dates>
</vuln>
<vuln vid="6fe72178-b2e3-11e6-8b2a-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.6.0</ge><lt>4.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-57/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-58/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-59/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-60/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-61/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-62/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-63/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-64/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-65/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-66/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-67/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-68/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-69/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-70/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-71/</url>
<cvename>CVE-2016-6632</cvename>
<cvename>CVE-2016-6633</cvename>
<cvename>CVE-2016-4412</cvename>
</references>
<dates>
<discovery>2016-11-25</discovery>
<entry>2016-11-25</entry>
</dates>
</vuln>
<vuln vid="dc596a17-7a9e-11e6-b034-f0def167eeea">
<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>mysql56-client</name>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql55-client</name>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LegalHackers' reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
It works by manipulating my.cnf files and using --malloc-lib.
The bug seems fixed in MySQL 5.7.15 by Oracle</p>
</blockquote>
</body>
</description>
<references>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-11-24</entry>
<modified>2016-11-24</modified>
</dates>
</vuln>
<vuln vid="8db8d62a-b08b-11e6-8eba-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p9</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se">
<p>NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:</p>
<ul>
<li>1 HIGH severity vulnerability that only affects Windows</li>
<li>2 MEDIUM severity vulnerabilities</li>
<li>2 MEDIUM/LOW severity vulnerabilities</li>
<li>5 LOW severity vulnerabilities</li>
<li>28 other non-security fixes and improvements</li>
</ul>
<p>All of the security issues in this release are listed in
<a href="http://www.kb.cert.org/vuls/id/633847">VU#633847</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7426</cvename>
<cvename>CVE-2016-7427</cvename>
<cvename>CVE-2016-7428</cvename>
<cvename>CVE-2016-7429</cvename>
<cvename>CVE-2016-7431</cvename>
<cvename>CVE-2016-7433</cvename>
<cvename>CVE-2016-7434</cvename>
<cvename>CVE-2016-9310</cvename>
<cvename>CVE-2016-9311</cvename>
<cvename>CVE-2016-9312</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se</url>
<url>http://www.kb.cert.org/vuls/id/633847</url>
</references>
<dates>
<discovery>2016-11-21</discovery>
<entry>2016-11-22</entry>
</dates>
</vuln>
<vuln vid="81fc7705-b002-11e6-b20a-14dae9d5a9d2">
<topic>teeworlds -- Remote code execution</topic>
<affects>
<package>
<name>teeworlds</name>
<range><lt>0.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Teeworlds project reports:</p>
<blockquote cite="https://www.teeworlds.com/?page=news&id=12086">
<p>Attacker controlled memory-writes and possibly arbitrary code
execution on the client, abusable by any server the client joins</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.teeworlds.com/?page=news&id=12086</url>
</references>
<dates>
<discovery>2016-11-13</discovery>
<entry>2016-11-21</entry>
</dates>
</vuln>
<vuln vid="27eee66d-9474-44a5-b830-21ec12a1c307">
<topic>jenkins -- Remote code execution vulnerability in remoting module</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.31</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.19.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16">
<p>An unauthenticated remote code execution vulnerability allowed
attackers to transfer a serialized Java object to the Jenkins CLI,
making Jenkins connect to an attacker-controlled LDAP server, which
in turn can send a serialized payload leading to code execution,
bypassing existing protection mechanisms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9299</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16</url>
</references>
<dates>
<discovery>2016-11-11</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="f6565fbf-ab9e-11e6-ae1b-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><lt>2.9.9</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.7</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0023: Question engine allows access to files that
should not be available</p></li>
<li><p>MSA-16-0024: Non-admin site managers may accidentally edit
admins via web services</p></li>
<li><p>MSA-16-0025: Capability to view course notes is checked in
the wrong context</p></li>
<li><p>MSA-16-0026: When debugging is enabled, error exceptions
returned from webservices could contain private data</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8642</cvename>
<cvename>CVE-2016-8643</cvename>
<cvename>CVE-2016-8644</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-11-14</discovery>
<entry>2016-11-16</entry>
<modified>2016-11-27</modified>
</dates>
</vuln>
<vuln vid="ab02f981-ab9e-11e6-ae1b-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><lt>2.9.8</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.6</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0022: Web service tokens should be invalidated when
the user password is changed or forced to be changed.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7038</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="d1853110-07f4-4645-895b-6fd462ad0589">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.47</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5289</cvename>
<cvename>CVE-2016-5290</cvename>
<cvename>CVE-2016-5291</cvename>
<cvename>CVE-2016-5292</cvename>
<cvename>CVE-2016-5293</cvename>
<cvename>CVE-2016-5294</cvename>
<cvename>CVE-2016-5295</cvename>
<cvename>CVE-2016-5296</cvename>
<cvename>CVE-2016-5297</cvename>
<cvename>CVE-2016-5298</cvename>
<cvename>CVE-2016-5299</cvename>
<cvename>CVE-2016-9061</cvename>
<cvename>CVE-2016-9062</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2016-9064</cvename>
<cvename>CVE-2016-9065</cvename>
<cvename>CVE-2016-9066</cvename>
<cvename>CVE-2016-9067</cvename>
<cvename>CVE-2016-9068</cvename>
<cvename>CVE-2016-9070</cvename>
<cvename>CVE-2016-9071</cvename>
<cvename>CVE-2016-9072</cvename>
<cvename>CVE-2016-9073</cvename>
<cvename>CVE-2016-9074</cvename>
<cvename>CVE-2016-9075</cvename>
<cvename>CVE-2016-9076</cvename>
<cvename>CVE-2016-9077</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-89/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-90/</url>
</references>
<dates>
<discovery>2016-11-15</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="a8e9d834-a916-11e6-b9b4-bcaec524bf84">
<topic>lives -- insecure files permissions</topic>
<affects>
<package>
<name>lives</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565">
<p>smogrify script creates insecure temporary files.</p>
</blockquote>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043">
<p>lives creates and uses world-writable directory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043</url>
</references>
<dates>
<discovery>2016-07-30</discovery>
<entry>2016-11-12</entry>
</dates>
</vuln>
<vuln vid="50751310-a763-11e6-a881-b499baebfeaf">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20161110.txt">
<ul>
<li>ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)<br/>
Severity: High<br/>
TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS
attack by corrupting larger payloads. This can result in an OpenSSL crash. This
issue is not considered to be exploitable beyond a DoS.</li>
<li>CMS Null dereference (CVE-2016-7053)<br/>
Severity: Medium<br/>
Applications parsing invalid CMS structures can crash with a NULL pointer
dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type
in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure
callback if an attempt is made to free certain invalid encodings. Only CHOICE
structures using a callback which do not handle NULL value are affected.</li>
<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)i<br/>
Severity: Low<br/>
There is a carry propagating bug in the Broadwell-specific Montgomery
multiplication procedure that handles input lengths divisible by, but
longer than 256 bits.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20161110.txt</url>
<cvename>CVE-2016-7054</cvename>
<cvename>CVE-2016-7053</cvename>
<cvename>CVE-2016-7055</cvename>
</references>
<dates>
<discovery>2016-11-10</discovery>
<entry>2016-11-10</entry>
<modified>2016-11-11</modified>
</dates>
</vuln>
<vuln vid="a3473f5a-a739-11e6-afaa-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.100</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html">
<p>4 security fixes in this release, including:</p>
<ul>
<li>[643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to
Paul Mehta</li>
<li>[658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to
Choongwoo Han</li>
<li>[660678] Medium CVE-2016-5201: Info leak in extensions. Credit to
Rob Wu</li>
<li>[662843] CVE-2016-5202: Various fixes from internal audits,
fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5199</cvename>
<cvename>CVE-2016-5200</cvename>
<cvename>CVE-2016-5201</cvename>
<cvename>CVE-2016-5202</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html</url>
</references>
<dates>
<discovery>2016-11-09</discovery>
<entry>2016-11-10</entry>
</dates>
</vuln>
<vuln vid="96f6bf10-a731-11e6-95ca-0011d823eebd">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c7-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.644</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-37.html">
<ul>
<li>These updates resolve type confusion vulnerabilities that
could lead to code execution (CVE-2016-7860, CVE-2016-7861,
CVE-2016-7865).</li>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2016-7857, CVE-2016-7858,
CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-37.html</url>
<cvename>CVE-2016-7857</cvename>
<cvename>CVE-2016-7858</cvename>
<cvename>CVE-2016-7859</cvename>
<cvename>CVE-2016-7860</cvename>
<cvename>CVE-2016-7861</cvename>
<cvename>CVE-2016-7862</cvename>
<cvename>CVE-2016-7863</cvename>
<cvename>CVE-2016-7864</cvename>
<cvename>CVE-2016-7865</cvename>
</references>
<dates>
<discovery>2016-11-08</discovery>
<entry>2016-11-10</entry>
</dates>
</vuln>
<vuln vid="10968dfd-a687-11e6-b2d3-60a44ce6887b">
<topic>gitlab -- Directory traversal via "import/export" feature</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.10.0</ge><le>8.10.12</le></range>
<range><ge>8.11.0</ge><le>8.11.9</le></range>
<range><ge>8.12.0</ge><le>8.12.7</le></range>
<range><ge>8.13.0</ge><le>8.13.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/">
<p>The import/export feature did not properly check for symbolic links
in user-provided archives and therefore it was possible for an
authenticated user to retrieve the contents of any file
accessible to the GitLab service account. This included
sensitive files such as those that contain secret tokens used
by the GitLab service to authenticate users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/</url>
<cvename>CVE-2016-9086</cvename>
<freebsdpr>ports/214360</freebsdpr>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-09</entry>
<modified>2017-05-18</modified>
</dates>
</vuln>
<vuln vid="ae9cb9b8-a203-11e6-a265-3065ec8fd3ec">
<topic>chromium -- out-of-bounds memory access</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html">
<p>[659475] High CVE-2016-5198: Out of bounds memory access in V8.
Credit to Tencent Keen Security Lab, working with Trend Micro's
Zero Day Initiative.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5198</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-03</entry>
</dates>
</vuln>
<vuln vid="0fcd3af0-a0fe-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- OpenSSL Remote DoS vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_12</lt></range>
<range><ge>10.2</ge><lt>10.2_25</lt></range>
<range><ge>10.1</ge><lt>10.1_42</lt></range>
<range><ge>9.3</ge><lt>9.3_50</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2i,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0a</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_13</lt></range>
</package>
<package>
<name>linux-c7-openssl-libs</name>
<range><lt>1.0.1e_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to improper handling of alert packets, OpenSSL would
consume an excessive amount of CPU time processing undefined
alert messages.</p>
<h1>Impact:</h1>
<p>A remote attacker who can initiate handshakes with an
OpenSSL based server can cause the server to consume a lot
of computation power with very little bandwidth usage, and
may be able to use this technique in a leveraged Denial of
Service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2016-8610</cvename>
<freebsdsa>SA-16:35.openssl</freebsdsa>
<url>http://seclists.org/oss-sec/2016/q4/224</url>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-02</entry>
<modified>2017-02-22</modified>
</dates>
</vuln>
<vuln vid="cb116651-79db-4c09-93a2-c38f9df46724">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.16</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.16</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.11</lt></range>
</package>
<package>
<name>py27-django110</name>
<name>py33-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<range><lt>1.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/nov/01/security-releases/">
<p>Today the Django team released Django 1.10.3, Django 1.9.11,
and 1.8.16. These releases addresses two security issues
detailed below. We encourage all users of Django to upgrade
as soon as possible.</p>
<ul>
<li>User with hardcoded password created when running tests on Oracle</li>
<li>DNS rebinding vulnerability when DEBUG=True</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/nov/01/security-releases/</url>
<cvename>CVE-2016-9013</cvename>
<cvename>CVE-2016-9014</cvename>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="765feb7d-a0d1-11e6-a881-b499baebfeaf">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.1</ge><lt>7.51.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<ul>
<li>cookie injection for other servers</li>
<li>case insensitive password comparison</li>
<li>OOB write via unchecked multiplication</li>
<li>double-free in curl_maprintf</li>
<li>double-free in krb5 code</li>
<li>glob parser write/read out of bounds</li>
<li>curl_getdate read out of bounds</li>
<li>URL unescape heap overflow via integer truncation</li>
<li>Use-after-free via shared cookies</li>
<li>invalid URL parsing with '#'</li>
<li>IDNA 2003 makes curl use wrong host</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<cvename>CVE-2016-8615</cvename>
<cvename>CVE-2016-8616</cvename>
<cvename>CVE-2016-8617</cvename>
<cvename>CVE-2016-8618</cvename>
<cvename>CVE-2016-8619</cvename>
<cvename>CVE-2016-8620</cvename>
<cvename>CVE-2016-8621</cvename>
<cvename>CVE-2016-8622</cvename>
<cvename>CVE-2016-8623</cvename>
<cvename>CVE-2016-8624</cvename>
<cvename>CVE-2016-8625</cvename>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="0b8d01a4-a0d2-11e6-9ca2-d050996490d0">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P4</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P1</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.10.21</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01434/">
<p>A defect in BIND's handling of responses containing
a DNAME answer can cause a resolver to exit after
encountering an assertion failure in db.c or
resolver.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8864</cvename>
<freebsdsa>SA-16:34.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01434/</url>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="f4bf713f-6ac7-4b76-8980-47bf90c5419f">
<topic>memcached -- multiple vulnerabilities</topic>
<affects>
<package>
<name>memcached</name>
<range><lt>1.4.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html">
<p>Multiple integer overflow vulnerabilities exist within Memcached
that could be exploited to achieve remote code execution on the
targeted system. These vulnerabilities manifest in various Memcached
functions that are used in inserting, appending, prepending, or
modifying key-value data pairs. Systems which also have Memcached
compiled with support for SASL authentication are also vulnerable to
a third flaw due to how Memcached handles SASL authentication
commands.</p>
<p>An attacker could exploit these vulnerabilities by sending a
specifically crafted Memcached command to the targeted server.
Additionally, these vulnerabilities could also be exploited to leak
sensitive process information which an attacker could use to bypass
common exploitation mitigations, such as ASLR, and can be triggered
multiple times. This enables reliable exploitation which makes these
vulnerabilities severe.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html</url>
<cvename>CVE-2016-8704</cvename>
<cvename>CVE-2016-8705</cvename>
<cvename>CVE-2016-8706</cvename>
</references>
<dates>
<discovery>2016-10-31</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="9bc14850-a070-11e6-a881-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<name>mysql55-server</name>
<range><lt>5.5.53</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.34</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/">
<p>Fixes for the following security vulnerabilities:</p>
<ul>
<li>CVE-2016-7440</li>
<li>CVE-2016-5584</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/</url>
<cvename>CVE-2016-7440</cvename>
<cvename>CVE-2016-5584</cvename>
</references>
<dates>
<discovery>2016-10-17</discovery>
<entry>2016-11-01</entry>
</dates>
</vuln>
<vuln vid="9118961b-9fa5-11e6-a265-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html">
<p>21 security fixes in this release, including:</p>
<ul>
<li>[645211] High CVE-2016-5181: Universal XSS in Blink. Credit to
Anonymous</li>
<li>[638615] High CVE-2016-5182: Heap overflow in Blink. Credit to
Giwan Go of STEALIEN</li>
<li>[645122] High CVE-2016-5183: Use after free in PDFium. Credit
to Anonymous</li>
<li>[630654] High CVE-2016-5184: Use after free in PDFium. Credit
to Anonymous</li>
<li>[621360] High CVE-2016-5185: Use after free in Blink. Credit to
cloudfuzzer</li>
<li>[639702] High CVE-2016-5187: URL spoofing. Credit to Luan
Herrera</li>
<li>[565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan
Herrera</li>
<li>[633885] Medium CVE-2016-5192: Cross-origin bypass in Blink.
Credit to haojunhou@gmail.com</li>
<li>[646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr
of Tencent's Xuanwu Lab</li>
<li>[644963] Medium CVE-2016-5186: Out of bounds read in DevTools.
Credit to Abdulrahman Alqabandi (@qab)</li>
<li>[639126] Medium CVE-2016-5191: Universal XSS in Bookmarks.
Credit to Gareth Hughes</li>
<li>[642067] Medium CVE-2016-5190: Use after free in Internals.
Credit to Atte Kettunen of OUSPG</li>
<li>[639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang
ZHOU (martinzhou96)</li>
<li>[654782] CVE-2016-5194: Various fixes from internal audits,
fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5181</cvename>
<cvename>CVE-2016-5182</cvename>
<cvename>CVE-2016-5183</cvename>
<cvename>CVE-2016-5184</cvename>
<cvename>CVE-2016-5185</cvename>
<cvename>CVE-2016-5186</cvename>
<cvename>CVE-2016-5187</cvename>
<cvename>CVE-2016-5188</cvename>
<cvename>CVE-2016-5189</cvename>
<cvename>CVE-2016-5190</cvename>
<cvename>CVE-2016-5191</cvename>
<cvename>CVE-2016-5192</cvename>
<cvename>CVE-2016-5193</cvename>
<cvename>CVE-2016-5194</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-10-12</discovery>
<entry>2016-10-31</entry>
</dates>
</vuln>
<vuln vid="9c135c7e-9fa4-11e6-a265-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.143</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[642496] High CVE-2016-5177: Use after free in V8. Credit to
Anonymous</li>
<li>[651092] CVE-2016-5178: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5177</cvename>
<cvename>CVE-2016-5178</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2016-09-29</discovery>
<entry>2016-10-31</entry>
</dates>
</vuln>
<vuln vid="6a2cfcdc-9dea-11e6-a298-14dae9d210b8">
<topic>FreeBSD -- OpenSSH Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3p1_1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_3</lt></range>
<range><ge>10.3</ge><lt>10.3_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When processing the SSH_MSG_KEXINIT message, the server
could allocate up to a few hundreds of megabytes of memory
per each connection, before any authentication take place.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause a SSH server to
allocate an excessive amount of memory. Note that the default
MaxStartups setting on FreeBSD will limit the effectiveness
of this attack.</p>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/191</url>
<cvename>CVE-2016-8858</cvename>
<freebsdsa>SA-16:33.openssh</freebsdsa>
</references>
<dates>
<discovery>2016-10-19</discovery>
<entry>2016-10-29</entry>
<modified>2016-11-02</modified>
</dates>
</vuln>
<vuln vid="2e4fbc9a-9d23-11e6-a298-14dae9d210b8">
<topic>sudo -- Potential bypass of sudo_noexec.so via wordexp()</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.6.8</ge><lt>1.8.18p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/alerts/noexec_wordexp.html">
<p>A flaw exists in sudo's noexec functionality that may allow
a user with sudo privileges to run additional commands even when the
NOEXEC tag has been applied to a command that uses the wordexp()
function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/alerts/noexec_wordexp.html</url>
<cvename>CVE-2016-7076</cvename>
</references>
<dates>
<discovery>2016-10-28</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="ac18046c-9b08-11e6-8011-005056925db4">
<topic>Axis2 -- Security vulnerabilities on dependency Apache HttpClient</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html">
<p>Apache Axis2 1.7.4 is a maintenance release that includes fixes for
several issues, including the following security issues:
Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities
affecting the admin console.
A dependency on an Apache HttpClient version affected by known security
vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html</url>
<url>https://issues.apache.org/jira/browse/AXIS2-4739</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5683</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5757</url>
<cvename>CVE-2012-6153</cvename>
<cvename>CVE-2014-3577</cvename>
</references>
<dates>
<discovery>2012-12-06</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="28bb6ee5-9b5c-11e6-b799-19bef72f4b7c">
<topic>node.js -- ares_create_query single byte out of buffer write</topic>
<affects>
<package>
<name>node010</name>
<range><lt>0.10.48</lt></range>
</package>
<package>
<name>node012</name>
<range><lt>0.12.17</lt></range>
</package>
<package>
<name>node4</name>
<range><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js has released new versions containing the following security fix:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
<p>The following releases all contain fixes for CVE-2016-5180 "ares_create_query single
byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance),
Node.js v4.6.1 (LTS "Argon")
</p>
<p>While this is not a critical update, all users of these release lines should upgrade at
their earliest convenience.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
<cvename>CVE-2016-5180</cvename>
<freebsdpr>ports/213800</freebsdpr>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2016-10-26</entry>
</dates>
</vuln>
<vuln vid="27180c99-9b5c-11e6-b799-19bef72f4b7c">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><ge>6.0.0</ge><lt>6.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
<p>Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL
configuration file, from the OPENSSL_CONF environment variable or from the default
location for the current platform. Always triggering a configuration file load attempt
may allow an attacker to load compromised OpenSSL configuration into a Node.js process
if they are able to place a file in a default location.
</p>
<p>Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes,
potentially allowing an attacker to obtain sensitive information from arbitrary memory
locations via crafted JavaScript code. This vulnerability would require an attacker to
be able to execute arbitrary JavaScript code in a Node.js process.
</p>
<p>Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of
the inspector. This provides additional security to prevent unauthorized clients from
connecting to the Node.js process via the v8_inspector port when running with --inspect.
Since the debugging protocol allows extensive access to the internals of a running process,
and the execution of arbitrary code, it is important to limit connections to authorized
tools only. Note that the v8_inspector protocol in Node.js is still considered an
experimental feature. Vulnerability originally reported by Jann Horn.
</p>
<p>All of these vulnerabilities are considered low-severity for Node.js users, however,
users of Node.js v6.x should upgrade at their earliest convenience.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
<cvename>CVE-2016-5172</cvename>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="c5c6e293-9cc7-11e6-823f-b8aeed92ecc4">
<topic>urllib3 -- certificate verification failure</topic>
<affects>
<package>
<name>py-urllib3</name>
<range><lt>1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>urllib3 reports:</p>
<blockquote cite="https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst">
<p>CVE-2016-9015: Certification verification failure</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9015</cvename>
<url>https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="de6d01d5-9c44-11e6-ba67-0011d823eebd">
<topic>flash -- remote code execution</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<name>linux-c6-flashplugin</name>
<name>linux-c7-flashplugin</name>
<range><lt>11.2r202.643</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-36.html">
<p>Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh, Linux and Chrome OS. These updates address a
critical vulnerability that could potentially allow an attacker to
take control of the affected system.</p>
<p>Adobe is aware of a report that an exploit for CVE-2016-7855
exists in the wild, and is being used in limited, targeted attacks
against users running Windows versions 7, 8.1 and 10.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7855</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-36.html</url>
</references>
<dates>
<discovery>2016-10-26</discovery>
<entry>2016-10-27</entry>
</dates>
</vuln>
<vuln vid="a479a725-9adb-11e6-a298-14dae9d210b8">
<topic>FreeBSD -- bhyve - privilege escalation vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An unchecked array reference in the VGA device emulation
code could potentially allow guests access to the heap of
the bhyve process. Since the bhyve process is running as
root, this may allow guests to obtain full control of the
hosts they are running on.</p>
<h1>Impact:</h1>
<p>For bhyve virtual machines with the "fbuf" framebuffer
device configured, if exploited, a malicious guest could
obtain full access to not just the host system, but to other
virtual machines running on the system.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:32.bhyve</freebsdsa>
</references>
<dates>
<discovery>2016-10-25</discovery>
<entry>2016-10-25</entry>
<modified>2016-10-25</modified>
</dates>
</vuln>
<vuln vid="2482c798-93c6-11e6-846f-bc5ff4fb5ea1">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-c7-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.637</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-32.html">
<p>Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh, Linux and ChromeOS. These updates address
critical vulnerabilities that could potentially allow an attacker
to take control of the affected system.</p>
<p>These updates resolve a type confusion vulnerability that could
lead to code execution (CVE-2016-6992).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-6981, CVE-2016-6987).</p>
<p>These updates resolve a security bypass vulnerability
(CVE-2016-4286).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4273, CVE-2016-6982,
CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986,
CVE-2016-6989, CVE-2016-6990).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4273</cvename>
<cvename>CVE-2016-4286</cvename>
<cvename>CVE-2016-6981</cvename>
<cvename>CVE-2016-6982</cvename>
<cvename>CVE-2016-6983</cvename>
<cvename>CVE-2016-6984</cvename>
<cvename>CVE-2016-6985</cvename>
<cvename>CVE-2016-6986</cvename>
<cvename>CVE-2016-6987</cvename>
<cvename>CVE-2016-6989</cvename>
<cvename>CVE-2016-6990</cvename>
<cvename>CVE-2016-6992</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-32.html</url>
</references>
<dates>
<discovery>2016-10-11</discovery>
<entry>2016-10-24</entry>
</dates>
</vuln>
<vuln vid="aaa9f3db-13b5-4a0e-9ed7-e5ab287098fa">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>49.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-87/">
<p>CVE-2016-5287: Crash in nsTArray_base<T>::SwapArrayElements</p>
<p>CVE-2016-5288: Web content can read cache entries</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5287</cvename>
<cvename>CVE-2016-5288</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-87/</url>
</references>
<dates>
<discovery>2016-10-20</discovery>
<entry>2016-10-21</entry>
</dates>
</vuln>
<vuln vid="0baadc45-92d0-11e6-8011-005056925db4">
<topic>Axis2 -- Cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html">
<p>Apache Axis2 1.7.3 is a security release that contains a fix
for CVE-2010-3981. That security vulnerability affects the admin console
that is part of the Axis2 Web application and was originally reported
for SAP BusinessObjects (which includes a version of Axis2). That report
didn’t mention Axis2 at all and the Axis2 project only recently became
aware (thanks to Devesh Bhatt and Nishant Agarwala) that the issue
affects Apache Axis2 as well.</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html</url>
<cvename>CVE-2010-3981</cvename>
<freebsdpr>ports/213546</freebsdpr>
</references>
<dates>
<discovery>2010-10-18</discovery>
<entry>2016-10-18</entry>
</dates>
</vuln>
<vuln vid="c1dc55dc-9556-11e6-b154-3065ec8fd3ec">
<topic>Tor -- remote denial of service</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.8.9</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.9.4-alpha</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Blog reports:</p>
<blockquote cite="https://blog.torproject.org/blog/tor-0289-released-important-fixes">
<p>Prevent a class of security bugs caused by treating the contents
of a buffer chunk as if they were a NUL-terminated string. At least
one such bug seems to be present in all currently used versions of
Tor, and would allow an attacker to remotely crash most Tor
instances, especially those compiled with extra compiler hardening.
With this defense in place, such bugs can't crash Tor, though we
should still fix them as they occur. Closes ticket 20384
(TROVE-2016-10-001).</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/blog/tor-0289-released-important-fixes</url>
</references>
<dates>
<discovery>2016-10-17</discovery>
<entry>2016-10-18</entry>
</dates>
</vuln>
<vuln vid="43f1c867-654a-11e6-8286-00248c0c745d">
<topic>Rails 4 -- Possible XSS Vulnerability in Action View</topic>
<affects>
<package>
<name>rubygem-actionview</name>
<range><gt>3.0.0</gt><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Security team reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE">
<p>There is a possible XSS vulnerability in Action View. Text declared as "HTML
safe" will not have quotes escaped when used as attribute values in tag
helpers. This vulnerability has been assigned the CVE identifier
CVE-2016-6316.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE</url>
<cvename>CVE-2016-6316</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-18</entry>
</dates>
</vuln>
<vuln vid="7e61cf44-6549-11e6-8286-00248c0c745d">
<topic>Rails 4 -- Unsafe Query Generation Risk in Active Record</topic>
<affects>
<package>
<name>rubygem-activerecord4</name>
<range><gt>4.2.0</gt><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Security team reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA">
<p>There is a vulnerability when Active Record is used in conjunction with JSON
parameter parsing. This vulnerability has been assigned the CVE identifier
CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694
and CVE-2013-0155.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA</url>
<cvename>CVE-2016-6317</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-18</entry>
</dates>
</vuln>
<vuln vid="f471032a-8700-11e6-8d93-00248c0c745d">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.11">
<ul>
<li><p>Fixed bug #73007 (add locale length check)</p></li>
<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.11</url>
<cvename>CVE-2016-7416</cvename>
<cvename>CVE-2016-7412</cvename>
<cvename>CVE-2016-7414</cvename>
<cvename>CVE-2016-7417</cvename>
<cvename>CVE-2016-7413</cvename>
<cvename>CVE-2016-7418</cvename>
</references>
<dates>
<discovery>2016-09-15</discovery>
<entry>2016-09-30</entry>
</dates>
</vuln>
<vuln vid="8d5180a6-86fe-11e6-8d93-00248c0c745d">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.26">
<ul>
<li><p>Fixed bug #73007 (add locale length check)</p></li>
<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.6.26</url>
<cvename>CVE-2016-7416</cvename>
<cvename>CVE-2016-7412</cvename>
<cvename>CVE-2016-7414</cvename>
<cvename>CVE-2016-7417</cvename>
<cvename>CVE-2016-7411</cvename>
<cvename>CVE-2016-7413</cvename>
<cvename>CVE-2016-7418</cvename>
</references>
<dates>
<discovery>2016-09-16</discovery>
<entry>2016-09-30</entry>
</dates>
</vuln>
<vuln vid="ad479f89-9020-11e6-a590-14dae9d210b8">
<topic>file-roller -- path traversal vulnerability</topic>
<affects>
<package>
<name>file-roller</name>
<range><ge>3.5.4,1</ge><lt>3.20.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/4">
<p>File Roller 3.5.4 through 3.20.2 was affected by a path
traversal bug that could result in deleted files if a user
were tricked into opening a malicious archive.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/09/08/4</url>
<cvename>CVE-2016-7162</cvename>
<freebsdpr>ports/213199</freebsdpr>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="7d40edd1-901e-11e6-a590-14dae9d210b8">
<topic>VirtualBox -- undisclosed vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><ge>5.0</ge><lt>5.0.8</lt></range>
<range><ge>4.3</ge><lt>4.3.32</lt></range>
<range><ge>4.2</ge><lt>4.2.34</lt></range>
<range><ge>4.1</ge><lt>4.1.42</lt></range>
<range><ge>4.0</ge><lt>4.0.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42,
4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local
users to affect availability via unknown vectors related to Core.</p>
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42,
4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature
(RDP) enabled, allows remote attackers to affect availability via
unknown vectors related to Core.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
<cvename>CVE-2015-4813</cvename>
<cvename>CVE-2015-4896</cvename>
<freebsdpr>ports/204406</freebsdpr>
</references>
<dates>
<discovery>2015-10-01</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="10f7f782-901c-11e6-a590-14dae9d210b8">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.5.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://www.debian.org/security/2016/dsa-3675">
<p>Various memory handling problems and cases of missing or
incomplete input sanitizing may result in denial of service or the
execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and
CALS files are processed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.debian.org/security/2016/dsa-3675</url>
<freebsdpr>ports/213032</freebsdpr>
</references>
<dates>
<discovery>2016-09-23</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="2a526c78-84ab-11e6-a4a1-60a44ce6887b">
<topic>libgd -- integer overflow which could lead to heap buffer overflow</topic>
<affects>
<package>
<name>gd</name>
<range><le>2.2.3</le></range>
</package>
<package>
<name>php70-gd</name>
<range><le>7.0.11</le></range>
</package>
<package>
<name>php56-gd</name>
<range><le>5.6.26</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LibGD reports:</p>
<blockquote cite="https://github.com/libgd/libgd/issues/308">
<p>An integer overflow issue was found in function gdImageWebpCtx of file gd_webp.c which could lead to heap buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgd/libgd/issues/308</url>
<url>https://bugs.php.net/bug.php?id=73003</url>
<freebsdpr>ports/213023</freebsdpr>
</references>
<dates>
<discovery>2016-09-02</discovery>
<entry>2016-10-11</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="cb3f036d-8c7f-11e6-924a-60a44ce6887b">
<topic>libvncserver -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nicolas Ruff reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q3/639">
<p>Integer overflow in MallocFrameBuffer() on client side.</p>
<p>Lack of malloc() return value checking on client side.</p>
<p>Server crash on a very large ClientCutText message.</p>
<p>Server crash when scaling factor is set to zero.</p>
<p>Multiple stack overflows in File Transfer feature.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q3/639</url>
<cvename>CVE-2014-6051</cvename>
<cvename>CVE-2014-6052</cvename>
<cvename>CVE-2014-6053</cvename>
<cvename>CVE-2014-6054</cvename>
<cvename>CVE-2014-6055</cvename>
<freebsdpr>ports/212380</freebsdpr>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2016-10-11</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="ab947396-9018-11e6-a590-14dae9d210b8">
<topic>openoffice -- information disclosure vulnerability</topic>
<affects>
<package>
<name>apache-openoffice</name>
<name>apache-openoffice-devel</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2014-3575.html">
<p>The exposure exploits the way OLE previews are generated to
embed arbitrary file data into a specially crafted document when it is
opened. Data exposure is possible if the updated document is distributed
to other parties.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openoffice.org/security/cves/CVE-2014-3575.html</url>
<cvename>CVE-2014-3575</cvename>
<freebsdpr>ports/212379</freebsdpr>
</references>
<dates>
<discovery>2014-08-21</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="47157c14-9013-11e6-a590-14dae9d210b8">
<topic>mupdf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mupdf</name>
<range><lt>1.9a_1,1</lt></range>
</package>
<package>
<name>llpp</name>
<range><lt>22_2</lt></range>
</package>
<package>
<name>zathura-pdf-mupdf</name>
<range><lt>0.3.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Kortkamp reports:</p>
<blockquote cite="http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html">
<p>Heap-based buffer overflow in the pdf_load_mesh_params
function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a
denial of service (crash) or execute arbitrary code via a large decode
array.</p>
<p>Use-after-free vulnerability in the pdf_load_xref function in
pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of
service (crash) via a crafted PDF file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696941</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696954</url>
<cvename>CVE-2016-6525</cvename>
<cvename>CVE-2016-6265</cvename>
<freebsdpr>ports/212207</freebsdpr>
</references>
<dates>
<discovery>2016-08-27</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="b7d56d0b-7a11-11e6-af78-589cfc0654e1">
<topic>openjpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tencent's Xuanwu LAB reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/2">
<p>A Heap Buffer Overflow (Out-of-Bounds Write) issue was found in
function opj_dwt_interleave_v of dwt.c. This vulnerability allows
remote attackers to execute arbitrary code on vulnerable installations
of OpenJPEG.</p>
<p>An integer overflow issue exists in function opj_pi_create_decode of
pi.c. It can lead to Out-Of-Bounds Read and Out-Of-Bounds Write in
function opj_pi_next_cprl of pi.c (function opj_pi_next_lrcp,
opj_pi_next_rlcp, opj_pi_next_rpcl, opj_pi_next_pcrl may also be
vulnerable). This vulnerability allows remote attackers to execute
arbitrary code on vulnerable installations of OpenJPEG.</p>
</blockquote>
</body>
</description>
<references>
<url>"http://www.openwall.com/lists/oss-security/2016/09/08/2"</url>
<url>"http://www.openwall.com/lists/oss-security/2016/09/08/3"</url>
<cvename>CVE-2016-5157</cvename>
<cvename>CVE-2016-7163</cvename>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-10-11</entry>
</dates>
</vuln>
<vuln vid="fa175f30-8c75-11e6-924a-60a44ce6887b">
<topic>redis -- sensitive information leak through command history file</topic>
<affects>
<package>
<name>redis</name>
<name>redis-devel</name>
<range><lt>3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis team reports:</p>
<blockquote cite="https://github.com/antirez/redis/pull/1418">
<p>The redis-cli history file (in linenoise) is created with the
default OS umask value which makes it world readable in most systems
and could potentially expose authentication credentials to other
users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/antirez/redis/pull/1418</url>
<url>https://github.com/antirez/redis/issues/3284</url>
<cvename>CVE-2013-7458</cvename>
</references>
<dates>
<discovery>2013-11-30</discovery>
<entry>2016-10-11</entry>
</dates>
</vuln>
<vuln vid="1a71a972-8ee7-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Multiple libarchive vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Flaws in libarchive's handling of symlinks and hard links
allow overwriting files outside the extraction directory,
or permission changes to a directory outside the extraction
directory.</p>
<h1>Impact:</h1>
<p>An attacker who can control freebsd-update's or portsnap's
input to tar(1) can change file content or permissions on
files outside of the update tool's working sandbox.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:31.libarchive</freebsdsa>
</references>
<dates>
<discovery>2016-10-05</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="e7dcd69d-8ee6-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Multiple portsnap vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Flaws in portsnap's verification of downloaded tar files
allows additional files to be included without causing the
verification to fail. Portsnap may then use or execute these
files.</p>
<h1>Impact:</h1>
<p>An attacker who can conduct man in the middle attack on
the network at the time when portsnap is run can cause
portsnap to execute arbitrary commands under the credentials
of the user who runs portsnap, typically root.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:30.portsnap</freebsdsa>
</references>
<dates>
<discovery>2016-10-10</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="ce808022-8ee6-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Heap overflow vulnerability in bspatch</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of bspatch is susceptible to integer
overflows with carefully crafted input, potentially allowing
an attacker who can control the patch file to write at
arbitrary locations in the heap. This issue was partially
addressed in FreeBSD-SA-16:25.bspatch, but some possible
integer overflows remained.</p>
<h1>Impact:</h1>
<p>An attacker who can control the patch file can cause a
crash or run arbitrary code under the credentials of the
user who runs bspatch, in many cases, root.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:29.bspatch</freebsdsa>
</references>
<dates>
<discovery>2016-10-10</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="aeb7874e-8df1-11e6-a082-5404a68ad561">
<topic>mkvtoolnix -- code execution via specially crafted files</topic>
<affects>
<package>
<name>mkvtoolnix</name>
<range><lt>9.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moritz Bunkus reports:</p>
<blockquote cite="https://mkvtoolnix.download/doc/ChangeLog">
<p>most of the bugs fixed on 2016-09-06 and 2016-09-07 for
issue #1780 are potentially exploitable. The scenario is arbitrary
code execution with specially-crafted files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mkvtoolnix.download/doc/ChangeLog</url>
</references>
<dates>
<discovery>2016-09-07</discovery>
<entry>2016-10-09</entry>
</dates>
</vuln>
<vuln vid="1cf65085-a760-41d2-9251-943e1af62eb8">
<topic>X.org libraries -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.4,1</lt></range>
</package>
<package>
<name>libXfixes</name>
<range><lt>5.0.3</lt></range>
</package>
<package>
<name>libXi</name>
<range><lt>1.7.7,1</lt></range>
</package>
<package>
<name>libXrandr</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>libXrender</name>
<range><lt>0.9.10</lt></range>
</package>
<package>
<name>libXtst</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>libXv</name>
<range><lt>1.0.11,1</lt></range>
</package>
<package>
<name>libXvMC</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2016-October/002720.html">
<p>Tobias Stoeckmann from the OpenBSD project has discovered a
number of issues in the way various X client libraries handle
the responses they receive from servers, and has worked with
X.Org's security team to analyze, confirm, and fix these issues.
These issue come in addition to the ones discovered by Ilja van
Sprundel in 2013.</p>
<p>Most of these issues stem from the client libraries trusting
the server to send correct protocol data, and not verifying
that the values will not overflow or cause other damage. Most
of the time X clients and servers are run by the same user, with
the server more privileged than the clients, so this is not a
problem, but there are scenarios in which a privileged client
can be connected to an unprivileged server, for instance,
connecting a setuid X client (such as a screen lock program)
to a virtual X server (such as Xvfb or Xephyr) which the user
has modified to return invalid data, potentially allowing the
user to escalate their privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2016-October/002720.html</url>
<cvename>CVE-2016-5407</cvename>
</references>
<dates>
<discovery>2016-10-04</discovery>
<entry>2016-10-07</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="c8d902b1-8550-11e6-81e7-d050996490d0">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P3</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0.rc3</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.12.0.a.2016.09.10</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01419">
<p>Testing by ISC has uncovered a critical error condition
which can occur when a nameserver is constructing a
response. A defect in the rendering of messages into
packets can cause named to exit with an assertion
failure in buffer.c while constructing a response
to a query that meets certain criteria.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2776</cvename>
<freebsdsa>SA-16:28.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01419</url>
</references>
<dates>
<discovery>2016-09-27</discovery>
<entry>2016-09-28</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="bb022643-84fb-11e6-a4a1-60a44ce6887b">
<topic>django -- CSRF protection bypass on a site with Google Analytics</topic>
<affects>
<package>
<name>py-django19</name>
<range><lt>1.9.10</lt></range>
</package>
<package>
<name>py-django18</name>
<range><lt>1.8.15</lt></range>
</package>
<package>
<name>py-django</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django Software Foundation reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/sep/26/security-releases/">
<p>An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/sep/26/security-releases/</url>
<cvename>CVE-2016-7401</cvename>
</references>
<dates>
<discovery>2016-09-26</discovery>
<entry>2016-09-27</entry>
</dates>
</vuln>
<vuln vid="91a337d8-83ed-11e6-bf52-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2j,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0b</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160926.txt">
<p>Critical vulnerability in OpenSSL 1.1.0a<br/>
Fix Use After Free for large message sizes (CVE-2016-6309)</p>
<p>Moderate vulnerability in OpenSSL 1.0.2i<br/>
Missing CRL sanity check (CVE-2016-7052)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160926.txt</url>
<cvename>CVE-2016-6309</cvename>
<cvename>CVE-2016-7052</cvename>
<freebsdsa>SA-16:27.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-09-26</discovery>
<entry>2016-09-26</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="43eaa656-80bc-11e6-bf52-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><ge>1.1.0</ge><lt>1.1.0_1</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2i,1</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_11</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_8</lt></range>
<range><ge>10.2</ge><lt>10.2_21</lt></range>
<range><ge>10.1</ge><lt>10.1_38</lt></range>
<range><ge>9.3</ge><lt>9.3_46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160922.txt">
<p>High: OCSP Status Request extension unbounded memory growth</p>
<p>SSL_peek() hang on empty record</p>
<p>SWEET32 Mitigation</p>
<p>OOB write in MDC2_Update()</p>
<p>Malformed SHA512 ticket DoS</p>
<p>OOB write in BN_bn2dec()</p>
<p>OOB read in TS_OBJ_print_bio()</p>
<p>Pointer arithmetic undefined behaviour</p>
<p>Constant time flag not preserved in DSA signing</p>
<p>DTLS buffered message DoS</p>
<p>DTLS replay protection DoS</p>
<p>Certificate message OOB reads</p>
<p>Excessive allocation of memory in tls_get_message_header()</p>
<p>Excessive allocation of memory in dtls1_preprocess_fragment()</p>
<p>NB: LibreSSL is only affected by CVE-2016-6304</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160922.txt</url>
<cvename>CVE-2016-6304</cvename>
<cvename>CVE-2016-6305</cvename>
<cvename>CVE-2016-2183</cvename>
<cvename>CVE-2016-6303</cvename>
<cvename>CVE-2016-6302</cvename>
<cvename>CVE-2016-2182</cvename>
<cvename>CVE-2016-2180</cvename>
<cvename>CVE-2016-2177</cvename>
<cvename>CVE-2016-2178</cvename>
<cvename>CVE-2016-2179</cvename>
<cvename>CVE-2016-2181</cvename>
<cvename>CVE-2016-6306</cvename>
<cvename>CVE-2016-6307</cvename>
<cvename>CVE-2016-6308</cvename>
<freebsdsa>SA-16:26.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-09-22</discovery>
<entry>2016-09-22</entry>
<modified>2016-10-11</modified>
</dates>
</vuln>
<vuln vid="e78261e4-803d-11e6-a590-14dae9d210b8">
<topic>irssi -- heap corruption and missing boundary checks</topic>
<affects>
<package>
<name>irssi</name>
<name>zh-irssi</name>
<range><ge>0.8.17</ge><lt>0.8.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2016.txt">
<p>Remote crash and heap corruption. Remote code execution seems
difficult since only Nuls are written.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2016.txt</url>
<cvename>CVE-2016-7044</cvename>
<cvename>CVE-2016-7045</cvename>
</references>
<dates>
<discovery>2016-09-21</discovery>
<entry>2016-09-21</entry>
<modified>2016-09-22</modified>
</dates>
</vuln>
<vuln vid="2c57c47e-8bb3-4694-83c8-9fc3abad3964">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>49.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/">
<p>CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]</p>
<p>CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]</p>
<p>CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]</p>
<p>CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]</p>
<p>CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]</p>
<p>CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]</p>
<p>CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]</p>
<p>CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]</p>
<p>CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]</p>
<p>CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]</p>
<p>CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]</p>
<p>CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]</p>
<p>CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]</p>
<p>CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]</p>
<p>CVE-2016-5281 - use-after-free in DOMSVGLength [high]</p>
<p>CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]</p>
<p>CVE-2016-5283 - <iframe src> fragment timing attack can reveal cross-origin data [high]</p>
<p>CVE-2016-5284 - Add-on update site certificate pin expiration [high]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2827</cvename>
<cvename>CVE-2016-5256</cvename>
<cvename>CVE-2016-5257</cvename>
<cvename>CVE-2016-5270</cvename>
<cvename>CVE-2016-5271</cvename>
<cvename>CVE-2016-5272</cvename>
<cvename>CVE-2016-5273</cvename>
<cvename>CVE-2016-5274</cvename>
<cvename>CVE-2016-5275</cvename>
<cvename>CVE-2016-5276</cvename>
<cvename>CVE-2016-5277</cvename>
<cvename>CVE-2016-5278</cvename>
<cvename>CVE-2016-5279</cvename>
<cvename>CVE-2016-5280</cvename>
<cvename>CVE-2016-5281</cvename>
<cvename>CVE-2016-5282</cvename>
<cvename>CVE-2016-5283</cvename>
<cvename>CVE-2016-5284</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-85/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-86/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-88/</url>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2016-09-20</entry>
<modified>2016-10-21</modified>
</dates>
</vuln>
<vuln vid="653a8059-7c49-11e6-9242-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html">
<p>Several security fixes in this release, including:</p>
<ul>
<li>[641101] High CVE-2016-5170: Use after free in Blink.Credit to
Anonymous</li>
<li>[643357] High CVE-2016-5171: Use after free in Blink. Credit to
Anonymous</li>
<li>[616386] Medium CVE-2016-5172: Arbitrary Memory Read in v8.
Credit to Choongwoo Han</li>
<li>[468931] Medium CVE-2016-5173: Extension resource access.
Credit to Anonymous</li>
<li>[579934] Medium CVE-2016-5174: Popup not correctly suppressed.
Credit to Andrey Kovalev (@L1kvID) Yandex Security Team</li>
<li>[646394] CVE-2016-5175: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5170</cvename>
<cvename>CVE-2016-5171</cvename>
<cvename>CVE-2016-5172</cvename>
<cvename>CVE-2016-5173</cvename>
<cvename>CVE-2016-5174</cvename>
<cvename>CVE-2016-5175</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2016-09-16</entry>
</dates>
</vuln>
<vuln vid="b64a7389-7c27-11e6-8aaa-5404a68ad561">
<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LegalHackers' reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
It works by manipulating my.cnf files and using --malloc-lib.
The bug seems fixed in MySQL 5.7.15 by Oracle</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6662</cvename>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="bc19dcca-7b13-11e6-b99e-589cfc0654e1">
<topic>dropbear -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2016.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnston reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/15/2">
<p>If specific usernames including "%" symbols can be created on a system
(validated by getpwnam()) then an attacker could run arbitrary code as root
when connecting to Dropbear server.
A dbclient user who can control username or host arguments could potentially
run arbitrary code as the dbclient user. This could be a problem if scripts
or webpages pass untrusted input to the dbclient program.</p>
<p>dropbearconvert import of OpenSSH keys could run arbitrary code as
the local dropbearconvert user when parsing malicious key files.</p>
<p>dbclient could run arbitrary code as the local dbclient user if
particular -m or -c arguments are provided. This could be an issue where
dbclient is used in scripts.</p>
<p>dbclient or dropbear server could expose process memory to the
running user if compiled with DEBUG_TRACE and running with -v</p>
</blockquote>
</body>
</description>
<references>
<url>"http://www.openwall.com/lists/oss-security/2016/09/15/2"</url>
<cvename>CVE-2016-7406</cvename>
<cvename>CVE-2016-7407</cvename>
<cvename>CVE-2016-7408</cvename>
<cvename>CVE-2016-7409</cvename>
</references>
<dates>
<discovery>2016-07-12</discovery>
<entry>2016-09-15</entry>
</dates>
</vuln>
<vuln vid="08664d42-7989-11e6-b7a8-74d02b9a84d5">
<topic>h2o -- fix DoS attack vector</topic>
<affects>
<package>
<name>h2o</name>
<range>
<lt>2.0.4</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frederik Deweerdt reported a denial-of-service attack vector
due to an unhandled error condition during socket connection.</p>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/issues/1077</url>
<cvename>CVE-2016-4864</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="b018121b-7a4b-11e6-bf52-b499baebfeaf">
<topic>cURL -- Escape and unescape integer overflows</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.11.1</ge><lt>7.50.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20160914.html">
<p>The four libcurl functions curl_escape(), curl_easy_escape(),
curl_unescape and curl_easy_unescape perform string URL percent
escaping and unescaping. They accept custom string length inputs
in signed integer arguments.</p>
<p>The provided string length arguments were not properly checked
and due to arithmetic in the functions, passing in the length
0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up
causing an allocation of zero bytes of heap memory that curl
would attempt to write gigabytes of data into.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20160914.html</url>
<cvename>CVE-2016-7167</cvename>
</references>
<dates>
<discovery>2016-09-14</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="769ba449-79e1-11e6-bf75-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html">
<p>33 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5147</cvename>
<cvename>CVE-2016-5148</cvename>
<cvename>CVE-2016-5149</cvename>
<cvename>CVE-2016-5150</cvename>
<cvename>CVE-2016-5151</cvename>
<cvename>CVE-2016-5152</cvename>
<cvename>CVE-2016-5153</cvename>
<cvename>CVE-2016-5154</cvename>
<cvename>CVE-2016-5155</cvename>
<cvename>CVE-2016-5156</cvename>
<cvename>CVE-2016-5157</cvename>
<cvename>CVE-2016-5158</cvename>
<cvename>CVE-2016-5159</cvename>
<cvename>CVE-2016-5160</cvename>
<cvename>CVE-2016-5161</cvename>
<cvename>CVE-2016-5162</cvename>
<cvename>CVE-2016-5163</cvename>
<cvename>CVE-2016-5164</cvename>
<cvename>CVE-2016-5165</cvename>
<cvename>CVE-2016-5166</cvename>
<cvename>CVE-2016-5167</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html</url>
</references>
<dates>
<discovery>2016-08-31</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="958b9cee-79da-11e6-bf75-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>52.0.2743.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html">
<p>10 security fixes in this release, including:</p>
<ul>
<li>[629542] High CVE-2016-5141 Address bar spoofing. Credit to
anonymous</li>
<li>[626948] High CVE-2016-5142 Use-after-free in Blink. Credit to
anonymous</li>
<li>[625541] High CVE-2016-5139 Heap overflow in pdfium. Credit to
GiWan Go of Stealien</li>
<li>[619405] High CVE-2016-5140 Heap overflow in pdfium. Credit to
Ke Liu of Tencent's Xuanwu LAB</li>
<li>[623406] Medium CVE-2016-5145 Same origin bypass for images in
Blink. Credit to anonymous</li>
<li>[619414] Medium CVE-2016-5143 Parameter sanitization failure in
DevTools. Credit to Gregory Panakkal</li>
<li>[618333] Medium CVE-2016-5144 Parameter sanitization failure in
DevTools. Credit to Gregory Panakkal</li>
<li>[633486] CVE-2016-5146: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5139</cvename>
<cvename>CVE-2016-5140</cvename>
<cvename>CVE-2016-5141</cvename>
<cvename>CVE-2016-5142</cvename>
<cvename>CVE-2016-5143</cvename>
<cvename>CVE-2016-5144</cvename>
<cvename>CVE-2016-5145</cvename>
<cvename>CVE-2016-5146</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="856b88bf-7984-11e6-81e7-d050996490d0">
<topic>mysql -- Remote Root Code Execution</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.51</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.27</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.17</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.51.38.1</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.32.78.0</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.14.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dawid Golunski reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt">
<p>An independent research has revealed multiple severe MySQL
vulnerabilities. This advisory focuses on a critical
vulnerability with a CVEID of CVE-2016-6662 which can allow
attackers to (remotely) inject malicious settings into MySQL
configuration files (my.cnf) leading to critical
consequences.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6662</cvename>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt</url>
<url>https://jira.mariadb.org/browse/MDEV-10465</url>
<url>https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/</url>
<url>https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/</url>
<url>https://www.psce.com/blog/2016/09/12/how-to-quickly-patch-mysql-server-against-cve-2016-6662/</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="331eabb3-85b1-466a-a2af-66ac864d395a">
<topic>wolfssl -- leakage of private key information</topic>
<affects>
<package>
<name>wolfssl</name>
<range><lt>3.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Weimer of Redhat discovered that an optimization in
RSA signature validation can result in disclosure of the
server's private key under certain fault conditions.</p>
</body>
</description>
<references>
<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
<url>https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/</url>
<cvename>CVE-2015-7744</cvename>
</references>
<dates>
<discovery>2015-09-17</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="3d1372e1-7822-4fd8-b56e-5ee832afbd96">
<topic>wolfssl -- DDoS amplification in DTLS</topic>
<affects>
<package>
<name>wolfssl</name>
<range><lt>3.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Ramacher identified an error in wolfSSL's implementation
of the server side of the DTLS handshake, which could be abused
for DDoS amplification or a DoS on the DTLS server itself.</p>
</body>
</description>
<references>
<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
<url>https://github.com/IAIK/wolfSSL-DoS</url>
<cvename>CVE-2015-6925</cvename>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="a0128291-7690-11e6-95a8-0011d823eebd">
<topic>gnutls -- OCSP validation issue</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.4.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-3">
<p>Stefan Bühler discovered an issue that affects validation
of certificates using OCSP responses, which can falsely report a
certificate as valid under certain circumstances.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2016-3</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-09-09</entry>
</dates>
</vuln>
<vuln vid="aa1aefe3-6e37-47db-bfda-343ef4acb1b5">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>48.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox48">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-2830</cvename>
<cvename>CVE-2016-2835</cvename>
<cvename>CVE-2016-2836</cvename>
<cvename>CVE-2016-2837</cvename>
<cvename>CVE-2016-2838</cvename>
<cvename>CVE-2016-2839</cvename>
<cvename>CVE-2016-5250</cvename>
<cvename>CVE-2016-5251</cvename>
<cvename>CVE-2016-5252</cvename>
<cvename>CVE-2016-5253</cvename>
<cvename>CVE-2016-5254</cvename>
<cvename>CVE-2016-5255</cvename>
<cvename>CVE-2016-5258</cvename>
<cvename>CVE-2016-5259</cvename>
<cvename>CVE-2016-5260</cvename>
<cvename>CVE-2016-5261</cvename>
<cvename>CVE-2016-5262</cvename>
<cvename>CVE-2016-5263</cvename>
<cvename>CVE-2016-5264</cvename>
<cvename>CVE-2016-5265</cvename>
<cvename>CVE-2016-5266</cvename>
<cvename>CVE-2016-5267</cvename>
<cvename>CVE-2016-5268</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/</url>
</references>
<dates>
<discovery>2016-08-02</discovery>
<entry>2016-09-07</entry>
<modified>2016-09-20</modified>
</dates>
</vuln>
<vuln vid="5cb18881-7604-11e6-b362-001999f8d30b">
<topic>asterisk -- RTP Resource Exhaustion</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.23.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The overlap dialing feature in chan_sip allows chan_sip
to report to a device that the number that has been dialed
is incomplete and more digits are required. If this
functionality is used with a device that has performed
username/password authentication RTP resources are leaked.
This occurs because the code fails to release the old RTP
resources before allocating new ones in this scenario.
If all resources are used then RTP port exhaustion will
occur and no RTP sessions are able to be set up.</p>
<p>If overlap dialing support is not needed the "allowoverlap"
option can be set to no. This will stop any usage of the
scenario which causes the resource exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-007.html</url>
</references>
<dates>
<discovery>2016-08-05</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="7fda7920-7603-11e6-b362-001999f8d30b">
<topic>asterisk -- Crash on ACK from unknown endpoint</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.10.0</ge><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk can be crashed remotely by sending an ACK to
it from an endpoint username that Asterisk does not
recognize. Most SIP request types result in an "artificial"
endpoint being looked up, but ACKs bypass this lookup.
The resulting NULL pointer results in a crash when
attempting to determine if ACLs should be applied.</p>
<p>This issue was introduced in the Asterisk 13.10 release
and only affects that release.</p>
<p>This issue only affects users using the PJSIP stack
with Asterisk. Those users that use chan_sip are
unaffected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-006.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="70c85c93-743c-11e6-a590-14dae9d210b8">
<topic>inspircd -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>2.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam reports:</p>
<blockquote cite="http://www.inspircd.org/2016/09/03/v2023-released.html">
<p>A serious vulnerability exists in when using m_sasl in
combination with any services that support SASL EXTERNAL.
To be vulnerable you must have m_sasl loaded, and have services which
support SASL EXTERNAL authentication.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.inspircd.org/2016/09/03/v2023-released.html</url>
</references>
<dates>
<discovery>2016-09-03</discovery>
<entry>2016-09-06</entry>
</dates>
</vuln>
<vuln vid="9e50dcc3-740b-11e6-94a2-080027ef73ec">
<topic>mailman -- CSRF hardening in parts of the web interface</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The late Tokio Kikuchi reported:</p>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/775294">
<p>We may have to set lifetime for input forms because of recent
activities on cross-site request forgery (CSRF). The form lifetime
is successfully deployed in frameworks like web.py or plone etc.
Proposed branch lp:~tkikuchi/mailman/form-lifetime implement
lifetime in admin, admindb, options and edithtml interfaces.
[...]</p>
</blockquote>
<blockquote cite="https://launchpad.net/mailman/2.1/2.1.15">
<p>The web admin interface has been hardened against CSRF attacks by
adding a hidden, encrypted token with a time stamp to form submissions
and not accepting authentication by cookie if the token is missing,
invalid or older than the new mm_cfg.py setting FORM_LIFETIME which
defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/mailman/+bug/775294</url>
<url>https://launchpad.net/mailman/2.1/2.1.15</url>
<cvename>CVE-2016-7123</cvename>
</references>
<dates>
<discovery>2011-05-02</discovery>
<entry>2016-09-06</entry>
</dates>
</vuln>
<vuln vid="adccefd1-7080-11e6-a2cb-c80aa9043978">
<topic>openssh -- sshd -- remote valid user discovery and PAM /bin/login attack</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="http://www.openssh.com/txt/release-7.3">
<p>* sshd(8): Mitigate timing differences in password authentication
that could be used to discern valid from invalid account names
when long passwords were sent and particular password hashing
algorithms are in use on the server. CVE-2016-6210, reported by
EddieEzra.Harari at verint.com
</p>
<p> * sshd(8): (portable only) Ignore PAM environment vars when
UseLogin=yes. If PAM is configured to read user-specified
environment variables and UseLogin=yes in sshd_config, then a
hostile local user may attack /bin/login via LD_PRELOAD or
similar environment variables set via PAM. CVE-2015-8325,
found by Shayan Sadigh.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.3</url>
<cvename>CVE-2016-6210</cvename>
<cvename>CVE-2015-8325</cvename>
</references>
<dates>
<discovery>2016-08-01</discovery>
<entry>2016-09-01</entry>
</dates>
</vuln>
<vuln vid="b11ab01b-6e19-11e6-ab24-080027ef73ec">
<topic>mailman -- CSRF protection enhancements</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668">
<p>CSRF protection has been extended to the user options page. This
was actually fixed by Tokio Kikuchi as part of the fix for LP:
#775294 and intended for Mailman 2.1.15, but that fix wasn't
completely merged at the time. The full fix also addresses the
admindb, and edithtml pages as well as the user options page and the
previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668</url>
<url>https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html</url>
<cvename>CVE-2016-6893</cvename>
</references>
<dates>
<discovery>2016-08-19</discovery>
<entry>2016-08-29</entry>
</dates>
</vuln>
<vuln vid="e195679d-045b-4953-bb33-be0073ba2ac6">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Veillard reports:</p>
<blockquote cite="https://mail.gnome.org/archives/xml/2016-May/msg00023.html">
<p>More format string warnings with possible format string
vulnerability (David Kilzer)</p>
<p>Avoid building recursive entities (Daniel Veillard)</p>
<p>Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)</p>
<p>Heap-based buffer-underreads due to xmlParseName (David Kilzer)</p>
<p>Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)</p>
<p>Heap use-after-free in htmlParsePubidLiteral and
htmlParseSystemiteral (Pranjal Jumde)</p>
<p>Fix some format string warnings with possible format string
vulnerability (David Kilzer)</p>
<p>Detect change of encoding when parsing HTML names (Hugh Davenport)</p>
<p>Fix inappropriate fetch of entities content (Daniel Veillard)</p>
<p>Bug 759398: Heap use-after-free in xmlDictComputeFastKey
(Pranjal Jumde)</p>
<p>Bug 758605: Heap-based buffer overread in xmlDictAddString
(Pranjal Jumde)</p>
<p>Bug 758588: Heap-based buffer overread in
xmlParserPrintFileContextInternal (David Kilzer)</p>
<p>Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup
(Pranjal Jumde)</p>
<p>Add missing increments of recursion depth counter to XML parser.
(Peter Simons)</p>
<p>Fix NULL pointer deref in XPointer range-to</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/xml/2016-May/msg00023.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=759398</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758605</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758588</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=757711</url>
<url>https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb</url>
<cvename>CVE-2016-1762</cvename>
<cvename>CVE-2016-1833</cvename>
<cvename>CVE-2016-1834</cvename>
<cvename>CVE-2016-1835</cvename>
<cvename>CVE-2016-1836</cvename>
<cvename>CVE-2016-1837</cvename>
<cvename>CVE-2016-1838</cvename>
<cvename>CVE-2016-1839</cvename>
<cvename>CVE-2016-1840</cvename>
<cvename>CVE-2016-3627</cvename>
<cvename>CVE-2016-3705</cvename>
<cvename>CVE-2016-4449</cvename>
<cvename>CVE-2016-4483</cvename>
</references>
<dates>
<discovery>2016-05-23</discovery>
<entry>2016-08-28</entry>
</dates>
</vuln>
<vuln vid="4472ab39-6c66-11e6-9ca5-50e549ebab6c">
<topic>kdelibs -- directory traversal vulnerability</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.10_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Faure reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20160724-1.txt">
<p>A maliciously crafted archive (.zip or .tar.bz2) with "../" in the
file paths could be offered for download via the KNewStuff
framework (e.g. on www.kde-look.org), and upon extraction would
install files anywhere in the user's home directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6232</cvename>
<url>https://www.kde.org/info/security/advisory-20160724-1.txt</url>
</references>
<dates>
<discovery>2016-07-24</discovery>
<entry>2016-08-27</entry>
</dates>
</vuln>
<vuln vid="f5035ead-688b-11e6-8b1d-c86000169601">
<topic>eog -- out-of-bounds write</topic>
<affects>
<package>
<name>eog</name>
<range><lt>3.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Felix Riemann reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html">
<p>CVE-2016-6855 out-of-bounds write in eog 3.10.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html</url>
<cvename>CVE-2016-6855</cvename>
</references>
<dates>
<discovery>2016-08-21</discovery>
<entry>2016-08-22</entry>
</dates>
</vuln>
<vuln vid="44989c29-67d1-11e6-8b1d-c86000169601">
<topic>fontconfig -- insufficiently cache file validation</topic>
<affects>
<package>
<name>fontconfig</name>
<range><lt>1.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian security team reports:</p>
<blockquote cite="https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html">
<p>Tobias Stoeckmann discovered that cache files are insufficiently
validated in fontconfig, a generic font configuration library. An
attacker can trigger arbitrary free() calls, which in turn allows
double free attacks and therefore arbitrary code execution. In
combination with setuid binaries using crafted cache files, this
could allow privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html</url>
<cvename>CVE-2016-5384</cvename>
</references>
<dates>
<discovery>2016-08-05</discovery>
<entry>2016-08-21</entry>
</dates>
</vuln>
<vuln vid="7fe7df75-6568-11e6-a590-14dae9d210b8">
<topic>End of Life Ports</topic>
<affects>
<package>
<name>python32</name>
<name>python31</name>
<name>python30</name>
<name>python26</name>
<name>python25</name>
<name>python24</name>
<name>python23</name>
<name>python22</name>
<name>python21</name>
<name>python20</name>
<name>python15</name>
<range><ge>0</ge></range>
</package>
<package>
<name>php54</name>
<name>php53</name>
<name>php52</name>
<name>php5</name>
<name>php4</name>
<range><ge>0</ge></range>
</package>
<package>
<name>perl5</name>
<range><lt>5.18</lt></range>
</package>
<package>
<name>perl5.16</name>
<name>perl5.14</name>
<name>perl5.12</name>
<name>perl</name> <!-- Perl 5.10 and earlier were called "perl" -->
<range><ge>0</ge></range>
</package>
<package>
<name>ruby</name>
<name>ruby_static</name>
<range><lt>2.1,1</lt></range>
</package>
<package>
<name>unifi2</name>
<name>unifi3</name>
<range><ge>0</ge></range>
</package>
<package>
<name>apache21</name>
<name>apache20</name>
<name>apache13</name>
<range><ge>0</ge></range>
</package>
<package>
<name>tomcat55</name>
<name>tomcat41</name>
<range><ge>0</ge></range>
</package>
<package>
<name>mysql51-client</name>
<name>mysql51-server</name>
<name>mysql50-client</name>
<name>mysql50-server</name>
<name>mysql41-client</name>
<name>mysql41-server</name>
<name>mysql40-client</name>
<name>mysql40-server</name>
<range><ge>0</ge></range>
</package>
<package>
<name>postgresql90-client</name>
<name>postgresql90-server</name>
<name>postgresql84-client</name>
<name>postgresql84-server</name>
<name>postgresql83-client</name>
<name>postgresql83-server</name>
<name>postgresql82-client</name>
<name>postgresql82-server</name>
<name>postgresql81-client</name>
<name>postgresql81-server</name>
<name>postgresql80-client</name>
<name>postgresql80-server</name>
<name>postgresql74-client</name>
<name>postgresql74-server</name>
<name>postgresql73-client</name>
<name>postgresql73-server</name>
<name>postgresql72-client</name>
<name>postgresql72-server</name>
<name>postgresql71-client</name>
<name>postgresql71-server</name>
<name>postgresql7-client</name>
<name>postgresql7-server</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>These packages have reached End of Life status and/or have
been removed from the Ports Tree. They may contain undocumented
security issues. Please take caution and find alternative
software as soon as possible.</p>
</body>
</description>
<references>
<freebsdpr>ports/211975</freebsdpr>
</references>
<dates>
<discovery>2016-08-18</discovery>
<entry>2016-08-18</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="e1c71d8d-64d9-11e6-b38a-25a46b33f2ed">
<topic>gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output</topic>
<affects>
<package>
<name>gnupg1</name>
<range><lt>1.4.21</lt></range>
</package>
<package>
<name>libgcrypt</name>
<range><lt>1.7.3</lt></range>
</package>
<package>
<name>linux-c6-libgcrypt</name>
<range><lt>1.4.5_4</lt></range>
</package>
<package>
<name>linux-c7-libgcrypt</name>
<range><lt>1.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html">
<p>There was a bug in the mixing functions of Libgcrypt's random
number generator: An attacker who obtains 4640 bits from the RNG can
trivially predict the next 160 bits of output. This bug exists since
1998 in all GnuPG and Libgcrypt versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html</url>
<cvename>CVE-2016-6313</cvename>
</references>
<dates>
<discovery>2016-08-17</discovery>
<entry>2016-08-18</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="ef70b201-645d-11e6-9cdc-6805ca0b3d42">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpmyadmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-29/">
<p>Weakness with cookie encryption</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-30/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-31/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-32/">
<p>PHP code injection</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-33/">
<p>Full path disclosure</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-34/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-35/">
<p>Local file exposure</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-36/">
<p>Local file exposure through symlinks with
UploadDir</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-37/">
<p>Path traversal with SaveDir and UploadDir</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-38/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-39/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-40/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-41/">
<p>Denial of service (DOS) attack in transformation
feature</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-42/">
<p>SQL injection attack as control user</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-43/">
<p>Unvalidated data passed to unserialize()</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-45/">
<p>DOS attack with forced persistent connections</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-46/">
<p>Denial of service (DOS) attack by for loops</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-47/">
<p>IPv6 and proxy server IP-based authentication rule
circumvention</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-48/">
<p>Detect if user is logged in</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-49/">
<p>Bypass URL redirect protection</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-50/">
<p>Referrer leak in url.php</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-51/">
<p>Reflected File Download attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-52/">
<p>ArbitraryServerRegexp bypass</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-53/">
<p>Denial of service (DOS) attack by changing password to a
very long string</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-54/">
<p>Remote code execution vulnerability when run as CGI</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-55/">
<h3>Summary</h3>
<p>Denial of service (DOS) attack with dbase extension</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-56/">
<p>Remote code execution vulnerability when PHP is running
with dbase extension</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-29/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-30/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-31/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-32/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-33/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-34/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-35/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-36/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-37/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-38/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-39/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-40/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-41/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-42/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-43/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-45/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-46/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-47/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-48/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-49/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-50/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-51/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-52/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-53/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-54/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-55/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-56/</url>
<cvename>CVE-2016-6606</cvename>
<cvename>CVE-2016-6607</cvename>
<cvename>CVE-2016-6608</cvename>
<cvename>CVE-2016-6609</cvename>
<cvename>CVE-2016-6610</cvename>
<cvename>CVE-2016-6611</cvename>
<cvename>CVE-2016-6612</cvename>
<cvename>CVE-2016-6613</cvename>
<cvename>CVE-2016-6614</cvename>
<cvename>CVE-2016-6615</cvename>
<cvename>CVE-2016-6616</cvename>
<cvename>CVE-2016-6617</cvename>
<cvename>CVE-2016-6618</cvename>
<cvename>CVE-2016-6619</cvename>
<cvename>CVE-2016-6620</cvename>
<cvename>CVE-2016-6622</cvename>
<cvename>CVE-2016-6623</cvename>
<cvename>CVE-2016-6624</cvename>
<cvename>CVE-2016-6625</cvename>
<cvename>CVE-2016-6626</cvename>
<cvename>CVE-2016-6627</cvename>
<cvename>CVE-2016-6628</cvename>
<cvename>CVE-2016-6629</cvename>
<cvename>CVE-2016-6630</cvename>
<cvename>CVE-2016-6631</cvename>
<cvename>CVE-2016-6632</cvename>
<cvename>CVE-2016-6633</cvename>
</references>
<dates>
<discovery>2016-08-17</discovery>
<entry>2016-08-17</entry>
</dates>
</vuln>
<vuln vid="f7dd2d09-625e-11e6-828b-fcaa14edc6a6">
<topic>TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution</topic>
<affects>
<package>
<name>teamspeak3-server</name>
<range><le>3.0.13_1,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanz Jenson audit report:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2016/Aug/61">
<p>I found 10 vulnerabilities. Some of these are critical and allow remote code
execution. For the average user, that means that these vulnerabilities can be
exploited by a malicious attacker in order to take over any Teamspeak server,
not only becoming serveradmin, but getting a shell on the affected machine.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/fulldisclosure/2016/Aug/61</url>
</references>
<dates>
<discovery>2016-08-12</discovery>
<entry>2016-08-14</entry>
</dates>
</vuln>
<vuln vid="df502a2f-61f6-11e6-a461-643150d3111d">
<topic>puppet-agent MCollective plugin -- Remote Code Execution vulnerability</topic>
<affects>
<package>
<name>mcollective-puppet-agent</name>
<range><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet reports:</p>
<blockquote cite="https://puppet.com/security/cve/cve-2015-7331">
<p>Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the `--server` argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE 2016.2.1, this option is disabled by default.</p>
</blockquote>
</body>
</description>
<references>
<url>https://puppet.com/security/cve/cve-2015-7331</url>
<cvename>CVE-2015-7331</cvename>
</references>
<dates>
<discovery>2016-08-09</discovery>
<entry>2016-08-15</entry>
</dates>
</vuln>
<vuln vid="7d4f4955-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Heap vulnerability in bspatch</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_6</lt></range>
<range><ge>10.2</ge><lt>10.2_20</lt></range>
<range><ge>10.1</ge><lt>10.1_37</lt></range>
<range><ge>9.3</ge><lt>9.3_45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of bspatch does not check for a
negative value on numbers of bytes read from the diff and
extra streams, allowing an attacker who can control the
patch file to write at arbitrary locations in the heap.</p>
<p>This issue was first discovered by The Chromium Project
and reported independently by Lu Tung-Pin to the FreeBSD
project.</p>
<h1>Impact:</h1>
<p>An attacker who can control the patch file can cause a
crash or run arbitrary code under the credentials of the
user who runs bspatch, in many cases, root.</p>
</body>
</description>
<references>
<cvename>CVE-2014-9862</cvename>
<freebsdsa>SA-16:25.bspatch</freebsdsa>
</references>
<dates>
<discovery>2016-07-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7cfcea05-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple ntp vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_5</lt></range>
<range><ge>10.2</ge><lt>10.2_19</lt></range>
<range><ge>10.1</ge><lt>10.1_36</lt></range>
<range><ge>9.3</ge><lt>9.3_44</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple vulnerabilities have been discovered in the NTP
suite:</p>
<p>The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that
could cause ntpd to crash. [CVE-2016-4957, Reported by
Nicolas Edet of Cisco]</p>
<p>An attacker who knows the origin timestamp and can send
a spoofed packet containing a CRYPTO-NAK to an ephemeral
peer target before any other response is sent can demobilize
that association. [CVE-2016-4953, Reported by Miroslav
Lichvar of Red Hat]</p>
<p>An attacker who is able to spoof packets with correct
origin timestamps from enough servers before the expected
response packets arrive at the target machine can affect
some peer variables and, for example, cause a false leap
indication to be set. [CVE-2016-4954, Reported by Jakub
Prokes of Red Hat]</p>
<p>An attacker who is able to spoof a packet with a correct
origin timestamp before the expected response packet arrives
at the target machine can send a CRYPTO_NAK or a bad MAC
and cause the association's peer variables to be cleared.
If this can be done often enough, it will prevent that
association from working. [CVE-2016-4955, Reported by
Miroslav Lichvar of Red Hat]</p>
<p>The fix for NtpBug2978 does not cover broadcast associations,
so broadcast clients can be triggered to flip into interleave
mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red
Hat.]</p>
<h1>Impact:</h1>
<p>Malicious remote attackers may be able to break time
synchronization, or cause the ntpd(8) daemon to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2016-4953</cvename>
<cvename>CVE-2016-4954</cvename>
<cvename>CVE-2016-4955</cvename>
<cvename>CVE-2016-4956</cvename>
<cvename>CVE-2016-4957</cvename>
<freebsdsa>SA-16:24.ntp</freebsdsa>
</references>
<dates>
<discovery>2016-06-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7cad4795-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of historic stat(2) system call does
not clear the output struct before copying it out to
userland.</p>
<h1>Impact:</h1>
<p>An unprivileged user can read a portion of uninitialised
kernel stack data, which may contain sensitive information,
such as the stack guard, portions of the file cache or
terminal buffers, which an attacker might leverage to obtain
elevated privileges.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:21.43bsd</freebsdsa>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7c5d64dd-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in Linux compatibility layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of the TIOCGSERIAL ioctl(2) does not
clear the output struct before copying it out to userland.</p>
<p>The implementation of the Linux sysinfo() system call
does not clear the output struct before copying it out to
userland.</p>
<h1>Impact:</h1>
<p>An unprivileged user can read a portion of uninitialised
kernel stack data, which may contain sensitive information,
such as the stack guard, portions of the file cache or
terminal buffers, which an attacker might leverage to obtain
elevated privileges.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:20.linux</freebsdsa>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7c0bac69-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect argument handling in sendmsg(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_3</lt></range>
<range><ge>10.2</ge><lt>10.2_17</lt></range>
<range><ge>10.1</ge><lt>10.1_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incorrect argument handling in the socket code allows
malicious local user to overwrite large portion of the
kernel memory.</p>
<h1>Impact:</h1>
<p>Malicious local user may crash kernel or execute arbitrary
code in the kernel, potentially gaining superuser privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1887</cvename>
<freebsdsa>SA-16:19.sendmsg</freebsdsa>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7bbc0e8c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Buffer overflow in keyboard driver</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_3</lt></range>
<range><ge>10.2</ge><lt>10.2_17</lt></range>
<range><ge>10.1</ge><lt>10.1_34</lt></range>
<range><ge>9.3</ge><lt>9.3_42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incorrect signedness comparison in the ioctl(2) handler
allows a malicious local user to overwrite a portion of the
kernel memory.</p>
<h1>Impact:</h1>
<p>A local user may crash the kernel, read a portion of
kernel memory and execute arbitrary code in kernel context.
The result of executing an arbitrary kernel code is privilege
escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1886</cvename>
<freebsdsa>SA-16:18.atkbd</freebsdsa>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7b6a11b5-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect argument validation in sysarch(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_2</lt></range>
<range><ge>10.3</ge><lt>10.3_11</lt></range>
<range><ge>10.2</ge><lt>10.2_24</lt></range>
<range><ge>10.1</ge><lt>10.1_41</lt></range>
<range><ge>9.3</ge><lt>9.3_49</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A special combination of sysarch(2) arguments, specify
a request to uninstall a set of descriptors from the LDT.
The start descriptor is cleared and the number of descriptors
are provided. Due to lack of sufficient bounds checking
during argument validity verification, unbound zero'ing of
the process LDT and adjacent memory can be initiated from
usermode.</p>
<h1>Impact:</h1>
<p>This vulnerability could cause the kernel to panic. In
addition it is possible to perform a local Denial of Service
against the system by unprivileged processes.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1885</cvename>
<freebsdsa>SA-16:15.sysarch</freebsdsa>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-08-11</entry>
<modified>2016-10-25</modified>
</dates>
</vuln>
<vuln vid="7b1a4a27-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple OpenSSL vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_13</lt></range>
<range><ge>10.1</ge><lt>10.1_30</lt></range>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A cross-protocol attack was discovered that could lead
to decryption of TLS sessions by using a server supporting
SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA
padding oracle. Note that traffic between clients and
non-vulnerable servers can be decrypted provided another
server supporting SSLv2 and EXPORT ciphers (even with a
different protocol such as SMTP, IMAP or POP3) shares the
RSA keys of the non-vulnerable server. This vulnerability
is known as DROWN. [CVE-2016-0800]</p>
<p>A double free bug was discovered when OpenSSL parses
malformed DSA private keys and could lead to a DoS attack
or memory corruption for applications that receive DSA
private keys from untrusted sources. This scenario is
considered rare. [CVE-2016-0705]</p>
<p>The SRP user database lookup method SRP_VBASE_get_by_user
had confusing memory management semantics; the returned
pointer was sometimes newly allocated, and sometimes owned
by the callee. The calling code has no way of distinguishing
these two cases. [CVE-2016-0798]</p>
<p>In the BN_hex2bn function, the number of hex digits is
calculated using an int value |i|. Later |bn_expand| is
called with a value of |i * 4|. For large values of |i|
this can result in |bn_expand| not allocating any memory
because |i * 4| is negative. This can leave the internal
BIGNUM data field as NULL leading to a subsequent NULL
pointer dereference. For very large values of |i|, the
calculation |i * 4| could be a positive value smaller than
|i|. In this case memory is allocated to the internal BIGNUM
data field, but it is insufficiently sized leading to heap
corruption. A similar issue exists in BN_dec2bn. This could
have security consequences if BN_hex2bn/BN_dec2bn is ever
called by user applications with very large untrusted hex/dec
data. This is anticipated to be a rare occurrence.
[CVE-2016-0797]</p>
<p>The internal |fmtstr| function used in processing a "%s"
formatted string in the BIO_*printf functions could overflow
while calculating the length of a string and cause an
out-of-bounds read when printing very long strings.
[CVE-2016-0799]</p>
<p>A side-channel attack was found which makes use of
cache-bank conflicts on the Intel Sandy-Bridge microarchitecture
which could lead to the recovery of RSA keys. [CVE-2016-0702]</p>
<p>s2_srvr.c did not enforce that clear-key-length is 0 for
non-export ciphers. If clear-key bytes are present for these
ciphers, they displace encrypted-key bytes. [CVE-2016-0703]</p>
<p>s2_srvr.c overwrites the wrong bytes in the master key
when applying Bleichenbacher protection for export cipher
suites. [CVE-2016-0704]</p>
<h1>Impact:</h1>
<p>Servers that have SSLv2 protocol enabled are vulnerable
to the "DROWN" attack which allows a remote attacker to
fast attack many recorded TLS connections made to the server,
even when the client did not make any SSLv2 connections
themselves.</p>
<p>An attacker who can supply malformed DSA private keys
to OpenSSL applications may be able to cause memory corruption
which would lead to a Denial of Service condition.
[CVE-2016-0705]</p>
<p>An attacker connecting with an invalid username can cause
memory leak, which could eventually lead to a Denial of
Service condition. [CVE-2016-0798]</p>
<p>An attacker who can inject malformed data into an
application may be able to cause memory corruption which
would lead to a Denial of Service condition. [CVE-2016-0797,
CVE-2016-0799]</p>
<p>A local attacker who has control of code in a thread
running on the same hyper-threaded core as the victim thread
which is performing decryptions could recover RSA keys.
[CVE-2016-0702]</p>
<p>An eavesdropper who can intercept SSLv2 handshake can
conduct an efficient divide-and-conquer key recovery attack
and use the server as an oracle to determine the SSLv2
master-key, using only 16 connections to the server and
negligible computation. [CVE-2016-0703]</p>
<p>An attacker can use the Bleichenbacher oracle, which
enables more efficient variant of the DROWN attack.
[CVE-2016-0704]</p>
</body>
</description>
<references>
<cvename>CVE-2016-0702</cvename>
<cvename>CVE-2016-0703</cvename>
<cvename>CVE-2016-0704</cvename>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0797</cvename>
<cvename>CVE-2016-0798</cvename>
<cvename>CVE-2016-0799</cvename>
<cvename>CVE-2016-0800</cvename>
<freebsdsa>SA-16:12.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7ac28df1-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer issetugid(2) system call</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_11</lt></range>
<range><ge>10.1</ge><lt>10.1_28</lt></range>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the Linux compatibility layer
could cause the issetugid(2) system call to return incorrect
information.</p>
<h1>Impact:</h1>
<p>If an application relies on output of the issetugid(2)
system call and that information is incorrect, this could
lead to a privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1883</cvename>
<freebsdsa>SA-16:10.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7a31dfba-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Insecure default snmpd.config permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SNMP protocol supports an authentication model called
USM, which relies on a shared secret. The default permission
of the snmpd configuration file, /etc/snmpd.config, is
weak and does not provide adequate protection against local
unprivileged users.</p>
<h1>Impact:</h1>
<p>A local user may be able to read the shared secret, if
configured and used by the system administrator.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5677</cvename>
<freebsdsa>SA-16:06.bsnmpd</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="79dfc135-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- TCP MD5 signature denial of service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in processing a TCP connection with
both TCP_MD5SIG and TCP_NOOPT socket options may lead to
kernel crash.</p>
<h1>Impact:</h1>
<p>A local attacker can crash the kernel, resulting in a
denial-of-service.</p>
<p>A remote attack is theoretically possible, if server has
a listening socket with TCP_NOOPT set, and server is either
out of SYN cache entries, or SYN cache is disabled by
configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1882</cvename>
<freebsdsa>SA-16:05.tcp</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="798f63e0-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer setgroups(2) system call</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the Linux compatibility layer
setgroups(2) system call can lead to an unexpected results,
such as overwriting random kernel memory contents.</p>
<h1>Impact:</h1>
<p>It is possible for a local attacker to overwrite portions
of kernel memory, which may result in a privilege escalation
or cause a system panic.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1881</cvename>
<freebsdsa>SA-16:04.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="793fb19c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer incorrect futex handling</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the handling of Linux futex robust
lists may result in incorrect memory locations being
accessed.</p>
<h1>Impact:</h1>
<p>It is possible for a local attacker to read portions of
kernel memory, which may result in a privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1880</cvename>
<freebsdsa>SA-16:03.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="78f06a6c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP ICMPv6 error message vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A lack of proper input checks in the ICMPv6 processing
in the SCTP stack can lead to either a failed kernel assertion
or to a NULL pointer dereference. In either case, a kernel
panic will follow.</p>
<h1>Impact:</h1>
<p>A remote, unauthenticated attacker can reliably trigger
a kernel panic in a vulnerable system running IPv6. Any
kernel compiled with both IPv6 and SCTP support is vulnerable.
There is no requirement to have an SCTP socket open.</p>
<p>IPv4 ICMP processing is not impacted by this vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1879</cvename>
<freebsdsa>SA-16:01.sctp</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0e5d6969-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- rpcbind(8) remote denial of service [REVISED]</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_5</lt></range>
<range><ge>10.1</ge><lt>10.1_22</lt></range>
<range><ge>9.3</ge><lt>9.3_28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In rpcbind(8), netbuf structures are copied directly,
which would result in two netbuf structures that reference
to one shared address buffer. When one of the two netbuf
structures is freed, access to the other netbuf structure
would result in an undefined result that may crash the
rpcbind(8) daemon.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send specifically crafted
packets to the rpcbind(8) daemon can cause it to crash,
resulting in a denial of service condition.</p>
</body>
</description>
<references>
<cvename>CVE-2015-7236</cvename>
<freebsdsa>SA-15:24.rpcbind</freebsdsa>
</references>
<dates>
<discovery>2015-09-29</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0dfa5dde-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Local privilege escalation in IRET handler</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_19</lt></range>
<range><ge>9.3</ge><lt>9.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If the kernel-mode IRET instruction generates an #SS or
#NP exception, but the exception handler does not properly
ensure that the right GS register base for kernel is reloaded,
the userland GS segment may be used in the context of the
kernel exception handler.</p>
<h1>Impact:</h1>
<p>By causing an IRET with #SS or #NP exceptions, a local
attacker can cause the kernel to use an arbitrary GS base,
which may allow escalated privileges or panic the system.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5675</cvename>
<freebsdsa>SA-15:21.amd64</freebsdsa>
</references>
<dates>
<discovery>2015-08-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0da8a68e-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_18</lt></range>
<range><ge>10.2</ge><lt>10.2_1</lt></range>
<range><ge>9.3</ge><lt>9.3_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple integer overflows have been discovered in the
XML_GetBuffer() function in the expat library.</p>
<h1>Impact:</h1>
<p>The integer overflows may be exploited by using specifically
crafted XML data and lead to infinite loop, or a heap buffer
overflow, which results in a Denial of Service condition,
or enables remote attackers to execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1283</cvename>
<freebsdsa>SA-15:20.expat</freebsdsa>
</references>
<dates>
<discovery>2015-08-18</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0d584493-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_17</lt></range>
<range><ge>9.3</ge><lt>9.3_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input path in routed(8) will accept queries from any
source and attempt to answer them. However, the output path
assumes that the destination address for the response is
on a directly connected network.</p>
<h1>Impact:</h1>
<p>Upon receipt of a query from a source which is not on a
directly connected network, routed(8) will trigger an
assertion and terminate. The affected system's routing table
will no longer be updated. If the affected system is a
router, its routes will eventually expire from other routers'
routing tables, and its networks will no longer be reachable
unless they are also connected to another router.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5674</cvename>
<freebsdsa>SA-15:19.routed</freebsdsa>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0d090952-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient sanitization of the input patch
stream, it is possible for a patch file to cause patch(1)
to pass certain ed(1) scripts to the ed(1) editor, which
would run commands.</p>
<h1>Impact:</h1>
<p>This issue could be exploited to execute arbitrary
commands as the user invoking patch(1) against a specially
crafted patch file, which could be leveraged to obtain
elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1418</cvename>
<freebsdsa>SA-15:18.bsdpatch</freebsdsa>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0cb9d5bb-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
<range><ge>9.3</ge><lt>9.3_21</lt></range>
<range><ge>8.4</ge><lt>8.4_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a mistake with the introduction of VNET, which
converted the global limit on the number of segments that
could belong to reassembly queues into a per-VNET limit.
Because mbufs are allocated from a global pool, in the
presence of a sufficient number of VNETs, the total number
of mbufs attached to reassembly queues can grow to the total
number of mbufs in the system, at which point all network
traffic would cease.</p>
<h1>Impact:</h1>
<p>An attacker who can establish concurrent TCP connections
across a sufficient number of VNETs and manipulate the
inbound packet streams such that the maximum number of mbufs
are enqueued on each reassembly queue can cause mbuf cluster
exhaustion on the target system, resulting in a Denial of
Service condition.</p>
<p>As the default per-VNET limit on the number of segments
that can belong to reassembly queues is 1/16 of the total
number of mbuf clusters in the system, only systems that
have 16 or more VNET instances are vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1417</cvename>
<freebsdsa>SA-15:15.tcp</freebsdsa>
</references>
<dates>
<discovery>2015-07-28</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0c6759dd-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient sanitization of the input patch
stream, it is possible for a patch file to cause patch(1)
to run commands in addition to the desired SCCS or RCS
commands.</p>
<h1>Impact:</h1>
<p>This issue could be exploited to execute arbitrary
commands as the user invoking patch(1) against a specially
crafted patch file, which could be leveraged to obtain
elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1416</cvename>
<freebsdsa>SA-15:14.bsdpatch</freebsdsa>
</references>
<dates>
<discovery>2015-07-28</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0c064c43-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_15</lt></range>
<range><ge>9.3</ge><lt>9.3_20</lt></range>
<range><ge>8.4</ge><lt>8.4_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>TCP connections transitioning to the LAST_ACK state can
become permanently stuck due to mishandling of protocol
state in certain situations, which in turn can lead to
accumulated consumption and eventual exhaustion of system
resources, such as mbufs and sockets.</p>
<h1>Impact:</h1>
<p>An attacker who can repeatedly establish TCP connections
to a victim system (for instance, a Web server) could create
many TCP connections that are stuck in LAST_ACK state and
cause resource exhaustion, resulting in a denial of service
condition. This may also happen in normal operation where
no intentional attack is conducted, but an attacker who can
send specifically crafted packets can trigger this more
reliably.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5358</cvename>
<freebsdsa>SA-15:13.tcp</freebsdsa>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0bb55a18-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of Service with IPv6 Router Advertisements</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The Neighbor Discover Protocol allows a local router to
advertise a suggested Current Hop Limit value of a link,
which will replace Current Hop Limit on an interface connected
to the link on the FreeBSD system.</p>
<h1>Impact:</h1>
<p>When the Current Hop Limit (similar to IPv4's TTL) is
small, IPv6 packets may get dropped before they reached
their destinations.</p>
<p>By sending specifically crafted Router Advertisement
packets, an attacker on the local network can cause the
FreeBSD system to lose the ability to communicate with
another IPv6 node on a different network.</p>
</body>
</description>
<references>
<cvename>CVE-2015-2923</cvename>
<freebsdsa>SA-15:09.ipv6</freebsdsa>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0b65f297-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Insecure default GELI keyfile permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The default permission set by bsdinstall(8) installer
when configuring full disk encrypted ZFS is too open.</p>
<h1>Impact:</h1>
<p>A local attacker may be able to get a copy of the geli(8)
provider's keyfile which is located at a fixed location.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1415</cvename>
<freebsdsa>SA-15:08.bsdinstall</freebsdsa>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0afe8b29-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Integer overflow in IGMP protocol</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An integer overflow in computing the size of IGMPv3 data
buffer can result in a buffer which is too small for the
requested operation.</p>
<h1>Impact:</h1>
<p>An attacker who can send specifically crafted IGMP packets
could cause a denial of service situation by causing the
kernel to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1414</cvename>
<freebsdsa>SA-15:04.igmp</freebsdsa>
</references>
<dates>
<discovery>2015-02-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0aad3ce5-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP stream reset vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_5</lt></range>
<range><ge>10.0</ge><lt>10.0_17</lt></range>
<range><ge>9.3</ge><lt>9.3_9</lt></range>
<range><ge>8.4</ge><lt>8.4_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input validation of received SCTP RE_CONFIG chunks
is insufficient, and can result in a NULL pointer deference
later.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send a malformed SCTP packet
to a FreeBSD system that serves SCTP can cause a kernel
panic, resulting in a Denial of Service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8613</cvename>
<freebsdsa>SA-15:03.sctp</freebsdsa>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0a5cf6d8-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_5</lt></range>
<range><ge>10.0</ge><lt>10.0_17</lt></range>
<range><ge>9.3</ge><lt>9.3_9</lt></range>
<range><ge>8.4</ge><lt>8.4_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient validation of the SCTP stream ID,
which serves as an array index, a local unprivileged attacker
can read or write 16-bits of kernel memory.</p>
<h1>Impact:</h1>
<p>An unprivileged process can read or modify 16-bits of
memory which belongs to the kernel. This may lead to
exposure of sensitive information or allow privilege
escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8612</cvename>
<freebsdsa>SA-15:02.kmem</freebsdsa>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="74ded00e-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Buffer overflow in stdio</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the standard I/O library's
__sflush() function could erroneously adjust the buffered
stream's internal state even when no write actually occurred
in the case when write(2) system call returns an error.</p>
<h1>Impact:</h1>
<p>The accounting mismatch would accumulate, if the caller
does not check for stream status and will eventually lead
to a heap buffer overflow.</p>
<p>Such overflows may lead to data corruption or the execution
of arbitrary code at the privilege level of the calling
program.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8611</cvename>
<freebsdsa>SA-14:27.stdio</freebsdsa>
</references>
<dates>
<discovery>2014-12-10</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7488378d-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Remote command execution in ftp(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.3</ge><lt>9.3_5</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
<range><ge>8.4</ge><lt>8.4_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A malicious HTTP server could cause ftp(1) to execute
arbitrary commands.</p>
<h1>Impact:</h1>
<p>When operating on HTTP URIs, the ftp(1) client follows
HTTP redirects, and uses the part of the path after the
last '/' from the last resource it accesses as the output
filename if '-o' is not specified.</p>
<p>If the output file name provided by the server begins
with a pipe ('|'), the output is passed to popen(3), which
might be used to execute arbitrary commands on the ftp(1)
client machine.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8517</cvename>
<freebsdsa>SA-14:26.ftp</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="74389f22-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.3</ge><lt>9.3_5</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
<range><ge>8.4</ge><lt>8.4_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When setlogin(2) is called while setting up a new login
session, the login name is copied into an uninitialized
stack buffer, which is then copied into a buffer of the
same size in the session structure. The getlogin(2) system
call returns the entire buffer rather than just the portion
occupied by the login name associated with the session.</p>
<h1>Impact:</h1>
<p>An unprivileged user can access this memory by calling
getlogin(2) and reading beyond the terminating NUL character
of the resulting string. Up to 16 (FreeBSD 8) or 32 (FreeBSD
9 and 10) bytes of kernel memory may be leaked in this
manner for each invocation of setlogin(2).</p>
<p>This memory may contain sensitive information, such as
portions of the file cache or terminal buffers, which an
attacker might leverage to obtain elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8476</cvename>
<freebsdsa>SA-14:25.setlogin</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="73e9a137-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of service attack against sshd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Although OpenSSH is not multithreaded, when OpenSSH is
compiled with Kerberos support, the Heimdal libraries bring
in the POSIX thread library as a dependency. Due to incorrect
library ordering while linking sshd(8), symbols in the C
library which are shadowed by the POSIX thread library may
not be resolved correctly at run time.</p>
<p>Note that this problem is specific to the FreeBSD build
system and does not affect other operating systems or the
version of OpenSSH available from the FreeBSD ports tree.</p>
<h1>Impact:</h1>
<p>An incorrectly linked sshd(8) child process may deadlock
while handling an incoming connection. The connection may
then time out or be interrupted by the client, leaving the
deadlocked sshd(8) child process behind. Eventually, the
sshd(8) parent process stops accepting new connections.</p>
<p>An attacker may take advantage of this by repeatedly
connecting and then dropping the connection after having
begun, but not completed, the authentication process.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8475</cvename>
<freebsdsa>SA-14:24.sshd</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="73964eac-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- memory leak in sandboxed namei lookup</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The namei facility will leak a small amount of kernel
memory every time a sandboxed process looks up a nonexistent
path name.</p>
<h1>Impact:</h1>
<p>A remote attacker that can cause a sandboxed process
(for instance, a web server) to look up a large number of
nonexistent path names can cause memory exhaustion.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3711</cvename>
<freebsdsa>SA-14:22.namei</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="734233f4-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
<range><ge>8.4</ge><lt>8.4_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input path in routed(8) will accept queries from any
source and attempt to answer them. However, the output path
assumes that the destination address for the response is
on a directly connected network.</p>
<h1>Impact:</h1>
<p>Upon receipt of a query from a source which is not on a
directly connected network, routed(8) will trigger an
assertion and terminate. The affected system's routing table
will no longer be updated. If the affected system is a
router, its routes will eventually expire from other routers'
routing tables, and its networks will no longer be reachable
unless they are also connected to another router.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3955</cvename>
<freebsdsa>SA-14:21.routed</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="72ee7111-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- rtsold(8) remote buffer overflow vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a missing length check in the code that handles
DNS parameters, a malformed router advertisement message
can result in a stack buffer overflow in rtsold(8).</p>
<h1>Impact:</h1>
<p>Receipt of a router advertisement message with a malformed
DNSSL option, for instance from a compromised host on the
same network, can cause rtsold(8) to crash.</p>
<p>While it is theoretically possible to inject code into
rtsold(8) through malformed router advertisement messages,
it is normally compiled with stack protection enabled,
rendering such an attack extremely difficult.</p>
<p>When rtsold(8) crashes, the existing DNS configuration
will remain in force, and the kernel will continue to receive
and process periodic router advertisements.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3954</cvename>
<freebsdsa>SA-14:20.rtsold</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="729c4a9f-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of Service in TCP packet processing</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_9</lt></range>
<range><ge>9.3</ge><lt>9.3_2</lt></range>
<range><ge>9.2</ge><lt>9.2_12</lt></range>
<range><ge>9.1</ge><lt>9.1_19</lt></range>
<range><ge>8.4</ge><lt>8.4_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When a segment with the SYN flag for an already existing
connection arrives, the TCP stack tears down the connection,
bypassing a check that the sequence number in the segment
is in the expected window.</p>
<h1>Impact:</h1>
<p>An attacker who has the ability to spoof IP traffic can
tear down a TCP connection by sending only 2 packets, if
they know both TCP port numbers. In case one of the two
port numbers is unknown, a successful attack requires less
than 2**17 packets spoofed, which can be generated within
less than a second on a decent connection to the Internet.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0230</cvename>
<freebsdsa>SA-14:19.tcp</freebsdsa>
</references>
<dates>
<discovery>2014-09-16</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7240de58-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel memory disclosure in control messages and SCTP</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_7</lt></range>
<range><ge>9.2</ge><lt>9.2_10</lt></range>
<range><ge>9.1</ge><lt>9.1_17</lt></range>
<range><ge>8.4</ge><lt>8.4_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Buffer between control message header and data may not
be completely initialized before being copied to userland.
[CVE-2014-3952]</p>
<p>Three SCTP cmsgs, SCTP_SNDRCV, SCTP_EXTRCV and SCTP_RCVINFO,
have implicit padding that may not be completely initialized
before being copied to userland. In addition, three SCTP
notifications, SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR and
SCTP_AUTHENTICATION_EVENT, have padding in the returning
data structure that may not be completely initialized before
being copied to userland. [CVE-2014-3953]</p>
<h1>Impact:</h1>
<p>An unprivileged local process may be able to retrieve
portion of kernel memory.</p>
<p>For the generic control message, the process may be able
to retrieve a maximum of 4 bytes of kernel memory.</p>
<p>For SCTP, the process may be able to retrieve 2 bytes
of kernel memory for all three control messages, plus 92
bytes for SCTP_SNDRCV and 76 bytes for SCTP_EXTRCV. If the
local process is permitted to receive SCTP notification, a
maximum of 112 bytes of kernel memory may be returned to
userland.</p>
<p>This information might be directly useful, or it might
be leveraged to obtain elevated privileges in some way. For
example, a terminal buffer might include a user-entered
password.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3952</cvename>
<cvename>CVE-2014-3953</cvename>
<freebsdsa>SA-14:17.kmem</freebsdsa>
</references>
<dates>
<discovery>2014-07-08</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="70140f20-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_6</lt></range>
<range><ge>9.2</ge><lt>9.2_9</lt></range>
<range><ge>9.1</ge><lt>9.1_16</lt></range>
<range><ge>8.4</ge><lt>8.4_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A specifically crafted Composite Document File (CDF)
file can trigger an out-of-bounds read or an invalid pointer
dereference. [CVE-2012-1571]</p>
<p>A flaw in regular expression in the awk script detector
makes use of multiple wildcards with unlimited repetitions.
[CVE-2013-7345]</p>
<p>A malicious input file could trigger infinite recursion
in libmagic(3). [CVE-2014-1943]</p>
<p>A specifically crafted Portable Executable (PE) can
trigger out-of-bounds read. [CVE-2014-2270]</p>
<h1>Impact:</h1>
<p>An attacker who can cause file(1) or any other applications
using the libmagic(3) library to be run on a maliciously
constructed input can the application to crash or consume
excessive CPU resources, resulting in a denial-of-service.</p>
</body>
</description>
<references>
<cvename>CVE-2012-1571</cvename>
<cvename>CVE-2013-7345</cvename>
<cvename>CVE-2014-1943</cvename>
<cvename>CVE-2014-2270</cvename>
<freebsdsa>SA-14:16.file</freebsdsa>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6f91a709-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A NULL pointer dereference in the initialization code
of the HZ module and an out of bounds array access in the
initialization code of the VIQR module make iconv_open(3)
calls involving HZ or VIQR result in an application crash.</p>
<h1>Impact:</h1>
<p>Services where an attacker can control the arguments of
an iconv_open(3) call can be caused to crash resulting in
a denial-of-service. For example, an email encoded in HZ
may cause an email delivery service to crash if it converts
emails to a more generic encoding like UTF-8 before applying
filtering rules.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3951</cvename>
<freebsdsa>SA-14:15.iconv</freebsdsa>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6e8f9003-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect error handling in PAM policy parser</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>10.0</ge><lt>10.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The OpenPAM library searches for policy definitions in
several locations. While doing so, the absence of a policy
file is a soft failure (handled by searching in the next
location) while the presence of an invalid file is a hard
failure (handled by returning an error to the caller).</p>
<p>The policy parser returns the same error code (ENOENT)
when a syntactically valid policy references a non-existent
module as when the requested policy file does not exist.
The search loop regards this as a soft failure and looks
for the next similarly-named policy, without discarding the
partially-loaded configuration.</p>
<p>A similar issue can arise if a policy contains an include
directive that refers to a non-existent policy.</p>
<h1>Impact:</h1>
<p>If a module is removed, or the name of a module is
misspelled in the policy file, the PAM library will proceed
with a partially loaded configuration. Depending on the
exact circumstances, this may result in a fail-open scenario
where users are allowed to log in without a password, or
with an incorrect password.</p>
<p>In particular, if a policy references a module installed
by a package or port, and that package or port is being
reinstalled or upgraded, there is a brief window of time
during which the module is absent and policies that use it
may fail open. This can be especially damaging to Internet-facing
SSH servers, which are regularly subjected to brute-force
scans.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3879</cvename>
<freebsdsa>SA-14:13.pam</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6e04048b-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- ktrace kernel memory disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>9.1</ge><lt>9.1_14</lt></range>
<range><ge>8.4</ge><lt>8.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to an overlooked merge to -STABLE branches, the size
for page fault kernel trace entries was set incorrectly.</p>
<h1>Impact:</h1>
<p>A user who can enable kernel process tracing could end
up reading the contents of kernel memory.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3873</cvename>
<freebsdsa>SA-14:12.ktrace</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6d9eadaf-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- sendmail improper close-on-exec flag handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_4</lt></range>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>9.1</ge><lt>9.1_14</lt></range>
<range><ge>8.4</ge><lt>8.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a programming error in sendmail(8) that prevented
open file descriptors have close-on-exec properly set.
Consequently a subprocess will be able to access all open
files that the parent process have open.</p>
<h1>Impact:</h1>
<p>A local user who can execute their own program for mail
delivery will be able to interfere with an open SMTP
connection.</p>
</body>
</description>
<references>
<freebsdsa>SA-14:11.sendmail</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6d472244-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- TCP reassembly vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>8.4</ge><lt>8.4_9</lt></range>
<range><ge>8.3</ge><lt>8.3_16</lt></range>
<range><ge>9.2</ge><lt>9.2_5</lt></range>
<range><ge>9.1</ge><lt>9.1_12</lt></range>
<range><ge>10.0</ge><lt>10.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>FreeBSD may add a reassemble queue entry on the stack
into the segment list when the reassembly queue reaches its
limit. The memory from the stack is undefined after the
function returns. Subsequent iterations of the reassembly
function will attempt to access this entry.</p>
<h1>Impact:</h1>
<p>An attacker who can send a series of specifically crafted
packets with a connection could cause a denial of service
situation by causing the kernel to crash.</p>
<p>Additionally, because the undefined on stack memory may
be overwritten by other kernel threads, while extremely
difficult, it may be possible for an attacker to construct
a carefully crafted attack to obtain portion of kernel
memory via a connected socket. This may result in the
disclosure of sensitive information such as login credentials,
etc. before or even without crashing the system.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3000</cvename>
<freebsdsa>SA-14:08.tcp</freebsdsa>
</references>
<dates>
<discovery>2014-04-30</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6b6ca5b6-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- devfs rules not applied by default for jails</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The default devfs rulesets are not loaded on boot, even
when jails are used. Device nodes will be created in the
jail with their normal default access permissions, while
most of them should be hidden and inaccessible.</p>
<h1>Impact:</h1>
<p>Jailed processes can get access to restricted resources
on the host system. For jailed processes running with
superuser privileges this implies access to all devices on
the system. This level of access could lead to information
leakage and privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3001</cvename>
<freebsdsa>SA-14:07.devfs</freebsdsa>
</references>
<dates>
<discovery>2014-04-30</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6a384960-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Deadlock in the NFS server</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_1</lt></range>
<range><ge>9.2</ge><lt>9.2_4</lt></range>
<range><ge>9.1</ge><lt>9.1_11</lt></range>
<range><ge>8.4</ge><lt>8.4_8</lt></range>
<range><ge>8.3</ge><lt>8.3_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel holds a lock over the source directory vnode
while trying to convert the target directory file handle
to a vnode, which needs to be returned with the lock held,
too. This order may be in violation of normal lock order,
which in conjunction with other threads that grab locks in
the right order, constitutes a deadlock condition because
no thread can proceed.</p>
<h1>Impact:</h1>
<p>An attacker on a trusted client could cause the NFS
server become deadlocked, resulting in a denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-1453</cvename>
<freebsdsa>SA-14:05.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2014-04-08</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="4c96ecf2-5fd9-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- bsnmpd remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.2</ge><lt>9.2_3</lt></range>
<range><ge>9.1</ge><lt>9.1_10</lt></range>
<range><ge>8.4</ge><lt>8.4_7</lt></range>
<range><ge>8.3</ge><lt>8.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The bsnmpd(8) daemon is prone to a stack-based
buffer-overflow when it has received a specifically crafted
GETBULK PDU request.</p>
<p>Impact:</p>
<p>This issue could be exploited to execute arbitrary code in
the context of the service daemon, or crash the service daemon, causing
a denial-of-service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-1452</cvename>
<freebsdsa>SA-14:01.bsnmpd</freebsdsa>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="ca16fd0b-5fd1-11e6-a6f2-6cc21735f730">
<topic>PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities</topic>
<affects>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.23</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.18</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1688/">
<p>
Security Fixes nested CASE expressions +
database and role names with embedded special characters
</p>
<ul>
<li>CVE-2016-5423: certain nested CASE expressions can cause the
server to crash.
</li>
<li>CVE-2016-5424: database and role names with embedded special
characters can allow code injection during administrative operations
like pg_dumpall.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5423</cvename>
<cvename>CVE-2016-5424</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="28bf62ef-5e2c-11e6-a15f-00248c0c745d">
<topic>piwik -- XSS vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik reports:</p>
<blockquote cite="https://piwik.org/changelog/piwik-2-16-2/">
<p>We have identified and fixed several XSS security issues in this release.</p>
</blockquote>
</body>
</description>
<references>
<url>We have identified and fixed several XSS security issues in this release.</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="7d08e608-5e95-11e6-b334-002590263bf5">
<topic>BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers</topic>
<affects>
<package>
<name>bind99</name>
<range><le>9.9.9P2</le></range>
</package>
<package>
<name>bind910</name>
<range><le>9.10.4P2</le></range>
</package>
<package>
<name>bind911</name>
<range><le>9.11.0.b2</le></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.11.02</le></range>
</package>
<package>
<name>knot</name>
<name>knot1</name>
<range><lt>1.6.8</lt></range>
</package>
<package>
<name>knot2</name>
<range><lt>2.3.0</lt></range>
</package>
<package>
<name>nsd</name>
<range><lt>4.1.11</lt></range>
</package>
<package>
<name>powerdns</name>
<range><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01390">
<p>DNS protocols were designed with the assumption that a certain
amount of trust could be presumed between the operators of primary
and secondary servers for a given zone. However, in current
practice some organizations have scenarios which require them to
accept zone data from sources that are not fully trusted (for
example: providers of secondary name service). A party who is
allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS
updates) can overwhelm the server which is accepting data by
intentionally or accidentally exhausting that server's memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6170</cvename>
<cvename>CVE-2016-6171</cvename>
<cvename>CVE-2016-6172</cvename>
<cvename>CVE-2016-6173</cvename>
<url>https://kb.isc.org/article/AA-01390</url>
<mlist>http://www.openwall.com/lists/oss-security/2016/07/06/4</mlist>
</references>
<dates>
<discovery>2016-07-06</discovery>
<entry>2016-08-10</entry>
<modified>2017-04-24</modified>
</dates>
</vuln>
<vuln vid="dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel memory disclosure in sctp(4)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_6</lt></range>
<range><ge>8.4</ge><lt>8.4_3</lt></range>
<range><ge>8.3</ge><lt>8.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>When initializing the SCTP state cookie being sent in INIT-ACK chunks,
a buffer allocated from the kernel stack is not completely initialized.</p>
<p>Impact:</p>
<p>Fragments of kernel memory may be included in SCTP packets and
transmitted over the network. For each SCTP session, there are two
separate instances in which a 4-byte fragment may be transmitted.</p>
<p>This memory might contain sensitive information, such as portions of the
file cache or terminal buffers. This information might be directly
useful, or it might be leveraged to obtain elevated privileges in
some way. For example, a terminal buffer might include a user-entered
password.</p>
</body>
</description>
<references>
<freebsdsa>SA-13:10.sctp</freebsdsa>
<cvename>CVE-2013-5209</cvename>
</references>
<dates>
<discovery>2013-08-22</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="0844632f-5e78-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- integer overflow in IP_MSFILTER</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_6</lt></range>
<range><ge>8.4</ge><lt>8.4_3</lt></range>
<range><ge>8.3</ge><lt>8.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>An integer overflow in computing the size of a temporary
buffer can result in a buffer which is too small for the requested
operation.</p>
<p>Impact:</p>
<p>An unprivileged process can read or write pages of memory
which belong to the kernel. These may lead to exposure of sensitive
information or allow privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2013-3077</cvename>
<freebsdsa>SA-13:09.ip_multicast</freebsdsa>
</references>
<dates>
<discovery>2013-08-22</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="e5d2442d-5e76-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect privilege validation in the NFS server</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_5</lt></range>
<range><ge>8.3</ge><lt>8.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The kernel incorrectly uses client supplied credentials
instead of the one configured in exports(5) when filling out the
anonymous credential for a NFS export, when -network or -host
restrictions are used at the same time.</p>
<p>Impact:</p>
<p>The remote client may supply privileged credentials (e.g. the
root user) when accessing a file under the NFS share, which will bypass
the normal access checks.</p>
</body>
</description>
<references>
<cvename>CVE-2013-4851</cvename>
<freebsdsa>SA-13:08.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2013-07-06</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="6da45e38-5b55-11e6-8859-000c292ee6b8">
<topic>collectd -- Network plugin heap overflow</topic>
<affects>
<package>
<name>collectd5</name>
<range><lt>5.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The collectd Project reports:</p>
<blockquote cite="http://collectd.org/news.shtml#news98">
<p>Emilien Gaspar has identified a heap overflow in collectd's
network plugin which can be triggered remotely and is potentially
exploitable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6254</cvename>
<url>http://collectd.org/news.shtml#news98</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-05</entry>
</dates>
</vuln>
<vuln vid="3ddcb42b-5b78-11e6-b334-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><le>2.8.12</le></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.7</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.5</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0019: Glossary search displays entries without
checking user permissions to view them</p></li>
<li><p>MSA-16-0020: Text injection in email headers</p></li>
<li><p>MSA-16-0021: Unenrolled user still receives event monitor
notifications even though they can no longer access course</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5012</cvename>
<cvename>CVE-2016-5013</cvename>
<cvename>CVE-2016-5014</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-07-19</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="7a31e0de-5b6d-11e6-b334-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P2</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P2</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0.b2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.12.0.a.2016.07.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01393">
<p>A query name which is too long can cause a segmentation fault in
lwresd.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2775</cvename>
<url>https://kb.isc.org/article/AA-01393</url>
</references>
<dates>
<discovery>2016-07-18</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="610101ea-5b6a-11e6-b334-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-41</p>
<p>PacketBB crash. (Bug 12577)</p></li>
<li><p>wnpa-sec-2016-42</p>
<p>WSP infinite loop. (Bug 12594)</p></li>
<li><p>wnpa-sec-2016-44</p>
<p>RLC long loop. (Bug 12660)</p></li>
<li><p>wnpa-sec-2016-45</p>
<p>LDSS dissector crash. (Bug 12662)</p></li>
<li><p>wnpa-sec-2016-46</p>
<p>RLC dissector crash. (Bug 12664)</p></li>
<li><p>wnpa-sec-2016-47</p>
<p>OpenFlow long loop. (Bug 12659)</p></li>
<li><p>wnpa-sec-2016-48</p>
<p>MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)</p></li>
<li><p>wnpa-sec-2016-49</p>
<p>WBXML crash. (Bug 12663)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6505</cvename>
<cvename>CVE-2016-6506</cvename>
<cvename>CVE-2016-6508</cvename>
<cvename>CVE-2016-6509</cvename>
<cvename>CVE-2016-6510</cvename>
<cvename>CVE-2016-6511</cvename>
<cvename>CVE-2016-6512</cvename>
<cvename>CVE-2016-6513</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/08/01/4</url>
</references>
<dates>
<discovery>2016-07-27</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="3e08047f-5a6c-11e6-a6c3-14dae9d210b8">
<topic>p5-XSLoader -- local arbitrary code execution</topic>
<affects>
<package>
<name>p5-XSLoader</name>
<range><lt>0.22</lt></range>
</package>
<package>
<name>perl5</name>
<name>perl5.18</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5.24</name>
<name>perl5-devel</name>
<range><lt>5.18.4_24</lt></range>
<range><ge>5.20</ge><lt>5.20.3_15</lt></range>
<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
<range><ge>5.25</ge><lt>5.25.2.87</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Wilk reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578">
<p>XSLoader tries to load code from a subdirectory in the cwd when
called inside a string eval</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578</url>
<cvename>CVE-2016-6185</cvename>
</references>
<dates>
<discovery>2016-06-30</discovery>
<entry>2016-08-04</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="72bfbb09-5a6a-11e6-a6c3-14dae9d210b8">
<topic>perl -- local arbitrary code execution</topic>
<affects>
<package>
<name>perl5</name>
<name>perl5.18</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5.24</name>
<name>perl5-devel</name>
<range><lt>5.18.4_23</lt></range>
<range><ge>5.20</ge><lt>5.20.3_14</lt></range>
<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
<range><ge>5.25</ge><lt>5.25.3.18</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sawyer X reports:</p>
<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html">
<p>Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do
not properly remove . (period) characters from the end of the includes
directory array, which might allow local users to gain privileges via a
Trojan horse module under the current working directory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html</url>
<cvename>CVE-2016-1238</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-08-04</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="556d2286-5a51-11e6-a6c3-14dae9d210b8">
<topic>gd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gd</name>
<range><lt>2.2.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pierre Joye reports:</p>
<blockquote cite="https://github.com/libgd/libgd/releases/tag/gd-2.2.3">
<ul>
<li><p>fix php bug 72339, Integer Overflow in _gd2GetHeader
(CVE-2016-5766)</p></li>
<li><p>gd: Buffer over-read issue when parsing crafted TGA
file (CVE-2016-6132)</p></li>
<li><p>Integer overflow error within _gdContributionsAlloc()
(CVE-2016-6207)</p></li>
<li><p>fix php bug 72494, invalid color index not handled, can
lead to crash ( CVE-2016-6128)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.3</url>
<cvename>CVE-2016-5766</cvename>
<cvename>CVE-2016-6132</cvename>
<cvename>CVE-2016-6207</cvename>
<cvename>CVE-2016-6128</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-08-04</entry>
</dates>
</vuln>
<vuln vid="e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1">
<topic>Vulnerabilities in Curl</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.32.0</ge><lt>7.50.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Curl security team reports:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2016-5419 - TLS session resumption client cert bypass</p>
<p>CVE-2016-5420 - Re-using connections with wrong client cert</p>
<p>CVE-2016-5421 - use of connection struct after free</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5419</cvename>
<cvename>CVE-2016-5420</cvename>
<cvename>CVE-2016-5421</cvename>
<url>https://curl.haxx.se/docs/adv_20160803A.html</url>
<url>https://curl.haxx.se/docs/adv_20160803B.html</url>
<url>https://curl.haxx.se/docs/adv_20160803C.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-08-04</entry>
</dates>
</vuln>
<vuln vid="ef0033ad-5823-11e6-80cc-001517f335e2">
<topic>lighttpd - multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd Project reports:</p>
<blockquote cite="http://www.lighttpd.net/2016/7/31/1.4.41/">
<p>Security fixes for Lighttpd:</p>
<ul>
<li><p>security: encode quoting chars in HTML and XML</p></li>
<li><p>security: ensure gid != 0 if server.username is set, but not server.groupname</p></li>
<li><p>security: disable stat_cache if server.follow-symlink = “disable”</p></li>
<li><p>security: httpoxy defense: do not emit HTTP_PROXY to CGI env</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.lighttpd.net/2016/7/31/1.4.41/</url>
<freebsdpr>ports/211495</freebsdpr>
</references>
<dates>
<discovery>2016-07-31</discovery>
<entry>2016-08-03</entry>
</dates>
</vuln>
<vuln vid="06574c62-5854-11e6-b334-002590263bf5">
<topic>xen-tools -- virtio: unbounded memory allocation issue</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-184.html">
<p>A guest can submit virtio requests without bothering to wait for
completion and is therefore not bound by virtqueue size...</p>
<p>A malicious guest administrator can cause unbounded memory
allocation in QEMU, which can cause an Out-of-Memory condition
in the domain running qemu. Thus, a malicious guest administrator
can cause a denial of service affecting the whole host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5403</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-184.html</url>
</references>
<dates>
<discovery>2016-07-27</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="04cf89e3-5854-11e6-b334-002590263bf5">
<topic>xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><gt>4.5</gt><lt>4.7.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-183.html">
<p>Supervisor Mode Access Prevention is a hardware feature designed
to make an Operating System more robust, by raising a pagefault
rather than accidentally following a pointer into userspace.
However, legitimate accesses into userspace require whitelisting,
and the exception delivery mechanism for 32bit PV guests wasn't
whitelisted.</p>
<p>A malicious 32-bit PV guest kernel can trigger a safety check,
crashing the hypervisor and causing a denial of service to other
VMs on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6259</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-183.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="032aa524-5854-11e6-b334-002590263bf5">
<topic>xen-kernel -- x86: Privilege escalation in PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-182.html">
<p>The PV pagetable code has fast-paths for making updates to
pre-existing pagetable entries, to skip expensive re-validation
in safe cases (e.g. clearing only Access/Dirty bits). The bits
considered safe were too broad, and not actually safe.</p>
<p>A malicious PV guest administrator can escalate their privilege to
that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6258</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-182.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="cb5189eb-572f-11e6-b334-002590263bf5">
<topic>libidn -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libidn</name>
<range><lt>1.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Josefsson reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html">
<p>libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.</p>
<p>idn: Solve out-of-bounds-read when reading one zero byte as input.
Also replaced fgets with getline.</p>
<p>libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was
always documented to only accept UTF-8 data, but now it doesn't
crash when presented with such data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6261</cvename>
<cvename>CVE-2015-8948</cvename>
<cvename>CVE-2016-6262</cvename>
<cvename>CVE-2016-6263</cvename>
<url>https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/07/21/4</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-31</entry>
</dates>
</vuln>
<vuln vid="6fb8a90f-c9d5-4d14-b940-aed3d63c2edc">
<topic>The GIMP -- Use after Free vulnerability</topic>
<affects>
<package>
<name>gimp-app</name>
<range><lt>2.8.18,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GIMP team reports:</p>
<blockquote cite="https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html">
<p>A Use-after-free vulnerability was found in the xcf_load_image function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=767873</url>
<cvename>CVE-2016-4994</cvename>
</references>
<dates>
<discovery>2016-06-20</discovery>
<entry>2016-07-19</entry>
</dates>
</vuln>
<vuln vid="cb09a7aa-5344-11e6-a7bd-14dae9d210b8">
<topic>xercesi-c3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt">
<p>The Xerces-C XML parser fails to successfully parse a
DTD that is deeply nested, and this causes a stack overflow, which
makes a denial of service attack against many applications possible
by an unauthenticated attacker.</p>
<p>Also, CVE-2016-2099: Use-after-free vulnerability in
validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier
allows context-dependent attackers to have unspecified impact via an
invalid character in an XML document.</p>
</blockquote>
</body>
</description>
<references>
<url>https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/09/7</url>
<cvename>CVE-2016-2099</cvename>
<cvename>CVE-2016-4463</cvename>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-07-26</entry>
</dates>
</vuln>
<vuln vid="b6402385-533b-11e6-a7bd-14dae9d210b8">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php70-curl</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-bz2</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-bz2</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-bz2</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-exif</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-exif</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-exif</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-gd</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-gd</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-gd</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php70-mcrypt</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-odbc</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-odbc</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-odbc</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-snmp</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-snmp</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-snmp</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-xmlrpc</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-xmlrpc</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-xmlrpc</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-zip</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-zip</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-zip</name>
<range><lt>7.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.38">
<ul>
<li><p>Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)</p></li>
<li><p>Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).</p></li>
<li><p>Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).</p></li>
<li><p>Fixed bug #72519 (imagegif/output out-of-bounds access).</p></li>
<li><p>Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).</p></li>
<li><p>Fixed bug #72533 (locale_accept_from_http out-of-bounds access).</p></li>
<li><p>Fixed bug #72541 (size_t overflow lead to heap corruption).</p></li>
<li><p>Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).</p></li>
<li><p>Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).</p></li>
<li><p>Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).</p></li>
<li><p>Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).</p></li>
<li><p>Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).</p></li>
<li><p>Fixed bug #72613 (Inadequate error handling in bzread()).</p></li>
<li><p>Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/ChangeLog-5.php#5.5.38</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.24</url>
<url>http://www.php.net/ChangeLog-7.php#7.0.8</url>
<url>http://seclists.org/oss-sec/2016/q3/121</url>
<cvename>CVE-2015-8879</cvename>
<cvename>CVE-2016-5385</cvename>
<cvename>CVE-2016-5399</cvename>
<cvename>CVE-2016-6288</cvename>
<cvename>CVE-2016-6289</cvename>
<cvename>CVE-2016-6290</cvename>
<cvename>CVE-2016-6291</cvename>
<cvename>CVE-2016-6292</cvename>
<cvename>CVE-2016-6294</cvename>
<cvename>CVE-2016-6295</cvename>
<cvename>CVE-2016-6296</cvename>
<cvename>CVE-2016-6297</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-07-26</entry>
</dates>
</vuln>
<vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>52.0.2743.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html">
<p>48 security fixes in this release, including:</p>
<ul>
<li>[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to
Pinkie Pie xisigr of Tencent's Xuanwu Lab</li>
<li>[613949] High CVE-2016-1708: Use-after-free in Extensions.
Credit to Adam Varsan</li>
<li>[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly.
Credit to ChenQin of Topsec Security Team</li>
<li>[616907] High CVE-2016-1710: Same-origin bypass in Blink.
Credit to Mariusz Mlynski</li>
<li>[617495] High CVE-2016-1711: Same-origin bypass in Blink.
Credit to Mariusz Mlynski</li>
<li>[618237] High CVE-2016-5127: Use-after-free in Blink. Credit
to cloudfuzzer</li>
<li>[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit
to Anonymous</li>
<li>[620553] High CVE-2016-5129: Memory corruption in V8. Credit to
Jeonghoon Shin</li>
<li>[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih
Matar</li>
<li>[623378] High CVE-2016-5131: Use-after-free in libxml. Credit
to Nick Wellnhofer</li>
<li>[607543] Medium CVE-2016-5132: Limited same-origin bypass in
Service Workers. Credit to Ben Kelly</li>
<li>[613626] Medium CVE-2016-5133: Origin confusion in proxy
authentication. Credit to Patch Eudor</li>
<li>[593759] Medium CVE-2016-5134: URL leakage via PAC script.
Credit to Paul Stone</li>
<li>[605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
Credit to kingxwy</li>
<li>[625393] Medium CVE-2016-5136: Use after free in extensions.
Credit to Rob Wu</li>
<li>[625945] Medium CVE-2016-5137: History sniffing with HSTS and
CSP. Credit to Xiaoyin Liu</li>
<li>[629852] CVE-2016-1705: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1705</cvename>
<cvename>CVE-2016-1706</cvename>
<cvename>CVE-2016-1708</cvename>
<cvename>CVE-2016-1709</cvename>
<cvename>CVE-2016-1710</cvename>
<cvename>CVE-2016-1711</cvename>
<cvename>CVE-2016-5127</cvename>
<cvename>CVE-2016-5128</cvename>
<cvename>CVE-2016-5129</cvename>
<cvename>CVE-2016-5130</cvename>
<cvename>CVE-2016-5131</cvename>
<cvename>CVE-2016-5132</cvename>
<cvename>CVE-2016-5133</cvename>
<cvename>CVE-2016-5134</cvename>
<cvename>CVE-2016-5135</cvename>
<cvename>CVE-2016-5136</cvename>
<cvename>CVE-2016-5137</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-22</entry>
</dates>
</vuln>
<vuln vid="62d45229-4fa0-11e6-9d13-206a8a720317">
<topic>krb5 -- KDC denial of service vulnerability</topic>
<affects>
<package>
<name>krb5-113</name>
<range><lt>1.13.6</lt></range>
</package>
<package>
<name>krb5-114</name>
<range><lt>1.14.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Major changes in krb5 1.14.3 and krb5 1.13.6:</p>
<blockquote cite="http://web.mit.edu/kerberos/krb5-1.14/">
<p>Fix a rare KDC denial of service vulnerability when anonymous
client principals are restricted to obtaining TGTs only
[CVE-2016-3120] .</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3120</cvename>
<url>http://web.mit.edu/kerberos/krb5-1.14/</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-21</entry>
<modified>2016-07-26</modified>
</dates>
</vuln>
<vuln vid="72f71e26-4f69-11e6-ac37-ac9e174be3af">
<topic>Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations)</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.2_8</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1753426,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2016-1513.html">
<p>An OpenDocument Presentation .ODP or Presentation Template
.OTP file can contain invalid presentation elements that lead
to memory corruption when the document is loaded in Apache
OpenOffice Impress. The defect may cause the document to appear
as corrupted and OpenOffice may crash in a recovery-stuck mode
requiring manual intervention. A crafted exploitation of the
defect can allow an attacker to cause denial of service
(memory corruption and application crash) and possible
execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1513</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
</references>
<dates>
<discovery>2016-07-17</discovery>
<entry>2016-07-21</entry>
</dates>
</vuln>
<vuln vid="ca5cb202-4f51-11e6-b2ec-b499baebfeaf">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>mariadb100-server</name>
<range><le>10.0.25</le></range>
</package>
<package>
<name>mariadb101-server</name>
<range><le>10.1.14</le></range>
</package>
<package>
<name>mysql55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.12_1</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>percona56-server</name>
<range><le>5.6.30</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL">
<p>The quarterly Critical Patch Update contains 22 new security fixes for
Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL</url>
<cvename>CVE-2016-3477</cvename>
<cvename>CVE-2016-3440</cvename>
<cvename>CVE-2016-2105</cvename>
<cvename>CVE-2016-3471</cvename>
<cvename>CVE-2016-3486</cvename>
<cvename>CVE-2016-3501</cvename>
<cvename>CVE-2016-3518</cvename>
<cvename>CVE-2016-3521</cvename>
<cvename>CVE-2016-3588</cvename>
<cvename>CVE-2016-3615</cvename>
<cvename>CVE-2016-3614</cvename>
<cvename>CVE-2016-5436</cvename>
<cvename>CVE-2016-3459</cvename>
<cvename>CVE-2016-5437</cvename>
<cvename>CVE-2016-3424</cvename>
<cvename>CVE-2016-5439</cvename>
<cvename>CVE-2016-5440</cvename>
<cvename>CVE-2016-5441</cvename>
<cvename>CVE-2016-5442</cvename>
<cvename>CVE-2016-5443</cvename>
<cvename>CVE-2016-5444</cvename>
<cvename>CVE-2016-3452</cvename>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-21</entry>
<modified>2016-08-08</modified>
</dates>
</vuln>
<vuln vid="3caf4e6c-4cef-11e6-a15f-00248c0c745d">
<topic>typo3 -- Missing access check in Extbase</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>7.6.8</lt></range>
</package>
<package>
<name>typo3-lts</name>
<range><lt>6.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 reports:</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/">
<p>Extbase request handling fails to implement a proper access check for
requested controller/ action combinations, which makes it possible for an
attacker to execute arbitrary Extbase actions by crafting a special request. To
successfully exploit this vulnerability, an attacker must have access to at
least one Extbase plugin or module action in a TYPO3 installation. The missing
access check inevitably leads to information disclosure or remote code
execution, depending on the action that an attacker is able to execute.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5091</cvename>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/</url>
<url>https://wiki.typo3.org/TYPO3_CMS_7.6.8</url>
<url>https://wiki.typo3.org/TYPO3_CMS_6.2.24</url>
</references>
<dates>
<discovery>2016-05-24</discovery>
<entry>2016-07-18</entry>
</dates>
</vuln>
<vuln vid="cf0b5668-4d1b-11e6-b2ec-b499baebfeaf">
<cancelled/>
</vuln>
<vuln vid="00cb1469-4afc-11e6-97ea-002590263bf5">
<topic>atutor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atutor</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ATutor reports:</p>
<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2">
<p>Security Fixes: Added a new layer of security over all php
superglobals, fixed several XSS, CSRF, and SQL injection
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="ffa8ca79-4afb-11e6-97ea-002590263bf5">
<topic>atutor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atutor</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ATutor reports:</p>
<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1">
<p>Security Fixes: A number of minor XSS vulnerabilities discovered in
the previous version of ATutor have been corrected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1</url>
</references>
<dates>
<discovery>2016-01-30</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="a522d6ac-4aed-11e6-97ea-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.632</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-25.htmL">
<p>These updates resolve a race condition vulnerability that could
lead to information disclosure (CVE-2016-4247).</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-4223, CVE-2016-4224,
CVE-2016-4225).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222,
CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).</p>
<p>These updates resolve a heap buffer overflow vulnerability that
could lead to code execution (CVE-2016-4249).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179,
CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183,
CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217,
CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221,
CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236,
CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244,
CVE-2016-4245, CVE-2016-4246).</p>
<p>These updates resolve a memory leak vulnerability (CVE-2016-4232).
</p>
<p>These updates resolve stack corruption vulnerabilities that could
lead to code execution (CVE-2016-4176, CVE-2016-4177).</p>
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2016-4178).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4172</cvename>
<cvename>CVE-2016-4173</cvename>
<cvename>CVE-2016-4174</cvename>
<cvename>CVE-2016-4175</cvename>
<cvename>CVE-2016-4176</cvename>
<cvename>CVE-2016-4177</cvename>
<cvename>CVE-2016-4178</cvename>
<cvename>CVE-2016-4179</cvename>
<cvename>CVE-2016-4180</cvename>
<cvename>CVE-2016-4181</cvename>
<cvename>CVE-2016-4182</cvename>
<cvename>CVE-2016-4183</cvename>
<cvename>CVE-2016-4184</cvename>
<cvename>CVE-2016-4185</cvename>
<cvename>CVE-2016-4186</cvename>
<cvename>CVE-2016-4187</cvename>
<cvename>CVE-2016-4188</cvename>
<cvename>CVE-2016-4189</cvename>
<cvename>CVE-2016-4190</cvename>
<cvename>CVE-2016-4217</cvename>
<cvename>CVE-2016-4218</cvename>
<cvename>CVE-2016-4219</cvename>
<cvename>CVE-2016-4220</cvename>
<cvename>CVE-2016-4221</cvename>
<cvename>CVE-2016-4222</cvename>
<cvename>CVE-2016-4223</cvename>
<cvename>CVE-2016-4224</cvename>
<cvename>CVE-2016-4225</cvename>
<cvename>CVE-2016-4226</cvename>
<cvename>CVE-2016-4227</cvename>
<cvename>CVE-2016-4228</cvename>
<cvename>CVE-2016-4229</cvename>
<cvename>CVE-2016-4230</cvename>
<cvename>CVE-2016-4231</cvename>
<cvename>CVE-2016-4232</cvename>
<cvename>CVE-2016-4233</cvename>
<cvename>CVE-2016-4234</cvename>
<cvename>CVE-2016-4235</cvename>
<cvename>CVE-2016-4236</cvename>
<cvename>CVE-2016-4237</cvename>
<cvename>CVE-2016-4238</cvename>
<cvename>CVE-2016-4239</cvename>
<cvename>CVE-2016-4240</cvename>
<cvename>CVE-2016-4241</cvename>
<cvename>CVE-2016-4242</cvename>
<cvename>CVE-2016-4243</cvename>
<cvename>CVE-2016-4244</cvename>
<cvename>CVE-2016-4245</cvename>
<cvename>CVE-2016-4246</cvename>
<cvename>CVE-2016-4247</cvename>
<cvename>CVE-2016-4248</cvename>
<cvename>CVE-2016-4249</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-25.html</url>
</references>
<dates>
<discovery>2016-07-12</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="61b8c359-4aab-11e6-a7bd-14dae9d210b8">
<cancelled superseded="cbceeb49-3bc7-11e6-8e82-002590263bf5"/>
</vuln>
<vuln vid="3159cd70-4aaa-11e6-a7bd-14dae9d210b8">
<topic>libreoffice -- use-after-free vulnerability</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>5.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0126/">
<p>An exploitable Use After Free vulnerability exists in the
RTF parser LibreOffice. A specially crafted file can cause a use after
free resulting in a possible arbitrary code execution. To exploit the
vulnerability a malicious file needs to be opened by the user via
vulnerable application.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.talosintelligence.com/reports/TALOS-2016-0126/</url>
<url>http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/</url>
<cvename>CVE-2016-4324</cvename>
</references>
<dates>
<discovery>2016-06-27</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="c17fe91d-4aa6-11e6-a7bd-14dae9d210b8">
<cancelled/>
</vuln>
<vuln vid="0ab66088-4aa5-11e6-a7bd-14dae9d210b8">
<topic>tiff -- buffer overflow</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_2</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mathias Svensson reports:</p>
<blockquote cite="https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2">
<p>potential buffer write overrun in PixarLogDecode() on
corrupted/unexpected images</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2</url>
<cvename>CVE-2016-5314</cvename>
<cvename>CVE-2016-5320</cvename>
<cvename>CVE-2016-5875</cvename>
</references>
<dates>
<discovery>2016-06-28</discovery>
<entry>2016-07-15</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="42ecf370-4aa4-11e6-a7bd-14dae9d210b8">
<cancelled/>
</vuln>
<vuln vid="d706a3a3-4a7c-11e6-97f7-5453ed2e2b49">
<topic>p7zip -- out-of-bounds read vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0094/">
<p>An out-of-bounds read vulnerability exists in the way 7-Zip
handles Universal Disk Format (UDF) files.</p>
<p>Central to 7-Zip’s processing of UDF files is the
CInArchive::ReadFileItem method. Because volumes can have more than
one partition map, their objects are kept in an object vector. To
start looking for an item, this method tries to reference the proper
object using the partition map’s object vector and the "PartitionRef"
field from the Long Allocation Descriptor. Lack of checking whether
the "PartitionRef" field is bigger than the available amount of
partition map objects causes a read out-of-bounds and can lead, in
some circumstances, to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2335</cvename>
<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49">
<topic>p7zip -- heap overflow vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0093/">
<p>An exploitable heap overflow vulnerability exists in the
NArchive::NHfs::CHandler::ExtractZlibFile method functionality of
7zip that can lead to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2334</cvename>
<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="4729c849-4897-11e6-b704-000c292e4fd8">
<topic>samba -- client side SMB2/3 required signing can be downgraded</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.14</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.11</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2016-2119.html">
<p>A man in the middle attack can disable client signing over
SMB2/3, even if enforced by configuration parameters.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2119</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2119.html</url>
</references>
<dates>
<discovery>2016-07-07</discovery>
<entry>2016-07-13</entry>
</dates>
</vuln>
<vuln vid="3fcd52b2-4510-11e6-a15f-00248c0c745d">
<topic>ruby-saml -- XML signature wrapping attack</topic>
<affects>
<package>
<name>rubygem-ruby-saml</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RubySec reports:</p>
<blockquote cite="http://rubysec.com/advisories/CVE-2016-5697/">
<p>ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack
in the specific scenario where there was a signature that referenced at the same
time 2 elements (but past the scheme validator process since 1 of the element was
inside the encrypted assertion).</p>
<p>ruby-saml users must update to 1.3.0, which implements 3 extra validations to
mitigate this kind of attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5697</cvename>
<url>http://rubysec.com/advisories/CVE-2016-5697/</url>
<url>https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995</url>
</references>
<dates>
<discovery>2016-06-24</discovery>
<entry>2016-07-08</entry>
</dates>
</vuln>
<vuln vid="7d64d00c-43e3-11e6-ab34-002590263bf5">
<topic>quassel -- remote denial of service</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4414">
<p>The onReadyRead function in core/coreauthhandler.cpp in Quassel
before 0.12.4 allows remote attackers to cause a denial of service
(NULL pointer dereference and crash) via invalid handshake data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4414</cvename>
<url>http://quassel-irc.org/node/129</url>
<url>https://github.com/quassel/quassel/commit/e678873</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/30/2</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/30/4</url>
</references>
<dates>
<discovery>2016-04-24</discovery>
<entry>2016-07-07</entry>
</dates>
</vuln>
<vuln vid="e9d1e040-42c9-11e6-9608-20cf30e32f6d">
<topic>apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.18</ge><lt>2.4.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="INSERT URL HERE">
<p>The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509
client certificate correctly when experimental module for the HTTP/2
protocol is used to access a resource.</p>
<p>The net result is that a resource that should require a valid client
certificate in order to get access can be accessed without that credential.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4979</cvename>
<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201607.mbox/CVE-2016-4979-68283</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-05</entry>
</dates>
</vuln>
<vuln vid="e800cd4b-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unrestricted qemu logging</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-180.html">
<p>When the libxl toolstack launches qemu for HVM guests, it pipes the
output of stderr to a file in /var/log/xen. This output is not
rate-limited in any way. The guest can easily cause qemu to print
messages to stderr, causing this file to become arbitrarily large.
</p>
<p>The disk containing the logfile can be exhausted, possibly causing a
denial-of-service (DoS).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3672</cvename>
<url>http://xenbits.xen.org/xsa/advisory-180.html</url>
</references>
<dates>
<discovery>2016-05-23</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e6ce6f50-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-179.html">
<p>Qemu VGA module allows banked access to video memory using the
window at 0xa00000 and it supports different access modes with
different address calculations.</p>
<p>Qemu VGA module allows guest to edit certain registers in 'vbe'
and 'vga' modes.</p>
<p>A privileged guest user could use CVE-2016-3710 to exceed the bank
address window and write beyond the said memory area, potentially
leading to arbitrary code execution with privileges of the Qemu
process. If the system is not using stubdomains, this will be in
domain 0.</p>
<p>A privileged guest user could use CVE-2016-3712 to cause potential
integer overflow or OOB read access issues in Qemu, resulting in a DoS
of the guest itself. More dangerous effect, such as data leakage or
code execution, are not known but cannot be ruled out.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3710</cvename>
<cvename>CVE-2016-3712</cvename>
<url>http://xenbits.xen.org/xsa/advisory-179.html</url>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e589ae90-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unsanitised driver domain input in libxl device handling</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-178.html">
<p>libxl's device-handling code freely uses and trusts information
from the backend directories in xenstore.</p>
<p>A malicious driver domain can deny service to management tools.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4963</cvename>
<url>http://xenbits.xen.org/xsa/advisory-178.html</url>
</references>
<dates>
<discovery>2016-06-02</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e43b210a-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-kernel -- x86 software guest page walk PS bit handling flaw</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-176.html">
<p>The Page Size (PS) page table entry bit exists at all page table
levels other than L1. Its meaning is reserved in L4, and
conditionally reserved in L3 and L2 (depending on hardware
capabilities). The software page table walker in the hypervisor,
however, so far ignored that bit in L4 and (on respective hardware)
L3 entries, resulting in pages to be treated as page tables which
the guest OS may not have designated as such. If the page in
question is writable by an unprivileged user, then that user will
be able to map arbitrary guest memory.</p>
<p>On vulnerable OSes, guest user mode code may be able to establish
mappings of arbitrary memory inside the guest, allowing it to
elevate its privileges inside the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4480</cvename>
<url>http://xenbits.xen.org/xsa/advisory-176.html</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e2fca11b-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unsanitised guest input in libxl device handling code</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-175.html">
<p>Various parts of libxl device-handling code inappropriately use
information from (partially) guest controlled areas of xenstore.</p>
<p>A malicious guest administrator can cause denial of service by
resource exhaustion.</p>
<p>A malicious guest administrator can confuse and/or deny service to
management facilities.</p>
<p>A malicious guest administrator of a guest configured with channel
devices may be able to escalate their privilege to that of the
backend domain (i.e., normally, to that of the host).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4962</cvename>
<url>http://xenbits.xen.org/xsa/advisory-175.html</url>
</references>
<dates>
<discovery>2016-06-02</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="d51ced72-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-kernel -- x86 shadow pagetables: address width overflow</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-173.html">
<p>In the x86 shadow pagetable code, the guest frame number of a
superpage mapping is stored in a 32-bit field. If a shadowed guest
can cause a superpage mapping of a guest-physical address at or
above 2^44 to be shadowed, the top bits of the address will be lost,
causing an assertion failure or NULL dereference later on, in code
that removes the shadow.</p>
<p>A HVM guest using shadow pagetables can cause the host to crash.
</p>
<p>A PV guest using shadow pagetables (i.e. being migrated) with PV
superpages enabled (which is not the default) can crash the host, or
corrupt hypervisor memory, and so a privilege escalation cannot be
ruled out.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3960</cvename>
<url>http://xenbits.xen.org/xsa/advisory-173.html</url>
</references>
<dates>
<discovery>2016-04-18</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="313e9557-41e8-11e6-ab34-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-29</p>
<p>The SPOOLS dissector could go into an infinite loop. Discovered
by the CESG.</p></li>
<li><p>wnpa-sec-2016-30</p>
<p>The IEEE 802.11 dissector could crash. (Bug 11585)</p></li>
<li><p>wnpa-sec-2016-31</p>
<p>The IEEE 802.11 dissector could crash. Discovered by Mateusz
Jurczyk. (Bug 12175)</p></li>
<li><p>wnpa-sec-2016-32</p>
<p>The UMTS FP dissector could crash. (Bug 12191)</p></li>
<li><p>wnpa-sec-2016-33</p>
<p>Some USB dissectors could crash. Discovered by Mateusz
Jurczyk. (Bug 12356)</p></li>
<li><p>wnpa-sec-2016-34</p>
<p>The Toshiba file parser could crash. Discovered by iDefense
Labs. (Bug 12394)</p></li>
<li><p>wnpa-sec-2016-35</p>
<p>The CoSine file parser could crash. Discovered by iDefense
Labs. (Bug 12395)</p></li>
<li><p>wnpa-sec-2016-36</p>
<p>The NetScreen file parser could crash. Discovered by iDefense
Labs. (Bug 12396)</p></li>
<li><p>wnpa-sec-2016-37</p>
<p>The Ethernet dissector could crash. (Bug 12440)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5350</cvename>
<cvename>CVE-2016-5351</cvename>
<cvename>CVE-2016-5352</cvename>
<cvename>CVE-2016-5353</cvename>
<cvename>CVE-2016-5354</cvename>
<cvename>CVE-2016-5355</cvename>
<cvename>CVE-2016-5356</cvename>
<cvename>CVE-2016-5357</cvename>
<cvename>CVE-2016-5358</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/09/4</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="8656cf5f-4170-11e6-8dfe-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.12</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.6</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0013: Users are able to change profile fields that
were locked by the administrator.</p></li>
<li><p>MSA-16-0015: Information disclosure of hidden forum names
and sub-names.</p></li>
<li><p>MSA-16-0016: User can view badges of other users without
proper permissions.</p></li>
<li><p>MSA-16-0017: Course idnumber not protected from teacher
restore.</p></li>
<li><p>MSA-16-0018: CSRF in script marking forum posts as read.</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3729</cvename>
<cvename>CVE-2016-3731</cvename>
<cvename>CVE-2016-3732</cvename>
<cvename>CVE-2016-3733</cvename>
<cvename>CVE-2016-3734</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-05-18</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="ad9b77f6-4163-11e6-b05b-14dae9d210b8">
<topic>icingaweb2 -- remote code execution</topic>
<affects>
<package>
<name>icingaweb2</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Lippmann reports:</p>
<blockquote cite="https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/">
<p>Possibility of remote code execution via the remote command
transport.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/</url>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="a5c204b5-4153-11e6-8dfe-002590263bf5">
<topic>hive -- authorization logic vulnerability</topic>
<affects>
<package>
<name>hive</name>
<range><lt>2.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sushanth Sowmyan reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E">
<p>Some partition-level operations exist that do not explicitly also
authorize privileges of the parent table. This can lead to issues when
the parent table would have denied the operation, but no denial occurs
because the partition-level privilege is not checked by the
authorization framework, which defines authorization entities only
from the table level upwards.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7521</cvename>
<url>http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E</url>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="546deeea-3fc6-11e6-a671-60a44ce6887b">
<topic>SQLite3 -- Tempdir Selection Vulnerability</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KoreLogic security reports:</p>
<blockquote cite="https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt">
<p>Affected versions of SQLite reject potential tempdir locations if
they are not readable, falling back to '.'. Thus, SQLite will favor
e.g. using cwd for tempfiles on such a system, even if cwd is an
unsafe location. Notably, SQLite also checks the permissions of
'.', but ignores the results of that check.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6153</cvename>
<freebsdpr>ports/209827</freebsdpr>
<url>https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt</url>
<url>http://openwall.com/lists/oss-security/2016/07/01/2</url>
<url>http://www.sqlite.org/cgi/src/info/67985761aa93fb61</url>
<url>http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3</url>
<url>http://www.sqlite.org/cgi/src/info/614bb709d34e1148</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="8d5368ef-40fe-11e6-b2ec-b499baebfeaf">
<topic>Python -- smtplib StartTLS stripping vulnerability</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.12</lt></range>
</package>
<package>
<name>python33</name>
<range><gt>0</gt></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772">
<p>A vulnerability in smtplib allowing MITM attacker to perform a
startTLS stripping attack. smtplib does not seem to raise an exception
when the remote end (smtp server) is capable of negotiating starttls but
fails to respond with 220 (ok) to an explicit call of SMTP.starttls().
This may allow a malicious MITM to perform a startTLS stripping attack
if the client code does not explicitly check the response code for startTLS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772</url>
<cvename>CVE-2016-0772</cvename>
</references>
<dates>
<discovery>2016-06-14</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="e7028e1d-3f9b-11e6-81f9-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-17/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-18/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-19/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-20/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-21/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-22/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-23/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-24/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-25/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-26/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-27/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-28/</url>
<cvename>CVE-2016-5701</cvename>
<cvename>CVE-2016-5702</cvename>
<cvename>CVE-2016-5703</cvename>
<cvename>CVE-2016-5704</cvename>
<cvename>CVE-2016-5705</cvename>
<cvename>CVE-2016-5706</cvename>
<cvename>CVE-2016-5730</cvename>
<cvename>CVE-2016-5731</cvename>
<cvename>CVE-2016-5732</cvename>
<cvename>CVE-2016-5733</cvename>
<cvename>CVE-2016-5734</cvename>
<cvename>CVE-2016-5739</cvename>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-07-01</entry>
</dates>
</vuln>
<vuln vid="f1c219ba-3f14-11e6-b3c8-14dae9d210b8">
<topic>haproxy -- denial of service</topic>
<affects>
<package>
<name>haproxy</name>
<range><ge>1.6.0</ge><lt>1.6.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAproxy reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/06/09/5">
<p>HAproxy 1.6.x before 1.6.6, when a deny comes from a
reqdeny rule, allows remote attackers to cause a denial of service
(uninitialized memory access and crash) or possibly have unspecified
other impact via unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/06/09/5</url>
<cvename>CVE-2016-5360</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="093584f2-3f14-11e6-b3c8-14dae9d210b8">
<topic>libtorrent-rasterbar -- denial of service</topic>
<affects>
<package>
<name>libtorrent-rasterbar</name>
<range><lt>1.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brandon Perry reports:</p>
<blockquote cite="https://github.com/arvidn/libtorrent/issues/780">
<p>The parse_chunk_header function in libtorrent before 1.1.1
allows remote attackers to cause a denial of service (crash) via a
crafted (1) HTTP response or possibly a (2) UPnP broadcast.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/arvidn/libtorrent/issues/780</url>
<cvename>CVE-2016-5301</cvename>
</references>
<dates>
<discovery>2016-06-03</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="ff76f0e0-3f11-11e6-b3c8-14dae9d210b8">
<topic>expat2 -- denial of service</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1344251">
<p>It was found that original patch for issues CVE-2015-1283
and CVE-2015-2716 used overflow checks that could be optimized out by
some compilers applying certain optimization settings, which can cause
the vulnerability to remain even after applying the patch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1344251</url>
<cvename>CVE-2016-4472</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-30</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="875e4cf8-3f0e-11e6-b3c8-14dae9d210b8">
<topic>dnsmasq -- denial of service</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.76,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.76.0test1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html">
<p>Dnsmasq before 2.76 allows remote servers to cause a denial
of service (crash) via a reply with an empty DNS address that has an (1)
A or (2) AAAA record defined locally.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/03/7</url>
<cvename>CVE-2015-8899</cvename>
</references>
<dates>
<discovery>2016-04-18</discovery>
<entry>2016-06-30</entry>
<modified>2016-06-30</modified>
</dates>
</vuln>
<vuln vid="a61374fc-3a4d-11e6-a671-60a44ce6887b">
<topic>Python -- HTTP Header Injection in Python urllib</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.10</lt></range>
</package>
<package>
<name>python33</name>
<range><ge>0</ge></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.4</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guido Vranken reports:</p>
<blockquote cite="https://bugs.python.org/issue22928">
<p>HTTP header injection in urrlib2/urllib/httplib/http.client with
newlines in header values, where newlines have a semantic consequence of
denoting the start of an additional header line.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.python.org/issue22928</url>
<url>http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/14/7</url>
<cvename>CVE-2016-5699</cvename>
</references>
<dates>
<discovery>2014-11-24</discovery>
<entry>2016-06-30</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="0ca24682-3f03-11e6-b3c8-14dae9d210b8">
<topic>openssl -- denial of service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177">
<p>OpenSSL through 1.0.2h incorrectly uses pointer arithmetic
for heap-buffer boundary checks, which might allow remote attackers to
cause a denial of service (integer overflow and application crash) or
possibly have unspecified other impact by leveraging unexpected malloc
behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177</url>
<url>ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705</url>
<url>https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/</url>
<cvename>CVE-2016-2177</cvename>
</references>
<dates>
<discovery>2016-06-01</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="cbceeb49-3bc7-11e6-8e82-002590263bf5">
<topic>Apache Commons FileUpload -- denial of service (DoS) vulnerability</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.70</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.36</lt></range>
</package>
<package>
<name>apache-struts</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E">
<p>CVE-2016-3092 is a denial of service vulnerability that has been
corrected in the Apache Commons FileUpload component. It occurred
when the length of the multipart boundary was just below the size of
the buffer (4096 bytes) used to read the uploaded file. This caused
the file upload process to take several orders of magnitude longer
than if the boundary length was the typical tens of bytes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3092</cvename>
<freebsdpr>ports/209669</freebsdpr>
<url>http://tomcat.apache.org/security-7.html</url>
<url>http://tomcat.apache.org/security-8.html</url>
<url>http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E</url>
<url>http://jvn.jp/en/jp/JVN89379547/index.html</url>
</references>
<dates>
<discovery>2016-06-20</discovery>
<entry>2016-06-26</entry>
<modified>2017-08-10</modified>
</dates>
</vuln>
<vuln vid="bfcc23b6-3b27-11e6-8e82-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.5.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Silverstein reports:</p>
<blockquote cite="https://wordpress.org/news/2016/06/wordpress-4-5-3/">
<p>WordPress 4.5.3 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.5.2 and earlier are affected by several
security issues: redirect bypass in the customizer, reported by
Yassine Aboukir; two different XSS problems via attachment names,
reported by Jouko Pynnönenand Divyesh Prajapati; revision history
information disclosure, reported independently by John Blackbourn
from the WordPress security team and by Dan Moen from the Wordfence
Research Team; oEmbed denial of service reported by Jennifer Dodd
from Automattic; unauthorized category removal from a post, reported
by David Herrera from Alley Interactive; password change via stolen
cookie, reported by Michael Adams from the WordPress security team;
and some less secure sanitize_file_name edge cases reported by Peter
Westwood of the WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5832</cvename>
<cvename>CVE-2016-5833</cvename>
<cvename>CVE-2016-5834</cvename>
<cvename>CVE-2016-5835</cvename>
<cvename>CVE-2016-5836</cvename>
<cvename>CVE-2016-5837</cvename>
<cvename>CVE-2016-5838</cvename>
<cvename>CVE-2016-5839</cvename>
<freebsdpr>ports/210480</freebsdpr>
<freebsdpr>ports/210581</freebsdpr>
<url>https://wordpress.org/news/2016/06/wordpress-4-5-3/</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/23/9</url>
</references>
<dates>
<discovery>2016-06-18</discovery>
<entry>2016-06-25</entry>
</dates>
</vuln>
<vuln vid="66d77c58-3b1d-11e6-8e82-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-mbstring</name>
<name>php55-wddx</name>
<name>php55-zip</name>
<range><lt>5.5.37</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<name>php56-mbstring</name>
<name>php56-phar</name>
<name>php56-wddx</name>
<name>php56-zip</name>
<range><lt>5.6.23</lt></range>
</package>
<package>
<name>php70</name>
<name>php70-gd</name>
<name>php70-mbstring</name>
<name>php70-phar</name>
<name>php70-wddx</name>
<name>php70-zip</name>
<range><lt>7.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.37">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8874</cvename>
<cvename>CVE-2016-5766</cvename>
<cvename>CVE-2016-5767</cvename>
<cvename>CVE-2016-5768</cvename>
<cvename>CVE-2016-5769</cvename>
<cvename>CVE-2016-5770</cvename>
<cvename>CVE-2016-5771</cvename>
<cvename>CVE-2016-5772</cvename>
<cvename>CVE-2016-5773</cvename>
<freebsdpr>ports/210491</freebsdpr>
<freebsdpr>ports/210502</freebsdpr>
<url>http://php.net/ChangeLog-5.php#5.5.37</url>
<url>http://php.net/ChangeLog-5.php#5.6.23</url>
<url>http://php.net/ChangeLog-7.php#7.0.8</url>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-06-25</entry>
</dates>
</vuln>
<vuln vid="4a0d9b53-395d-11e6-b3c8-14dae9d210b8">
<topic>libarchive -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Bock and Cisco Talos report:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2016/06/23/6">
<ul>
<li><p>Out of bounds heap read in RAR parser</p></li>
<li><p>Signed integer overflow in ISO parser</p></li>
<li><p>TALOS-2016-0152 [CVE-2016-4300]: 7-Zip
read_SubStreamsInfo Integer Overflow</p></li>
<li><p>TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack
Based Buffer Overflow</p></li>
<li><p>TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel
Heap Overflow</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://openwall.com/lists/oss-security/2016/06/23/6</url>
<url>https://github.com/libarchive/libarchive/issues/521</url>
<url>https://github.com/libarchive/libarchive/issues/717#event-697151157</url>
<url>http://blog.talosintel.com/2016/06/the-poisoned-archives.html</url>
<cvename>CVE-2015-8934</cvename>
<cvename>CVE-2016-4300</cvename>
<cvename>CVE-2016-4301</cvename>
<cvename>CVE-2016-4302</cvename>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-06-23</entry>
</dates>
</vuln>
<vuln vid="22775cdd-395a-11e6-b3c8-14dae9d210b8">
<topic>piwik -- XSS vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik reports:</p>
<blockquote cite="http://piwik.org/changelog/piwik-2-16-1/">
<p>The Piwik Security team is grateful for the responsible
disclosures by our security researchers: Egidio Romano (granted a
critical security bounty), James Kettle and Paweł Bartunek (XSS) and
Emanuel Bronshtein (limited XSS).</p>
</blockquote>
</body>
</description>
<references>
<url>http://piwik.org/changelog/piwik-2-16-1/</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-06-23</entry>
</dates>
</vuln>
<vuln vid="6df56c60-3738-11e6-a671-60a44ce6887b">
<topic>wget -- HTTP to FTP redirection file name confusion vulnerability</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Giuseppe Scrivano reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html">
<p>On a server redirect from HTTP to a FTP resource, wget would trust the
HTTP server and uses the name in the redirected URL as the destination
filename.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html</url>
<cvename>CVE-2016-4971</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-21</entry>
</dates>
</vuln>
<vuln vid="1a2aa04f-3718-11e6-b3c8-14dae9d210b8">
<topic>libxslt -- Denial of Service</topic>
<affects>
<package>
<name>libxslt</name>
<range><lt>1.1.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2016/Jun/81">
<ul>
<li>[583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt.
Credit to Nicolas Gregoire.</li>
<li>[583171] Medium CVE-2016-1684: Integer overflow in libxslt.
Credit to Nicolas Gregoire.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html</url>
<cvename>CVE-2016-1683</cvename>
<cvename>CVE-2016-1684</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-06-20</entry>
</dates>
</vuln>
<vuln vid="0e3dfdde-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.626</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-18.html">
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-4144, CVE-2016-4149).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).</p>
<p>These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2016-4135, CVE-2016-4136,
CVE-2016-4138).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129,
CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133,
CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154,
CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-4140).</p>
<p>These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2016-4139).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4122</cvename>
<cvename>CVE-2016-4123</cvename>
<cvename>CVE-2016-4124</cvename>
<cvename>CVE-2016-4125</cvename>
<cvename>CVE-2016-4127</cvename>
<cvename>CVE-2016-4128</cvename>
<cvename>CVE-2016-4129</cvename>
<cvename>CVE-2016-4130</cvename>
<cvename>CVE-2016-4131</cvename>
<cvename>CVE-2016-4132</cvename>
<cvename>CVE-2016-4133</cvename>
<cvename>CVE-2016-4134</cvename>
<cvename>CVE-2016-4135</cvename>
<cvename>CVE-2016-4136</cvename>
<cvename>CVE-2016-4137</cvename>
<cvename>CVE-2016-4138</cvename>
<cvename>CVE-2016-4139</cvename>
<cvename>CVE-2016-4140</cvename>
<cvename>CVE-2016-4141</cvename>
<cvename>CVE-2016-4142</cvename>
<cvename>CVE-2016-4143</cvename>
<cvename>CVE-2016-4144</cvename>
<cvename>CVE-2016-4145</cvename>
<cvename>CVE-2016-4146</cvename>
<cvename>CVE-2016-4147</cvename>
<cvename>CVE-2016-4148</cvename>
<cvename>CVE-2016-4149</cvename>
<cvename>CVE-2016-4150</cvename>
<cvename>CVE-2016-4151</cvename>
<cvename>CVE-2016-4152</cvename>
<cvename>CVE-2016-4153</cvename>
<cvename>CVE-2016-4154</cvename>
<cvename>CVE-2016-4155</cvename>
<cvename>CVE-2016-4156</cvename>
<cvename>CVE-2016-4166</cvename>
<cvename>CVE-2016-4171</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-18.html</url>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="0c6b008d-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.621</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-15.html">
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-1105, CVE-2016-4117).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107,
CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,
CVE-2016-4110, CVE-2016-4121).</p>
<p>These updates resolve a heap buffer overflow vulnerability that
could lead to code execution (CVE-2016-1101).</p>
<p>These updates resolve a buffer overflow vulnerability that could
lead to code execution (CVE-2016-1103).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099,
CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,
CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,
CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161,
CVE-2016-4162, CVE-2016-4163).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-4116).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1096</cvename>
<cvename>CVE-2016-1097</cvename>
<cvename>CVE-2016-1098</cvename>
<cvename>CVE-2016-1099</cvename>
<cvename>CVE-2016-1100</cvename>
<cvename>CVE-2016-1101</cvename>
<cvename>CVE-2016-1102</cvename>
<cvename>CVE-2016-1103</cvename>
<cvename>CVE-2016-1104</cvename>
<cvename>CVE-2016-1105</cvename>
<cvename>CVE-2016-1106</cvename>
<cvename>CVE-2016-1107</cvename>
<cvename>CVE-2016-1108</cvename>
<cvename>CVE-2016-1109</cvename>
<cvename>CVE-2016-1110</cvename>
<cvename>CVE-2016-4108</cvename>
<cvename>CVE-2016-4109</cvename>
<cvename>CVE-2016-4110</cvename>
<cvename>CVE-2016-4111</cvename>
<cvename>CVE-2016-4112</cvename>
<cvename>CVE-2016-4113</cvename>
<cvename>CVE-2016-4114</cvename>
<cvename>CVE-2016-4115</cvename>
<cvename>CVE-2016-4116</cvename>
<cvename>CVE-2016-4117</cvename>
<cvename>CVE-2016-4120</cvename>
<cvename>CVE-2016-4121</cvename>
<cvename>CVE-2016-4160</cvename>
<cvename>CVE-2016-4161</cvename>
<cvename>CVE-2016-4162</cvename>
<cvename>CVE-2016-4163</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-15.html</url>
</references>
<dates>
<discovery>2016-05-12</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="07888b49-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.616</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-10.html">
<p>These updates harden a mitigation against JIT spraying attacks that
could be used to bypass memory layout randomization mitigations
(CVE-2016-1006).</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-1015, CVE-2016-1019).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016,
CVE-2016-1017, CVE-2016-1031).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021,
CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025,
CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,
CVE-2016-1032, CVE-2016-1033).</p>
<p>These updates resolve a stack overflow vulnerability that could
lead to code execution (CVE-2016-1018).</p>
<p>These updates resolve a security bypass vulnerability
(CVE-2016-1030).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-1014).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1006</cvename>
<cvename>CVE-2016-1011</cvename>
<cvename>CVE-2016-1012</cvename>
<cvename>CVE-2016-1013</cvename>
<cvename>CVE-2016-1014</cvename>
<cvename>CVE-2016-1015</cvename>
<cvename>CVE-2016-1016</cvename>
<cvename>CVE-2016-1017</cvename>
<cvename>CVE-2016-1018</cvename>
<cvename>CVE-2016-1019</cvename>
<cvename>CVE-2016-1020</cvename>
<cvename>CVE-2016-1021</cvename>
<cvename>CVE-2016-1022</cvename>
<cvename>CVE-2016-1023</cvename>
<cvename>CVE-2016-1024</cvename>
<cvename>CVE-2016-1025</cvename>
<cvename>CVE-2016-1026</cvename>
<cvename>CVE-2016-1027</cvename>
<cvename>CVE-2016-1028</cvename>
<cvename>CVE-2016-1029</cvename>
<cvename>CVE-2016-1030</cvename>
<cvename>CVE-2016-1031</cvename>
<cvename>CVE-2016-1032</cvename>
<cvename>CVE-2016-1033</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-10.html</url>
</references>
<dates>
<discovery>2016-04-07</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="d59ebed4-34be-11e6-be25-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.103</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[620742] CVE-2016-1704: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1704</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html</url>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2016-06-17</entry>
</dates>
</vuln>
<vuln vid="1d0f6852-33d8-11e6-a671-60a44ce6887b">
<topic>Python -- Integer overflow in zipimport module</topic>
<affects>
<package>
<name>python35</name>
<range><lt>3.5.1_3</lt></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.4_3</lt></range>
</package>
<package>
<name>python33</name>
<range><lt>3.3.6_5</lt></range>
</package>
<package>
<name>python27</name>
<range><lt>2.7.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="http://bugs.python.org/issue26171">
<p>Possible integer overflow and heap corruption in
zipimporter.get_data()</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.python.org/issue26171</url>
<cvename>CVE-2016-5636</cvename>
</references>
<dates>
<discovery>2016-01-21</discovery>
<entry>2016-06-17</entry>
</dates>
</vuln>
<vuln vid="7932548e-3427-11e6-8e82-002590263bf5">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.44</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-002">
<ul>
<li><p>Saving user accounts can sometimes grant the user all roles
(User module - Drupal 7 - Moderately Critical)</p></li>
<li><p>Views can allow unauthorized users to see Statistics
information (Views module - Drupal 8 - Less Critical)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6211</cvename>
<cvename>CVE-2016-6212</cvename>
<url>https://www.drupal.org/SA-CORE-2016-002</url>
<url>http://www.openwall.com/lists/oss-security/2016/07/13/7</url>
</references>
<dates>
<discovery>2016-06-15</discovery>
<entry>2016-06-17</entry>
<modified>2016-07-16</modified>
</dates>
</vuln>
<vuln vid="ac0900df-31d0-11e6-8e82-002590263bf5">
<topic>botan -- multiple vulnerabilities</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jack Lloyd reports:</p>
<blockquote cite="https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html">
<p>Botan 1.10.13 has been released backporting some side channel
protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA
decryption (CVE-2015-7827).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2849</cvename>
<cvename>CVE-2015-7827</cvename>
<url>https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-06-14</entry>
</dates>
</vuln>
<vuln vid="f771880c-31cf-11e6-8e82-002590263bf5">
<topic>botan -- cryptographic vulnerability</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9742">
<p>The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x
before 1.11.9 improperly uses a single random base, which makes it
easier for remote attackers to defeat cryptographic protection
mechanisms via a DH group.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9742</cvename>
</references>
<dates>
<discovery>2014-04-11</discovery>
<entry>2016-06-14</entry>
</dates>
</vuln>
<vuln vid="6d402857-2fba-11e6-9f31-5404a68ad561">
<topic>VLC -- Possibly remote code execution via crafted file</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.4,4</lt></range>
</package>
<package>
<name>vlc-qt4</name>
<range><lt>2.2.4,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
<p>Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5108</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-06-11</entry>
</dates>
</vuln>
<vuln vid="97e86d10-2ea7-11e6-ae88-002590263bf5">
<topic>roundcube -- XSS vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.1.5_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://github.com/roundcube/roundcubemail/wiki/Changelog">
<p>Fix XSS issue in href attribute on area tag (#5240).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5103</cvename>
<freebsdpr>ports/209841</freebsdpr>
<url>https://github.com/roundcube/roundcubemail/issues/5240</url>
<url>http://seclists.org/oss-sec/2016/q2/414</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-06-10</entry>
</dates>
</vuln>
<vuln vid="6f0529e2-2e82-11e6-b2ec-b499baebfeaf">
<topic>OpenSSL -- vulnerability in DSA signing</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_13</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.2.9</lt></range>
<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL team reports:</p>
<blockquote cite="https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2">
<p>Operations in the DSA signing algorithm should run in constant time
in order to avoid side channel attacks. A flaw in the OpenSSL DSA
implementation means that a non-constant time codepath is followed for
certain operations. This has been demonstrated through a cache-timing
attack to be sufficient for an attacker to recover the private DSA key.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2</url>
<cvename>CVE-2016-2178</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-09</entry>
<modified>2016-12-20</modified>
</dates>
</vuln>
<vuln vid="c9c252f5-2def-11e6-ae88-002590263bf5">
<topic>expat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Pipping reports:</p>
<blockquote cite="https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/">
<p>CVE-2012-6702 -- Resolve troublesome internal call to srand that
was introduced with Expat 2.1.0 when addressing CVE-2012-0876
(issue #496)</p>
<p>CVE-2016-5300 -- Use more entropy for hash initialization than the
original fix to CVE-2012-0876.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6702</cvename>
<cvename>CVE-2016-5300</cvename>
<freebsdpr>ports/210155</freebsdpr>
<url>https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/</url>
<url>http://www.openwall.com/lists/oss-security/2016/03/18/3</url>
</references>
<dates>
<discovery>2016-03-18</discovery>
<entry>2016-06-09</entry>
<modified>2016-11-06</modified>
</dates>
</vuln>
<vuln vid="d6bbf2d8-2cfc-11e6-800b-080027468580">
<topic>iperf3 -- buffer overflow</topic>
<affects>
<package>
<name>iperf3</name>
<range><ge>3.1</ge><lt>3.1.3</lt></range>
<range><ge>3.0</ge><lt>3.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ESnet reports:</p>
<blockquote cite="https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc">
<p>A malicious process can connect to an iperf3 server and,
by sending a malformed message on the control channel,
corrupt the server process's heap area. This can lead to a
crash (and a denial of service), or theoretically a remote
code execution as the user running the iperf3 server. A
malicious iperf3 server could potentially mount a similar
attack on an iperf3 client.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4303</cvename>
<url>https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc</url>
</references>
<dates>
<discovery>2016-06-08</discovery>
<entry>2016-06-08</entry>
</dates>
</vuln>
<vuln vid="9c196cfd-2ccc-11e6-94b0-0011d823eebd">
<topic>gnutls -- file overwrite by setuid programs</topic>
<affects>
<package>
<name>gnutls</name>
<range><ge>3.4.12</ge><lt>3.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-1">
<p>Setuid programs using GnuTLS 3.4.12 could potentially allow an
attacker to overwrite and corrupt arbitrary files in the
filesystem.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2016-1</url>
</references>
<dates>
<discovery>2016-06-06</discovery>
<entry>2016-06-07</entry>
</dates>
</vuln>
<vuln vid="32166082-53fa-41fa-b081-207e7a989a0a">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<range><lt>3.23</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<name>linux-c7-nss</name>
<range><lt>3.21.3</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.44</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-61/">
<p>Mozilla has updated the version of Network Security
Services (NSS) library used in Firefox to NSS 3.23. This
addresses four moderate rated networking security issues
reported by Mozilla engineers Tyson Smith and Jed Davis.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2834</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-61/</url>
<url>https://hg.mozilla.org/projects/nss/rev/1ba7cd83c672</url>
<url>https://hg.mozilla.org/projects/nss/rev/8d78a5ae260a</url>
<url>https://hg.mozilla.org/projects/nss/rev/5fde729fdbff</url>
<url>https://hg.mozilla.org/projects/nss/rev/329932eb1700</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-06-07</entry>
<modified>2016-11-23</modified>
</dates>
</vuln>
<vuln vid="8065d37b-8e7c-4707-a608-1b0a2b8509c3">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>47.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.44</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox47">
<p>MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 /
rv:45.2)</p>
<p>MFSA 2016-50 Buffer overflow parsing HTML5 fragments</p>
<p>MFSA 2016-51 Use-after-free deleting tables from a
contenteditable document</p>
<p>MFSA 2016-52 Addressbar spoofing though the SELECT element</p>
<p>MFSA 2016-54 Partial same-origin-policy through setting
location.host through data URI</p>
<p>MFSA 2016-56 Use-after-free when textures are used in WebGL
operations after recycle pool destruction</p>
<p>MFSA 2016-57 Incorrect icon displayed on permissions
notifications</p>
<p>MFSA 2016-58 Entering fullscreen and persistent pointerlock
without user permission</p>
<p>MFSA 2016-59 Information disclosure of disabled plugins
through CSS pseudo-classes</p>
<p>MFSA 2016-60 Java applets bypass CSP protections</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2815</cvename>
<cvename>CVE-2016-2818</cvename>
<cvename>CVE-2016-2819</cvename>
<cvename>CVE-2016-2821</cvename>
<cvename>CVE-2016-2822</cvename>
<cvename>CVE-2016-2825</cvename>
<cvename>CVE-2016-2828</cvename>
<cvename>CVE-2016-2829</cvename>
<cvename>CVE-2016-2831</cvename>
<cvename>CVE-2016-2832</cvename>
<cvename>CVE-2016-2833</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-49/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-50/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-51/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-52/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-54/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-56/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-57/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-58/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-59/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-60/</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-06-07</entry>
</dates>
</vuln>
<vuln vid="c039a761-2c29-11e6-8912-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html">
<p>15 security fixes in this release, including:</p>
<ul>
<li>601073] High CVE-2016-1696: Cross-origin bypass in Extension
bindings. Credit to anonymous.</li>
<li>[613266] High CVE-2016-1697: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[603725] Medium CVE-2016-1698: Information leak in Extension
bindings. Credit to Rob Wu.</li>
<li>[607939] Medium CVE-2016-1699: Parameter sanitization failure
in DevTools. Credit to Gregory Panakkal.</li>
<li>[608104] Medium CVE-2016-1700: Use-after-free in Extensions.
Credit to Rob Wu.</li>
<li>[608101] Medium CVE-2016-1701: Use-after-free in Autofill.
Credit to Rob Wu.</li>
<li>[609260] Medium CVE-2016-1702: Out-of-bounds read in Skia.
Credit to cloudfuzzer.</li>
<li>[616539] CVE-2016-1703: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1695</cvename>
<cvename>CVE-2016-1696</cvename>
<cvename>CVE-2016-1697</cvename>
<cvename>CVE-2016-1698</cvename>
<cvename>CVE-2016-1699</cvename>
<cvename>CVE-2016-1700</cvename>
<cvename>CVE-2016-1701</cvename>
<cvename>CVE-2016-1702</cvename>
<cvename>CVE-2016-1703</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-06-01</discovery>
<entry>2016-06-06</entry>
</dates>
</vuln>
<vuln vid="bcbd3fe0-2b46-11e6-ae88-002590263bf5">
<topic>openafs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt">
<p>Foreign users can bypass access controls to create groups as
system:administrators, including in the user namespace and the
system: namespace.</p>
</blockquote>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt">
<p>The contents of uninitialized memory are sent on the wire when
clients perform certain RPCs. Depending on the RPC, the information
leaked may come from kernel memory or userspace.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2860</cvename>
<cvename>CVE-2016-4536</cvename>
<freebsdpr>ports/209534</freebsdpr>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt</url>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt</url>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="2e8fe57e-2b46-11e6-ae88-002590263bf5">
<topic>openafs -- local DoS vulnerability</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16">
<p>Avoid a potential denial of service issue, by fixing a bug in
pioctl logic that allowed a local user to overrun a kernel buffer
with a single NUL byte.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8312</cvename>
<url>https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16</url>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="0297b260-2b3b-11e6-ae88-002590263bf5">
<topic>ikiwiki -- XSS vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20160509</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4561">
<p>Cross-site scripting (XSS) vulnerability in the cgierror function
in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers
to inject arbitrary web script or HTML via unspecified vectors
involving an error message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4561</cvename>
<freebsdpr>ports/209593</freebsdpr>
</references>
<dates>
<discovery>2016-05-04</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="65bb1858-27de-11e6-b714-74d02b9a84d5">
<topic>h2o -- use after free on premature connection close</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Newsha reports:</p>
<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
<p>When H2O tries to disconnect a premature HTTP/2 connection, it
calls free(3) to release memory allocated for the connection and
immediately after then touches the memory. No malloc-related
operation is performed by the same thread between the time it calls
free and the time the memory is touched. Fixed by Frederik
Deweerdt.</p>
</blockquote>
</body>
</description>
<references>
<url>https://h2o.examp1e.net/vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-06-01</entry>
</dates>
</vuln>
<vuln vid="36cf7670-2774-11e6-af29-f0def16c5c1b">
<topic>nginx -- a specially crafted request might result in worker process crash</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.4.0</ge><lt>1.8.1_3,2</lt></range>
<range><ge>1.10.0,2</ge><lt>1.10.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.3.9</ge><lt>1.9.15_1</lt></range>
<range><ge>1.10.0</ge><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html">
<p>A problem was identified in nginx code responsible for saving
client request body to a temporary file. A specially crafted
request might result in worker process crash due to a NULL
pointer dereference while writing client request body to a
temporary file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html</url>
<cvename>CVE-2016-4450</cvename>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-05-31</entry>
<modified>2016-06-05</modified>
</dates>
</vuln>
<vuln vid="6167b341-250c-11e6-a6fb-003048f2e514">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8h.php">
<p>Changelog</p>
<ul>
<li>bug:0002667: Cacti SQL Injection Vulnerability</li>
<li>bug:0002673: CVE-2016-3659 - Cacti graph_view.php SQL Injection
Vulnerability</li>
<li>bug:0002656: Authentication using web authentication as a user
not in the cacti database allows complete access (regression)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3659</cvename>
<url>http://www.cacti.net/release_notes_0_8_8h.php</url>
<url>http://bugs.cacti.net/view.php?id=2673</url>
<url>http://seclists.org/fulldisclosure/2016/Apr/4</url>
<url>http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html</url>
</references>
<dates>
<discovery>2016-04-04</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="b53bbf58-257f-11e6-9f4d-20cf30e32f6d">
<topic>openvswitch -- MPLS buffer overflow</topic>
<affects>
<package>
<name>openvswitch</name>
<range><ge>2.2.0</ge><lt>2.3.3</lt></range>
<range><ge>2.4.0</ge><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Open vSwitch reports:</p>
<blockquote cite="http://openvswitch.org/pipermail/announce/2016-March/000082.html">
<p>Multiple versions of Open vSwitch are vulnerable to remote buffer
overflow attacks, in which crafted MPLS packets could overflow the
buffer reserved for MPLS labels in an OVS internal data structure.
The MPLS packets that trigger the vulnerability and the potential for
exploitation vary depending on version:</p>
<p>Open vSwitch 2.1.x and earlier are not vulnerable.</p>
<p>In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be
exploited for arbitrary remote code execution.</p>
<p>In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead
to a remote code execution exploit, but testing shows that it can allow a
remote denial of service. See the mitigation section for details.</p>
<p>Open vSwitch 2.5.x is not vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2074</cvename>
<url>http://openvswitch.org/pipermail/announce/2016-March/000082.html</url>
<url>http://openvswitch.org/pipermail/announce/2016-March/000083.html</url>
</references>
<dates>
<discovery>2016-03-28</discovery>
<entry>2016-05-29</entry>
<modified>2016-07-03</modified>
</dates>
</vuln>
<vuln vid="1a6bbb95-24b8-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html">
<p>42 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1672</cvename>
<cvename>CVE-2016-1673</cvename>
<cvename>CVE-2016-1674</cvename>
<cvename>CVE-2016-1675</cvename>
<cvename>CVE-2016-1672</cvename>
<cvename>CVE-2016-1677</cvename>
<cvename>CVE-2016-1678</cvename>
<cvename>CVE-2016-1679</cvename>
<cvename>CVE-2016-1680</cvename>
<cvename>CVE-2016-1681</cvename>
<cvename>CVE-2016-1682</cvename>
<cvename>CVE-2016-1685</cvename>
<cvename>CVE-2016-1686</cvename>
<cvename>CVE-2016-1687</cvename>
<cvename>CVE-2016-1688</cvename>
<cvename>CVE-2016-1689</cvename>
<cvename>CVE-2016-1690</cvename>
<cvename>CVE-2016-1691</cvename>
<cvename>CVE-2016-1692</cvename>
<cvename>CVE-2016-1693</cvename>
<cvename>CVE-2016-1694</cvename>
<cvename>CVE-2016-1695</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html</url>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-05-28</entry>
<modified>2016-06-20</modified>
</dates>
</vuln>
<vuln vid="4dfafa16-24ba-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[605766] High CVE-2016-1667: Same origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[605910] High CVE-2016-1668: Same origin bypass in Blink V8
bindings. Credit to Mariusz Mlynski.</li>
<li>[606115] High CVE-2016-1669: Buffer overflow in V8. Credit to
Choongwoo Han.</li>
<li>[578882] Medium CVE-2016-1670: Race condition in loader. Credit
to anonymous.</li>
<li>[586657] Medium CVE-2016-1671: Directory traversal using the
file scheme on Android. Credit to Jann Horn.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1667</cvename>
<cvename>CVE-2016-1668</cvename>
<cvename>CVE-2016-1669</cvename>
<cvename>CVE-2016-1670</cvename>
<cvename>CVE-2016-1671</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="7da1da96-24bb-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html">
<p>9 security fixes in this release, including:</p>
<ul>
<li>[574802] High CVE-2016-1660: Out-of-bounds write in Blink.
Credit to Atte Kettunen of OUSPG.</li>
<li>[601629] High CVE-2016-1661: Memory corruption in cross-process
frames. Credit to Wadih Matar.</li>
<li>[603732] High CVE-2016-1662: Use-after-free in extensions.
Credit to Rob Wu.</li>
<li>[603987] High CVE-2016-1663: Use-after-free in Blink's V8
bindings. Credit to anonymous.</li>
<li>[597322] Medium CVE-2016-1664: Address bar spoofing. Credit to
Wadih Matar.</li>
<li>[606181] Medium CVE-2016-1665: Information leak in V8. Credit
to HyungSeok Han.</li>
<li>[607652] CVE-2016-1666: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1660</cvename>
<cvename>CVE-2016-1661</cvename>
<cvename>CVE-2016-1662</cvename>
<cvename>CVE-2016-1663</cvename>
<cvename>CVE-2016-1664</cvename>
<cvename>CVE-2016-1665</cvename>
<cvename>CVE-2016-1666</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="6b110175-246d-11e6-8dd3-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70-gd</name>
<name>php70-intl</name>
<range><lt>7.0.7</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<range><lt>5.6.22</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-phar</name>
<range><lt>5.5.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.36">
<ul><li>Core:
<ul>
<li>Fixed bug #72114 (Integer underflow / arbitrary null write in
fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)</li>
<li>Fixed bug #72135 (Integer Overflow in php_html_entities).
(CVE-2016-5094) (PHP 5.5/5.6 only)</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #72227 (imagescale out-of-bounds read).
(CVE-2013-7456)</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed bug #72241 (get_icu_value_internal out-of-bounds read).
(CVE-2016-5093)</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71331 (Uninitialized pointer in
phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5096</cvename>
<cvename>CVE-2016-5094</cvename>
<cvename>CVE-2013-7456</cvename>
<cvename>CVE-2016-5093</cvename>
<cvename>CVE-2016-4343</cvename>
<freebsdpr>ports/209779</freebsdpr>
<url>http://php.net/ChangeLog-7.php#7.0.7</url>
<url>http://php.net/ChangeLog-5.php#5.6.22</url>
<url>http://php.net/ChangeLog-5.php#5.5.36</url>
</references>
<dates>
<discovery>2016-05-26</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="00ec1be1-22bb-11e6-9ead-6805ca0b3d42">
<topic>phpmyadmin -- XSS and sensitive data leakage</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpmyadmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-14/">
<h2>Description</h2>
<p>Because user SQL queries are part of the URL, sensitive
information made as part of a user query can be exposed by
clicking on external links to attackers monitoring user GET
query parameters or included in the webserver logs.</p>
<h2>Severity</h2>
<p>We consider this to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-16/">
<h2>Description</h2>
<p>A specially crafted attack could allow for special HTML
characters to be passed as URL encoded values and displayed
back as special characters in the page.</p>
<h2>Severity</h2>
<p>We consider this to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-14/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-16/</url>
<cvename>CVE-2016-5097</cvename>
<cvename>CVE-2016-5099</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-05-25</entry>
<modified>2016-05-26</modified>
</dates>
</vuln>
<vuln vid="b50f53ce-2151-11e6-8dd3-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.14</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><le>1.24.6</le></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.6</lt></range>
</package>
<package>
<name>mediawiki126</name>
<range><lt>1.26.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html">
<p>Security fixes:</p>
<p>T122056: Old tokens are remaining valid within a new session</p>
<p>T127114: Login throttle can be tricked using non-canonicalized
usernames</p>
<p>T123653: Cross-domain policy regexp is too narrow</p>
<p>T123071: Incorrectly identifying http link in a's href
attributes, due to m modifier in regex</p>
<p>T129506: MediaWiki:Gadget-popups.js isn't renderable</p>
<p>T125283: Users occasionally logged in as different users after
SessionManager deployment</p>
<p>T103239: Patrol allows click catching and patrolling of any
page</p>
<p>T122807: [tracking] Check php crypto primatives</p>
<p>T98313: Graphs can leak tokens, leading to CSRF</p>
<p>T130947: Diff generation should use PoolCounter</p>
<p>T133507: Careless use of $wgExternalLinkTarget is insecure</p>
<p>T132874: API action=move is not rate limited</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html</url>
</references>
<dates>
<discovery>2016-05-20</discovery>
<entry>2016-05-24</entry>
</dates>
</vuln>
<vuln vid="967b852b-1e28-11e6-8dd3-002590263bf5">
<topic>hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.5_2</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2016-1/psk-parameter-config-update.txt">
<p>psk configuration parameter update allowing arbitrary data to be
written (2016-1 - CVE-2016-4476/CVE-2016-4477).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4476</cvename>
<cvename>CVE-2016-4477</cvename>
<freebsdpr>ports/209564</freebsdpr>
<url>http://w1.fi/security/2016-1/psk-parameter-config-update.txt</url>
</references>
<dates>
<discovery>2016-05-02</discovery>
<entry>2016-05-20</entry>
<modified>2017-03-22</modified>
</dates>
</vuln>
<vuln vid="57b3aba7-1e25-11e6-8dd3-002590263bf5">
<topic>expat -- denial of service vulnerability on malformed input</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1</lt></range>
</package>
<package>
<name>linux-c6-expat</name>
<range><lt>2.0.1_3</lt></range>
</package>
<package>
<name>linux-c7-expat</name>
<range><lt>2.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/17/12">
<p>The Expat XML parser mishandles certain kinds of malformed input
documents, resulting in buffer overflows during processing and error
reporting. The overflows can manifest as a segmentation fault or as
memory corruption during a parse operation. The bugs allow for a
denial of service attack in many applications by an unauthenticated
attacker, and could conceivably result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0718</cvename>
<freebsdpr>ports/209360</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2016/05/17/12</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-05-20</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="036d6c38-1c5b-11e6-b9e0-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.12</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.4.11/">
<p>A specially crafted bug summary could trigger XSS in dependency graphs.
Due to an incorrect parsing of the image map generated by the dot script,
a specially crafted bug summary could trigger XSS in dependency graphs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2803</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1253263</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-05-17</entry>
</dates>
</vuln>
<vuln vid="0dc8be9e-19af-11e6-8de0-080027ef73ec">
<topic>OpenVPN -- Buffer overflow in PAM authentication and DoS through port sharing</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.11</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://sourceforge.net/p/openvpn/mailman/message/35076507/">
<p>OpenVPN 2.3.11 [...] fixes two vulnerabilities: a port-share bug
with DoS potential and a buffer overflow by user supplied data when
using pam authentication.[...]</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/openvpn/mailman/message/35076507/</url>
<url>https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-05-14</entry>
</dates>
</vuln>
<vuln vid="82b702e0-1907-11e6-857b-00221503d280">
<topic>imagemagick -- buffer overflow</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.4.1,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ImageMagick reports:</p>
<blockquote cite="http://legacy.imagemagick.org/script/changelog.php">
<p>Fix a buffer overflow in magick/drag.c/DrawStrokePolygon().</p>
</blockquote>
</body>
</description>
<references>
<url>http://legacy.imagemagick.org/script/changelog.php</url>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-05-13</entry>
</dates>
</vuln>
<vuln vid="e387834a-17ef-11e6-9947-7054d2909b71">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.2</le></range>
</package>
<package>
<name>jenkins2</name>
<range><le>2.2</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.651.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11">
<h1>Description</h1>
<h5>SECURITY-170 / CVE-2016-3721</h5>
<p>Arbitrary build parameters are passed to build scripts as environment variables</p>
<h5>SECURITY-243 / CVE-2016-3722</h5>
<p>Malicious users with multiple user accounts can prevent other users from logging in</p>
<h5>SECURITY-250 / CVE-2016-3723</h5>
<p>Information on installed plugins exposed via API</p>
<h5>SECURITY-266 / CVE-2016-3724</h5>
<p>Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration</p>
<h5>SECURITY-273 / CVE-2016-3725</h5>
<p>Regular users can trigger download of update site metadata</p>
<h5>SECURITY-276 / CVE-2016-3726</h5>
<p>Open redirect to scheme-relative URLs</p>
<h5>SECURITY-281 / CVE-2016-3727</h5>
<p>Granting the permission to read node configurations allows access to overall system configuration</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3721</cvename>
<cvename>CVE-2016-3722</cvename>
<cvename>CVE-2016-3723</cvename>
<cvename>CVE-2016-3724</cvename>
<cvename>CVE-2016-3725</cvename>
<cvename>CVE-2016-3726</cvename>
<cvename>CVE-2016-3727</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-05-12</entry>
</dates>
</vuln>
<vuln vid="d9f99491-1656-11e6-94fa-002590263bf5">
<topic>perl5 -- taint mechanism bypass vulnerability</topic>
<affects>
<package>
<name>perl5</name>
<range><lt>5.18.4_21</lt></range>
<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
</package>
<package>
<name>perl5.18</name>
<range><ge>5.18.0</ge><lt>5.18.4_21</lt></range>
</package>
<package>
<name>perl5.20</name>
<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
</package>
<package>
<name>perl5.22</name>
<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2381">
<p>Perl might allow context-dependent attackers to bypass the taint
protection mechanism in a child process via duplicate environment
variables in envp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2381</cvename>
<freebsdpr>ports/208879</freebsdpr>
</references>
<dates>
<discovery>2016-04-08</discovery>
<entry>2016-05-10</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="3686917b-164d-11e6-94fa-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.5.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Helen Hou-Sandi reports:</p>
<blockquote cite="https://wordpress.org/news/2016/05/wordpress-4-5-2/">
<p>WordPress 4.5.2 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.5.1 and earlier are affected by a SOME
vulnerability through Plupload, the third-party library WordPress
uses for uploading files. WordPress versions 4.2 through 4.5.1 are
vulnerable to reflected XSS using specially crafted URIs through
MediaElement.js, the third-party library used for media players.
MediaElement.js and Plupload have also released updates fixing
these issues.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4566</cvename>
<cvename>CVE-2016-4567</cvename>
<url>https://wordpress.org/news/2016/05/wordpress-4-5-2/</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/07/7</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-05-10</entry>
</dates>
</vuln>
<vuln vid="2b4c8e1f-1609-11e6-b55e-b499baebfeaf">
<topic>libarchive -- RCE vulnerability</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.2.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libarchive project reports:</p>
<blockquote cite="https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7">
<p>Heap-based buffer overflow in the zip_read_mac_metadata function
in archive_read_support_format_zip.c in libarchive before 3.2.0
allows remote attackers to execute arbitrary code via crafted
entry-size values in a ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1541</cvename>
<url>https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7</url>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-09</entry>
<modified>2016-05-10</modified>
</dates>
</vuln>
<vuln vid="25e5205b-1447-11e6-9ead-6805ca0b3d42">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.0.0</ge><lt>3.5.18</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid development team reports:</p>
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<cvename>CVE-2016-4553</cvename>
<cvename>CVE-2016-4554</cvename>
<cvename>CVE-2016-4555</cvename>
<cvename>CVE-2016-4556</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_7.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_8.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_9.txt</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-05-07</entry>
<modified>2016-05-09</modified>
</dates>
</vuln>
<vuln vid="0d724b05-687f-4527-9c03-af34d3b094ec">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.3.9_1,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openwall reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/03/18">
<p>Insufficient filtering for filename passed to delegate's command
allows remote code execution during conversion of several file
formats. Any service which uses ImageMagick to process user
supplied images and uses default delegates.xml / policy.xml,
may be vulnerable to this issue.</p>
<p>It is possible to make ImageMagick perform a HTTP GET or FTP
request</p>
<p>It is possible to delete files by using ImageMagick's 'ephemeral'
pseudo protocol which deletes files after reading.</p>
<p>It is possible to move image files to file with any extension
in any folder by using ImageMagick's 'msl' pseudo protocol.
msl.txt and image.gif should exist in known location - /tmp/
for PoC (in real life it may be web service written in PHP,
which allows to upload raw txt files and process images with
ImageMagick).</p>
<p>It is possible to get content of the files from the server
by using ImageMagick's 'label' pseudo protocol.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3714</cvename>
<cvename>CVE-2016-3715</cvename>
<cvename>CVE-2016-3716</cvename>
<cvename>CVE-2016-3717</cvename>
<cvename>CVE-2016-3718</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/05/03/18</url>
<url>https://imagetragick.com/</url>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2016-05-06</entry>
<modified>2016-05-07</modified>
</dates>
</vuln>
<vuln vid="a6cd01fa-11bd-11e6-bb3c-9cb654ea3e1c">
<topic>jansson -- local denial of service vulnerabilities</topic>
<affects>
<package>
<name>jansson</name>
<range><lt>2.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>QuickFuzz reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/01/5">
<p>A crash caused by stack exhaustion parsing a JSON was found.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/05/01/5</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/02/1</url>
<cvename>CVE-2016-4425</cvename>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-04</entry>
</dates>
</vuln>
<vuln vid="01d729ca-1143-11e6-b55e-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_11</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_8</lt></range>
</package>
<package>
<name>libressl</name>
<range><ge>2.3.0</ge><lt>2.3.4</lt></range>
<range><lt>2.2.7</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.3.4</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_2</lt></range>
<range><ge>10.2</ge><lt>10.2_16</lt></range>
<range><ge>10.1</ge><lt>10.1_33</lt></range>
<range><ge>9.3</ge><lt>9.3_41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160503.txt">
<p>Memory corruption in the ASN.1 encoder</p>
<p>Padding oracle in AES-NI CBC MAC check</p>
<p>EVP_EncodeUpdate overflow</p>
<p>EVP_EncryptUpdate overflow</p>
<p>ASN.1 BIO excessive memory allocation</p>
<p>EBCDIC overread (OpenSSL only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160503.txt</url>
<url>https://marc.info/?l=openbsd-tech&m=146228598730414</url>
<cvename>CVE-2016-2105</cvename>
<cvename>CVE-2016-2106</cvename>
<cvename>CVE-2016-2107</cvename>
<cvename>CVE-2016-2108</cvename>
<cvename>CVE-2016-2109</cvename>
<cvename>CVE-2016-2176</cvename>
<freebsdsa>SA-16:17.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2016-05-03</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="95564990-1138-11e6-b55e-b499baebfeaf">
<cancelled superseded="01d729ca-1143-11e6-b55e-b499baebfeaf"/>
</vuln>
<vuln vid="be72e773-1131-11e6-94fa-002590263bf5">
<topic>gitlab -- privilege escalation via "impersonate" feature</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.2.0</ge><lt>8.2.5</lt></range>
<range><ge>8.3.0</ge><lt>8.3.9</lt></range>
<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
<range><ge>8.5.0</ge><lt>8.5.12</lt></range>
<range><ge>8.6.0</ge><lt>8.6.8</lt></range>
<range><ge>8.7.0</ge><lt>8.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/">
<p>During an internal code review, we discovered a critical security
flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2,
this feature was intended to allow an administrator to simulate
being logged in as any other user.</p>
<p>A part of this feature was not properly secured and it was possible
for any authenticated user, administrator or not, to "log in" as any
other user, including administrators. Please see the issue for more
details.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4340</cvename>
<freebsdpr>ports/209225</freebsdpr>
<url>https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/</url>
<url>https://gitlab.com/gitlab-org/gitlab-ce/issues/15548</url>
</references>
<dates>
<discovery>2016-05-02</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="5764c634-10d2-11e6-94fa-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-bcmath</name>
<name>php70-exif</name>
<name>php70-gd</name>
<name>php70-xml</name>
<range><lt>7.0.6</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-bcmath</name>
<name>php56-exif</name>
<name>php56-gd</name>
<name>php56-xml</name>
<range><lt>5.6.21</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-bcmath</name>
<name>php55-exif</name>
<name>php55-gd</name>
<name>php55-xml</name>
<range><lt>5.5.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.35">
<ul><li>BCMath:
<ul>
<li>Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
_one_ definition).</li>
</ul></li>
<li>Exif:
<ul>
<li>Fixed bug #72094 (Out of bounds heap read access in exif header
processing).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #71912 (libgd: signedness vulnerability).
(CVE-2016-3074)</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos
with negative offset).</li>
</ul></li>
<li>XML:
<ul>
<li>Fixed bug #72099 (xml_parse_into_struct segmentation fault).
</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3074</cvename>
<freebsdpr>ports/209145</freebsdpr>
<url>http://www.php.net/ChangeLog-7.php#7.0.6</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.21</url>
<url>http://www.php.net/ChangeLog-5.php#5.5.35</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="a1134048-10c6-11e6-94fa-002590263bf5">
<topic>libksba -- local denial of service vulnerabilities</topic>
<affects>
<package>
<name>libksba</name>
<range><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Prpic, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/29/5">
<p>Denial of Service due to stack overflow in src/ber-decoder.c.</p>
<p>Integer overflow in the BER decoder src/ber-decoder.c.</p>
<p>Integer overflow in the DN decoder src/dn.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4353</cvename>
<cvename>CVE-2016-4354</cvename>
<cvename>CVE-2016-4355</cvename>
<cvename>CVE-2016-4356</cvename>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a</url>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887</url>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3</url>
<url>https://security.gentoo.org/glsa/201604-04</url>
<mlist>http://www.openwall.com/lists/oss-security/2016/04/29/5</mlist>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="7e36c369-10c0-11e6-94fa-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-19</p>
<p>The NCP dissector could crash. (Bug 11591)</p></li>
<li><p>wnpa-sec-2016-20</p>
<p>TShark could crash due to a packet reassembly bug. (Bug 11799)
</p></li>
<li><p>wnpa-sec-2016-21</p>
<p>The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187)
</p></li>
<li><p>wnpa-sec-2016-22</p>
<p>The PKTC dissector could crash. (Bug 12206)</p></li>
<li><p>wnpa-sec-2016-23</p>
<p>The PKTC dissector could crash. (Bug 12242)</p></li>
<li><p>wnpa-sec-2016-24</p>
<p>The IAX2 dissector could go into an infinite loop. (Bug
12260)</p></li>
<li><p>wnpa-sec-2016-25</p>
<p>Wireshark and TShark could exhaust the stack. (Bug 12268)</p>
</li>
<li><p>wnpa-sec-2016-26</p>
<p>The GSM CBCH dissector could crash. (Bug 12278)</p></li>
<li><p>wnpa-sec-2016-27</p>
<p>MS-WSP dissector crash. (Bug 12341)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4076</cvename>
<cvename>CVE-2016-4077</cvename>
<cvename>CVE-2016-4078</cvename>
<cvename>CVE-2016-4079</cvename>
<cvename>CVE-2016-4080</cvename>
<cvename>CVE-2016-4081</cvename>
<cvename>CVE-2016-4006</cvename>
<cvename>CVE-2016-4082</cvename>
<cvename>CVE-2016-4083</cvename>
<cvename>CVE-2016-4084</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/25/2</url>
</references>
<dates>
<discovery>2016-04-22</discovery>
<entry>2016-05-02</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="78abc022-0fee-11e6-9a1c-0014a5a57822">
<topic>mercurial -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>3.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial reports:</p>
<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29">
<p>CVE-2016-3105: Arbitrary code execution when converting
Git repos</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3105</cvename>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29</url>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-01</entry>
</dates>
</vuln>
<vuln vid="8c2b2f11-0ebe-11e6-b55e-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.25</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.12</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.12</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>percona-server</name>
<range><lt>5.6.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL">
<p>Critical Patch Update contains 31 new security fixes for Oracle MySQL
5.5.48, 5.6.29, 5.7.11 and earlier</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/</url>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0639</cvename>
<cvename>CVE-2015-3194</cvename>
<cvename>CVE-2016-0640</cvename>
<cvename>CVE-2016-0641</cvename>
<cvename>CVE-2016-3461</cvename>
<cvename>CVE-2016-2047</cvename>
<cvename>CVE-2016-0642</cvename>
<cvename>CVE-2016-0643</cvename>
<cvename>CVE-2016-0644</cvename>
<cvename>CVE-2016-0646</cvename>
<cvename>CVE-2016-0647</cvename>
<cvename>CVE-2016-0648</cvename>
<cvename>CVE-2016-0649</cvename>
<cvename>CVE-2016-0650</cvename>
<cvename>CVE-2016-0652</cvename>
<cvename>CVE-2016-0653</cvename>
<cvename>CVE-2016-0654</cvename>
<cvename>CVE-2016-0655</cvename>
<cvename>CVE-2016-0656</cvename>
<cvename>CVE-2016-0657</cvename>
<cvename>CVE-2016-0658</cvename>
<cvename>CVE-2016-0651</cvename>
<cvename>CVE-2016-0659</cvename>
<cvename>CVE-2016-0661</cvename>
<cvename>CVE-2016-0662</cvename>
<cvename>CVE-2016-0663</cvename>
<cvename>CVE-2016-0665</cvename>
<cvename>CVE-2016-0666</cvename>
<cvename>CVE-2016-0667</cvename>
<cvename>CVE-2016-0668</cvename>
</references>
<dates>
<discovery>2016-04-19</discovery>
<entry>2016-04-30</entry>
</dates>
</vuln>
<vuln vid="f2d4f879-0d7c-11e6-925f-6805ca0b3d42">
<topic>logstash -- password disclosure vulnerability</topic>
<affects>
<package>
<name>logstash</name>
<range><ge>2.1.0</ge><lt>2.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Logstash developers report:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18">
<h2>Passwords Printed in Log Files under Some Conditions</h2>
<p>It was discovered that, in Logstash 2.1.0+, log messages
generated by a stalled pipeline during shutdown will print
plaintext contents of password fields. While investigating
this issue we also discovered that debug logging has
included this data for quite some time. Our latest releases
fix both leaks. You will want to scrub old log files if this
is of particular concern to you. This was fixed in issue
#4965</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18</url>
<url>https://github.com/elastic/logstash/pull/4965</url>
</references>
<dates>
<discovery>2016-04-01</discovery>
<entry>2016-04-28</entry>
</dates>
</vuln>
<vuln vid="c8174b63-0d3a-11e6-b06e-d43d7eed0ce2">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.4</lt></range>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2167-advisory.txt">
<p>svnserve, the svn:// protocol server, can optionally use the Cyrus
SASL library for authentication, integrity protection, and encryption.
Due to a programming oversight, authentication against Cyrus SASL
would permit the remote user to specify a realm string which is
a prefix of the expected realm string.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2168-advisory.txt">
<p>Subversion's httpd servers are vulnerable to a remotely triggerable crash
in the mod_authz_svn module. The crash can occur during an authorization
check for a COPY or MOVE request with a specially crafted header value.</p>
<p>This allows remote attackers to cause a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2167</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2167-advisory.txt</url>
<cvename>CVE-2016-2168</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2168-advisory.txt</url>
</references>
<dates>
<discovery>2016-04-21</discovery>
<entry>2016-04-28</entry>
</dates>
</vuln>
<vuln vid="b2487d9a-0c30-11e6-acd0-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p7</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.92</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_1</lt></range>
<range><ge>10.2</ge><lt>10.2_15</lt></range>
<range><ge>10.1</ge><lt>10.1_32</lt></range>
<range><ge>9.3</ge><lt>9.3_40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p7, released on Tuesday, 26 April 2016:</p>
<ul>
<li>Bug 3020 / CVE-2016-1551: Refclock impersonation
vulnerability, AKA: refclock-peering. Reported by
Matt Street and others of Cisco ASIG</li>
<li>Bug 3012 / CVE-2016-1549: Sybil vulnerability:
ephemeral association attack, AKA: ntp-sybil -
MITIGATION ONLY. Reported by Matthew Van Gundy
of Cisco ASIG</li>
<li>Bug 3011 / CVE-2016-2516: Duplicate IPs on
unconfig directives will cause an assertion botch.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3010 / CVE-2016-2517: Remote configuration
trustedkey/requestkey values are not properly
validated. Reported by Yihan Lian of the Cloud
Security Team, Qihoo 360</li>
<li>Bug 3009 / CVE-2016-2518: Crafted addpeer with
hmode > 7 causes array wraparound with MATCH_ASSOC.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3008 / CVE-2016-2519: ctl_getitem() return
value not always checked. Reported by Yihan Lian
of the Cloud Security Team, Qihoo 360</li>
<li>Bug 3007 / CVE-2016-1547: Validate crypto-NAKs,
AKA: nak-dos. Reported by Stephen Gray and
Matthew Van Gundy of Cisco ASIG</li>
<li>Bug 2978 / CVE-2016-1548: Interleave-pivot -
MITIGATION ONLY. Reported by Miroslav Lichvar of
RedHat and separately by Jonathan Gardner of
Cisco ASIG.</li>
<li>Bug 2952 / CVE-2015-7704: KoD fix: peer
associations were broken by the fix for
NtpBug2901, AKA: Symmetric active/passive mode
is broken. Reported by Michael Tatarinov,
NTP Project Developer Volunteer</li>
<li>Bug 2945 / Bug 2901 / CVE-2015-8138: Zero
Origin Timestamp Bypass, AKA: Additional KoD Checks.
Reported by Jonathan Gardner of Cisco ASIG</li>
<li>Bug 2879 / CVE-2016-1550: Improve NTP security
against buffer comparison timing attacks,
authdecrypt-timing, AKA: authdecrypt-timing.
Reported independently by Loganaden Velvindron,
and Matthew Van Gundy and Stephen Gray of
Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:16.ntp</freebsdsa>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2016-1547</cvename>
<cvename>CVE-2016-1548</cvename>
<cvename>CVE-2016-1549</cvename>
<cvename>CVE-2016-1550</cvename>
<cvename>CVE-2016-1551</cvename>
<cvename>CVE-2016-2516</cvename>
<cvename>CVE-2016-2517</cvename>
<cvename>CVE-2016-2518</cvename>
<cvename>CVE-2016-2519</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="92d44f83-a7bf-41cf-91ee-3d1b8ecf579f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>46.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.43</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>39.0,1</ge><lt>45.1.0,1</lt></range>
<range><lt>38.8.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>39.0</ge><lt>45.1.0</lt></range>
<range><lt>38.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46">
<p>MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 /
rv:45.1 / rv:38.8)</p>
<p>MFSA 2016-42 Use-after-free and buffer overflow
in Service Workers</p>
<p>MFSA 2016-44 Buffer overflow in libstagefright with
CENC offsets</p>
<p>MFSA 2016-45 CSP not applied to pages sent with
multipart/x-mixed-replace</p>
<p>MFSA 2016-46 Elevation of privilege with
chrome.tabs.update API in web extensions</p>
<p>MFSA 2016-47 Write to invalid HashMap entry through
JavaScript.watch()</p>
<p>MFSA 2016-48 Firefox Health Reports could accept events
from untrusted domains</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2804</cvename>
<cvename>CVE-2016-2805</cvename>
<cvename>CVE-2016-2806</cvename>
<cvename>CVE-2016-2807</cvename>
<cvename>CVE-2016-2808</cvename>
<cvename>CVE-2016-2811</cvename>
<cvename>CVE-2016-2812</cvename>
<cvename>CVE-2016-2814</cvename>
<cvename>CVE-2016-2816</cvename>
<cvename>CVE-2016-2817</cvename>
<cvename>CVE-2016-2820</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-39/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-42/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-44/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-45/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-46/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-47/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-48/</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-26</entry>
</dates>
</vuln>
<vuln vid="f87a9376-0943-11e6-8fc4-00a0986f28c4">
<topic>phpmyfaq -- cross-site request forgery vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/security/advisory-2016-04-11">
<p>The vulnerability exists due to application does not properly
verify origin of HTTP requests in "Interface Translation"
functionality.: A remote unauthenticated attacker can create
a specially crafted malicious web page with CSRF exploit, trick
a logged-in administrator to visit the page, spoof the HTTP
request, as if it was coming from the legitimate user, inject
and execute arbitrary PHP code on the target system with privileges
of the webserver.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/security/advisory-2016-04-11</url>
<url>https://www.htbridge.com/advisory/HTB23300</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-23</entry>
</dates>
</vuln>
<vuln vid="1b0d2938-0766-11e6-94fa-002590263bf5">
<topic>libtasn1 -- denial of service parsing malicious DER certificates</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Libtasn1 NEWS reports:</p>
<blockquote cite="http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37">
<p>Fixes to avoid an infinite recursion when decoding without the
ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4008</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/13/3</url>
<url>http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="e05bfc92-0763-11e6-94fa-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:5 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_5.txt">
<p>Due to incorrect buffer management Squid cachemgr.cgi tool is
vulnerable to a buffer overflow when processing remotely supplied
inputs relayed to it from Squid.</p>
<p>This problem allows any client to seed the Squid manager reports
with data that will cause a buffer overflow when processed by the
cachemgr.cgi tool. However, this does require manual administrator
actions to take place. Which greatly reduces the impact and
possible uses.</p>
</blockquote>
<p>Squid security advisory 2016:6 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_6.txt">
<p>Due to buffer overflow issues Squid is vulnerable to a denial of
service attack when processing ESI responses. Due to incorrect input
validation Squid is vulnerable to public information disclosure of
the server stack layout when processing ESI responses. Due to
incorrect input validation and buffer overflow Squid is vulnerable
to remote code execution when processing ESI responses.</p>
<p>These problems allow ESI components to be used to perform a denial
of service attack on the Squid service and all other services on the
same machine. Under certain build conditions these problems allow
remote clients to view large sections of the server memory. However,
the bugs are exploitable only if you have built and configured the
ESI features to be used by a reverse-proxy and if the ESI components
being processed by Squid can be controlled by an attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4051</cvename>
<cvename>CVE-2016-4052</cvename>
<cvename>CVE-2016-4053</cvename>
<cvename>CVE-2016-4054</cvename>
<freebsdpr>ports/208939</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_5.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_6.txt</url>
</references>
<dates>
<discovery>2016-04-20</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="253c6889-06f0-11e6-925f-6805ca0b3d42">
<topic>ansible -- use of predictable paths in lxc_container</topic>
<affects>
<package>
<name>ansible</name>
<range><ge>2.0.0.0</ge><lt>2.0.2.0</lt></range>
</package>
<package>
<name>ansible1</name>
<range><lt>1.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4">
<p>CVE-2016-3096: do not use predictable paths in lxc_container</p>
<ul>
<li>do not use a predictable filename for the LXC attach
script</li>
<li>don't use predictable filenames for LXC attach script
logging</li>
<li>don't set a predictable archive_path</li>
</ul>
<p>this should prevent symlink attacks which could result
in</p>
<ul>
<li>data corruption</li>
<li>data leakage</li>
<li>privilege escalation</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3096</cvename>
<url>https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1322925</url>
</references>
<dates>
<discovery>2016-04-02</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="a733b5ca-06eb-11e6-817f-3085a9a4510d">
<topic>proftpd -- vulnerability in mod_tls</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5b</lt></range>
<range><eq>1.3.6.r1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3125">
<p>The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before
1.3.6rc2 does not properly handle the TLSDHParamFile directive, which
might cause a weaker than intended Diffie-Hellman (DH) key to be used
and consequently allow attackers to have unspecified impact via
unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3125</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="6d8505f0-0614-11e6-b39c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html">
<p>20 security fixes in this release, including:</p>
<ul>
<li>[590275] High CVE-2016-1652: Universal XSS in extension
bindings. Credit to anonymous.</li>
<li>[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit
to Choongwoo Han.</li>
<li>[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium
JPEG2000 decoding. Credit to kdot working with HP's Zero Day
Initiative.</li>
<li>[589512] Medium CVE-2016-1654: Uninitialized memory read in
media. Credit to Atte Kettunen of OUSPG.</li>
<li>[582008] Medium CVE-2016-1655: Use-after-free related to
extensions. Credit to Rob Wu.</li>
<li>[570750] Medium CVE-2016-1656: Android downloaded file path
restriction bypass. Credit to Dzmitry Lukyanenko.</li>
<li>[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to
Luan Herrera.</li>
<li>[573317] Low CVE-2016-1658: Potential leak of sensitive
information to malicious extensions. Credit to Antonio Sanso
(@asanso) of Adobe.</li>
<li>[602697] CVE-2016-1659: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1651</cvename>
<cvename>CVE-2016-1652</cvename>
<cvename>CVE-2016-1653</cvename>
<cvename>CVE-2016-1654</cvename>
<cvename>CVE-2016-1655</cvename>
<cvename>CVE-2016-1656</cvename>
<cvename>CVE-2016-1657</cvename>
<cvename>CVE-2016-1658</cvename>
<cvename>CVE-2016-1659</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html</url>
</references>
<dates>
<discovery>2016-04-13</discovery>
<entry>2016-04-19</entry>
</dates>
</vuln>
<vuln vid="976567f6-05c5-11e6-94fa-002590263bf5">
<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.5_1</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt">
<p>wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 -
CVE-2015-5310)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt">
<p>EAP-pwd missing last fragment length validation. (2015-7 -
CVE-2015-5315)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt">
<p>EAP-pwd peer error path failure on unexpected Confirm message.
(2015-8 - CVE-2015-5316)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5310</cvename>
<cvename>CVE-2015-5315</cvename>
<cvename>CVE-2015-5316</cvename>
<freebsdpr>ports/208482</freebsdpr>
<url>http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt</url>
<url>http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt</url>
<url>http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2016-04-19</entry>
<modified>2017-03-22</modified>
</dates>
</vuln>
<vuln vid="092156c9-04d7-11e6-b1ce-002590263bf5">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7912">
<p>The get_option function in dhcp.c in dhcpcd before 6.2.0, as used
in dhcpcd 5.x in Android before 5.1 and other products, does not
validate the relationship between length fields and the amount of
data, which allows remote DHCP servers to execute arbitrary code or
cause a denial of service (memory corruption) via a large length
value of an option in a DHCPACK message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7912</cvename>
<url>http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe</url>
</references>
<dates>
<discovery>2015-06-19</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7913">
<p>The print_option function in dhcp-common.c in dhcpcd through 6.9.1,
as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other
products, misinterprets the return value of the snprintf function,
which allows remote DHCP servers to execute arbitrary code or cause
a denial of service (memory corruption) via a crafted message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7913</cvename>
<freebsdpr>ports/208702</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="e21474c6-031a-11e6-aa86-001999f8d30b">
<topic>PJSIP -- TCP denial of service in PJProject</topic>
<affects>
<package>
<name>pjsip</name>
<range><le>2.4.5</le></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><le>2.4.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>PJProject has a limit on the number of TCP connections
that it can accept. Furthermore, PJProject does not close
TCP connections it accepts. By default, this value is
approximately 60.</p>
<p>An attacker can deplete the number of allowed TCP
connections by opening TCP connections and sending no
data to Asterisk.</p>
<p>If PJProject has been compiled in debug mode, then
once the number of allowed TCP connections has been
depleted, the next attempted TCP connection to Asterisk
will crash due to an assertion in PJProject.</p>
<p>If PJProject has not been compiled in debug mode, then
any further TCP connection attempts will be rejected.
This makes Asterisk unable to process TCP SIP traffic.</p>
<p>Note that this only affects TCP/TLS, since UDP is
connectionless.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-005.html</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="ee50726e-0319-11e6-aa86-001999f8d30b">
<topic>asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk may crash when processing an incoming REGISTER
request if that REGISTER contains a Contact header with
a lengthy URI.</p>
<p>This crash will only happen for requests that pass
authentication. Unauthenticated REGISTER requests will
not result in a crash occurring.</p>
<p>This vulnerability only affects Asterisk when using
PJSIP as its SIP stack. The chan_sip module does not have
this problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-004.html</url>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="f2217cdf-01e4-11e6-b1ce-002590263bf5">
<topic>go -- remote denial of service</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.6.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/05/2">
<p>Go has an infinite loop in several big integer routines that makes
Go programs vulnerable to remote denial of service attacks. Programs
using HTTPS client authentication or the Go ssh server libraries are
both exposed to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3959</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/05/2</url>
<url>https://golang.org/cl/21533</url>
</references>
<dates>
<discovery>2016-04-05</discovery>
<entry>2016-04-14</entry>
</dates>
</vuln>
<vuln vid="a636fc26-00d9-11e6-b704-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_3</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.11</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.8</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.4.2">
<p>[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
(crashes and high cpu consumption) and man in the middle attacks.</p>
<p>[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected.
A man in the middle is able to clear even required flags, especially
NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.</p>
<p>[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
attackers to spoof the computer name of a secure channel's endpoints, and obtain
sensitive session information, by running a crafted application and leveraging
the ability to sniff network traffic.</p>
<p>[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections
to no integrity protection.</p>
<p>[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
connections (with ldaps://) and ncacn_http connections (with https://).</p>
<p>[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.</p>
<p>[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
the default for most the file server related protocols) is inherited from the underlying SMB connection.</p>
<p>[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic
between a client and a server in order to impersonate the client and get the same privileges
as the authenticated user account. This is most problematic against active directory domain controllers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5370</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5370.html</url>
<cvename>CVE-2016-2110</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2110.html</url>
<cvename>CVE-2016-2111</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2111.html</url>
<cvename>CVE-2016-2112</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2112.html</url>
<cvename>CVE-2016-2113</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2113.html</url>
<cvename>CVE-2016-2114</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2114.html</url>
<cvename>CVE-2016-2115</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2115.html</url>
<cvename>CVE-2016-2118</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2118.html</url>
</references>
<dates>
<discovery>2016-04-12</discovery>
<entry>2016-04-12</entry>
<modified>2016-04-12</modified>
</dates>
</vuln>
<vuln vid="482d40cb-f9a3-11e5-92ce-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-fileinfo</name>
<name>php70-mbstring</name>
<name>php70-phar</name>
<name>php70-snmp</name>
<range><lt>7.0.5</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-fileinfo</name>
<name>php56-mbstring</name>
<name>php56-phar</name>
<name>php56-snmp</name>
<range><lt>5.6.20</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-fileinfo</name>
<name>php55-mbstring</name>
<name>php55-phar</name>
<name>php55-snmp</name>
<range><lt>5.5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.5">
<ul><li>Fileinfo:
<ul>
<li>Fixed bug #71527 (Buffer over-write in finfo_open with
malformed magic file).</li>
</ul></li>
<li>mbstring:
<ul>
<li>Fixed bug #71906 (AddressSanitizer: negative-size-param (-1)
in mbfl_strcut).</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71860 (Invalid memory write in phar on filename with
\0 in name).</li>
</ul></li>
<li>SNMP:
<ul>
<li>Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug #71798 (Integer Overflow in php_raw_url_encode).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/208465</freebsdpr>
<url>http://php.net/ChangeLog-7.php#7.0.5</url>
<url>http://php.net/ChangeLog-5.php#5.6.20</url>
<url>http://php.net/ChangeLog-5.php#5.5.34</url>
</references>
<dates>
<discovery>2016-03-31</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="497b82e0-f9a0-11e5-92ce-002590263bf5">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283">
<p>The pcre_compile2 function in pcre_compile.c in PCRE 8.38
mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/
pattern and related patterns with named subgroups, which allows
remote attackers to cause a denial of service (heap-based buffer
overflow) or possibly have unspecified other impact via a crafted
regular expression, as demonstrated by a JavaScript RegExp object
encountered by Konqueror.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1283</cvename>
<freebsdpr>ports/208260</freebsdpr>
<url>https://bugs.exim.org/show_bug.cgi?id=1767</url>
</references>
<dates>
<discovery>2016-02-27</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="df328fac-f942-11e5-92ce-002590263bf5">
<topic>py-djblets -- Self-XSS vulnerability</topic>
<affects>
<package>
<name>py27-djblets</name>
<name>py32-djblets</name>
<name>py33-djblets</name>
<name>py34-djblets</name>
<name>py35-djblets</name>
<range><lt>0.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Djblets Release Notes reports:</p>
<blockquote cite="https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/">
<p>A recently-discovered vulnerability in the datagrid templates allows an
attacker to generate a URL to any datagrid page containing malicious code
in a column sorting value. If the user visits that URL and then clicks
that column, the code will execute.</p>
<p>The cause of the vulnerability was due to a template not escaping
user-provided values.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="a430e15d-f93f-11e5-92ce-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.11</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.5</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0003: Incorrect capability check when displaying
users emails in Participants list</p></li>
<li><p>MSA-16-0004: XSS from profile fields from external db</p>
</li>
<li><p>MSA-16-0005: Reflected XSS in mod_data advanced search</p>
</li>
<li><p>MSA-16-0006: Hidden courses are shown to students in Event
Monitor</p></li>
<li><p>MSA-16-0007: Non-Editing Instructor role can edit exclude
checkbox in Single View</p></li>
<li><p>MSA-16-0008: External function get_calendar_events return
events that pertains to hidden activities</p></li>
<li><p>MSA-16-0009: CSRF in Assignment plugin management page</p>
</li>
<li><p>MSA-16-0010: Enumeration of category details possible without
authentication</p></li>
<li><p>MSA-16-0011: Add no referrer to links with _blank target
attribute</p></li>
<li><p>MSA-16-0012: External function mod_assign_save_submission
does not check due dates</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2151</cvename>
<cvename>CVE-2016-2152</cvename>
<cvename>CVE-2016-2153</cvename>
<cvename>CVE-2016-2154</cvename>
<cvename>CVE-2016-2155</cvename>
<cvename>CVE-2016-2156</cvename>
<cvename>CVE-2016-2157</cvename>
<cvename>CVE-2016-2158</cvename>
<cvename>CVE-2016-2190</cvename>
<cvename>CVE-2016-2159</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-03-21</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="297117ba-f92d-11e5-92ce-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:3 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_3.txt">
<p>Due to a buffer overrun Squid pinger binary is vulnerable to
denial of service or information leak attack when processing
ICMPv6 packets.</p>
<p>This bug also permits the server response to manipulate other
ICMP and ICMPv6 queries processing to cause information leak.</p>
<p>This bug allows any remote server to perform a denial of service
attack on the Squid service by crashing the pinger. This may
affect Squid HTTP routing decisions. In some configurations,
sub-optimal routing decisions may result in serious service
degradation or even transaction failures.</p>
<p>If the system does not contain buffer-overrun protection leading
to that crash this bug will instead allow attackers to leak
arbitrary amounts of information from the heap into Squid log
files. This is of higher importance than usual because the pinger
process operates with root priviliges.</p>
</blockquote>
<p>Squid security advisory 2016:4 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_4.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>This problem allows a malicious client script and remote server
delivering certain unusual HTTP response syntax to trigger a
denial of service for all clients accessing the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3947</cvename>
<cvename>CVE-2016-3948</cvename>
<freebsdpr>ports/208463</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_3.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_4.txt</url>
</references>
<dates>
<discovery>2016-03-28</discovery>
<entry>2016-04-02</entry>
</dates>
</vuln>
<vuln vid="97a24d2e-f74c-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql95-server</name>
<name>postgresql95-contrib</name>
<range><ge>9.5.0</ge><lt>9.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1656/">
<p>Security Fixes for RLS, BRIN</p>
<p>
This release closes security hole CVE-2016-2193
(https://access.redhat.com/security/cve/CVE-2016-2193), where a query
plan might get reused for more than one ROLE in the same session.
This could cause the wrong set of Row Level Security (RLS) policies to
be used for the query.</p>
<p>
The update also fixes CVE-2016-3065
(https://access.redhat.com/security/cve/CVE-2016-3065), a server crash
bug triggered by using `pageinspect` with BRIN index pages. Since an
attacker might be able to expose a few bytes of server memory, this
crash is being treated as a security issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2193</cvename>
<cvename>CVE-2016-3065</cvename>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="f7b3d1eb-f738-11e5-a710-0011d823eebd">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.577</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-08.html">
<p>These updates resolve integer overflow vulnerabilities that
could lead to code execution (CVE-2016-0963, CVE-2016-0993,
CVE-2016-1010).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-0987, CVE-2016-0988,
CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995,
CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,
CVE-2016-1000).</p>
<p>These updates resolve a heap overflow vulnerability that could
lead to code execution (CVE-2016-1001).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2016-0960, CVE-2016-0961,
CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992,
CVE-2016-1002, CVE-2016-1005).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0960</cvename>
<cvename>CVE-2016-0961</cvename>
<cvename>CVE-2016-0962</cvename>
<cvename>CVE-2016-0963</cvename>
<cvename>CVE-2016-0986</cvename>
<cvename>CVE-2016-0987</cvename>
<cvename>CVE-2016-0988</cvename>
<cvename>CVE-2016-0989</cvename>
<cvename>CVE-2016-0990</cvename>
<cvename>CVE-2016-0991</cvename>
<cvename>CVE-2016-0992</cvename>
<cvename>CVE-2016-0993</cvename>
<cvename>CVE-2016-0994</cvename>
<cvename>CVE-2016-0995</cvename>
<cvename>CVE-2016-0996</cvename>
<cvename>CVE-2016-0997</cvename>
<cvename>CVE-2016-0998</cvename>
<cvename>CVE-2016-0999</cvename>
<cvename>CVE-2016-1000</cvename>
<cvename>CVE-2016-1001</cvename>
<cvename>CVE-2016-1002</cvename>
<cvename>CVE-2016-1005</cvename>
<cvename>CVE-2016-1010</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-08.html</url>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="4cd9b19f-f66d-11e5-b94c-001999f8d30b">
<topic>Multiple vulnerabilities in Botan</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/security.html">
<p>Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.</p>
<p>Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.</p>
<p>The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.</p>
<p>The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.</p>
<p>On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2016-2194</cvename>
<cvename>CVE-2016-2195</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="2004616d-f66c-11e5-b94c-001999f8d30b">
<topic>Botan BER Decoder vulnerabilities</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/">
<p>Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.</p>
<p>Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2015-5726</cvename>
<cvename>CVE-2015-5727</cvename>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="e1085b15-f609-11e5-a230-0014a5a57822">
<topic>mercurial -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial reports:</p>
<blockquote cite="https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html">
<p>CVE-2016-3630: Remote code execution in binary delta decoding</p>
<p>CVE-2016-3068: Arbitrary code execution with Git subrepos</p>
<p>CVE-2016-3069: Arbitrary code execution when converting
Git repos</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3630</cvename>
<cvename>CVE-2016-3068</cvename>
<cvename>CVE-2016-3069</cvename>
<url>https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html</url>
</references>
<dates>
<discovery>2016-03-29</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="8be8ca39-ae70-4422-bf1a-d8fae6911c5e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html">
<p>[594574] High CVE-2016-1646: Out-of-bounds read in V8.</p>
<p>[590284] High CVE-2016-1647: Use-after-free in Navigation.</p>
<p>[590455] High CVE-2016-1648: Use-after-free in Extensions.</p>
<p>[597518] CVE-2016-1650: Various fixes from internal audits,
fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed at the tip of the
4.9 branch</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1646</cvename>
<cvename>CVE-2016-1647</cvename>
<cvename>CVE-2016-1648</cvename>
<cvename>CVE-2016-1649</cvename>
<cvename>CVE-2016-1650</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2016-03-24</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="5c288f68-c7ca-4c0d-b7dc-1ec6295200b3">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.87</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html">
<p>[589838] High CVE-2016-1643: Type confusion in Blink.</p>
<p>[590620] High CVE-2016-1644: Use-after-free in Blink.</p>
<p>[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1643</cvename>
<cvename>CVE-2016-1644</cvename>
<cvename>CVE-2016-1645</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="cd409df7-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01351">
<p>A response containing multiple DNS cookies causes servers with
cookie support enabled to exit with an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2088</cvename>
<url>https://kb.isc.org/article/AA-01351</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
</dates>
</vuln>
<vuln vid="cba246d2-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01353">
<p>A problem parsing resource record signatures for DNAME resource
records can lead to an assertion failure in resolver.c or db.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1286</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01353</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="c9075321-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01352">
<p>An error parsing input received by the rndc control channel can
cause an assertion failure in sexpr.c or alist.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1285</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01352</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6d25c306-f3bb-11e5-92ce-002590263bf5">
<topic>salt -- Insecure configuration of PAM external authentication service</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><lt>2015.5.10</lt></range>
<range><ge>2015.8.0</ge><lt>2015.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html">
<p>This issue affects all Salt versions prior to 2015.8.8/2015.5.10
when PAM external authentication is enabled. This issue involves
passing an alternative PAM authentication service with a command
that is sent to LocalClient, enabling the attacker to bypass the
configured authentication service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3176</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html</url>
</references>
<dates>
<discovery>2016-03-17</discovery>
<entry>2016-03-27</entry>
</dates>
</vuln>
<vuln vid="a258604d-f2aa-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Unsafe deserialization</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt">
<p>JMS Object messages depends on Java Serialization for
marshaling/unmashaling of the message payload. There are a couple of places
inside the broker where deserialization can occur, like web console or stomp
object message transformation. As deserialization of untrusted data can lead to
security flaws as demonstrated in various reports, this leaves the broker
vulnerable to this attack vector. Additionally, applications that consume
ObjectMessage type of messages can be vulnerable as they deserialize objects on
ObjectMessage.getObject() calls.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt</url>
<cvename>CVE-2015-5254</cvename>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="950b2d60-f2a9-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Clickjacking</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Furman reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt">
<p>The web based administration console does not set the
X-Frame-Options header in HTTP responses. This allows the console to be embedded
in a frame or iframe which could then be used to cause a user to perform an
unintended action in the console.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt</url>
<cvename>CVE-2016-0734</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="a6cc5753-f29e-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Cross-Site Scripting</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vladimir Ivanov (Positive Technologies) reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt">
<p>Several instances of cross-site scripting vulnerabilities were
identified to be present in the web based administration console as well as the
ability to trigger a Java memory dump into an arbitrary folder. The root cause
of these issues are improper user data output validation and incorrect
permissions configured on Jolokia.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt</url>
<cvename>CVE-2016-0782</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="7033b42d-ef09-11e5-b766-14dae9d210b8">
<topic>pcre -- stack buffer overflow</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38</lt></range>
</package>
<package>
<name>pcre2</name>
<range><lt>10.20_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philip Hazel reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1791">
<p>PCRE does not validate that handling the (*ACCEPT) verb
will occur within the bounds of the cworkspace stack buffer, leading to
a stack buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=1791</url>
<cvename>CVE-2016-3191</cvename>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-03-21</entry>
<modified>2016-03-21</modified>
</dates>
</vuln>
<vuln vid="c428de09-ed69-11e5-92ce-002590263bf5">
<topic>kamailio -- SEAS Module Heap overflow</topic>
<affects>
<package>
<name>kamailio</name>
<range><lt>4.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stelios Tsampas reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/338">
<p>A (remotely exploitable) heap overflow vulnerability was found in
Kamailio v4.3.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2385</cvename>
<url>https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643</url>
<url>https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/</url>
<url>http://seclists.org/oss-sec/2016/q1/338</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
<modified>2016-04-03</modified>
</dates>
</vuln>
<vuln vid="5dd39f26-ed68-11e5-92ce-002590263bf5">
<topic>hadoop2 -- unauthorized disclosure of data vulnerability</topic>
<affects>
<package>
<name>hadoop2</name>
<range><ge>2.6</ge><lt>2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arun Suresh reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser">
<p>RPC traffic from clients, potentially including authentication
credentials, may be intercepted by a malicious user with access to
run tasks or containers on a cluster.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1776</cvename>
<url>http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
</dates>
</vuln>
<vuln vid="d2a84feb-ebe0-11e5-92ce-002590263bf5">
<topic>git -- integer overflow</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2324">
<p>integer overflow due to a loop which adds more to "len".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2324</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2324</url>
<url>https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-03-18</entry>
</dates>
</vuln>
<vuln vid="93ee802e-ebde-11e5-92ce-002590263bf5">
<topic>git -- potential code execution</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2315">
<p>"int" is the wrong data type for ... nlen assignment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2315</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/03/15/6</url>
<url>https://marc.info/?l=oss-security&m=145809217306686&w=2</url>
<url>https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305</url>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2315</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2016-03-17</entry>
</dates>
</vuln>
<vuln vid="6d33b3e5-ea03-11e5-85be-14dae9d210b8">
<topic>node -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>5.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeremiah Senkpiel reports:</p>
<blockquote cite="https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac">
<ul>
<li><p>Fix a double-free defect in parsing malformed DSA keys
that may potentially be used for DoS or memory corruption attacks.</p></li>
<li><p>Fix a defect that can cause memory corruption in
certain very rare cases</p></li>
<li><p>Fix a defect that makes the CacheBleed Attack possible</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac</url>
<cvename>CVE-2016-0702</cvename>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0797</cvename>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="8eb78cdc-e9ec-11e5-85be-14dae9d210b8">
<topic>dropbear -- authorized_keys command= bypass</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2016.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnson reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Validate X11 forwarding input. Could allow bypass of
authorized_keys command= restrictions</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2016-3116</cvename>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="77b7ffb7-e937-11e5-8bed-5404a68ad561">
<topic>jpgraph2 -- XSS vulnerability</topic>
<affects>
<package>
<name>jpgraph2</name>
<range><lt>3.0.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Barbella reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded">
<p>JpGraph is an object oriented library for PHP that can be used to create
various types of graphs which also contains support for client side
image maps.
The GetURLArguments function for the JpGraph's Graph class does not
properly sanitize the names of get and post variables, leading to a
cross site scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded</url>
</references>
<dates>
<discovery>2009-12-22</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="5af511e5-e928-11e5-92ce-002590263bf5">
<topic>php7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-soap</name>
<range><lt>7.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.4">
<ul><li>Core:
<ul>
<li>Fixed bug #71637 (Multiple Heap Overflow due to integer
overflows in xml/filter_url/addcslashes).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
make_http_soap_request()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.4</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e991ef79-e920-11e5-92ce-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.33</lt></range>
</package>
<package>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.19">
<ul><li>Phar:
<ul>
<li>Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).
</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71587 (Use-After-Free / Double-Free in WDDX
Deserialize).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.6.19</url>
<url>http://php.net/ChangeLog-5.php#5.5.33</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e4644df8-e7da-11e5-829d-c80aa9043978">
<topic>openssh -- command injection when X11Forwarding is enabled</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.2.p2,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_14</lt></range>
<range><ge>10.1</ge><lt>10.1_31</lt></range>
<range><ge>9.3</ge><lt>9.3_39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="http://www.openssh.com/txt/x11fwd.adv">
<p>Missing sanitisation of untrusted input allows an
authenticated user who is able to request X11 forwarding
to inject commands to xauth(1).
</p>
<p>Injection of xauth commands grants the ability to read
arbitrary files under the authenticated user's privilege,
Other xauth commands allow limited information leakage,
file overwrite, port probing and generally expose xauth(1),
which was not written with a hostile user in mind, as an
attack surface.
</p>
<p>Mitigation:</p>
<p>Set X11Forwarding=no in sshd_config. This is the default.</p>
<p>For authorized_keys that specify a "command" restriction,
also set the "restrict" (available in OpenSSH >=7.2) or
"no-x11-forwarding" restrictions.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/x11fwd.adv</url>
<cvename>CVE-2016-3115</cvename>
<freebsdsa>SA-16:14.openssh</freebsdsa>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-11</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="70c44cd0-e717-11e5-85be-14dae9d210b8">
<topic>quagga -- stack based buffer overflow vulnerability</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>1.0.20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Donald Sharp reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/270232">
<p>A malicious BGP peer may execute arbitrary code in
particularly configured remote bgpd hosts.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/270232</url>
<url>http://savannah.nongnu.org/forum/forum.php?forum_id=8476</url>
<cvename>CVE-2016-2342</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="d71831ef-e6f8-11e5-85be-14dae9d210b8">
<topic>ricochet -- information disclosure</topic>
<affects>
<package>
<name>ricochet</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>special reports:</p>
<blockquote cite="https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2">
<p>By sending a nickname with some HTML tags in a contact
request, an attacker could cause Ricochet to make network requests
without Tor after the request is accepted, which would reveal the user's
IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="77e0b631-e6cf-11e5-85be-14dae9d210b8">
<topic>pidgin-otr -- use after free</topic>
<affects>
<package>
<name>pidgin-otr</name>
<range><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Bock reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/572">
<p>The pidgin-otr plugin version 4.0.2 fixes a heap use after
free error.
The bug is triggered when a user tries to authenticate a buddy and
happens in the function create_smp_dialog.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q1/572</url>
<url>https://bugs.otr.im/issues/88</url>
<url>https://bugs.otr.im/issues/128</url>
<cvename>CVE-2015-8833</cvename>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="c2b1652c-e647-11e5-85be-14dae9d210b8">
<topic>libotr -- integer overflow</topic>
<affects>
<package>
<name>libotr</name>
<range><lt>4.1.1</lt></range>
</package>
<package>
<name>libotr3</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X41 D-Sec reports:</p>
<blockquote cite="https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/">
<p>A remote attacker may crash or execute arbitrary code in
libotr by sending large OTR messages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/</url>
<cvename>CVE-2016-2851</cvename>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-03-09</entry>
<modified>2016-03-09</modified>
</dates>
</vuln>
<vuln vid="1bcfd963-e483-41b8-ab8e-bad5c3ce49c9">
<topic>brotli -- buffer overflow</topic>
<affects>
<package>
<name>brotli</name>
<range><ge>0.3.0</ge><lt>0.3.0_1</lt></range>
<range><lt>0.2.0_2</lt></range>
</package>
<package>
<name>libbrotli</name>
<range><lt>0.3.0_3</lt></range>
</package>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.</p>
</blockquote>
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-30/">
<p>Security researcher Luke Li reported a pointer underflow
bug in the Brotli library's decompression that leads to a
buffer overflow. This results in a potentially exploitable
crash when triggered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1624</cvename>
<cvename>CVE-2016-1968</cvename>
<url>https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade</url>
<url>https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-30/</url>
<url>https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="2225c5b4-1e5a-44fc-9920-b3201c384a15">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox45">
<p>MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0
/ rv:38.7)</p>
<p>MFSA 2016-17 Local file overwriting and potential
privilege escalation through CSP reports</p>
<p>MFSA 2016-18 CSP reports fail to strip location
information for embedded iframe pages</p>
<p>MFSA 2016-19 Linux video memory DOS with Intel
drivers</p>
<p>MFSA 2016-20 Memory leak in libstagefright when deleting
an array during MP4 processing</p>
<p>MFSA 2016-21 Displayed page address can be overridden</p>
<p>MFSA 2016-22 Service Worker Manager out-of-bounds read in
Service Worker Manager</p>
<p>MFSA 2016-23 Use-after-free in HTML5 string parser</p>
<p>MFSA 2016-24 Use-after-free in SetBody</p>
<p>MFSA 2016-25 Use-after-free when using multiple WebRTC
data channels</p>
<p>MFSA 2016-26 Memory corruption when modifying a file
being read by FileReader</p>
<p>MFSA 2016-27 Use-after-free during XML
transformations</p>
<p>MFSA 2016-28 Addressbar spoofing though history
navigation and Location protocol property</p>
<p>MFSA 2016-29 Same-origin policy violation using
perfomance.getEntries and history navigation with session
restore</p>
<p>MFSA 2016-31 Memory corruption with malicious NPAPI
plugin</p>
<p>MFSA 2016-32 WebRTC and LibVPX vulnerabilities found
through code inspection</p>
<p>MFSA 2016-33 Use-after-free in GetStaticInstance in
WebRTC</p>
<p>MFSA 2016-34 Out-of-bounds read in HTML parser following
a failed allocation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1952</cvename>
<cvename>CVE-2016-1953</cvename>
<cvename>CVE-2016-1954</cvename>
<cvename>CVE-2016-1955</cvename>
<cvename>CVE-2016-1956</cvename>
<cvename>CVE-2016-1957</cvename>
<cvename>CVE-2016-1958</cvename>
<cvename>CVE-2016-1959</cvename>
<cvename>CVE-2016-1960</cvename>
<cvename>CVE-2016-1961</cvename>
<cvename>CVE-2016-1962</cvename>
<cvename>CVE-2016-1963</cvename>
<cvename>CVE-2016-1964</cvename>
<cvename>CVE-2016-1965</cvename>
<cvename>CVE-2016-1966</cvename>
<cvename>CVE-2016-1967</cvename>
<cvename>CVE-2016-1970</cvename>
<cvename>CVE-2016-1971</cvename>
<cvename>CVE-2016-1972</cvename>
<cvename>CVE-2016-1973</cvename>
<cvename>CVE-2016-1974</cvename>
<cvename>CVE-2016-1975</cvename>
<cvename>CVE-2016-1976</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-16/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-17/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-18/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-19/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-20/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-22/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-23/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-27/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-28/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-29/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-31/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-32/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-33/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-34/</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="adffe823-e692-4921-ae9c-0b825c218372">
<topic>graphite2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.6</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/">
<p>Security researcher Holger Fuhrmannek and Mozilla
security engineer Tyson Smith reported a number of security
vulnerabilities in the Graphite 2 library affecting version
1.3.5.
The issue reported by Holger Fuhrmannek is a mechanism to
induce stack corruption with a malicious graphite font. This
leads to a potentially exploitable crash when the font is
loaded.
Tyson Smith used the Address Sanitizer tool in concert with
a custom software fuzzer to find a series of uninitialized
memory, out-of-bounds read, and out-of-bounds write errors
when working with fuzzed graphite fonts.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/">
<p>Security researcher James Clawson used the Address
Sanitizer tool to discover an out-of-bounds write in the
Graphite 2 library when loading a crafted Graphite font
file. This results in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2016-37/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-38/</url>
<cvename>CVE-2016-1969</cvename>
<cvename>CVE-2016-1977</cvename>
<cvename>CVE-2016-2790</cvename>
<cvename>CVE-2016-2791</cvename>
<cvename>CVE-2016-2792</cvename>
<cvename>CVE-2016-2793</cvename>
<cvename>CVE-2016-2794</cvename>
<cvename>CVE-2016-2795</cvename>
<cvename>CVE-2016-2796</cvename>
<cvename>CVE-2016-2797</cvename>
<cvename>CVE-2016-2798</cvename>
<cvename>CVE-2016-2799</cvename>
<cvename>CVE-2016-2800</cvename>
<cvename>CVE-2016-2801</cvename>
<cvename>CVE-2016-2802</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-14</modified>
</dates>
</vuln>
<vuln vid="c4292768-5273-4f17-a267-c5fe35125ce4">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<range><ge>3.20</ge><lt>3.21.1</lt></range>
<range><lt>3.19.2.3</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.21.0_1</lt></range>
<range><lt>3.19.2.3</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-35/">
<p>Security researcher Francis Gabriel reported a heap-based
buffer overflow in the way the Network Security Services
(NSS) libraries parsed certain ASN.1 structures. An attacker
could create a specially-crafted certificate which, when
parsed by NSS, would cause it to crash or execute arbitrary
code with the permissions of the user.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-36/">
<p>Mozilla developer Tim Taubert used the Address Sanitizer
tool and software fuzzing to discover a use-after-free
vulnerability while processing DER encoded keys in the
Network Security Services (NSS) libraries. The vulnerability
overwrites the freed memory with zeroes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1950</cvename>
<cvename>CVE-2016-1979</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-35/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-36/</url>
<url>https://hg.mozilla.org/projects/nss/rev/b9a31471759d</url>
<url>https://hg.mozilla.org/projects/nss/rev/7033b1193c94</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-09-05</modified>
</dates>
</vuln>
<vuln vid="75091516-6f4b-4059-9884-6727023dc366">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><lt>3.21</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/">
<p>Security researcher Hanno Böck reported that calculations
with mp_div and mp_exptmod in Network Security Services
(NSS) can produce wrong results in some circumstances. These
functions are used within NSS for a variety of cryptographic
division functions, leading to potential cryptographic
weaknesses.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/">
<p>Mozilla developer Eric Rescorla reported that a failed
allocation during DHE and ECDHE handshakes would lead to a
use-after-free vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1938</cvename>
<cvename>CVE-2016-1978</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-07/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-15/</url>
<url>https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a</url>
<url>https://hg.mozilla.org/projects/nss/rev/a245a4ccd354</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="f9e6c0d1-e4cc-11e5-b2bd-002590263bf5">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py32-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>Malicious redirect and possible XSS attack via user-supplied
redirect URLs containing basic auth</p>
<p>User enumeration through timing difference on password hasher work
factor upgrade</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2512</cvename>
<cvename>CVE-2016-2513</cvename>
<url>https://www.djangoproject.com/weblog/2016/mar/01/security-releases/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="fef03980-e4c6-11e5-b2bd-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/">
<p>WordPress 4.4.2 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4.1 and earlier are affected by two security
issues: a possible SSRF for certain local URIs, reported by Ronni
Skansing; and an open redirection attack, reported by Shailesh
Suthar.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2221</cvename>
<cvename>CVE-2016-2222</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/04/6</url>
<url>https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="7f0fbb30-e462-11e5-a3f3-080027ef73ec">
<topic>PuTTY - old-style scp downloads may allow remote code execution</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.67</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon G. Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html">
<p>Many versions of PSCP prior to 0.67 have a stack corruption
vulnerability in their treatment of the 'sink' direction (i.e.
downloading from server to client) of the old-style SCP protocol.
</p>
<p>In order for this vulnerability to be exploited, the user must
connect to a malicious server and attempt to download any file.[...]
you can work around it in a vulnerable PSCP by using the -sftp
option to force the use of the newer SFTP protocol, provided your
server supports that protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html</url>
<cvename>CVE-2016-2563</cvename>
<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-07</entry>
</dates>
</vuln>
<vuln vid="12d1b5a6-e39d-11e5-9f77-5453ed2e2b49">
<topic>websvn -- reflected cross-site scripting</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Delafond reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2016/msg00060.html">
<p>Jakub Palaczynski discovered that websvn, a web viewer for
Subversion repositories, does not correctly sanitize user-supplied
input, which allows a remote user to run reflected cross-site
scripting attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2511</cvename>
<url>https://lists.debian.org/debian-security-announce/2016/msg00060.html</url>
<url>http://seclists.org/fulldisclosure/2016/Feb/99</url>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f69e1f09-e39b-11e5-9f77-5453ed2e2b49">
<topic>websvn -- information disclosure</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thijs Kinkhorst reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682">
<p>James Clawson reported:</p>
<p>"Arbitrary files with a known path can be accessed in websvn by
committing a symlink to a repository and then downloading the file
(using the download link).</p>
<p>An attacker must have write access to the repo, and the download
option must have been enabled in the websvn config file."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6892</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682</url>
</references>
<dates>
<discovery>2015-01-18</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="5a016dd0-8aa8-490e-a596-55f4cc17e4ef">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/">
<p>Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These
contain the following important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2097</cvename>
<cvename>CVE-2016-2098</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ</url>
<url>http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/</url>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html">
<p>[560011] High CVE-2016-1630: Same-origin bypass in Blink.</p>
<p>[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.</p>
<p>[549986] High CVE-2016-1632: Bad cast in Extensions.</p>
<p>[572537] High CVE-2016-1633: Use-after-free in Blink.</p>
<p>[559292] High CVE-2016-1634: Use-after-free in Blink.</p>
<p>[585268] High CVE-2016-1635: Use-after-free in Blink.</p>
<p>[584155] High CVE-2016-1636: SRI Validation Bypass.</p>
<p>[555544] Medium CVE-2016-1637: Information Leak in Skia.</p>
<p>[585282] Medium CVE-2016-1638: WebAPI Bypass.</p>
<p>[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.</p>
<p>[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.</p>
<p>[583718] Medium CVE-2016-1641: Use-after-free in Favicon.</p>
<p>[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1630</cvename>
<cvename>CVE-2016-1631</cvename>
<cvename>CVE-2016-1632</cvename>
<cvename>CVE-2016-1633</cvename>
<cvename>CVE-2016-1634</cvename>
<cvename>CVE-2016-1635</cvename>
<cvename>CVE-2016-1636</cvename>
<cvename>CVE-2016-1637</cvename>
<cvename>CVE-2016-1638</cvename>
<cvename>CVE-2016-1639</cvename>
<cvename>CVE-2016-1640</cvename>
<cvename>CVE-2016-1641</cvename>
<cvename>CVE-2016-1642</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49">
<topic>libssh -- weak Diffie-Hellman secret generation</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Schneider reports:</p>
<blockquote cite="https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/">
<p>libssh versions 0.1 and above have a bits/bytes confusion bug and
generate an abnormally short ephemeral secret for the
diffie-hellman-group1 and diffie-hellman-group14 key exchange
methods. The resulting secret is 128 bits long, instead of the
recommended sizes of 1024 and 2048 bits respectively. There are
practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can
solve this problem in O(2^63) operations.</p>
<p>Both client and server are are vulnerable, pre-authentication.
This vulnerability could be exploited by an eavesdropper with enough
resources to decrypt or intercept SSH sessions. The bug was found
during an internal code review by Aris Adamantiadis of the libssh
team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0739</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739</url>
<url>https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/</url>
</references>
<dates>
<discovery>2016-02-23</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="7d09b9ee-e0ba-11e5-abc4-6fb07af136d2">
<topic>exim -- local privillege escalation</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.86.2</lt></range>
<range><lt>4.85.2</lt></range>
<range><lt>4.84.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Exim development team reports:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html">
<p>All installations having Exim set-uid root and using 'perl_startup' are
vulnerable to a local privilege escalation. Any user who can start an
instance of Exim (and this is normally <strong>any</strong> user) can gain root
privileges. If you do not use 'perl_startup' you <strong>should</strong> be safe.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1531</cvename>
<url>https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="db3301be-e01c-11e5-b2bd-002590263bf5">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8g.php">
<p>Changelog</p>
<ul>
<li>bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php</li>
<li>bug:0002655: CVE-2015-8377: SQL injection vulnerability in the
host_new_graphs_save function in graphs_new.php</li>
<li>bug:0002656: Authentication using web authentication as a user
not in the cacti database allows complete access</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8377</cvename>
<cvename>CVE-2015-8604</cvename>
<cvename>CVE-2016-2313</cvename>
<url>http://www.cacti.net/release_notes_0_8_8g.php</url>
<url>http://bugs.cacti.net/view.php?id=2652</url>
<url>http://bugs.cacti.net/view.php?id=2655</url>
<url>http://bugs.cacti.net/view.php?id=2656</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/09/3</url>
</references>
<dates>
<discovery>2016-02-21</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="f682a506-df7c-11e5-81e4-6805ca0b3d42">
<topic>phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-10/">
<p>XSS vulnerability in SQL parser.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-11/">
<p>Multiple XSS vulnerabilities.</p>
<p>By sending a specially crafted URL as part of the HOST
header, it is possible to trigger an XSS attack.</p>
<p>A weakness was found that allows an XSS attack with Internet
Explorer versions older than 8 and Safari on Windows using a
specially crafted URL.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in user accounts page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in zoom search page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-12/">
<p>Multiple XSS vulnerabilities.</p>
<p>With a crafted table/column name it is possible to trigger
an XSS attack in the database normalization page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in the database structure page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in central columns page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-13/">
<p>Vulnerability allowing man-in-the-middle attack on API
call to GitHub.</p>
<p>A vulnerability in the API call to GitHub can be exploited
to perform a man-in-the-middle attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-10/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-11/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-12/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-13/</url>
<cvename>CVE-2016-2559</cvename>
<cvename>CVE-2016-2560</cvename>
<cvename>CVE-2016-2561</cvename>
<cvename>CVE-2016-2562</cvename>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="45117749-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-02</p>
<p>ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522</p></li>
<li><p>wnpa-sec-2016-03</p>
<p>DNP dissector infinite loop. (Bug 11938) CVE-2016-2523</p></li>
<li><p>wnpa-sec-2016-04</p>
<p>X.509AF dissector crash. (Bug 12002) CVE-2016-2524</p></li>
<li><p>wnpa-sec-2016-05</p>
<p>HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525</p></li>
<li><p>wnpa-sec-2016-06</p>
<p>HiQnet dissector crash. (Bug 11983) CVE-2016-2526</p></li>
<li><p>wnpa-sec-2016-07</p>
<p>3GPP TS 32.423 Trace file parser crash. (Bug 11982)
</p>CVE-2016-2527</li>
<li><p>wnpa-sec-2016-08</p>
<p>LBMC dissector crash. (Bug 11984) CVE-2016-2528</p></li>
<li><p>wnpa-sec-2016-09</p>
<p>iSeries file parser crash. (Bug 11985) CVE-2016-2529</p></li>
<li><p>wnpa-sec-2016-10</p>
<p>RSL dissector crash. (Bug 11829) CVE-2016-2530
CVE-2016-2531</p></li>
<li><p>wnpa-sec-2016-11</p>
<p>LLRP dissector crash. (Bug 12048) CVE-2016-2532</p></li>
<li><p>wnpa-sec-2016-12</p>
<p>Ixia IxVeriWave file parser crash. (Bug 11795)</p></li>
<li><p>wnpa-sec-2016-13</p>
<p>IEEE 802.11 dissector crash. (Bug 11818)</p></li>
<li><p>wnpa-sec-2016-14</p>
<p>GSM A-bis OML dissector crash. (Bug 11825)</p></li>
<li><p>wnpa-sec-2016-15</p>
<p>ASN.1 BER dissector crash. (Bug 12106)</p></li>
<li><p>wnpa-sec-2016-16</p>
<p>SPICE dissector large loop. (Bug 12151)</p></li>
<li><p>wnpa-sec-2016-17</p>
<p>NFS dissector crash.</p></li>
<li><p>wnpa-sec-2016-18</p>
<p>ASN.1 BER dissector crash. (Bug 11822)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2522</cvename>
<cvename>CVE-2016-2523</cvename>
<cvename>CVE-2016-2524</cvename>
<cvename>CVE-2016-2525</cvename>
<cvename>CVE-2016-2526</cvename>
<cvename>CVE-2016-2527</cvename>
<cvename>CVE-2016-2528</cvename>
<cvename>CVE-2016-2529</cvename>
<cvename>CVE-2016-2530</cvename>
<cvename>CVE-2016-2531</cvename>
<cvename>CVE-2016-2532</cvename>
<cvename>CVE-2016-4415</cvename>
<cvename>CVE-2016-4416</cvename>
<cvename>CVE-2016-4417</cvename>
<cvename>CVE-2016-4418</cvename>
<cvename>CVE-2016-4419</cvename>
<cvename>CVE-2016-4420</cvename>
<cvename>CVE-2016-4421</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/01/1</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-01</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="42c2c422-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2015-31</p>
<p>NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)</p>
</li>
<li><p>wnpa-sec-2015-37</p>
<p>NLM dissector crash.</p></li>
<li><p>wnpa-sec-2015-39</p>
<p>BER dissector crash.</p></li>
<li><p>wnpa-sec-2015-40</p>
<p>Zlib decompression crash. (Bug 11548)</p></li>
<li><p>wnpa-sec-2015-41</p>
<p>SCTP dissector crash. (Bug 11767)</p></li>
<li><p>wnpa-sec-2015-42</p>
<p>802.11 decryption crash. (Bug 11790, Bug 11826)</p></li>
<li><p>wnpa-sec-2015-43</p>
<p>DIAMETER dissector crash. (Bug 11792)</p></li>
<li><p>wnpa-sec-2015-44</p>
<p>VeriWave file parser crashes. (Bug 11789, Bug 11791)</p></li>
<li><p>wnpa-sec-2015-45</p>
<p>RSVP dissector crash. (Bug 11793)</p></li>
<li><p>wnpa-sec-2015-46</p>
<p>ANSI A and GSM A dissector crashes. (Bug 11797)</p></li>
<li><p>wnpa-sec-2015-47</p>
<p>Ascend file parser crash. (Bug 11794)</p></li>
<li><p>wnpa-sec-2015-48</p>
<p>NBAP dissector crash. (Bug 11815)</p></li>
<li><p>wnpa-sec-2015-49</p>
<p>RSL dissector crash. (Bug 11829)</p></li>
<li><p>wnpa-sec-2015-50</p>
<p>ZigBee ZCL dissector crash. (Bug 11830)</p></li>
<li><p>wnpa-sec-2015-51</p>
<p>Sniffer file parser crash. (Bug 11827)</p></li>
<li><p>wnpa-sec-2015-52</p>
<p>NWP dissector crash. (Bug 11726)</p></li>
<li><p>wnpa-sec-2015-53</p>
<p>BT ATT dissector crash. (Bug 11817)</p></li>
<li><p>wnpa-sec-2015-54</p>
<p>MP2T file parser crash. (Bug 11820)</p></li>
<li><p>wnpa-sec-2015-55</p>
<p>MP2T file parser crash. (Bug 11821)</p></li>
<li><p>wnpa-sec-2015-56</p>
<p>S7COMM dissector crash. (Bug 11823)</p></li>
<li><p>wnpa-sec-2015-57</p>
<p>IPMI dissector crash. (Bug 11831)</p></li>
<li><p>wnpa-sec-2015-58</p>
<p>TDS dissector crash. (Bug 11846)</p></li>
<li><p>wnpa-sec-2015-59</p>
<p>PPI dissector crash. (Bug 11876)</p></li>
<li><p>wnpa-sec-2015-60</p>
<p>MS-WSP dissector crash. (Bug 11931)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html</url>
</references>
<dates>
<discovery>2015-12-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="7bbc3016-de63-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5346 Apache Tomcat Session fixation</p></li>
<li><p>CVE-2015-5351 Apache Tomcat CSRF token leak</p></li>
<li><p>CVE-2016-0763 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e</url>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2015-5351</cvename>
<cvename>CVE-2016-0763</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="1f1124fe-de5c-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.45</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5345 Apache Tomcat Directory disclosure</p></li>
<li><p>CVE-2016-0706 Apache Tomcat Security Manager bypass</p></li>
<li><p>CVE-2016-0714 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e</url>
<cvename>CVE-2015-5345</cvename>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2016-0706</cvename>
<cvename>CVE-2016-0714</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="a7f2e9c6-de20-11e5-8458-6cc21735f730">
<topic>xerces-c3 -- Parser Crashes on Malformed Input</topic>
<affects>
<package>
<name>xerces-c3</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt">
<p>The Xerces-C XML parser mishandles certain kinds of malformed input
documents, resulting in buffer overflows during processing and error
reporting. The overflows can manifest as a segmentation fault or as
memory corruption during a parse operation. The bugs allow for a
denial of service attack in many applications by an unauthenticated
attacker, and could conceivably result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0729</cvename>
<url>http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt</url>
</references>
<dates>
<discovery>2016-02-25</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8">
<topic>django -- regression in permissions model</topic>
<affects>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.2</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/">
<p>User with "change" but not "add" permission can create
objects for ModelAdmin’s with save_as=True</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/</url>
<cvename>CVE-2016-2048</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="81f9d6a4-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-170.html">
<p>VMX refuses attempts to enter a guest with an instruction pointer
which doesn't satisfy certain requirements. In particular, the
instruction pointer needs to be canonical when entering a guest
currently in 64-bit mode. This is the case even if the VM entry
information specifies an exception to be injected immediately (in
which case the bad instruction pointer would possibly never get used
for other than pushing onto the exception handler's stack).
Provided the guest OS allows user mode to map the virtual memory
space immediately below the canonical/non-canonical address
boundary, a non-canonical instruction pointer can result even from
normal user mode execution. VM entry failure, however, is fatal to
the guest.</p>
<p>Malicious HVM guest user mode code may be able to crash the
guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2271</cvename>
<url>http://xenbits.xen.org/xsa/advisory-170.html</url>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="80adc394-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.3</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-168.html">
<p>While INVLPG does not cause a General Protection Fault when used on
a non-canonical address, INVVPID in its "individual address"
variant, which is used to back the intercepted INVLPG in certain
cases, fails in such cases. Failure of INVVPID results in a
hypervisor bug check.</p>
<p>A malicious guest can crash the host, leading to a Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1571</cvename>
<url>http://xenbits.xen.org/xsa/advisory-168.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="7ed7c36f-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- PV superpage functionality missing sanity checks</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><eq>3.4.0</eq></range>
<range><eq>3.4.1</eq></range>
<range><ge>4.1</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-167.html">
<p>The PV superpage functionality lacks certain validity checks on
data being passed to the hypervisor by guests. This is the case
for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and
MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as
well as for various forms of page table updates.</p>
<p>Use of the feature, which is disabled by default, may have unknown
effects, ranging from information leaks through Denial of Service to
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1570</cvename>
<url>http://xenbits.xen.org/xsa/advisory-167.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="2d299950-ddb0-11e5-8fa8-14dae9d210b8">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.10</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.4</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0001: Two enrolment-related web services don't
check course visibility</p></li>
<li><p>MSA-16-0002: XSS Vulnerability in course management
search</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://moodle.org/security/</url>
<cvename>CVE-2016-0724</cvename>
<cvename>CVE-2016-0725</cvename>
</references>
<dates>
<discovery>2016-01-18</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6540c8f0-dca3-11e5-8fa8-14dae9d210b8">
<topic>pitivi -- code execution</topic>
<affects>
<package>
<name>pitivi</name>
<range><lt>0.95</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/23/8">
<p>Double-clicking a file in the user's media library with a
specially-crafted path or filename allows for arbitrary code execution
with the permissions of the user running Pitivi.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/8</url>
<url>https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2</url>
<cvename>CVE-2015-0855</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="90c8385a-dc9f-11e5-8fa8-14dae9d210b8">
<topic>giflib -- heap overflow</topic>
<affects>
<package>
<name>giflib</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hans Jerry Illikainen reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2015/Dec/114">
<p>A heap overflow may occur in the giffix utility included in
giflib-5.1.1 when processing records of the type
`IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer'
equaling the value of the logical screen width, `GifFileIn->SWidth',
while subsequently having `GifFileIn->Image.Width' bytes of data written
to it.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/bugtraq/2015/Dec/114</url>
<cvename>CVE-2015-7555</cvename>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="59a0af97-dbd4-11e5-8fa8-14dae9d210b8">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.38</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.43</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-001">
<ul>
<li><p>File upload access bypass and denial of service (File
module - Drupal 7 and 8 - Moderately Critical)</p></li>
<li><p>Brute force amplification attacks via XML-RPC (XML-RPC
server - Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Open redirect via path manipulation (Base system -
Drupal 6, 7 and 8 - Moderately Critical) </p></li>
<li><p>Form API ignores access restrictions on submit buttons
(Form API - Drupal 6 - Critical)</p></li>
<li><p>HTTP header injection using line breaks (Base system -
Drupal 6 - Moderately Critical)</p></li>
<li><p>Open redirect via double-encoded 'destination'
parameter (Base system - Drupal 6 - Moderately Critical)</p></li>
<li><p>Reflected file download vulnerability (System module -
Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Saving user accounts can sometimes grant the user all
roles (User module - Drupal 6 and 7 - Less Critical)</p></li>
<li><p>Email address can be matched to an account (User module
- Drupal 7 and 8 - Less Critical)</p></li>
<li><p>Session data truncation can lead to unserialization of
user provided data (Base system - Drupal 6 - Less Critical)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2016-001</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="7e01df39-db7e-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.650</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.642.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24">
<h1>Description</h1>
<h5>SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)</h5>
<p>A vulnerability in the Jenkins remoting module allowed
unauthenticated remote attackers to open a JRMP listener on the
server hosting the Jenkins master process, which allowed arbitrary
code execution.</p>
<h5>SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)</h5>
<p>An HTTP response splitting vulnerability in the CLI command
documentation allowed attackers to craft Jenkins URLs that serve
malicious content.</p>
<h5>SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)</h5>
<p>The verification of user-provided API tokens with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
API tokens using brute-force methods.</p>
<h5>SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)</h5>
<p>The verification of user-provided CSRF crumbs with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
CSRF crumbs using brute-force methods.</p>
<h5>SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)</h5>
<p>Jenkins has several API endpoints that allow low-privilege users
to POST XML files that then get deserialized by Jenkins.
Maliciously crafted XML files sent to these API endpoints could
result in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="660ebbf5-daeb-11e5-b2bd-002590263bf5">
<topic>squid -- remote DoS in HTTP response processing</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_2.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>These problems allow remote servers delivering certain unusual
HTTP response syntax to trigger a denial of service for all
clients accessing the Squid service.</p>
<p>HTTP responses containing malformed headers that trigger this
issue are becoming common. We are not certain at this time if
that is a sign of malware or just broken server scripting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2569</cvename>
<cvename>CVE-2016-2570</cvename>
<cvename>CVE-2016-2571</cvename>
<freebsdpr>ports/207454</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_2.txt</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/24/12</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-24</entry>
<modified>2016-02-28</modified>
</dates>
</vuln>
<vuln vid="9e5bbffc-d8ac-11e5-b2bd-002590263bf5">
<topic>bsh -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bsh</name>
<range><lt>2.0.b6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stian Soiland-Reyes reports:</p>
<blockquote cite="https://github.com/beanshell/beanshell/releases/tag/2.0b6">
<p>This release fixes a remote code execution vulnerability that was
identified in BeanShell by Alvaro Muñoz and Christian Schneider.
The BeanShell team would like to thank them for their help and
contributions to this fix!</p>
<p>An application that includes BeanShell on the classpath may be
vulnerable if another part of the application uses Java
serialization or XStream to deserialize data from an untrusted
source.</p>
<p>A vulnerable application could be exploited for remote code
execution, including executing arbitrary shell commands.</p>
<p>This update fixes the vulnerability in BeanShell, but it is worth
noting that applications doing such deserialization might still be
insecure through other libraries. It is recommended that application
developers take further measures such as using a restricted class
loader when deserializing. See notes on Java serialization security
XStream security and How to secure deserialization from untrusted
input without using encryption or sealing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2510</cvename>
<freebsdpr>ports/207334</freebsdpr>
<url>https://github.com/beanshell/beanshell/releases/tag/2.0b6</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="6171eb07-d8a9-11e5-b2bd-002590263bf5">
<topic>libsrtp -- DoS via crafted RTP header vulnerability</topic>
<affects>
<package>
<name>libsrtp</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libsrtp reports:</p>
<blockquote cite="https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2">
<p>Prevent potential DoS attack due to lack of bounds checking on RTP
header CSRC count and extension header length. Credit goes to
Randell Jesup and the Firefox team for reporting this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6360</cvename>
<freebsdpr>ports/207003</freebsdpr>
<url>https://github.com/cisco/libsrtp/releases/tag/v1.5.3</url>
<url>https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2</url>
<url>https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4</url>
<url>https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee</url>
<url>https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f</url>
</references>
<dates>
<discovery>2015-11-02</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="006e3b7c-d7d7-11e5-b85f-0018fe623f2b">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-012.html">
<p>The library is affected by a double-free vulnerability in function
jas_iccattrval_destroy()
as well as a heap-based buffer overflow in function jp2_decode().
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-001.html">
<p>The library is affected by an off-by-one error in a buffer boundary check
in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well
as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to
stack overflow.
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-009.html">
<p>Multiple off-by-one flaws, leading to heap-based buffer overflows, were
found in the way JasPer decoded JPEG 2000 files. A specially crafted file
could cause an application using JasPer to crash or,
possibly, execute arbitrary code.</p>
</blockquote>
<p>limingxing reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/233">
<p>A vulnerability was found in the way the JasPer's jas_matrix_clip()
function parses certain JPEG 2000 image files. A specially crafted file
could cause an application using JasPer to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2014-012.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173157</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173162</url>
<url>http://www.ocert.org/advisories/ocert-2015-001.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1179282</url>
<url>http://www.ocert.org/advisories/ocert-2014-009.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1167537</url>
<url>http://seclists.org/oss-sec/2016/q1/233</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1302636</url>
<cvename>CVE-2014-8137</cvename>
<cvename>CVE-2014-8138</cvename>
<cvename>CVE-2014-8157</cvename>
<cvename>CVE-2014-8158</cvename>
<cvename>CVE-2014-9029</cvename>
<cvename>CVE-2016-2089</cvename>
</references>
<dates>
<discovery>2014-12-10</discovery>
<entry>2016-02-20</entry>
<modified>2016-02-24</modified>
</dates>
</vuln>
<vuln vid="368993bb-d685-11e5-8858-00262d5ed8ee">
<topic>chromium -- same origin bypass</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html">
<p>[583431] Critical CVE-2016-1629: Same-origin bypass in Blink
and Sandbox escape in Chrome. Credit to anonymous.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1629</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28">
<topic>glibc -- getaddrinfo stack-based buffer overflow</topic>
<affects>
<package>
<name>linux_base-c6</name>
<name>linux_base-c6_64</name>
<range><lt>6.7_1</lt></range>
</package>
<package>
<name>linux_base-f10</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabio Olive Leite reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547">
<p>A stack-based buffer overflow was found in libresolv when invoked
from nss_dns, allowing specially crafted DNS responses to seize
control of EIP in the DNS client. The buffer overflow occurs in the
functions send_dg (send datagram) and send_vc (send TCP) for the
NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or
AF_INET6 in some cases) triggers the low-level resolver code to
send out two parallel queries for A and AAAA. A mismanagement of
the buffers used for those queries could result in the response of
a query writing beyond the alloca allocated buffer created by
__res_nquery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7547</cvename>
<freebsdpr>ports/207272</freebsdpr>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547</url>
<url>https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/</url>
<url>https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html</url>
<url>https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="56562efb-d5e4-11e5-b2bd-002590263bf5">
<topic>squid -- SSL/TLS processing remote DoS</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.13</ge><lt>3.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_1.txt">
<p>Due to incorrectly handling server errors Squid is vulnerable to a
denial of service attack when connecting to TLS or SSL servers.</p>
<p>This problem allows any trusted client to perform a denial of
service attack on the Squid service regardless of whether TLS or
SSL is configured for use in the proxy.</p>
<p>Misconfigured client or server software may trigger this issue
to perform a denial of service unintentionally.</p>
<p>However, the bug is exploitable only if Squid is built using the
--with-openssl option.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2016-2390</cvename>
<freebsdpr>ports/207294</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_1.txt</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="dd563930-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- remote code execution</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b">
<p>Fix remote code execution in SQLite query</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b</url>
</references>
<dates>
<discovery>2016-02-06</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="18201a1c-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66">
<p>Fix XSS in indexes (non-MySQL only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66</url>
</references>
<dates>
<discovery>2015-11-08</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="ad91ee9b-d599-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c">
<p>Fix XSS in alter table</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c</url>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="8cf54d73-d591-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5">
<p>Fix XSS in login form</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5</url>
<url>https://sourceforge.net/p/adminer/bugs-and-features/436/</url>
</references>
<dates>
<discovery>2015-01-30</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="95b92e3b-d451-11e5-9794-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack on ECDH</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html">
<p>Mitigate side-channel attack on ECDH with Weierstrass curves.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7511</cvename>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="f1bf28c5-d447-11e5-b2bd-002590263bf5">
<topic>xdelta3 -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>xdelta3</name>
<range><lt>3.0.9,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stepan Golosunov reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/02/08/1">
<p>Buffer overflow was found and fixed in xdelta3 binary diff tool
that allows arbitrary code execution from input files at least on
some systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9765</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/08/1</url>
<url>https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2</url>
</references>
<dates>
<discovery>2014-10-08</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="172b22cb-d3f6-11e5-ac9e-485d605f4717">
<topic>firefox -- Same-origin-policy violation using Service Workers with plugins</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2">
<p>MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept
responses to plugin network requests made through the browser. Plugins which
make security decisions based on the content of network requests can have these
decisions subverted if a service worker forges responses to those requests. For
example, a forged crossdomain.xml could allow a malicious site to violate the
same-origin policy using the Flash plugin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1949</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/</url>
</references>
<dates>
<discovery>2016-02-11</discovery>
<entry>2016-02-15</entry>
</dates>
</vuln>
<vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf">
<topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/">
<p>Out of memory in nghttpd, nghttp, and libnghttp2_asio applications
due to unlimited incoming HTTP header fields.</p>
<p>nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage
for the incoming HTTP header field. If peer sends specially crafted HTTP/2
HEADERS frames and CONTINUATION frames, they will crash with out of memory
error.</p>
<p>Note that libnghttp2 itself is not affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url>
<cvename>CVE-2016-1544</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-13</entry>
</dates>
</vuln>
<vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5">
<topic>horde -- XSS vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<range><lt>5.2.9</lt></range>
</package>
<package>
<name>pear-Horde_Core</name>
<range><lt>2.22.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde Team reports:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2016/001149.html">
<p>Fixed XSS vulnerabilities in menu bar and form renderer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8807</cvename>
<cvename>CVE-2016-2228</cvename>
<url>https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253</url>
<url>https://bugs.horde.org/ticket/14213</url>
<url>https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0</url>
<url>https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/06/4</url>
<url>http://lists.horde.org/archives/announce/2016/001149.html</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-14</entry>
</dates>
</vuln>
<vuln vid="e8b6605b-d29f-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- Security Fixes for Regular Expressions, PL/Java.</topic>
<affects>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.20</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.15</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.6</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1644/">
<p>
Security Fixes for Regular Expressions, PL/Java
</p>
<ul>
<li>CVE-2016-0773: This release closes security hole CVE-2016-0773,
an issue with regular expression (regex) parsing. Prior code allowed
users to pass in expressions which included out-of-range Unicode
characters, triggering a backend crash. This issue is critical for
PostgreSQL systems with untrusted users or which generate regexes
based on user input.
</li>
<li>CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege
escalation issue for users of PL/Java. Certain custom configuration
settings (GUCS) for PL/Java will now be modifiable only by the
database superuser
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0773</cvename>
<cvename>CVE-2016-0766</cvename>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-12</entry>
</dates>
</vuln>
<vuln vid="5d8e56c3-9e67-4d5b-81c9-3a409dfd705f">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.569</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-04.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2016-0985).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2016-0973, CVE-2016-0974,
CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).</p>
<p>These updates resolve a heap buffer overflow vulnerability
that could lead to code execution (CVE-2016-0971).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2016-0964,
CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968,
CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976,
CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980,
CVE-2016-0981).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0964</cvename>
<cvename>CVE-2016-0965</cvename>
<cvename>CVE-2016-0966</cvename>
<cvename>CVE-2016-0967</cvename>
<cvename>CVE-2016-0968</cvename>
<cvename>CVE-2016-0969</cvename>
<cvename>CVE-2016-0970</cvename>
<cvename>CVE-2016-0971</cvename>
<cvename>CVE-2016-0972</cvename>
<cvename>CVE-2016-0973</cvename>
<cvename>CVE-2016-0974</cvename>
<cvename>CVE-2016-0975</cvename>
<cvename>CVE-2016-0976</cvename>
<cvename>CVE-2016-0977</cvename>
<cvename>CVE-2016-0978</cvename>
<cvename>CVE-2016-0979</cvename>
<cvename>CVE-2016-0980</cvename>
<cvename>CVE-2016-0981</cvename>
<cvename>CVE-2016-0982</cvename>
<cvename>CVE-2016-0983</cvename>
<cvename>CVE-2016-0984</cvename>
<cvename>CVE-2016-0985</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-04.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-10</entry>
</dates>
</vuln>
<vuln vid="515b4327-cf8a-11e5-96d6-14dae9d210b8">
<topic>dnscrypt-proxy -- code execution</topic>
<affects>
<package>
<name>dnscrypt-proxy</name>
<range><ge>1.1.0</ge><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Denis reports:</p>
<blockquote cite="https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8">
<p>Malformed packets could lead to denial of service or code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-10</entry>
<modified>2016-02-14</modified>
</dates>
</vuln>
<vuln vid="36034227-cf81-11e5-9c2b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>6 security fixes in this release, including:</p>
<ul>
<li>[546677] High CVE-2016-1622: Same-origin bypass in Extensions.
Credit to anonymous.</li>
<li>[577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[509313] Medium CVE-2016-1625: Navigation bypass in Chrome
Instant. Credit to Jann Horn.</li>
<li>[571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium.
Credit to anonymous, working with HP's Zero Day Initiative.</li>
<li>[585517] CVE-2016-1627: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1622</cvename>
<cvename>CVE-2016-1623</cvename>
<cvename>CVE-2016-1625</cvename>
<cvename>CVE-2016-1626</cvename>
<cvename>CVE-2016-1627</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="8f10fa04-cf6a-11e5-96d6-14dae9d210b8">
<topic>graphite2 -- code execution vulnerability</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.5</lt></range>
</package>
<package>
<name>silgraphite</name>
<range><lt>2.3.1_4</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html">
<ul>
<li><p>An exploitable denial of service vulnerability exists
in the font handling of Libgraphite. A specially crafted font can cause
an out-of-bounds read potentially resulting in an information leak or
denial of service.</p></li>
<li><p>A specially crafted font can cause a buffer overflow
resulting in potential code execution.</p></li>
<li><p>An exploitable NULL pointer dereference exists in the
bidirectional font handling functionality of Libgraphite. A specially
crafted font can cause a NULL pointer dereference resulting in a
crash.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html</url>
<url>http://www.talosintel.com/reports/TALOS-2016-0061/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-14/</url>
<cvename>CVE-2016-1521</cvename>
<cvename>CVE-2016-1522</cvename>
<cvename>CVE-2016-1523</cvename>
<cvename>CVE-2016-1526</cvename>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="1cecd5e0-c372-11e5-96d6-14dae9d210b8">
<topic>xymon-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xymon-server</name>
<range><lt>4.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>J.C. Cleaver reports:</p>
<blockquote cite="http://lists.xymon.com/pipermail/xymon/2016-February/042986.html">
<ul>
<li><p>CVE-2016-2054: Buffer overflow in xymond handling of
"config" command</p></li>
<li><p> CVE-2016-2055: Access to possibly confidential files
in the Xymon configuration directory</p></li>
<li><p>CVE-2016-2056: Shell command injection in the
"useradm" and "chpasswd" web applications</p></li>
<li><p>CVE-2016-2057: Incorrect permissions on IPC queues
used by the xymond daemon can bypass IP access filtering</p></li>
<li><p>CVE-2016-2058: Javascript injection in "detailed status
webpage" of monitoring items; XSS vulnerability via malformed
acknowledgment messages</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.xymon.com/pipermail/xymon/2016-February/042986.html</url>
<cvename>CVE-2016-2054</cvename>
<cvename>CVE-2016-2055</cvename>
<cvename>CVE-2016-2056</cvename>
<cvename>CVE-2016-2057</cvename>
<cvename>CVE-2016-2058</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="85eb4e46-cf16-11e5-840f-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.32</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.18">
<ul><li>Core:
<ul>
<li>Fixed bug #71039 (exec functions ignore length but look for NULL
termination).</li>
<li>Fixed bug #71323 (Output of stream_get_meta_data can be
falsified by its input).</li>
<li>Fixed bug #71459 (Integer overflow in iptcembed()).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Upgraded bundled PCRE library to 8.38.(CVE-2015-8383,
CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71354 (Heap corruption in tar/zip/phar parser).</li>
<li>Fixed bug #71391 (NULL Pointer Dereference in
phar_tar_setupmetadata()).</li>
<li>Fixed bug #71488 (Stack overflow when decompressing tar
archives). (CVE-2016-2554)</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71335 (Type Confusion in WDDX Packet
Deserialization).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8383</cvename>
<cvename>CVE-2015-8386</cvename>
<cvename>CVE-2015-8387</cvename>
<cvename>CVE-2015-8389</cvename>
<cvename>CVE-2015-8390</cvename>
<cvename>CVE-2015-8391</cvename>
<cvename>CVE-2015-8393</cvename>
<cvename>CVE-2015-8394</cvename>
<cvename>CVE-2016-2554</cvename>
<url>http://php.net/ChangeLog-5.php#5.6.18</url>
<url>http://php.net/ChangeLog-5.php#5.5.32</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-13</modified>
</dates>
</vuln>
<vuln vid="a8de962a-cf15-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in PCD decoder</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, PcdDecode.c has a buffer overflow error.</p>
<p>The state.buffer for PcdDecode.c is allocated based on a 3 bytes
per pixel sizing, where PcdDecode.c wrote into the buffer assuming
4 bytes per pixel. This writes 768 bytes beyond the end of the
buffer into other Python object storage. In some cases, this causes
a segfault, in others an internal Python malloc error.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2016/02/02/5</mlist>
<url>https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4</url>
<url>https://github.com/python-pillow/Pillow/issues/568</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="0519db18-cf15-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Integer overflow in Resample.c</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>If a large value was passed into the new size for an image, it is
possible to overflow an int32 value passed into malloc, leading the
malloc’d buffer to be undersized. These allocations are followed by
a loop that writes out of bounds. This can lead to corruption on
the heap of the Python process with attacker controlled float
data.</p>
<p>This issue was found by Ned Williamson.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798</url>
<url>https://github.com/python-pillow/Pillow/issues/1710</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ea60e00-cf13-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in FLI decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, FliDecode.c has a buffer overflow error.</p>
<p>There is a memcpy error where x is added to a target buffer
address. X is used in several internal temporary variable roles,
but can take a value up to the width of the image. Im->image[y]
is a set of row pointers to segments of memory that are the size of
the row. At the max y, this will write the contents of the line off
the end of the memory buffer, causing a segfault.</p>
<p>This issue was found by Alyssa Besseling at Atlassian.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0775</cvename>
<url>https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="53252879-cf11-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Buffer overflow in TIFF decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on
x64 may overflow a buffer when reading a specially crafted tiff
file.</p>
<p>Specifically, libtiff >= 4.0.0 changed the return type of
TIFFScanlineSize from int32 to machine dependent int32|64. If the
scanline is sized so that it overflows an int32, it may be
interpreted as a negative number, which will then pass the size check
in TiffDecode.c line 236. To do this, the logical scanline size has
to be > 2gb, and for the test file, the allocated buffer size is 64k
against a roughly 4gb scan line size. Any image data over 64k is
written over the heap, causing a segfault.</p>
<p>This issue was found by security researcher FourOne.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0740</cvename>
<url>https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ac79ed8-ccc2-11e5-932b-5404a68ad561">
<topic>ffmpeg -- remote denial of service in JPEG2000 decoder</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>2.8.6,1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_3</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>FFmpeg 2.8.6 fixes the following vulnerabilities:
CVE-2016-2213</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2213</cvename>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-02-06</entry>
</dates>
</vuln>
<vuln vid="448047e9-030e-4ce4-910b-f21a3ad5d9a0">
<topic>shotwell -- not verifying certificates</topic>
<affects>
<package>
<name>shotwell</name>
<range><lt>0.22.0.99</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Catanzaro reports:</p>
<blockquote cite="https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html">
<p>Shotwell has a serious security issue ("Shotwell does not
verify TLS certificates"). Upstream is no longer active and
I do not expect any further upstream releases unless someone
from the community steps up to maintain it.</p>
<p>What is the impact of the issue? If you ever used any of
the publish functionality (publish to Facebook, publish to
Flickr, etc.), your passwords may have been stolen; changing
them is not a bad idea.</p>
<p>What is the risk of the update? Regressions. The easiest
way to validate TLS certificates was to upgrade WebKit; it
seems to work but I don't have accounts with the online
services it supports, so I don't know if photo publishing
still works properly on all the services.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-02-05</entry>
</dates>
</vuln>
<vuln vid="1091d2d1-cb2e-11e5-b14b-bcaec565249c">
<topic>webkit -- UI spoof</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<name>webkit-gtk3</name>
<range><lt>2.4.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>webkit reports:</p>
<blockquote cite="http://webkitgtk.org/security/WSA-2015-0002.html">
<p>The ScrollView::paint function in platform/scroll/ScrollView.cpp
in Blink, as used in Google Chrome before 35.0.1916.114, allows
remote attackers to spoof the UI by extending scrollbar painting
into the parent frame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1748</cvename>
<url>http://webkitgtk.org/security/WSA-2015-0002.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="e78bfc9d-cb1e-11e5-b251-0050562a4d7b">
<topic>py-rsa -- Bleichenbacher'06 signature forgery vulnerability</topic>
<affects>
<package>
<name>py27-rsa</name>
<name>py32-rsa</name>
<name>py33-rsa</name>
<name>py34-rsa</name>
<name>py35-rsa</name>
<range><lt>3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Filippo Valsorda reports:</p>
<blockquote cite="https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/">
<p>
python-rsa is vulnerable to a straightforward variant of the
Bleichenbacher'06 attack against RSA signature verification
with low public exponent.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1494</cvename>
<url>https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/</url>
<url>https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/3</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/1</url>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="559f3d1b-cb1d-11e5-80a4-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.3_5</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.21.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2016-001 - BEAST vulnerability in HTTP server</p>
<p>AST-2016-002 - File descriptor exhaustion in chan_sip</p>
<p>AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-001.html</url>
<cvename>CVE-2011-3389</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-002.html</url>
<cvename>CVE-2016-2316</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-003.html</url>
<cvename>CVE-2016-2232</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-04</entry>
<modified>2016-03-07</modified>
</dates>
</vuln>
<vuln vid="0652005e-ca96-11e5-96d6-14dae9d210b8">
<topic>salt -- code execution</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><ge>2015.8.0</ge><lt>2015.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html">
<p>Improper handling of clear messages on the minion, which
could result in executing commands not sent by the master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html</url>
<url>https://github.com/saltstack/salt/pull/30613/files</url>
<cvename>CVE-2016-1866</cvename>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-03</entry>
</dates>
</vuln>
<vuln vid="bb0ef21d-0e1b-461b-bc3d-9cba39948888">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activemodel4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-activerecord4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-rails-html-sanitizer</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/">
<p>Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been
released! These contain important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7576</cvename>
<cvename>CVE-2015-7577</cvename>
<cvename>CVE-2015-7581</cvename>
<cvename>CVE-2016-0751</cvename>
<cvename>CVE-2016-0752</cvename>
<cvename>CVE-2016-0753</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ</url>
<url>http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/</url>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-02</entry>
</dates>
</vuln>
<vuln vid="a52a7172-c92e-11e5-96d6-14dae9d210b8">
<topic>socat -- diffie hellman parameter was not prime</topic>
<affects>
<package>
<name>socat</name>
<range><ge>1.7.2.5</ge><lt>1.7.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>socat reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv7.html">
<p>In the OpenSSL address implementation the hard coded 1024
bit DH p parameter was not prime. The effective cryptographic strength
of a key exchange using these parameters was weaker than the one one
could get by using a prime p. Moreover, since there is no indication of
how these parameters were chosen, the existence of a trapdoor that makes
possible for an eavesdropper to recover the shared secret from a key
exchange that uses them cannot be ruled out.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dest-unreach.org/socat/contrib/socat-secadv7.html</url>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="4f00dac0-1e18-4481-95af-7aaad63fd303">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.6.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44">
<p>MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0
/ rv:38.6)</p>
<p>MFSA 2016-02 Out of Memory crash when parsing GIF format
images</p>
<p>MFSA 2016-03 Buffer overflow in WebGL after out of memory
allocation</p>
<p>MFSA 2016-04 Firefox allows for control characters to be
set in cookie names</p>
<p>MFSA 2016-06 Missing delay following user click events in
protocol handler dialog</p>
<p>MFSA 2016-09 Addressbar spoofing attacks</p>
<p>MFSA 2016-10 Unsafe memory manipulation found through
code inspection</p>
<p>MFSA 2016-11 Application Reputation service disabled in
Firefox 43</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2016-1930</cvename>
<cvename>CVE-2016-1931</cvename>
<cvename>CVE-2016-1933</cvename>
<cvename>CVE-2016-1935</cvename>
<cvename>CVE-2016-1937</cvename>
<cvename>CVE-2016-1939</cvename>
<cvename>CVE-2016-1942</cvename>
<cvename>CVE-2016-1943</cvename>
<cvename>CVE-2016-1944</cvename>
<cvename>CVE-2016-1945</cvename>
<cvename>CVE-2016-1946</cvename>
<cvename>CVE-2016-1947</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-01/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-02/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-03/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-04/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-06/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-09/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-10/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-11/</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-02-01</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="e00d8b94-c88a-11e5-b5fe-002590263bf5">
<topic>gdcm -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gdcm</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CENSUS S.A. reports:</p>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an integer overflow vulnerability which leads to a buffer
overflow and potentially to remote code execution.</p>
</blockquote>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an out-of-bounds read vulnerability due to missing checks.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8396</cvename>
<cvename>CVE-2015-8397</cvename>
<url>http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/</url>
<url>http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="c1c18ee1-c711-11e5-96d6-14dae9d210b8">
<topic>nginx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.8.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html">
<p>Several problems in nginx resolver were identified, which
might allow an attacker to cause worker process crash, or might have
potential other impact if the "resolver" directive
is used in a configuration file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html</url>
<cvename>CVE-2016-0742</cvename>
<cvename>CVE-2016-0746</cvename>
<cvename>CVE-2016-0747</cvename>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-01-30</entry>
</dates>
</vuln>
<vuln vid="a0d77bc8-c6a7-11e5-96d6-14dae9d210b8">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>7.6.1</lt></range>
</package>
<package>
<name>typo3-lts</name>
<range><lt>6.2.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 Security Team reports:</p>
<blockquote cite="http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html">
<p>It has been discovered that TYPO3 CMS is susceptible to
Cross-Site Scripting and Cross-Site Flashing.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="93eadedb-c6a6-11e5-96d6-14dae9d210b8">
<topic>nghttp2 -- use after free</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/">
<p>This release fixes heap-use-after-free bug in idle stream
handling code. We strongly recommend to upgrade the older installation
to this latest version as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/</url>
<cvename>CVE-2015-8659</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="3166222b-c6a4-11e5-96d6-14dae9d210b8">
<topic>owncloud -- multiple vulnerabilities</topic>
<affects>
<package>
<name>owncloud</name>
<range><lt>8.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Owncloud reports:</p>
<blockquote cite="https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/">
<ul>
<li><p>Reflected XSS in OCS provider discovery
(oC-SA-2016-001)</p></li>
<li><p>Information Exposure Through Directory Listing in the
file scanner (oC-SA-2016-002)</p></li>
<li><p>Disclosure of files that begin with ".v" due to
unchecked return value (oC-SA-2016-003)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-001</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-002</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-003</url>
<cvename>CVE-2016-1498</cvename>
<cvename>CVE-2016-1499</cvename>
<cvename>CVE-2016-1500</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="ff824eea-c69c-11e5-96d6-14dae9d210b8">
<topic>radicale -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-radicale</name>
<name>py32-radicale</name>
<name>py33-radicale</name>
<name>py34-radicale</name>
<range><lt>1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Radicale reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/06/4">
<p>The multifilesystem backend allows access to arbitrary
files on all platforms.</p>
<p>Prevent regex injection in rights management.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/01/06/4</url>
<cvename>CVE-2015-8747</cvename>
<cvename>CVE-2015-8748</cvename>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="7a59e283-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in SQL editor</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-9/">
<p>With a crafted SQL query, it is possible to trigger an
XSS attack in the SQL editor.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-9/</url>
<cvename>CVE-2016-2045</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="78b4ebfb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Full path disclosure vulnerability in SQL parser</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-8/">
<p>By calling a particular script that is part of phpMyAdmin
in an unexpected way, it is possible to trigger phpMyAdmin
to display a PHP error message which contains the full path
of the directory where phpMyAdmin is installed.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-8/</url>
<cvename>CVE-2016-2044</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="7694927f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in normalization page</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-7/">
<p>With a crafted table name it is possible to trigger an
XSS attack in the database normalization page.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-7/</url>
<cvename>CVE-2016-2043</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="740badcb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-6/</url>
<cvename>CVE-2016-2042</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="71b24d99-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe comparison of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-5/">
<p>The comparison of the XSRF/CSRF token parameter with the
value saved in the session is vulnerable to timing
attacks. Moreover, the comparison could be bypassed if the
XSRF/CSRF token matches a particular pattern.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-5/</url>
<cvename>CVE-2016-2041</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6f0c2d1b-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Insecure password generation in JavaScript</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-4/">
<p>Password suggestion functionality uses Math.random()
which does not provide cryptographically secure random
numbers.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-4/</url>
<cvename>CVE-2016-1927</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6cc06eec-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-3/">
<ul>
<li>With a crafted table name it is possible to trigger
an XSS attack in the database search page.</li>
<li>With a crafted SET value or a crafted search query, it
is possible to trigger an XSS attacks in the zoom search
page.</li>
<li>With a crafted hostname header, it is possible to
trigger an XSS attacks in the home page.</li>
</ul>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>These vulnerabilities can be triggered only by someone
who is logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-3/</url>
<cvename>CVE-2016-2040</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="60ab0e93-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe generation of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-2/">
<p>The XSRF/CSRF token is generated with a weak algorithm
using functions that do not return cryptographically secure
values.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-2/</url>
<cvename>CVE-2016-2039</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="5d6a204f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-1/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-1/</url>
<cvename>CVE-2016-2038</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="50394bc9-c5fa-11e5-96a5-d93b343d1ff7">
<topic>prosody -- user impersonation vulnerability</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody team reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20160127/">
<p>Adopt key generation algorithm from XEP-0185, to
prevent impersonation attacks (CVE-2016-0756)</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/206707</freebsdpr>
<cvename>CVE-2016-0756</cvename>
<url>https://prosody.im/security/advisory_20160127/</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="3679fd10-c5d1-11e5-b85f-0018fe623f2b">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_7</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2f</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_12</lt></range>
<range><ge>10.1</ge><lt>10.1_29</lt></range>
<range><ge>9.3</ge><lt>9.3_36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160128.txt">
<ol>
<li>Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC 5114
support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that are
not "safe" then an attacker could use this fact to find a peer's private
DH exponent. This attack requires that the attacker complete multiple
handshakes in which the peer uses the same private DH exponent. For example
this could be used to discover a TLS server's private DH exponent if it's
reusing the private DH exponent or it's using a static DH ciphersuite.
OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
TLS. It is not on by default. If the option is not set then the server
reuses the same private DH exponent for the life of the server process and
would be vulnerable to this attack. It is believed that many popular
applications do set this option and would therefore not be at risk.
(CVE-2016-0701)</li>
<li>A malicious client can negotiate SSLv2 ciphers that have been disabled on
the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
been disabled, provided that the SSLv2 protocol was not also disabled via
SSL_OP_NO_SSLv2.
(CVE-2015-3197)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:11.openssl</freebsdsa>
<cvename>CVE-2016-0701</cvename>
<cvename>CVE-2015-3197</cvename>
<url>https://www.openssl.org/news/secadv/20160128.txt</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="8b27f1bc-c509-11e5-a95f-b499baebfeaf">
<topic>curl -- Credentials not checked</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.10.0</ge><lt>7.47.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20160127A.html">
<p>libcurl will reuse NTLM-authenticated proxy connections
without properly making sure that the connection was
authenticated with the same credentials as set for this
transfer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20160127A.html</url>
<cvename>CVE-2016-0755</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-27</entry>
<modified>2017-02-06</modified>
</dates>
</vuln>
<vuln vid="fb754341-c3e2-11e5-b5fe-002590263bf5">
<topic>wordpress -- XSS vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Jorbin reports:</p>
<blockquote cite="https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/">
<p>WordPress 4.4.1 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4 and earlier are affected by a cross-site
scripting vulnerability that could allow a site to be compromised.
This was reported by Crtc4L.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1564</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/08/3</url>
<url>https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-01-26</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="a763a0e7-c3d9-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.24/user-manual/whatsnew.html">
<p>Prevent invalid reads in case of corrupt chunk-encoded content.
CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.
</p>
<p>Remove empty Host headers in client requests. Previously they
would result in invalid reads. CVE-2016-1983. Bug discovered with
afl-fuzz and AddressSanitizer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1982</cvename>
<cvename>CVE-2016-1983</cvename>
<freebsdpr>ports/206504</freebsdpr>
<url>http://www.privoxy.org/3.0.24/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/21/4</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="d9e1b569-c3d8-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.23/user-manual/whatsnew.html">
<p>Fixed a DoS issue in case of client requests with incorrect
chunk-encoded body. When compiled with assertions enabled (the
default) they could previously cause Privoxy to abort(). Reported
by Matthew Daley. CVE-2015-1380.</p>
<p>Fixed multiple segmentation faults and memory leaks in the pcrs
code. This fix also increases the chances that an invalid pcrs
command is rejected as such. Previously some invalid commands would
be loaded without error. Note that Privoxy's pcrs sources (action
and filter files) are considered trustworthy input and should not be
writable by untrusted third-parties. CVE-2015-1381.</p>
<p>Fixed an 'invalid read' bug which could at least theoretically
cause Privoxy to crash. So far, no crashes have been observed.
CVE-2015-1382.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1380</cvename>
<cvename>CVE-2015-1381</cvename>
<cvename>CVE-2015-1382</cvename>
<freebsdpr>ports/197089</freebsdpr>
<url>http://www.privoxy.org/3.0.23/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/26/4</url>
</references>
<dates>
<discovery>2015-01-26</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="89d4ed09-c3d7-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.22/user-manual/whatsnew.html">
<p>Fixed a memory leak when rejecting client connections due to the
socket limit being reached (CID 66382). This affected Privoxy 3.0.21
when compiled with IPv6 support (on most platforms this is the
default).</p>
<p>Fixed an immediate-use-after-free bug (CID 66394) and two
additional unconfirmed use-after-free complaints made by Coverity
scan (CID 66391, CID 66376).</p>
</blockquote>
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1201">
<p>Privoxy before 3.0.22 allows remote attackers to cause a denial
of service (file descriptor consumption) via unspecified vectors.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1030</cvename>
<cvename>CVE-2015-1031</cvename>
<cvename>CVE-2015-1201</cvename>
<freebsdpr>ports/195468</freebsdpr>
<url>http://www.privoxy.org/3.0.22/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/1</url>
</references>
<dates>
<discovery>2015-01-10</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="ad82b0e9-c3d6-11e5-b5fe-002590263bf5">
<topic>privoxy -- malicious server spoofing as proxy vulnerability</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.21/user-manual/whatsnew.html">
<p>Proxy authentication headers are removed unless the new directive
enable-proxy-authentication-forwarding is used. Forwarding the
headers potentially allows malicious sites to trick the user into
providing them with login information. Reported by Chris John Riley.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2503</cvename>
<freebsdpr>ports/176813</freebsdpr>
<url>http://www.privoxy.org/3.0.21/user-manual/whatsnew.html</url>
</references>
<dates>
<discovery>2013-03-07</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="2e8cdd36-c3cc-11e5-b5fe-002590263bf5">
<topic>sudo -- potential privilege escalation via symlink misconfiguration</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602">
<p>sudoedit in Sudo before 1.8.15 allows local users to gain
privileges via a symlink attack on a file whose full path is defined
using multiple wildcards in /etc/sudoers, as demonstrated by
"/home/*/*/file.txt."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5602</cvename>
<freebsdpr>ports/206590</freebsdpr>
<url>https://www.exploit-db.com/exploits/37710/</url>
<url>https://bugzilla.sudo.ws/show_bug.cgi?id=707</url>
<url>http://www.sudo.ws/stable.html#1.8.15</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="99d3a8a5-c13c-11e5-96d6-14dae9d210b8">
<topic>imlib2 -- denial of service vulnerabilities</topic>
<affects>
<package>
<name>imlib2</name>
<range><lt>1.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Enlightenment reports:</p>
<blockquote cite="https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog">
<p>GIF loader: Fix segv on images without colormap</p>
<p>Prevent division-by-zero crashes.</p>
<p>Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog</url>
<url>http://seclists.org/oss-sec/2016/q1/162</url>
<cvename>CVE-2014-9762</cvename>
<cvename>CVE-2014-9763</cvename>
<cvename>CVE-2014-9764</cvename>
</references>
<dates>
<discovery>2013-12-21</discovery>
<entry>2016-01-22</entry>
</dates>
</vuln>
<vuln vid="b4578647-c12b-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01335">
<p>Specific APL data could trigger an INSIST in apl_42.c</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01335</url>
<cvename>CVE-2015-8704</cvename>
<freebsdsa>SA-16:08.bind</freebsdsa>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-22</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="371bbea9-3836-4832-9e70-e8e928727f8c">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html">
<p>This update includes 37 security fixes, including:</p>
<ul>
<li>[497632] High CVE-2016-1612: Bad cast in V8.</li>
<li>[572871] High CVE-2016-1613: Use-after-free in PDFium.</li>
<li>[544691] Medium CVE-2016-1614: Information leak in Blink.</li>
<li>[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.</li>
<li>[541415] Medium CVE-2016-1616: URL Spoofing.</li>
<li>[544765] Medium CVE-2016-1617: History sniffing with HSTS and
CSP.</li>
<li>[552749] Medium CVE-2016-1618: Weak random number generator in
Blink.</li>
<li>[557223] Medium CVE-2016-1619: Out-of-bounds read in
PDFium.</li>
<li>[579625] CVE-2016-1620: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.8
branch.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1612</cvename>
<cvename>CVE-2016-1613</cvename>
<cvename>CVE-2016-1614</cvename>
<cvename>CVE-2016-1615</cvename>
<cvename>CVE-2016-1616</cvename>
<cvename>CVE-2016-1617</cvename>
<cvename>CVE-2016-1618</cvename>
<cvename>CVE-2016-1619</cvename>
<cvename>CVE-2016-1620</cvename>
<url>http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
</dates>
</vuln>
<vuln vid="5237f5d7-c020-11e5-b397-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p6</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.90</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_11</lt></range>
<range><ge>10.1</ge><lt>10.1_28</lt></range>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p6, released on Tuesday, 19 January 2016:</p>
<ul>
<li>Bug 2948 / CVE-2015-8158: Potential Infinite Loop
in ntpq. Reported by Cisco ASIG.</li>
<li>Bug 2945 / CVE-2015-8138: origin: Zero Origin
Timestamp Bypass. Reported by Cisco ASIG.</li>
<li>Bug 2942 / CVE-2015-7979: Off-path Denial of
Service (DoS) attack on authenticated broadcast
mode. Reported by Cisco ASIG.</li>
<li>Bug 2940 / CVE-2015-7978: Stack exhaustion in
recursive traversal of restriction list.
Reported by Cisco ASIG.</li>
<li>Bug 2939 / CVE-2015-7977: reslist NULL pointer
dereference. Reported by Cisco ASIG.</li>
<li>Bug 2938 / CVE-2015-7976: ntpq saveconfig command
allows dangerous characters in filenames.
Reported by Cisco ASIG.</li>
<li>Bug 2937 / CVE-2015-7975: nextvar() missing length
check. Reported by Cisco ASIG.</li>
<li>Bug 2936 / CVE-2015-7974: Skeleton Key: Missing
key check allows impersonation between authenticated
peers. Reported by Cisco ASIG.</li>
<li>Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on
authenticated broadcast mode. Reported by Cisco ASIG.</li>
</ul>
<p>Additionally, mitigations are published for the following
two issues:</p>
<ul>
<li>Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay
attacks. Reported by Cisco ASIG.</li>
<li>Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc,
disclose origin. Reported by Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:09.ntp</freebsdsa>
<cvename>CVE-2015-7973</cvename>
<cvename>CVE-2015-7974</cvename>
<cvename>CVE-2015-7975</cvename>
<cvename>CVE-2015-7976</cvename>
<cvename>CVE-2015-7977</cvename>
<cvename>CVE-2015-7978</cvename>
<cvename>CVE-2015-7979</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2015-8139</cvename>
<cvename>CVE-2015-8140</cvename>
<cvename>CVE-2015-8158</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="62c0dbbd-bfce-11e5-b5fe-002590263bf5">
<topic>cgit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cgit</name>
<range><lt>0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason A. Donenfeld reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/14/6">
<p>Reflected Cross Site Scripting and Header Injection in Mimetype
Query String.</p>
<p>Stored Cross Site Scripting and Header Injection in Filename
Parameter.</p>
<p>Integer Overflow resulting in Buffer Overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1899</cvename>
<cvename>CVE-2016-1900</cvename>
<cvename>CVE-2016-1901</cvename>
<freebsdpr>ports/206417</freebsdpr>
<url>http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/14/6</url>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-20</entry>
</dates>
</vuln>
<vuln vid="314830d8-bf91-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01336">
<p>Problems converting OPT resource records and ECS options to
text format can cause BIND to terminate</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01336</url>
<cvename>CVE-2015-8705</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-20</entry>
<modified>2016-01-22</modified>
</dates>
</vuln>
<vuln vid="51358314-bec8-11e5-82cd-bcaec524bf84">
<topic>claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc</topic>
<affects>
<package>
<name>claws-mail</name>
<range><lt>3.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DrWhax reports:</p>
<blockquote cite="http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557">
<p>So in codeconv.c there is a function for Japanese character set
conversion called conv_jistoeuc(). There is no bounds checking on
the output buffer, which is created on the stack with alloca()
Bug can be triggered by sending an email to TAILS_luser@riseup.net
or whatever.
Since my C is completely rusty, you might be able to make a better
judgment on the severity of this issue. Marking critical for now.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8614</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8614</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2016-01-19</entry>
</dates>
</vuln>
<vuln vid="7c63775e-be31-11e5-b5fe-002590263bf5">
<topic>libarchive -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.1.2_5,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0211">
<p>Integer signedness error in the archive_write_zip_data function in
archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when
running on 64-bit machines, allows context-dependent attackers to
cause a denial of service (crash) via unspecified vectors, which
triggers an improper conversion between unsigned and signed types,
leading to a buffer overflow.</p>
</blockquote>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2304">
<p>Absolute path traversal vulnerability in bsdcpio in libarchive
3.1.2 and earlier allows remote attackers to write to arbitrary
files via a full pathname in an archive.</p>
</blockquote>
<p>Libarchive issue tracker reports:</p>
<blockquote cite="https://github.com/libarchive/libarchive/issues/502">
<p>Using a crafted tar file bsdtar can perform an out-of-bounds memory
read which will lead to a SEGFAULT. The issue exists when the
executable skips data in the archive. The amount of data to skip is
defined in byte offset [16-19] If ASLR is disabled, the issue can
lead to an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0211</cvename>
<cvename>CVE-2015-2304</cvename>
<freebsdpr>ports/200176</freebsdpr>
<freebsdsa>SA-16:22.libarchive</freebsdsa>
<freebsdsa>SA-16:23.libarchive</freebsdsa>
<url>https://github.com/libarchive/libarchive/pull/110</url>
<url>https://github.com/libarchive/libarchive/commit/5935715</url>
<url>https://github.com/libarchive/libarchive/commit/2253154</url>
<url>https://github.com/libarchive/libarchive/issues/502</url>
<url>https://github.com/libarchive/libarchive/commit/3865cf2</url>
<url>https://github.com/libarchive/libarchive/commit/e6c9668</url>
<url>https://github.com/libarchive/libarchive/commit/24f5de6</url>
</references>
<dates>
<discovery>2012-12-06</discovery>
<entry>2016-01-18</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6809c6db-bdeb-11e5-b5fe-002590263bf5">
<topic>go -- information disclosure vulnerability</topic>
<affects>
<package>
<name>go</name>
<range><ge>1.5,1</ge><lt>1.5.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/13/7">
<p>A security-related issue has been reported in Go's math/big
package. The issue was introduced in Go 1.5. We recommend that all
users upgrade to Go 1.5.3, which fixes the issue. Go programs must
be recompiled with Go 1.5.3 in order to receive the fix.</p>
<p>The Go team would like to thank Nick Craig-Wood for identifying the
issue.</p>
<p>This issue can affect RSA computations in crypto/rsa, which is used
by crypto/tls. TLS servers on 32-bit systems could plausibly leak
their RSA private key due to this issue. Other protocol
implementations that create many RSA signatures could also be
impacted in the same way.</p>
<p>Specifically, incorrect results in one part of the RSA Chinese
Remainder computation can cause the result to be incorrect in such a
way that it leaks one of the primes. While RSA blinding should
prevent an attacker from crafting specific inputs that trigger the
bug, on 32-bit systems the bug can be expected to occur at random
around one in 2^26 times. Thus collecting around 64 million
signatures (of known data) from an affected server should be enough
to extract the private key used.</p>
<p>On 64-bit systems, the frequency of the bug is so low (less than
one in 2^50) that it would be very difficult to exploit.
Nonetheless, everyone is strongly encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8618</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/13/7</url>
<url>https://go-review.googlesource.com/#/c/17672/</url>
<url>https://go-review.googlesource.com/#/c/18491/</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-18</entry>
</dates>
</vuln>
<vuln vid="05eeb7e9-b987-11e5-83ef-14dae9d210b8">
<topic>isc-dhcpd -- Denial of Service</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_10,2</lt></range>
</package>
<package>
<name>isc-dhcp41-client</name>
<range><lt>4.1.e_3,2</lt></range>
</package>
<package>
<name>isc-dhcp41-relay</name>
<range><lt>4.1.e_6,2</lt></range>
</package>
<package>
<name>isc-dhcp42-client</name>
<name>isc-dhcp42-server</name>
<name>isc-dhcp42-relay</name>
<range><ge>0</ge></range>
</package>
<package>
<name>isc-dhcp43-client</name>
<name>isc-dhcp43-server</name>
<name>isc-dhcp43-relay</name>
<range><lt>4.3.3.p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01334">
<p>A badly formed packet with an invalid IPv4 UDP length field
can cause a DHCP server, client, or relay program to terminate
abnormally.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01334</url>
<cvename>CVE-2015-8605</cvename>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-01-12</entry>
</dates>
</vuln>
<vuln vid="3b5c2362-bd07-11e5-b7ef-5453ed2e2b49">
<topic>libproxy -- stack-based buffer overflow</topic>
<affects>
<!-- libproxy-python is not affected. It only installs a .py file that
dlopen()s libproxy.so. -->
<package>
<name>libproxy</name>
<range><ge>0.4.0</ge><lt>0.4.6_1</lt></range>
</package>
<package>
<name>libproxy-gnome</name>
<range><ge>0.4.0</ge><lt>0.4.6_2</lt></range>
</package>
<package>
<name>libproxy-kde</name>
<range><ge>0.4.0</ge><lt>0.4.6_6</lt></range>
</package>
<package>
<name>libproxy-perl</name>
<range><ge>0.4.0</ge><lt>0.4.6_3</lt></range>
</package>
<package>
<name>libproxy-webkit</name>
<range><ge>0.4.0</ge><lt>0.4.6_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Hoger reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=864417#c0">
<p>A buffer overflow flaw was discovered in the libproxy's
url::get_pac() used to download proxy.pac proxy auto-configuration
file. A malicious host hosting proxy.pac, or a man in the middle
attacker, could use this flaw to trigger a stack-based buffer
overflow in an application using libproxy, if proxy configuration
instructed it to download proxy.pac file from a remote HTTP
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4504</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504</url>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/12/1</mlist>
<url>https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=864417</url>
<mlist>https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E</mlist>
</references>
<dates>
<discovery>2012-10-10</discovery>
<entry>2016-01-17</entry>
<modified>2016-01-18</modified>
</dates>
</vuln>
<vuln vid="046fedd1-bd01-11e5-bbf4-5404a68ad561">
<topic>ffmpeg -- remote attacker can access local files</topic>
<affects>
<package>
<name>ffmpeg</name>
<range>
<gt>2.0,1</gt>
<lt>2.8.5,1</lt>
</range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_2</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arch Linux reports:</p>
<blockquote cite="https://bugs.archlinux.org/task/47738">
<p>ffmpeg has a vulnerability in the current version that allows the
attacker to create a specially crafted video file, downloading which
will send files from a user PC to a remote attacker server. The
attack does not even require the user to open that file — for
example, KDE Dolphin thumbnail generation is enough.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1897</cvename>
<cvename>CVE-2016-1898</cvename>
<freebsdpr>ports/206282</freebsdpr>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-17</entry>
</dates>
</vuln>
<vuln vid="6c808811-bb9a-11e5-a65c-485d605f4717">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo OKU reports:</p>
<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
<p>When redirect directive is used, this flaw allows a remote
attacker to inject response headers into an HTTP redirect response.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1133</cvename>
<url>https://h2o.examp1e.net/vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-15</entry>
</dates>
</vuln>
<vuln vid="dfe0cdc1-baf2-11e5-863a-b499baebfeaf">
<topic>openssh -- information disclosure</topic>
<affects>
<package>
<name>openssh-portable</name>
<range>
<gt>5.4.p0,1</gt>
<lt>7.1.p2,1</lt>
</range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_10</lt></range>
<range><ge>10.1</ge><lt>10.1_27</lt></range>
<range><ge>9.3</ge><lt>9.3_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSH reports:</p>
<blockquote cite="http://www.openssh.com/security.html">
<p>OpenSSH clients between versions 5.4 and 7.1 are vulnerable to
information disclosure that may allow a malicious server to retrieve
information including under some circumstances, user's private keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/security.html</url>
<cvename>CVE-2016-0777</cvename>
<cvename>CVE-2016-0778</cvename>
<freebsdsa>SA-16:07</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="842cd117-ba54-11e5-9728-002590263bf5">
<topic>prosody -- multiple vulnerabilities</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody Team reports:</p>
<blockquote cite="http://blog.prosody.im/prosody-0-9-9-security-release/">
<p>Fix path traversal vulnerability in mod_http_files
(CVE-2016-1231)</p>
<p>Fix use of weak PRNG in generation of dialback secrets
(CVE-2016-1232)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1231</cvename>
<cvename>CVE-2016-1232</cvename>
<freebsdpr>ports/206150</freebsdpr>
<url>http://blog.prosody.im/prosody-0-9-9-security-release/</url>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-01-14</entry>
</dates>
</vuln>
<vuln vid="a7a4e96c-ba50-11e5-9728-002590263bf5">
<topic>kibana4 -- XSS vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><lt>4.1.4</lt></range>
</package>
<package>
<name>kibana42</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>kibana43</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4">
<p>Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov
for responsibly reporting.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205961</freebsdpr>
<freebsdpr>ports/205962</freebsdpr>
<freebsdpr>ports/205963</freebsdpr>
<url>https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-13</entry>
</dates>
</vuln>
<vuln vid="333f655a-b93a-11e5-9efa-5453ed2e2b49">
<topic>p5-PathTools -- File::Spec::canonpath loses taint</topic>
<affects>
<package>
<name>p5-PathTools</name>
<range>
<gt>3.4000</gt>
<lt>3.6200</lt>
</range>
</package>
<package>
<name>perl5</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5-devel</name>
<range><ge>5.19.9</ge><lt>5.20.2</lt></range>
<range><ge>5.21.0</ge><lt>5.22.2</lt></range>
<range><ge>5.23.0</ge><lt>5.23.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ricardo Signes reports:</p>
<blockquote>
<p>Beginning in PathTools 3.47 and/or perl 5.20.0, the
File::Spec::canonpath() routine returned untained strings even if
passed tainted input. This defect undermines the guarantee of taint
propagation, which is sometimes used to ensure that unvalidated
user input does not reach sensitive code.</p>
<p>This defect was found and reported by David Golden of MongoDB.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8607</cvename>
<url>https://rt.perl.org/Public/Bug/Display.html?id=126862</url>
</references>
<dates>
<discovery>2016-01-11</discovery>
<entry>2016-01-12</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="6b771fe2-b84e-11e5-92f9-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-wddx</name>
<name>php55-xmlrpc</name>
<range><lt>5.5.31</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<name>php56-soap</name>
<name>php56-wddx</name>
<name>php56-xmlrpc</name>
<range><lt>5.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.31">
<ul><li>Core:
<ul>
<li>Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array
Index Out of Bounds).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70900 (SoapClient systematic out of memory error).</li>
</ul></li>
<li>Wddx
<ul>
<li>Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
Deserialization).</li>
<li>Fixed bug #70741 (Session WDDX Packet Deserialization Type
Confusion Vulnerability).</li>
</ul></li>
<li>XMLRPC:
<ul>
<li>Fixed bug #70728 (Type Confusion Vulnerability in
PHP_to_XMLRPC_worker()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/ChangeLog-5.php#5.5.31</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.17</url>
</references>
<dates>
<discovery>2016-01-07</discovery>
<entry>2016-01-11</entry>
</dates>
</vuln>
<vuln vid="5f276780-b6ce-11e5-9731-5453ed2e2b49">
<topic>pygments -- shell injection vulnerability</topic>
<affects>
<package>
<name>py27-pygments</name>
<name>py32-pygments</name>
<name>py33-pygments</name>
<name>py34-pygments</name>
<name>py35-pygments</name>
<range><lt>2.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8557">
<p>The FontManager._get_nix_font_path function in formatters/img.py
in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute
arbitrary commands via shell metacharacters in a font name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8557</cvename>
<mlist>http://seclists.org/fulldisclosure/2015/Oct/4</mlist>
<url>https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8</url>
</references>
<dates>
<discovery>2015-09-28</discovery>
<entry>2016-01-09</entry>
</dates>
</vuln>
<vuln vid="631fc042-b636-11e5-83ef-14dae9d210b8">
<topic>polkit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polkit</name>
<range><lt>0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Walters reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html">
<ul>
<li><p>Integer overflow in the
authentication_agent_new_cookie function in PolicyKit (aka polkit)
before 0.113 allows local users to gain privileges by creating a large
number of connections, which triggers the issuance of a duplicate cookie
value.</p></li>
<li><p>The authentication_agent_new function in
polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka
polkit) before 0.113 allows local users to cause a denial of service
(NULL pointer dereference and polkitd daemon crash) by calling
RegisterAuthenticationAgent with an invalid object path.</p></li>
<li><p>The polkit_backend_action_pool_init function in
polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before
0.113 might allow local users to gain privileges via duplicate action
IDs in action descriptions.</p></li>
<li><p>PolicyKit (aka polkit) before 0.113 allows local
users to cause a denial of service (memory corruption and polkitd daemon
crash) and possibly gain privileges via unspecified vectors, related to
"javascript rule evaluation."</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html</url>
<cvename>CVE-2015-4625</cvename>
<cvename>CVE-2015-3218</cvename>
<cvename>CVE-2015-3255</cvename>
<cvename>CVE-2015-3256</cvename>
</references>
<dates>
<discovery>2015-06-03</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="b22b016b-b633-11e5-83ef-14dae9d210b8">
<topic>librsync -- collision vulnerability</topic>
<affects>
<package>
<name>librsync</name>
<range><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Samuel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/07/28/1">
<p>librsync before 1.0.0 uses a truncated MD4 checksum to
match blocks, which makes it easier for remote attackers to modify
transmitted data via a birthday attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/07/28/1</url>
<cvename>CVE-2014-8242</cvename>
</references>
<dates>
<discovery>2014-07-28</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4eae4f46-b5ce-11e5-8a2b-d050996490d0">
<topic>ntp -- denial of service vulnerability</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p5</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.78</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit">
<p>NTF's NTP Project has been notified of the following
1 medium-severity vulnerability that is fixed in
ntp-4.2.8p5, released on Thursday, 7 January 2016:</p>
<p>NtpBug2956: Small-step/Big-step CVE-2015-5300</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:02.ntp</freebsdsa>
<cvename>CVE-2015-5300</cvename>
<url>https://www.cs.bu.edu/~goldbe/NTPattack.html</url>
<url>http://support.ntp.org/bin/view/Main/NtpBug2956</url>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2016-01-08</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="df587aa2-b5a5-11e5-9728-002590263bf5">
<topic>dhcpcd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nico Golde reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/07/3">
<p>heap overflow via malformed dhcp responses later in print_option
(via dhcp_envoption1) due to incorrect option length values.
Exploitation is non-trivial, but I'd love to be proven wrong.</p>
<p>invalid read/crash via malformed dhcp responses. not exploitable
beyond DoS as far as I can judge.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1503</cvename>
<cvename>CVE-2016-1504</cvename>
<freebsdpr>ports/206015</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30</url>
<url>http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/07/3</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4084168e-b531-11e5-a98c-0011d823eebd">
<topic>mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication</topic>
<affects>
<package>
<name>polarssl13</name>
<range><lt>1.3.16</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released">
<p>MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack
on TLS 1.2 server authentication. They have been disabled by default.
Other attacks from the SLOTH paper do not apply to any version of mbed
TLS or PolarSSL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-07</entry>
</dates>
</vuln>
<vuln vid="6aa2d135-b40e-11e5-9728-002590263bf5">
<topic>xen-kernel -- ioreq handling possibly susceptible to multiple read issue</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-166.html">
<p>Single memory accesses in source code can be translated to multiple
ones in machine code by the compiler, requiring special caution when
accessing shared memory. Such precaution was missing from the
hypervisor code inspecting the state of I/O requests sent to the
device model for assistance.</p>
<p>Due to the offending field being a bitfield, it is however believed
that there is no issue in practice, since compilers, at least when
optimizing (which is always the case for non-debug builds), should find
it more expensive to extract the bit field value twice than to keep the
calculated value in a register.</p>
<p>This vulnerability is exposed to malicious device models. In
conventional Xen systems this means the qemu which service an HVM
domain. On such systems this vulnerability can only be exploited if
the attacker has gained control of the device model qemu via another
vulnerability.</p>
<p>Privilege escalation, host crash (Denial of Service), and leaked
information all cannot be excluded.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-166.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="e839ca04-b40d-11e5-9728-002590263bf5">
<topic>xen-kernel -- information leak in legacy x86 FPU/XMM initialization</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-165.html">
<p>When XSAVE/XRSTOR are not in use by Xen to manage guest extended
register state, the initial values in the FPU stack and XMM
registers seen by the guest upon first use are those left there by
the previous user of those registers.</p>
<p>A malicious domain may be able to leverage this to obtain sensitive
information such as cryptographic keys from another domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8555</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-165.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="5d1d4473-b40d-11e5-9728-002590263bf5">
<topic>xen-tools -- libxl leak of pv kernel and initrd on error</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-160.html">
<p>When constructing a guest which is configured to use a PV
bootloader which runs as a userspace process in the toolstack domain
(e.g. pygrub) libxl creates a mapping of the files to be used as
kernel and initial ramdisk when building the guest domain.</p>
<p>However if building the domain subsequently fails these mappings
would not be released leading to a leak of virtual address space in
the calling process, as well as preventing the recovery of the
temporary disk files containing the kernel and initial ramdisk.</p>
<p>For toolstacks which manage multiple domains within the same
process, an attacker who is able to repeatedly start a suitable
domain (or many such domains) can cause an out-of-memory condition in the
toolstack process, leading to a denial of service.</p>
<p>Under the same circumstances an attacker can also cause files to
accumulate on the toolstack domain filesystem (usually under /var in
dom0) used to temporarily store the kernel and initial ramdisk,
perhaps leading to a denial of service against arbitrary other
services using that filesystem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8341</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-160.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="bcad3faa-b40c-11e5-9728-002590263bf5">
<topic>xen-kernel -- XENMEM_exchange error handling issues</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-159.html">
<p>Error handling in the operation may involve handing back pages to
the domain. This operation may fail when in parallel the domain gets
torn down. So far this failure unconditionally resulted in the host
being brought down due to an internal error being assumed. This is
CVE-2015-8339.</p>
<p>Furthermore error handling so far wrongly included the release of a
lock. That lock, however, was either not acquired or already released
on all paths leading to the error handling sequence. This is
CVE-2015-8340.</p>
<p>A malicious guest administrator may be able to deny service by
crashing the host or causing a deadlock.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8339</cvename>
<cvename>CVE-2015-8340</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-159.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="b65e4914-b3bc-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in CIE Lab image format</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_1</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zzf of Alibaba discovered an out-of-bounds vulnerability in the code
processing the LogLUV and CIE Lab image format files. An attacker
could create a specially-crafted TIFF file that could cause libtiff
to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8683</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/25/2</mlist>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2016-01-05</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="bd349f7a-b3b9-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in tif_getimage.c</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_1</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in
tif_getimage.c. An attacker could create a specially-crafted TIFF
file that could cause libtiff to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8665</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/24/2</mlist>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-05</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="86c3c66e-b2f5-11e5-863a-b499baebfeaf">
<topic>unzip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/07/4">
<p>Two issues were found in unzip 6.0:</p>
<p> * A heap overflow triggered by unzipping a file with password
(e.g unzip -p -P x sigsegv.zip).</p>
<p> * A denegation of service with a file that never finishes unzipping
(e.g. unzip sigxcpu.zip).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/09/07/4</url>
<freebsdpr>ports/204413</freebsdpr>
<cvename>CVE-2015-7696</cvename>
<cvename>CVE-2015-7697</cvename>
</references>
<dates>
<discovery>2015-09-26</discovery>
<entry>2016-01-04</entry>
</dates>
</vuln>
<vuln vid="bb961ff3-b3a4-11e5-8255-5453ed2e2b49">
<topic>cacti -- SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><le>0.8.8f_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8369">
<p>SQL injection vulnerability in include/top_graph_header.php in
Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary
SQL commands via the rra_id parameter in a properties action to
graph.php.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8369</cvename>
<url>http://bugs.cacti.net/view.php?id=2646</url>
<url>http://svn.cacti.net/viewvc?view=rev&revision=7767</url>
<mlist>http://seclists.org/fulldisclosure/2015/Dec/8</mlist>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="59e7eb28-b309-11e5-af83-80ee73b5dcf5">
<topic>kea -- unexpected termination while handling a malformed packet</topic>
<affects>
<package>
<name>kea</name>
<range><ge>0.9.2</ge><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC Support reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html">
<p>ISC Kea may terminate unexpectedly (crash) while handling
a malformed client packet. Related defects in the kea-dhcp4
and kea-dhcp6 servers can cause the server to crash during
option processing if a client sends a malformed packet.
An attacker sending a crafted malformed packet can cause
an ISC Kea server providing DHCP services to IPv4 or IPv6
clients to exit unexpectedly.</p>
<ul>
<li><p>The kea-dhcp4 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when logging
at debug level 40 or higher. Servers running kea-dhcp4
versions 0.9.1 or lower, and servers which are not
logging or are logging at debug level 39 or below are
not vulnerable.</p></li>
<li><p>The kea-dhcp6 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when
logging at debug level 45 or higher. Servers running
kea-dhcp6 versions 0.9.1 or lower, and servers
which are not logging or are logging at debug level 44
or below are not vulnerable.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8373</cvename>
<url>https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-04</entry>
<modified>2016-01-05</modified>
</dates>
</vuln>
<vuln vid="84dc49b0-b267-11e5-8a5b-00262d5ed8ee">
<topic>mini_httpd -- buffer overflow via snprintf</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ACME Updates reports:</p>
<blockquote cite="https://cxsecurity.com/acveshow/CVE-2015-1548">
<p>mini_httpd 1.21 and earlier allows remote attackers to obtain
sensitive information from process memory via an HTTP request with
a long protocol string, which triggers an incorrect response size
calculation and an out-of-bounds read.</p>
<p>(rene) ACME, the author, claims that the vulnerability is fixed
*after* version 1.22, released on 2015-12-28</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1548</cvename>
<url>https://cxsecurity.com/cveshow/CVE-2015-1548</url>
<url>http://acme.com/updates/archive/192.html</url>
</references>
<dates>
<discovery>2015-02-10</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="1384f2fd-b1be-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Rocker switch emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/28/6">
<p>Qemu emulator built with the Rocker switch emulation support is
vulnerable to an off-by-one error. It happens while processing
transmit(tx) descriptors in 'tx_consume' routine, if a descriptor
was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.
</p>
<p>A privileged user inside guest could use this flaw to cause memory
leakage on the host or crash the Qemu process instance resulting in
DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8701</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/28/6</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="152acff3-b1bd-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Q35 chipset emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/24/1">
<p>Qemu emulator built with the Q35 chipset based pc system emulator
is vulnerable to a heap based buffer overflow. It occurs during VM
guest migration, as more(16 bytes) data is moved into allocated
(8 bytes) memory area.</p>
<p>A privileged guest user could use this issue to corrupt the VM
guest image, potentially leading to a DoS. This issue affects q35
machine types.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8666</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/24/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
</references>
<dates>
<discovery>2015-11-19</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="62ab8707-b1bc-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Human Monitor Interface support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/22/8">
<p>Qemu emulator built with the Human Monitor Interface(HMP) support
is vulnerable to an OOB write issue. It occurs while processing
'sendkey' command in hmp_sendkey routine, if the command argument is
longer than the 'keyname_buf' buffer size.</p>
<p>A user/process could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8619</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/22/8</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="b3f9f8ef-b1bb-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/7">
<p>Qemu emulator built with the SCSI MegaRAID SAS HBA emulation
support is vulnerable to a stack buffer overflow issue. It occurs
while processing the SCSI controller's CTRL_GET_INFO command. A
privileged guest user could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8613</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/7</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811</url>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="9ad8993e-b1ba-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/15/4">
<p>Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator
support is vulnerable to a memory leakage flaw. It occurs when a
guest repeatedly tries to activate the vmxnet3 device.</p>
<p>A privileged guest user could use this flaw to leak host memory,
resulting in DoS on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8567</cvename>
<cvename>CVE-2015-8568</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/15/4</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="60cb2055-b1b8-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in USB EHCI emulation support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/9">
<p>Qemu emulator built with the USB EHCI emulation support is
vulnerable to an infinite loop issue. It occurs during communication
between host controller interface(EHCI) and a respective device
driver. These two communicate via a isochronous transfer descriptor
list(iTD) and an infinite loop unfolds if there is a closed loop in
this list.</p>
<p>A privileges user inside guest could use this flaw to consume
excessive CPU cycles & resources on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8558</cvename>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/9</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="3fb06284-b1b7-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MSI-X support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/2">
<p>Qemu emulator built with the PCI MSI-X support is vulnerable to
null pointer dereference issue. It occurs when the controller
attempts to write to the pending bit array(PBA) memory region.
Because the MSI-X MMIO support did not define the .write method.</p>
<p>A privileges used inside guest could use this flaw to crash the
Qemu process resulting in DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7549</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/2</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="67feba97-b1b5-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/08/4">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to an arithmetic exception flaw. It occurs on the VNC
server side while processing the 'SetPixelFormat' messages from a
client.</p>
<p>A privileged remote client could use this flaw to crash the guest
resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8504</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/08/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="405446f4-b1b3-11e5-9728-002590263bf5">
<topic>qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/2">
<p>Qemu emulator built with the AMD PC-Net II Ethernet Controller
support is vulnerable to a heap buffer overflow flaw. While
receiving packets in the loopback mode, it appends CRC code to the
receive buffer. If the data size given is same as the receive buffer
size, the appended CRC code overwrites 4 bytes beyond this
's->buffer' array.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS or potentially execute
arbitrary code with privileges of the Qemu process on the host.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/3">
<p>The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets
from a remote host(non-loopback mode), fails to validate the
received data size, thus resulting in a buffer overflow issue. It
could potentially lead to arbitrary code execution on the host, with
privileges of the Qemu process. It requires the guest NIC to have
larger MTU limit.</p>
<p>A remote user could use this flaw to crash the guest instance
resulting in DoS or potentially execute arbitrary code on a remote
host with privileges of the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7504</cvename>
<cvename>CVE-2015-7512</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>http://xenbits.xen.org/xsa/advisory-162.html</url>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2016-01-03</entry>
<modified>2016-01-06</modified>
</dates>
</vuln>
<vuln vid="b56fe6bb-b1b1-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in eepro100 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/25/3">
<p>Qemu emulator built with the i8255x (PRO100) emulation support is
vulnerable to an infinite loop issue. It could occur while
processing a chain of commands located in the Command Block List
(CBL). Each Command Block(CB) points to the next command in the
list. An infinite loop unfolds if the link to the next CB points
to the same block or there is a closed loop in the chain.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8345</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/3</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="42cbd1e8-b152-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in virtio-net support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/5">
<p>Qemu emulator built with the Virtual Network Device(virtio-net)
support is vulnerable to a DoS issue. It could occur while receiving
large packets over the tuntap/macvtap interfaces and when guest's
virtio-net driver did not support big/mergeable receive buffers.</p>
<p>An attacker on the local network could use this flaw to disable
guest's networking by sending a large number of jumbo frames to the
guest, exhausting all receive buffers and thus leading to a DoS
situation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7295</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="6aa3322f-b150-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in NE2000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/2">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur when receiving
packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/3">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to a heap buffer overflow issue. It could occur when
receiving packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance or potentially execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5278</cvename>
<cvename>CVE-2015-5279</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="bbc97005-b14e-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/10/1">
<p>Qemu emulator built with the IDE disk and CD/DVD-ROM emulation
support is vulnerable to a divide by zero issue. It could occur
while executing an IDE command WIN_READ_NATIVE_MAX to determine
the maximum size of a drive.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6855</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/10/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a</url>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="10bf8eed-b14d-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in e1000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/04/4">
<p>Qemu emulator built with the e1000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur while
processing transmit descriptor data when sending a network packet.
</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6815</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7</url>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="8a560bcf-b14b-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.1.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.2.50.g20141230</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/7">
<p>Qemu emulator built with the VNC display driver is vulnerable to an
infinite loop issue. It could occur while processing a
CLIENT_CUT_TEXT message with specially crafted payload message.</p>
<p>A privileged guest user could use this flaw to crash the Qemu
process on the host, resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5239</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
</references>
<dates>
<discovery>2014-06-30</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="2b3b4c27-b0c7-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20151011</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/21/6">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to a buffer overflow flaw leading to a heap memory
corruption issue. It could occur while refreshing the server
display surface via routine vnc_refresh_server_surface().</p>
<p>A privileged guest user could use this flaw to corrupt the heap
memory and crash the Qemu process instance OR potentially use it
to execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5225</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/21/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b</url>
</references>
<dates>
<discovery>2015-08-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="21e5abe3-b0c6-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in virtio-serial message exchanges</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/06/3">
<p>Qemu emulator built with the virtio-serial vmchannel support is
vulnerable to a buffer overflow issue. It could occur while
exchanging virtio control messages between guest and the host.</p>
<p>A malicious guest could use this flaw to corrupt few bytes of Qemu
memory area, potentially crashing the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5745</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/06/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295</url>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="a267cd6c-b0c4-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- stack buffer overflow while parsing SCSI commands</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/07/23/6">
<p>Qemu emulator built with the SCSI device emulation support is
vulnerable to a stack buffer overflow issue. It could occur while
parsing SCSI command descriptor block with an invalid operation
code.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5158</cvename>
<url>http://openwall.com/lists/oss-security/2015/07/23/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
</references>
<dates>
<discovery>2015-07-23</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="aea8d90e-b0c1-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- code execution on host machine</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Matousek of Red Hat Inc. reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/06/17/5">
<p>Due converting PIO to the new memory read/write api we no longer
provide separate I/O region lenghts for read and write operations.
As a result, reading from PIT Mode/Command register will end with
accessing pit->channels with invalid index and potentially cause
memory corruption and/or minor information leak.</p>
<p>A privileged guest user in a guest with QEMU PIT emulation enabled
could potentially (tough unlikely) use this flaw to execute
arbitrary code on the host with the privileges of the hosting QEMU
process.</p>
<p>Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT
emulation and are thus not vulnerable to this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3214</cvename>
<url>http://openwall.com/lists/oss-security/2015/06/17/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="4b3a7e70-afce-11e5-b864-14dae9d210b8">
<topic>mono -- DoS and code execution</topic>
<affects>
<package>
<name>mono</name>
<range><lt>4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NCC Group reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q4/543">
<p>An attacker who can cause a carefully-chosen string to be
converted to a floating-point number can cause a crash and potentially
induce arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q4/543</url>
<cvename>CVE-2009-0689</cvename>
</references>
<dates>
<discovery>2015-12-19</discovery>
<entry>2015-12-31</entry>
</dates>
</vuln>
<vuln vid="84c7ea88-bf04-4bdc-973b-36744bf540ab">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.559</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-01.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8644).</p>
<p>These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8651).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8634, CVE-2015-8635,
CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641,
CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647,
CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2015-8459,
CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8459</cvename>
<cvename>CVE-2015-8460</cvename>
<cvename>CVE-2015-8634</cvename>
<cvename>CVE-2015-8636</cvename>
<cvename>CVE-2015-8638</cvename>
<cvename>CVE-2015-8639</cvename>
<cvename>CVE-2015-8640</cvename>
<cvename>CVE-2015-8641</cvename>
<cvename>CVE-2015-8642</cvename>
<cvename>CVE-2015-8643</cvename>
<cvename>CVE-2015-8644</cvename>
<cvename>CVE-2015-8645</cvename>
<cvename>CVE-2015-8646</cvename>
<cvename>CVE-2015-8647</cvename>
<cvename>CVE-2015-8648</cvename>
<cvename>CVE-2015-8649</cvename>
<cvename>CVE-2015-8650</cvename>
<cvename>CVE-2015-8651</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-01.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2015-12-29</entry>
</dates>
</vuln>
<vuln vid="b808c3a8-ae30-11e5-b864-14dae9d210b8">
<topic>inspircd -- DoS</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>2.0.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Inspircd reports:</p>
<blockquote cite="http://www.inspircd.org/2015/04/16/v2019-released.html">
<p>This release fixes the issues discovered since 2.0.18,
containing multiple important stability and correctness related
improvements, including a fix for a bug which allowed malformed DNS
records to cause netsplits on a network.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.inspircd.org/2015/04/16/v2019-released.html</url>
<url>https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559</url>
<url>http://comments.gmane.org/gmane.comp.security.oss.general/18464</url>
<cvename>CVE-2015-8702</cvename>
</references>
<dates>
<discovery>2015-04-16</discovery>
<entry>2015-12-29</entry>
<modified>2015-12-29</modified>
</dates>
</vuln>
<vuln vid="4bae544d-06a3-4352-938c-b3bcbca89298">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.4,1</lt></range>
<range><lt>2.7.4,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.2.r20151219 has ffmpeg-2.8.3 -->
<range><lt>1.2.r20151219_1</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8662">
<p>The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in
FFmpeg before 2.8.4 does not validate the number of
decomposition levels before proceeding with Discrete Wavelet
Transform decoding, which allows remote attackers to cause a
denial of service (out-of-bounds array access) or possibly
have unspecified other impact via crafted JPEG 2000
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8663">
<p>The ff_get_buffer function in libavcodec/utils.c in
FFmpeg before 2.8.4 preserves width and height values after
a failure, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via a crafted .mov file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8662</cvename>
<cvename>CVE-2015-8663</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-12-20</discovery>
<entry>2015-12-28</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="10f7bc76-0335-4a88-b391-0b05b3a8ce1c">
<topic>NSS -- MD5 downgrade in TLS 1.2 signatures</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.20.2</lt></range>
<range><lt>3.19.2.2</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0.2,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/">
<p>Security researcher Karthikeyan Bhargavan reported an
issue in Network Security Services (NSS) where MD5
signatures in the server signature within the TLS 1.2
ServerKeyExchange message are still accepted. This is an
issue since NSS has officially disallowed the accepting MD5
as a hash algorithm in signatures since 2011. This issues
exposes NSS based clients such as Firefox to theoretical
collision-based forgery attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7575</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-150/</url>
<url>https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-28</entry>
</dates>
</vuln>
<vuln vid="88f75070-abcf-11e5-83d3-6805ca0b3d42">
<topic>phpMyAdmin -- path disclosure vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.5.0</ge><lt>4.5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-6/</url>
<cvename>CVE-2015-8669</cvename>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2015-12-26</entry>
</dates>
</vuln>
<vuln vid="876768aa-ab1e-11e5-8a30-5453ed2e2b49">
<topic>dpkg -- stack-based buffer overflow</topic>
<affects>
<package>
<name>dpkg</name>
<range><lt>1.16.17</lt></range>
<range><lt>1.17.26</lt></range>
<range><lt>1.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2015/msg00312.html">
<p>Hanno Boeck discovered a stack-based buffer overflow in the
dpkg-deb component of dpkg, the Debian package management system.
This flaw could potentially lead to arbitrary code execution if a
user or an automated system were tricked into processing a specially
crafted Debian binary package (.deb) in the old style Debian binary
package format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0860</cvename>
<url>http://openwall.com/lists/oss-security/2015/11/26/3</url>
<url>https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0</url>
</references>
<dates>
<discovery>2015-11-26</discovery>
<entry>2015-12-25</entry>
</dates>
</vuln>
<vuln vid="e1b5318c-aa4d-11e5-8f5c-002590263bf5">
<topic>mantis -- information disclosure vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.19_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=19873">
<p>CVE-2015-5059: documentation in private projects can be seen by
every user</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5059</cvename>
<freebsdpr>ports/201106</freebsdpr>
<url>https://mantisbt.org/bugs/view.php?id=19873</url>
<url>http://openwall.com/lists/oss-security/2015/06/25/3</url>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="f36bbd66-aa44-11e5-8f5c-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.12</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.5</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.4</lt></range>
</package>
<package>
<name>mediawiki126</name>
<range><lt>1.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html">
<p>(T117899) SECURITY: $wgArticlePath can no longer be set to relative
paths that do not begin with a slash. This enabled trivial XSS
attacks. Configuration values such as "http://my.wiki.com/wiki/$1"
are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is
not and will now throw an error.</p>
<p>(T119309) SECURITY: Use hash_compare() for edit token comparison.
</p>
<p>(T118032) SECURITY: Don't allow cURL to interpret POST parameters
starting with '@' as file uploads.</p>
<p>(T115522) SECURITY: Passwords generated by User::randomPassword()
can no longer be shorter than $wgMinimalPasswordLength.</p>
<p>(T97897) SECURITY: Improve IP parsing and trimming. Previous
behavior could result in improper blocks being issued.</p>
<p>(T109724) SECURITY: Special:MyPage, Special:MyTalk,
Special:MyContributions and related pages no longer use HTTP
redirects and are now redirected by MediaWiki.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8622</cvename>
<cvename>CVE-2015-8623</cvename>
<cvename>CVE-2015-8624</cvename>
<cvename>CVE-2015-8625</cvename>
<cvename>CVE-2015-8626</cvename>
<cvename>CVE-2015-8627</cvename>
<cvename>CVE-2015-8628</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html</url>
<url>https://phabricator.wikimedia.org/T117899</url>
<url>https://phabricator.wikimedia.org/T119309</url>
<url>https://phabricator.wikimedia.org/T118032</url>
<url>https://phabricator.wikimedia.org/T115522</url>
<url>https://phabricator.wikimedia.org/T97897</url>
<url>https://phabricator.wikimedia.org/T109724</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/7</url>
</references>
<dates>
<discovery>2015-12-18</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="3b50881d-1860-4721-aab1-503290e23f6c">
<topic>Ruby -- unsafe tainted string vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.0.0,1</ge><lt>2.0.0.648,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.8,1</lt></range>
<range><ge>2.2.0,1</ge><lt>2.2.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developer reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/">
<p>There is an unsafe tainted string vulnerability in Fiddle and DL.
This issue was originally reported and fixed with CVE-2009-5147 in
DL, but reappeared after DL was reimplemented using Fiddle and
libffi.</p>
<p>And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not
fixed at other branches, then rubies which bundled DL except Ruby
1.9.1 are still vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/</url>
<cvename>CVE-2015-7551</cvename>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="54075861-a95a-11e5-8b40-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.11</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.15/">
<p>During the generation of a dependency graph, the code for
the HTML image map is generated locally if a local dot
installation is used. With escaped HTML characters in a bug
summary, it is possible to inject unfiltered HTML code in
the map file which the CreateImagemap function generates.
This could be used for a cross-site scripting attack.</p>
<p>If an external HTML page contains a <script> element with
its src attribute pointing to a buglist in CSV format, some
web browsers incorrectly try to parse the CSV file as valid
JavaScript code. As the buglist is generated based on the
privileges of the user logged into Bugzilla, the external
page could collect confidential data contained in the CSV
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8508</cvename>
<cvename>CVE-2015-8509</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1221518</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1232785</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="d6c51737-a84b-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to
crash an application was found in librsvg2 while parsing SVG file.
It has been fixed in 2.40.12 by many commits that has rewritten the
checks for cyclic references.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7558</cvename>
<freebsdpr>ports/205502</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://bugzilla.redhat.com/1268243</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="da634091-a84a-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when
parsing SVG file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7557</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df</url>
</references>
<dates>
<discovery>2015-02-06</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="9e7306b9-a5c3-11e5-b864-14dae9d210b8">
<topic>quassel -- remote denial of service</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pierre Schweitzer reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/12/1">
<p>Any client sending the command "/op *" in a query will
cause the Quassel core to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/12/1</url>
<cvename>CVE-2015-8547</cvename>
</references>
<dates>
<discovery>2015-11-22</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="f714b4c9-a6c1-11e5-88d7-047d7b492d07">
<topic>libvirt -- ACL bypass using ../ to access beyond storage pool</topic>
<affects>
<package>
<name>libvirt</name>
<range><ge>1.1.0</ge><lt>1.2.19_2</lt></range>
<range><ge>1.2.20</ge><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Libvit development team reports:</p>
<blockquote cite="http://security.libvirt.org/2015/0004.html">
<p>Various virStorageVol* API operate on user-supplied volume names by
concatenating the volume name to the pool location. Note that the
virStoragePoolListVolumes API, when used on a storage pool backed by
a directory in a file system, will only list volumes immediately in
that directory (there is no traversal into subdirectories). However,
other APIs such as virStorageVolCreateXML were not checking if a
potential volume name represented one of the volumes that could be
returned by virStoragePoolListVolumes; because they were not rejecting
the use of '/' in a volume name.</p>
<p>Because no checking was done on volume names, a user could supply
a potential volume name of something like '../../../etc/passwd' to
attempt to access a file not belonging to the storage pool. When
fine-grained Access Control Lists (ACL) are in effect, a user with
storage_vol:create ACL permission but lacking domain:write permission
could thus abuse virStorageVolCreateXML and similar APIs to gain
access to files not normally permitted to that user. Fortunately, it
appears that the only APIs that could leak information or corrupt
files require read-write connection to libvirtd; and when ACLs are not
in use (the default without any further configuration), a user with
read-write access can already be considered to have full access to the
machine, and without an escalation of privilege there is no security
problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5313</cvename>
<url>http://security.libvirt.org/2015/0004.html</url>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-20</entry>
</dates>
</vuln>
<vuln vid="ef434839-a6a4-11e5-8275-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><lt>3.6.25_2</lt></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.22</lt></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.3</lt></range>
</package>
<package>
<name>ldb</name>
<range><ge>1.0.0</ge><lt>1.1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.3.3">
<p>[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.</p>
<p>[CVE-2015-5330] Malicious request can cause Samba LDAP server
to return uninitialized memory that should not be part of the reply.</p>
<p>[CVE-2015-5296] Requesting encryption should also request
signing when setting up the connection to protect against man-in-the-middle attacks.</p>
<p>[CVE-2015-5299] A missing access control check in the VFS
shadow_copy2 module could allow unauthorized users to access snapshots.</p>
<p>[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.</p>
<p>[CVE-2015-8467] Samba can expose Windows DCs to MS15-096
Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).</p>
<p>[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3223</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-3223.html</url>
<cvename>CVE-2015-5252</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5252.html</url>
<cvename>CVE-2015-5296</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5296.html</url>
<cvename>CVE-2015-5299</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5299.html</url>
<cvename>CVE-2015-5330</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5330.html</url>
<cvename>CVE-2015-7540</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-7540.html</url>
<cvename>CVE-2015-8467</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-8467.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-19</entry>
<modified>2016-02-05</modified>
</dates>
</vuln>
<vuln vid="bb7d4791-a5bf-11e5-a0e5-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.106</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[569486] CVE-2015-6792: Fixes from internal audits and
fuzzing.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6792</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="7329938b-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Till Kamppeter reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/13">
<p>Cups Filters/Foomatic Filters does not consider semicolon
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/13</url>
<cvename>CVE-2015-8560</cvename>
</references>
<dates>
<discovery>2015-12-12</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="6dbae1a8-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/13/2">
<p>Cups Filters/Foomatic Filters does not consider backtick
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/13/2</url>
<cvename>CVE-2015-8327</cvename>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="1fbd6db1-a4e4-11e5-b864-14dae9d210b8">
<topic>py-amf -- input sanitization errors</topic>
<affects>
<package>
<name>py27-amf</name>
<name>py32-amf</name>
<name>py33-amf</name>
<name>py34-amf</name>
<range><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-011.html">
<p>A specially crafted AMF payload, containing malicious
references to XML external entities, can be used to trigger Denial of
Service (DoS) conditions or arbitrarily return the contents of files
that are accessible with the running application privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2015-011.html</url>
<cvename>CVE-2015-8549</cvename>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="a9f60ce8-a4e0-11e5-b864-14dae9d210b8">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html">
<h2>[20151201] - Core - Remote Code Execution Vulnerability</h2>
<p>Browser information is not filtered properly while saving the
session values into the database which leads to a Remote Code
Execution vulnerability.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html">
<h2>[20151202] - Core - CSRF Hardening</h2>
<p>Add additional CSRF hardening in com_templates.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html">
<h2>[20151203] - Core - Directory Traversal</h2>
<p>Failure to properly sanitize input data from the XML install file
located within an extension's package archive allows for directory
traversal.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html">
<h2>[20151204] - Core - Directory Traversal</h2>
<p>Inadequate filtering of request data leads to a Directory Traversal
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html</url>
<cvename>CVE-2015-8562</cvename>
<cvename>CVE-2015-8563</cvename>
<cvename>CVE-2015-8564</cvename>
<cvename>CVE-2015-8565</cvename>
<url>https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html</url>
<url>https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html</url>
<url>https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html</url>
<url>https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html</url>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2015-12-17</entry>
<modified>2016-12-22</modified>
</dates>
</vuln>
<vuln vid="a8ec4db7-a398-11e5-85e9-14dae9d210b8">
<topic>bind -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P2</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20151215</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html">
<p>Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.</p>
<p>Incorrect reference counting could result in an INSIST
failure if a socket error occurred while performing a lookup. This flaw
is disclosed in CVE-2015-8461. [RT#40945]</p>
<p>Insufficient testing when parsing a message allowed records
with an incorrect class to be be accepted, triggering a REQUIRE failure
when those records were subsequently cached. This flaw is disclosed in
CVE-2015-8000. [RT #40987]</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html</url>
<url>https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html</url>
<url>https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html</url>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-8000</cvename>
<cvename>CVE-2015-8461</cvename>
<freebsdsa>SA-15:27.bind</freebsdsa>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-12-16</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="2c2d1c39-1396-459a-91f5-ca03ee7c64c6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.5.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-134 Miscellaneous memory safety hazards
(rv:43.0 / rv:38.5)</p>
<p>MFSA 2015-135 Crash with JavaScript variable assignment
with unboxed objects</p>
<p>MFSA 2015-136 Same-origin policy violation using
perfomance.getEntries and history navigation</p>
<p>MFSA 2015-137 Firefox allows for control characters to be
set in cookies</p>
<p>MFSA 2015-138 Use-after-free in WebRTC when datachannel
is used after being destroyed</p>
<p>MFSA 2015-139 Integer overflow allocating extremely large
textures</p>
<p>MFSA 2015-140 Cross-origin information leak through web
workers error events</p>
<p>MFSA 2015-141 Hash in data URI is incorrectly parsed</p>
<p>MFSA 2015-142 DOS due to malformed frames in HTTP/2</p>
<p>MFSA 2015-143 Linux file chooser crashes on malformed
images due to flaws in Jasper library</p>
<p>MFSA 2015-144 Buffer overflows found through code
inspection</p>
<p>MFSA 2015-145 Underflow through code inspection</p>
<p>MFSA 2015-146 Integer overflow in MP4 playback in 64-bit
versions</p>
<p>MFSA 2015-147 Integer underflow and buffer overflow
processing MP4 metadata in libstagefright</p>
<p>MFSA 2015-148 Privilege escalation vulnerabilities in
WebExtension APIs</p>
<p>MFSA 2015-149 Cross-site reading attack through data and
view-source URIs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7201</cvename>
<cvename>CVE-2015-7202</cvename>
<cvename>CVE-2015-7203</cvename>
<cvename>CVE-2015-7204</cvename>
<cvename>CVE-2015-7205</cvename>
<cvename>CVE-2015-7207</cvename>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2015-7210</cvename>
<cvename>CVE-2015-7211</cvename>
<cvename>CVE-2015-7212</cvename>
<cvename>CVE-2015-7213</cvename>
<cvename>CVE-2015-7214</cvename>
<cvename>CVE-2015-7215</cvename>
<cvename>CVE-2015-7216</cvename>
<cvename>CVE-2015-7217</cvename>
<cvename>CVE-2015-7218</cvename>
<cvename>CVE-2015-7219</cvename>
<cvename>CVE-2015-7220</cvename>
<cvename>CVE-2015-7221</cvename>
<cvename>CVE-2015-7222</cvename>
<cvename>CVE-2015-7223</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-134/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-135/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-136/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-137/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-138/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-139/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-140/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-141/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-142/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-143/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-144/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-145/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-146/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-147/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-148/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-149/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="a5934ba8-a376-11e5-85e9-14dae9d210b8">
<topic>java -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjdk8</name>
<name>openjdk8-jre</name>
<range><lt>8.66.17</lt></range>
</package>
<package>
<name>openjdk7</name>
<name>openjdk7-jre</name>
<range><lt>7.91.02,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA">
<p>This Critical Patch Update contains 25 new security fixes
for Oracle Java SE. 24 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without the need for a username and password.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA</url>
<cvename>CVE-2015-4835</cvename>
<cvename>CVE-2015-4881</cvename>
<cvename>CVE-2015-4843</cvename>
<cvename>CVE-2015-4883</cvename>
<cvename>CVE-2015-4860</cvename>
<cvename>CVE-2015-4805</cvename>
<cvename>CVE-2015-4844</cvename>
<cvename>CVE-2015-4901</cvename>
<cvename>CVE-2015-4868</cvename>
<cvename>CVE-2015-4810</cvename>
<cvename>CVE-2015-4806</cvename>
<cvename>CVE-2015-4871</cvename>
<cvename>CVE-2015-4902</cvename>
<cvename>CVE-2015-4840</cvename>
<cvename>CVE-2015-4882</cvename>
<cvename>CVE-2015-4842</cvename>
<cvename>CVE-2015-4734</cvename>
<cvename>CVE-2015-4903</cvename>
<cvename>CVE-2015-4803</cvename>
<cvename>CVE-2015-4893</cvename>
<cvename>CVE-2015-4911</cvename>
<cvename>CVE-2015-4872</cvename>
<cvename>CVE-2015-4906</cvename>
<cvename>CVE-2015-4916</cvename>
<cvename>CVE-2015-4908</cvename>
</references>
<dates>
<discovery>2015-10-20</discovery>
<entry>2015-12-15</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="daadef86-a366-11e5-8b40-20cf30e32f6d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion17</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
<package>
<name>mod_dav_svn</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Remotely triggerable heap overflow and out-of-bounds read caused
by integer overflow in the svn:// protocol parser.</p>
<p>Remotely triggerable heap overflow and out-of-bounds read in
mod_dav_svn caused by integer overflow when parsing skel-encoded
request bodies.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5343</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5343-advisory.txt</url>
<cvename>CVE-2015-5259</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5259-advisory.txt</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="72c145df-a1e0-11e5-8ad0-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html">
<p>7 security fixes in this release, including:</p>
<ul>
<li>[548273] High CVE-2015-6788: Type confusion in extensions.
Credit to anonymous.</li>
<li>[557981] High CVE-2015-6789: Use-after-free in Blink. Credit to
cloudfuzzer.</li>
<li>[542054] Medium CVE-2015-6790: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[567513] CVE-2015-6791: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6788</cvename>
<cvename>CVE-2015-6789</cvename>
<cvename>CVE-2015-6790</cvename>
<cvename>CVE-2015-6791</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="33459061-a1d6-11e5-8794-bcaec565249c">
<topic>freeimage -- multiple integer overflows</topic>
<affects>
<package>
<name>freeimage</name>
<range><lt>3.16.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pcheng pcheng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/28/1">
<p>An integer overflow issue in the FreeImage project was
reported and fixed recently.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0852</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/28/1</url>
</references>
<dates>
<discovery>2015-08-28</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="21bc4d71-9ed8-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.9</lt></range>
<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
<range><ge>3.1.0</ge><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Data disclosure in atom feed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8537</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2015-12-10</entry>
<modified>2015-12-11</modified>
</dates>
</vuln>
<vuln vid="be63533c-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.8</lt></range>
<range><ge>3.0.0</ge><lt>3.0.6</lt></range>
<range><ge>3.1.0</ge><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential changeset message disclosure in issues API.</p>
<p>Data disclosure on the time logging form</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8346</cvename>
<cvename>CVE-2015-8473</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/12</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/7</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="3ec2e0bc-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.5.1</ge><lt>2.6.7</lt></range>
<range><ge>3.0.0</ge><lt>3.0.5</lt></range>
<range><eq>3.1.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8474</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/04/1</url>
</references>
<dates>
<discovery>2015-09-20</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="939a7086-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- potential XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential XSS vulnerability when rendering some flash messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8477</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/05/6</url>
</references>
<dates>
<discovery>2015-02-19</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="49def4b7-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.6</lt></range>
<range><ge>2.5.0</ge><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential data leak (project names) in the invalid form
authenticity token error screen.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2014-07-06</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="c2efcd46-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.5</lt></range>
<range><eq>2.5.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1985</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>https://jvn.jp/en/jp/JVN93004610/index.html</url>
</references>
<dates>
<discovery>2014-03-29</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="66ba5931-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.1.0</ge><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2012-09-30</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="0e0385d1-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Mass-assignment vulnerability that would allow an attacker to
bypass part of the security checks.</p>
<p>Persistent XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0327</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://jvn.jp/en/jp/JVN93406632/</url>
</references>
<dates>
<discovery>2012-03-11</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="ae377aeb-9ed4-11e5-8f5c-002590263bf5">
<topic>redmine -- CSRF protection bypass</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Vulnerability that would allow an attacker to bypass the CSRF
protection.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2011-12-10</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="23af0425-9eac-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.641</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.625.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09">
<h1>Description</h1>
<h5>SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)</h5>
<p>In certain configurations, low privilege users were able to
create e.g. HTML files in workspaces and archived artifacts that
could result in XSS when accessed by other users. Jenkins now sends
Content-Security-Policy headers that enables sandboxing and
prohibits script execution by default.</p>
<h5>SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)</h5>
<p>Several administration/configuration related URLs could be
accessed using GET, which allowed attackers to circumvent CSRF
protection.</p>
<h5>SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)</h5>
<p>Malicious users were able to circumvent CSRF protection on any
URL by sending specially crafted POST requests.</p>
<h5>SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)</h5>
<p>While the Jenkins update site data is digitally signed, and the
signature verified by Jenkins, Jenkins did not verify the provided
SHA-1 checksums for the plugin files referenced in the update site
data. This enabled MITM attacks on the plugin manager, resulting
in installation of attacker-provided plugins.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09</url>
</references>
<dates>
<discovery>2015-12-09</discovery>
<entry>2015-12-09</entry>
</dates>
</vuln>
<vuln vid="c8842a84-9ddd-11e5-8c2f-c485083ca99c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.554</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-32.html">
<p>
These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2015-8438, CVE-2015-8446).</p>
<p>
These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-8444, CVE-2015-8443,
CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047,
CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060,
CVE-2015-8419, CVE-2015-8408).</p>
<p>
These updates resolve security bypass vulnerabilities
(CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).</p>
<p>
These updates resolve a stack overflow vulnerability that
could lead to code execution (CVE-2015-8407).</p>
<p>
These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8439).</p>
<p>
These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8445).</p>
<p>
These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-8415).</p>
<p>
These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8050, CVE-2015-8049,
CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448,
CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413,
CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424,
CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423,
CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431,
CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428,
CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414,
CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055,
CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067,
CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064,
CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404,
CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401,
CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441,
CVE-2015-8442, CVE-2015-8447).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-32.html</url>
<cvename>CVE-2015-8045</cvename>
<cvename>CVE-2015-8047</cvename>
<cvename>CVE-2015-8048</cvename>
<cvename>CVE-2015-8049</cvename>
<cvename>CVE-2015-8050</cvename>
<cvename>CVE-2015-8051</cvename>
<cvename>CVE-2015-8052</cvename>
<cvename>CVE-2015-8053</cvename>
<cvename>CVE-2015-8054</cvename>
<cvename>CVE-2015-8055</cvename>
<cvename>CVE-2015-8056</cvename>
<cvename>CVE-2015-8057</cvename>
<cvename>CVE-2015-8058</cvename>
<cvename>CVE-2015-8059</cvename>
<cvename>CVE-2015-8060</cvename>
<cvename>CVE-2015-8061</cvename>
<cvename>CVE-2015-8062</cvename>
<cvename>CVE-2015-8063</cvename>
<cvename>CVE-2015-8064</cvename>
<cvename>CVE-2015-8065</cvename>
<cvename>CVE-2015-8066</cvename>
<cvename>CVE-2015-8067</cvename>
<cvename>CVE-2015-8068</cvename>
<cvename>CVE-2015-8069</cvename>
<cvename>CVE-2015-8070</cvename>
<cvename>CVE-2015-8071</cvename>
<cvename>CVE-2015-8401</cvename>
<cvename>CVE-2015-8402</cvename>
<cvename>CVE-2015-8403</cvename>
<cvename>CVE-2015-8404</cvename>
<cvename>CVE-2015-8405</cvename>
<cvename>CVE-2015-8406</cvename>
<cvename>CVE-2015-8407</cvename>
<cvename>CVE-2015-8408</cvename>
<cvename>CVE-2015-8409</cvename>
<cvename>CVE-2015-8410</cvename>
<cvename>CVE-2015-8411</cvename>
<cvename>CVE-2015-8412</cvename>
<cvename>CVE-2015-8413</cvename>
<cvename>CVE-2015-8414</cvename>
<cvename>CVE-2015-8415</cvename>
<cvename>CVE-2015-8416</cvename>
<cvename>CVE-2015-8417</cvename>
<cvename>CVE-2015-8419</cvename>
<cvename>CVE-2015-8420</cvename>
<cvename>CVE-2015-8421</cvename>
<cvename>CVE-2015-8422</cvename>
<cvename>CVE-2015-8423</cvename>
<cvename>CVE-2015-8424</cvename>
<cvename>CVE-2015-8425</cvename>
<cvename>CVE-2015-8426</cvename>
<cvename>CVE-2015-8427</cvename>
<cvename>CVE-2015-8428</cvename>
<cvename>CVE-2015-8429</cvename>
<cvename>CVE-2015-8430</cvename>
<cvename>CVE-2015-8431</cvename>
<cvename>CVE-2015-8432</cvename>
<cvename>CVE-2015-8433</cvename>
<cvename>CVE-2015-8434</cvename>
<cvename>CVE-2015-8435</cvename>
<cvename>CVE-2015-8436</cvename>
<cvename>CVE-2015-8437</cvename>
<cvename>CVE-2015-8438</cvename>
<cvename>CVE-2015-8439</cvename>
<cvename>CVE-2015-8440</cvename>
<cvename>CVE-2015-8441</cvename>
<cvename>CVE-2015-8442</cvename>
<cvename>CVE-2015-8443</cvename>
<cvename>CVE-2015-8444</cvename>
<cvename>CVE-2015-8445</cvename>
<cvename>CVE-2015-8446</cvename>
<cvename>CVE-2015-8447</cvename>
<cvename>CVE-2015-8448</cvename>
<cvename>CVE-2015-8449</cvename>
<cvename>CVE-2015-8450</cvename>
<cvename>CVE-2015-8451</cvename>
<cvename>CVE-2015-8452</cvename>
<cvename>CVE-2015-8453</cvename>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="215e740e-9c56-11e5-90e7-b499baebfeaf">
<topic>libressl -- NULL pointer dereference</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.5</lt></range>
<range><ge>2.3.0</ge><lt>2.3.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenBSD project reports:</p>
<blockquote cite="https://marc.info/?l=openbsd-announce&t=144920914600002">
<p>A NULL pointer deference could be triggered by a crafted
certificate sent to services configured to verify client
certificates on TLS/SSL connections.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://marc.info/?l=openbsd-announce&t=144920914600002</url>
<cvename>CVE-2015-3194</cvename>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="918a5d1f-9d40-11e5-8f5c-002590263bf5">
<topic>KeePassX -- information disclosure</topic>
<affects>
<package>
<name>KeePassX</name>
<range><lt>0.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yves-Alexis Perez reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/4">
<p>Starting an export (using File / Export to / KeepassX XML file) and
cancelling it leads to KeepassX saving a cleartext XML file in
~/.xml without any warning.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8378</cvename>
<freebsdpr>ports/205105</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/4</url>
</references>
<dates>
<discovery>2015-07-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="84fdd1bb-9d37-11e5-8f5c-002590263bf5">
<topic>passenger -- client controlled header overwriting</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><ge>5.0.0</ge><lt>5.0.22</lt></range>
<range><lt>4.0.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Knoppel reports:</p>
<blockquote cite="https://blog.phusion.nl/2015/12/07/cve-2015-7519/">
<p>It was discovered by the SUSE security team that it was possible,
in some cases, for clients to overwrite headers set by the server,
resulting in a medium level security issue. CVE-2015-7519 has been
assigned to this issue.</p>
<p>Affected use-cases:</p>
<p>Header overwriting may occur if all of the following conditions are met:</p>
<ul>
<li>Apache integration mode, or standalone+builtin engine without
a filtering proxy</li>
<li>Ruby or Python applications only (Passenger 5); or any
application (Passenger 4)</li>
<li>The app depends on a request header containing a dash (-)</li>
<li>The header is supposed to be trusted (set by the server)</li>
<li>The client correctly guesses the header name</li>
</ul>
<p>This vulnerability has been fixed by filtering out client headers
that do not consist of alphanumeric/dash characters (Nginx already
did this, so Passenger+Nginx was not affected). If your application
depends on headers that don't conform to this, you can add a
workaround in Apache specifically for those to convert them to a
dash-based format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7519</cvename>
<url>https://blog.phusion.nl/2015/12/07/cve-2015-7519/</url>
</references>
<dates>
<discovery>2015-12-07</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="e6b974ab-9d35-11e5-8f5c-002590263bf5">
<topic>Salt -- information disclosure</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes report:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html">
<p>CVE-2015-8034: Saving state.sls cache data to disk with insecure
permissions</p>
<p>This affects users of the state.sls function. The state run cache
on the minion was being created with incorrect permissions. This
file could potentially contain sensitive data that was inserted via
jinja into the state SLS files. The permissions for this file are
now being set correctly. Thanks to @zmalone for bringing this issue
to our attention.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8034</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html</url>
</references>
<dates>
<discovery>2015-11-25</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="6bc6eed2-9cca-11e5-8c2b-c335fa8985d7">
<topic>libraw -- memory objects not properly initialized</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8367, LibRaw's phase_one_correct function does not
handle memory initialization correctly, which may cause other
problems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8367</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="db04bf07-9cc8-11e5-8c2b-c335fa8985d7">
<topic>libraw -- index overflow in smal_decode_segment</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8366, LibRaw's smal_decode_segment function does not
handle indexes carefully, which can cause an index overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8366</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="4c8d1d72-9b38-11e5-aece-d050996490d0">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_5</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2e</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_7</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_8</lt></range>
<range><ge>10.1</ge><lt>10.1_25</lt></range>
<range><ge>9.3</ge><lt>9.3_31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20151203.txt">
<ol>
<li>BN_mod_exp may produce incorrect results on x86_64
(CVE-2015-3193)</li>
<li>Certificate verify crash with missing PSS parameter
(CVE-2015-3194)</li>
<li>X509_ATTRIBUTE memory leak (CVE-2015-3195)</li>
<li>Race condition handling PSK identify hint
(CVE-2015-3196)</li>
<li>Anon DH ServerKeyExchange with 0 p parameter
(CVE-2015-1794)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:26.openssl</freebsdsa>
<cvename>CVE-2015-1794</cvename>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-3194</cvename>
<cvename>CVE-2015-3195</cvename>
<cvename>CVE-2015-3196</cvename>
<url>https://www.openssl.org/news/secadv/20151203.txt</url>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="8a90dc87-89f9-11e5-a408-00248c0c745d">
<topic>PHPmailer -- SMTP injection vulnerability</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHPMailer changelog reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md">
<p>Fix vulnerability that allowed email addresses with
line breaks (valid in RFC5322) to pass to SMTP, permitting
message injection at the SMTP level. Mitigated in both
the address validator and in the lower-level SMTP class.
Thanks to Takeshi Terada.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md</url>
</references>
<dates>
<discovery>2015-11-05</discovery>
<entry>2015-12-03</entry>
</dates>
</vuln>
<vuln vid="b0da85af-21a3-4c15-a137-fe9e4bc86002">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.3,1</lt></range>
<range><lt>2.7.3,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.5</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150822_6 has ffmpeg-2.8.2 -->
<range><lt>1.1.r20150822_7</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6761">
<p>The update_dimensions function in libavcodec/vp8.c in
FFmpeg through 2.8.1, as used in Google Chrome before
46.0.2490.71 and other products, relies on a
coefficient-partition count during multi-threaded operation,
which allows remote attackers to cause a denial of service
(race condition and memory corruption) or possibly have
unspecified other impact via a crafted WebM file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8216">
<p>The ljpeg_decode_yuv_scan function in
libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain
width and height checks, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted MJPEG
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8217">
<p>The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in
FFmpeg before 2.8.2 does not validate the Chroma Format
Indicator, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via crafted High Efficiency Video
Coding (HEVC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8218">
<p>The decode_uncompressed function in libavcodec/faxcompr.c
in FFmpeg before 2.8.2 does not validate uncompressed runs,
which allows remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted CCITT FAX data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8219">
<p>The init_tile function in libavcodec/jpeg2000dec.c in
FFmpeg before 2.8.2 does not enforce minimum-value and
maximum-value constraints on tile coordinates, which allows
remote attackers to cause a denial of service (out-of-bounds
array access) or possibly have unspecified other impact via
crafted JPEG 2000 data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8363">
<p>The jpeg2000_read_main_headers function in
libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x
before 2.7.3, and 2.8.x through 2.8.2 does not enforce
uniqueness of the SIZ marker in a JPEG 2000 image, which
allows remote attackers to cause a denial of service
(out-of-bounds heap-memory access) or possibly have
unspecified other impact via a crafted image with two or
more of these markers.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8364">
<p>Integer overflow in the ff_ivi_init_planes function in
libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3,
and 2.8.x through 2.8.2 allows remote attackers to cause a
denial of service (out-of-bounds heap-memory access) or
possibly have unspecified other impact via crafted image
dimensions in Indeo Video Interactive data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8365">
<p>The smka_decode_frame function in libavcodec/smacker.c in
FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through
2.8.2 does not verify that the data size is consistent with
the number of channels, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted Smacker
data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-8216</cvename>
<cvename>CVE-2015-8217</cvename>
<cvename>CVE-2015-8218</cvename>
<cvename>CVE-2015-8219</cvename>
<cvename>CVE-2015-8363</cvename>
<cvename>CVE-2015-8364</cvename>
<cvename>CVE-2015-8365</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-11-27</discovery>
<entry>2015-12-02</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="548f74bd-993c-11e5-956b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html">
<p>41 security fixes in this release, including:</p>
<ul>
<li>[558589] Critical CVE-2015-6765: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[551044] High CVE-2015-6766: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[554908] High CVE-2015-6767: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[556724] High CVE-2015-6768: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[534923] High CVE-2015-6769: Cross-origin bypass in core.
Credit to Mariusz Mlynski.</li>
<li>[541206] High CVE-2015-6770: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[544991] High CVE-2015-6771: Out of bounds access in v8.
Credit to anonymous.</li>
<li>[546545] High CVE-2015-6772: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[554946] High CVE-2015-6764: Out of bounds access in v8.
Credit to Guang Gong of Qihoo 360 via pwn2own.</li>
<li>[491660] High CVE-2015-6773: Out of bounds access in Skia.
Credit to cloudfuzzer.</li>
<li>[549251] High CVE-2015-6774: Use-after-free in Extensions.
Credit to anonymous.</li>
<li>[529012] High CVE-2015-6775: Type confusion in PDFium.
Credit to Atte Kettunen of OUSPG.</li>
<li>[457480] High CVE-2015-6776: Out of bounds access in PDFium.
Credit to Hanno Böck.</li>
<li>[544020] High CVE-2015-6777: Use-after-free in DOM.
Credit to Long Liu of Qihoo 360Vulcan Team.</li>
<li>[514891] Medium CVE-2015-6778: Out of bounds access in PDFium.
Credit to Karl Skomski.</li>
<li>[528505] Medium CVE-2015-6779: Scheme bypass in PDFium.
Credit to Til Jasper Ullrich.</li>
<li>[490492] Medium CVE-2015-6780: Use-after-free in Infobars.
Credit to Khalil Zhani.</li>
<li>[497302] Medium CVE-2015-6781: Integer overflow in Sfntly.
Credit to miaubiz.</li>
<li>[536652] Medium CVE-2015-6782: Content spoofing in Omnibox.
Credit to Luan Herrera.</li>
<li>[537205] Medium CVE-2015-6783: Signature validation issue in
Android Crazy Linker. Credit to Michal Bednarski.</li>
<li>[503217] Low CVE-2015-6784: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[534542] Low CVE-2015-6785: Wildcard matching issue in CSP.
Credit to Michael Ficarra / Shape Security.</li>
<li>[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to
Michael Ficarra / Shape Security.</li>
<li>[563930] CVE-2015-6787: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li> Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6765</cvename>
<cvename>CVE-2015-6766</cvename>
<cvename>CVE-2015-6767</cvename>
<cvename>CVE-2015-6768</cvename>
<cvename>CVE-2015-6769</cvename>
<cvename>CVE-2015-6770</cvename>
<cvename>CVE-2015-6771</cvename>
<cvename>CVE-2015-6772</cvename>
<cvename>CVE-2015-6773</cvename>
<cvename>CVE-2015-6774</cvename>
<cvename>CVE-2015-6775</cvename>
<cvename>CVE-2015-6776</cvename>
<cvename>CVE-2015-6777</cvename>
<cvename>CVE-2015-6778</cvename>
<cvename>CVE-2015-6779</cvename>
<cvename>CVE-2015-6780</cvename>
<cvename>CVE-2015-6781</cvename>
<cvename>CVE-2015-6782</cvename>
<cvename>CVE-2015-6783</cvename>
<cvename>CVE-2015-6784</cvename>
<cvename>CVE-2015-6785</cvename>
<cvename>CVE-2015-6786</cvename>
<cvename>CVE-2015-6787</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="11351c82-9909-11e5-a9c8-14dae9d5a9d2">
<topic>piwik -- multiple vulnerabilities</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik changelog reports:</p>
<blockquote cite="http://piwik.org/changelog/piwik-2-15-0/">
<p>This release is rated critical.
We are grateful for Security researchers who disclosed
security issues privately to the Piwik Security Response
team: Elamaran Venkatraman, Egidio Romano and Dmitriy
Shcherbatov. The following vulnerabilities were fixed:
XSS, CSRF, possible file inclusion in older PHP versions
(low impact), possible Object Injection Vulnerability
(low impact).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7815</cvename>
<cvename>CVE-2015-7816</cvename>
<url>http://piwik.org/changelog/piwik-2-15-0/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="d62ec98e-97d8-11e5-8c0e-080027b00c2e">
<topic>cyrus-imapd -- integer overflow in the start_octet addition</topic>
<affects>
<package>
<name>cyrus-imapd25</name>
<range><ge>2.5.0</ge><lt>2.5.7</lt></range>
</package>
<package>
<name>cyrus-imapd24</name>
<range><ge>2.4.0</ge><lt>2.4.18_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 2.5.7 Release Note states:</p>
<blockquote cite="https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html">
<p>CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8078</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8078</url>
<cvename>CVE-2015-8077</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8077</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-12-01</entry>
</dates>
</vuln>
<vuln vid="11c52bc6-97aa-11e5-b8df-14dae9d210b8">
<topic>django -- information leak vulnerability</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django17</name>
<name>py32-django17</name>
<name>py33-django17</name>
<name>py34-django17</name>
<range><lt>1.7.11</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>If an application allows users to specify an unvalidated
format for dates and passes this format to the date filter, e.g. {{
last_updated|date:user_date_format }}, then a malicious user could
obtain any secret in the application's settings by specifying a settings
key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/</url>
<cvename>CVE-2015-8213</cvename>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-11-30</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="fb2475c2-9125-11e5-bd18-002590263bf5">
<topic>kibana4 -- CSRF vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><ge>4.0.0</ge><lt>4.1.3</lt></range>
</package>
<package>
<name>kibana42</name>
<range><ge>4.2.0</ge><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security/">
<p>Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1
are vulnerable to a CSRF attack.</p>
<p>Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8131</cvename>
<url>https://www.elastic.co/community/security/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="e359051d-90bd-11e5-bd18-002590263bf5">
<topic>a2ps -- format string vulnerability</topic>
<affects>
<package>
<name>a2ps</name>
<range><lt>4.13b_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jong-Gwon Kim reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/16/4">
<p>When user runs a2ps with malicious crafted pro(a2ps prologue) file,
an attacker can execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8107</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/16/4</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="ecc268f2-8fc2-11e5-918c-bcaec565249c">
<topic>libxslt -- DoS vulnerability due to type confusing error</topic>
<affects>
<package>
<name>libsxlt</name>
<range><lt>1.1.28_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libxslt maintainer reports:</p>
<blockquote cite="https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617">
<p>CVE-2015-7995:
http://www.openwall.com/lists/oss-security/2015/10/27/10
We need to check that the parent node is an element before
dereferencing its namespace.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7995</cvename>
<url>https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="e5423caf-8fb8-11e5-918c-bcaec565249c">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://xmlsoft.org/news.html">
<p>CVE-2015-5312 Another entity expansion issue (David Drysdale).</p>
<p>CVE-2015-7497 Avoid an heap buffer overflow in
xmlDictComputeFastQKey (David Drysdale).</p>
<p>CVE-2015-7498 Avoid processing entities after encoding
conversion failures (Daniel Veillard).</p>
<p>CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser
(Daniel Veillard).</p>
<p>CVE-2015-7499 (2) Detect incoherency on GROW (Daniel
Veillard).</p>
<p>CVE-2015-7500 Fix memory access error due to incorrect
entities boundaries (Daniel Veillard).</p>
<p>CVE-2015-7941 (1) Stop parsing on entities boundaries
errors (Daniel Veillard).</p>
<p>CVE-2015-7941 (2) Cleanup conditional section error
handling (Daniel Veillard).</p>
<p>CVE-2015-7942 Another variation of overflow in
Conditional sections (Daniel Veillard).</p>
<p>CVE-2015-7942 (2) Fix an error in previous Conditional
section patch (Daniel Veillard).</p>
<p>CVE-2015-8035 Fix XZ compression support loop
(Daniel Veillard).</p>
<p>CVE-2015-8242 Buffer overead with HTML parser in push
mode (Hugh Davenport)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5312</cvename>
<cvename>CVE-2015-7497</cvename>
<cvename>CVE-2015-7498</cvename>
<cvename>CVE-2015-7499</cvename>
<cvename>CVE-2015-7500</cvename>
<cvename>CVE-2015-7941</cvename>
<cvename>CVE-2015-7942</cvename>
<cvename>CVE-2015-8035</cvename>
<cvename>CVE-2015-8241</cvename>
<cvename>CVE-2015-8242</cvename>
<url>http://xmlsoft.org/news.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/18/23</url>
</references>
<dates>
<discovery>2015-11-20</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="9d04936c-75f1-4a2c-9ade-4c1708be5df9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>linux-c6-nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>nss</name>
<range><ge>3.20</ge><lt>3.20.1</lt></range>
<range><ge>3.19.3</ge><lt>3.19.4</lt></range>
<range><lt>3.19.2.1</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.4.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-133 NSS and NSPR memory corruption issues</p>
<p>MFSA 2015-132 Mixed content WebSocket policy bypass
through workers</p>
<p>MFSA 2015-131 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-130 JavaScript garbage collection crash with
Java applet</p>
<p>MFSA 2015-129 Certain escaped characters in host of
Location-header are being treated as non-escaped</p>
<p>MFSA 2015-128 Memory corruption in libjar through zip
files</p>
<p>MFSA 2015-127 CORS preflight is bypassed when
non-standard Content-Type headers are received</p>
<p>MFSA 2015-126 Crash when accessing HTML tables with
accessibility tools on OS X</p>
<p>MFSA 2015-125 XSS attack through intents on Firefox for
Android</p>
<p>MFSA 2015-124 Android intents can be used on Firefox for
Android to open privileged files</p>
<p>MFSA 2015-123 Buffer overflow during image interactions
in canvas</p>
<p>MFSA 2015-122 Trailing whitespace in IP address hostnames
can bypass same-origin policy</p>
<p>MFSA 2015-121 Disabling scripts in Add-on SDK panels has
no effect</p>
<p>MFSA 2015-120 Reading sensitive profile files through
local HTML file on Android</p>
<p>MFSA 2015-119 Firefox for Android addressbar can be
removed after fullscreen mode</p>
<p>MFSA 2015-118 CSP bypass due to permissive Reader mode
whitelist</p>
<p>MFSA 2015-117 Information disclosure through NTLM
authentication</p>
<p>MFSA 2015-116 Miscellaneous memory safety hazards
(rv:42.0 / rv:38.4)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4513</cvename>
<cvename>CVE-2015-4514</cvename>
<cvename>CVE-2015-4515</cvename>
<cvename>CVE-2015-4518</cvename>
<cvename>CVE-2015-7181</cvename>
<cvename>CVE-2015-7182</cvename>
<cvename>CVE-2015-7183</cvename>
<cvename>CVE-2015-7185</cvename>
<cvename>CVE-2015-7186</cvename>
<cvename>CVE-2015-7187</cvename>
<cvename>CVE-2015-7188</cvename>
<cvename>CVE-2015-7189</cvename>
<cvename>CVE-2015-7190</cvename>
<cvename>CVE-2015-7191</cvename>
<cvename>CVE-2015-7192</cvename>
<cvename>CVE-2015-7193</cvename>
<cvename>CVE-2015-7194</cvename>
<cvename>CVE-2015-7195</cvename>
<cvename>CVE-2015-7196</cvename>
<cvename>CVE-2015-7197</cvename>
<cvename>CVE-2015-7198</cvename>
<cvename>CVE-2015-7199</cvename>
<cvename>CVE-2015-7200</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-116/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-117/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-118/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-119/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-120/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-121/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-122/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-123/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-124/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-125/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-126/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-127/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-128/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-129/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-130/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-131/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-132/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-133/</url>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-19</entry>
<modified>2016-04-13</modified>
</dates>
</vuln>
<vuln vid="68847b20-8ddc-11e5-b69c-c86000169601">
<topic>gdm -- lock screen bypass when holding escape key</topic>
<affects>
<package>
<name>gdm</name>
<range><lt>3.16.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ray Strode reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html">
<p>CVE-2015-7496 - lock screen bypass when holding escape key.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7496</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758032</url>
</references>
<dates>
<discovery>2015-11-12</discovery>
<entry>2015-11-18</entry>
</dates>
</vuln>
<vuln vid="3eb0ccc2-8c6a-11e5-8519-005056ac623e">
<topic>strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
<p>Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that
was caused by insufficient verification of the internal state when handling
MSCHAPv2 Success messages received by the client.
This vulnerability has been registered as CVE-2015-8023.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8023</cvename>
<url>https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="82b3ca2a-8c07-11e5-bd18-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.11</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.9</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.9.3_release_notes">
<p>MSA-15-0037 Possible to send a message to a user who blocked
messages from non contacts</p>
<p>MSA-15-0038 DDoS possibility in Atto</p>
<p>MSA-15-0039 CSRF in site registration form</p>
<p>MSA-15-0040 Student XSS in survey</p>
<p>MSA-15-0041 XSS in flash video player</p>
<p>MSA-15-0042 CSRF in lesson login form</p>
<p>MSA-15-0043 Web service core_enrol_get_enrolled_users does not
respect course group mode</p>
<p>MSA-15-0044 Capability to view available badges is not
respected</p>
<p>MSA-15-0045 SCORM module allows to bypass access restrictions based
on date</p>
<p>MSA-15-0046 Choice module closing date can be bypassed</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.moodle.org/dev/Moodle_2.7.11_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.9_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.3_release_notes</url>
</references>
<dates>
<discovery>2015-11-09</discovery>
<entry>2015-11-16</entry>
<modified>2015-12-21</modified>
</dates>
</vuln>
<vuln vid="2cabfbab-8bfb-11e5-bd18-002590263bf5">
<topic>xen-kernel -- CPU lockup during exception delivery</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-156.html">
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant,
perhaps indefinite period. If a host watchdog (Xen or dom0) is in
use, this can lead to a watchdog timeout and consequently a reboot
of the host. If another, innocent, guest, is configured with a
watchdog, this issue can lead to a reboot of such a guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5307</cvename>
<cvename>CVE-2015-8104</cvename>
<url>http://xenbits.xen.org/xsa/advisory-156.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="1886e195-8b87-11e5-90e7-b499baebfeaf">
<topic>libpng buffer overflow in png_set_PLTE</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.6.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libpng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/12/2">
<p>CVE for a vulnerability in libpng, all versions, in the
png_set_PLTE/png_get_PLTE functions. These functions failed to check for
an out-of-range palette when reading or writing PNG files with a bit_depth
less than 8. Some applications might read the bit depth from the IHDR
chunk and allocate memory for a 2^N entry palette, while libpng can return
a palette with up to 256 entries even when the bit depth is less than 8.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/11/12/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/6</url>
<cvename>CVE-2015-8126</cvename>
<cvename>CVE-2015-8472</cvename>
</references>
<dates>
<discovery>2015-11-15</discovery>
<entry>2015-11-15</entry>
<modified>2015-12-08</modified>
</dates>
</vuln>
<vuln vid="547fbd98-8b1f-11e5-b48b-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.548</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-28.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-7659).</p>
<p>These updates resolve a security bypass vulnerability that
could be exploited to write arbitrary data to the file
system under user permissions (CVE-2015-7662).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7651, CVE-2015-7652,
CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656,
CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,
CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044,
CVE-2015-8046).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-28.html</url>
<cvename>CVE-2015-7651</cvename>
<cvename>CVE-2015-7652</cvename>
<cvename>CVE-2015-7653</cvename>
<cvename>CVE-2015-7654</cvename>
<cvename>CVE-2015-7655</cvename>
<cvename>CVE-2015-7656</cvename>
<cvename>CVE-2015-7657</cvename>
<cvename>CVE-2015-7658</cvename>
<cvename>CVE-2015-7659</cvename>
<cvename>CVE-2015-7660</cvename>
<cvename>CVE-2015-7661</cvename>
<cvename>CVE-2015-7662</cvename>
<cvename>CVE-2015-7663</cvename>
<cvename>CVE-2015-8043</cvename>
<cvename>CVE-2015-8044</cvename>
<cvename>CVE-2015-8046</cvename>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-14</entry>
</dates>
</vuln>
<vuln vid="f0b9049f-88c4-11e5-aed7-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html">
<p>[520422] High CVE-2015-1302: Information leak in PDF viewer.
Credit to Rob Wu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1302</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="851a0eea-88aa-11e5-90e7-b499baebfeaf">
<topic>MySQL - Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb-client</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb-server</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mysql55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
<p>Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
<cvename>CVE-2015-4802</cvename>
<cvename>CVE-2015-4807</cvename>
<cvename>CVE-2015-4815</cvename>
<cvename>CVE-2015-4826</cvename>
<cvename>CVE-2015-4830</cvename>
<cvename>CVE-2015-4836</cvename>
<cvename>CVE-2015-4858</cvename>
<cvename>CVE-2015-4861</cvename>
<cvename>CVE-2015-4870</cvename>
<cvename>CVE-2015-4913</cvename>
<cvename>CVE-2015-4792</cvename>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/</url>
<url>https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html</url>
<url>https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="b665668a-91db-4f13-8113-9e4b5b0e47f7">
<topic>jenkins -- remote code execution via unsafe deserialization</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.638</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.625.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Developers report:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11">
<p>Unsafe deserialization allows unauthenticated remote attackers to
run arbitrary code on the Jenkins master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11</url>
<url>https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli</url>
<url>http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix</url>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="71af4ded-8864-11e5-af1b-001999f8d30b">
<topic>owncloudclient -- Improper validation of certificates when using self-signed certificates</topic>
<affects>
<package>
<name>owncloudclient</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>owncloud.org reports:</p>
<blockquote cite="https://owncloud.org/security/advisory/?id=oc-sa-2015-016">
<p>The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.</p>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2015-016</url>
<cvename>CVE-2015-7298</cvename>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="c0e76d33-8821-11e5-ab94-002590263bf5">
<topic>xen-tools -- populate-on-demand balloon size inaccuracy can crash guests</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.4</ge><lt>4.5.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-153.html">
<p>Guests configured with PoD might be unstable, especially under
load. In an affected guest, an unprivileged guest user might be
able to cause a guest crash, perhaps simply by applying load so
as to cause heavy memory pressure within the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7972</cvename>
<url>http://xenbits.xen.org/xsa/advisory-153.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e4848ca4-8820-11e5-ab94-002590263bf5">
<topic>xen-kernel -- some pmu and profiling hypercalls log without rate limiting</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.2</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-152.html">
<p>HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and
attempts at invalid operations. These log messages are not
rate-limited, even though they can be triggered by guests.</p>
<p>A malicious guest could cause repeated logging to the hypervisor
console, leading to a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7971</cvename>
<url>http://xenbits.xen.org/xsa/advisory-152.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e3792855-881f-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of per-domain profiling-related vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.0</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-151.html">
<p>A domain's xenoprofile state contains an array of per-vcpu
information... This array is leaked on domain teardown. This memory
leak could -- over time -- exhaust the host's memory.</p>
<p>The following parties can mount a denial of service attack
affecting the whole system:</p>
<ul>
<li>A malicious guest administrator via XENOPROF_get_buffer.</li>
<li>A domain given suitable privilege over another domain via
XENOPROF_set_passive (this would usually be a domain being
used to profile another domain, eg with the xenoprof tool).</li>
</ul>
<p>The ability to also restart or create suitable domains is also
required to fully exploit the issue. Without this the leak is
limited to a small multiple of the maximum number of vcpus for the
domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-151.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="83350009-881e-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Long latency populate-on-demand operation is not preemptible</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-150.html">
<p>When running an HVM domain in Populate-on-Demand mode, Xen would
sometimes search the domain for memory to reclaim, in response to
demands for population of other pages in the same domain. This
search runs without preemption. The guest can, by suitable
arrangement of its memory contents, create a situation where this
search is a time-consuming linear scan of the guest's address
space.</p>
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant
period.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7970</cvename>
<url>http://xenbits.xen.org/xsa/advisory-150.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="fc1f8795-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of main per-domain vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-149.html">
<p>A domain's primary array of vcpu pointers can be allocated by a
toolstack exactly once in the lifetime of a domain via the
XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain
teardown. This memory leak could -- over time -- exhaust the host's
memory.</p>
<p>A domain given partial management control via XEN_DOMCTL_max_vcpus
can mount a denial of service attack affecting the whole system. The
ability to also restart or create suitable domains is also required
to fully exploit the issue. Without this the leak is limited to a
small multiple of the maximum number of vcpus for the domain. The
maximum leak is 64kbytes per domain (re)boot (less on ARM).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-149.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="3d9f6260-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Uncontrolled creation of large page mappings by PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-148.html">
<p>The code to validate level 2 page table entries is bypassed when
certain conditions are satisfied. This means that a PV guest can
create writable mappings using super page mappings. Such writable
mappings can violate Xen intended invariants for pages which Xen is
supposed to keep read-only. This is possible even if the
"allowsuperpage" command line option is not used.</p>
<p>Malicious PV guest administrators can escalate privilege so as to
control the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7835</cvename>
<url>http://xenbits.xen.org/xsa/advisory-148.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="301b04d7-881c-11e5-ab94-002590263bf5">
<topic>xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-142.html">
<p>Callers of libxl can specify that a disk should be read-only to the
guest. However, there is no code in libxl to pass this information
to qemu-xen (the upstream-based qemu); and indeed there is no way in
qemu to make a disk read-only.</p>
<p>The vulnerability is exploitable only via devices emulated by the
device model, not the parallel PV devices for supporting PVHVM.
Normally the PVHVM device unplug protocol renders the emulated
devices inaccessible early in boot.</p>
<p>Malicious guest administrators or (in some situations) users may be
able to write to supposedly read-only disk images.</p>
<p>CDROM devices (that is, devices specified to be presented to the
guest as CDROMs, regardless of the nature of the backing storage on
the host) are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7311</cvename>
<url>http://xenbits.xen.org/xsa/advisory-142.html</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="2f7f4db2-8819-11e5-ab94-002590263bf5">
<topic>p5-HTML-Scrubber -- XSS vulnerability</topic>
<affects>
<package>
<name>p5-HTML-Scrubber</name>
<range><lt>0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5667">
<p>Cross-site scripting (XSS) vulnerability in the HTML-Scrubber
module before 0.15 for Perl, when the comment feature is enabled,
allows remote attackers to inject arbitrary web script or HTML via
a crafted comment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5667</cvename>
<url>https://metacpan.org/release/HTML-Scrubber</url>
<url>http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171</url>
<url>http://jvn.jp/en/jp/JVN53973084/index.html</url>
</references>
<dates>
<discovery>2015-10-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="6ca7eddd-d436-486a-b169-b948436bcf14">
<topic>libvpx -- buffer overflow in vp9_init_context_buffers</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0.488_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-101/">
<p>Security researcher Khalil Zhani reported that a
maliciously crafted vp9 format video could be used to
trigger a buffer overflow while parsing the file. This leads
to a potentially exploitable crash due to a flaw in the
libvpx library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4506</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-10</entry>
</dates>
</vuln>
<vuln vid="56665ccb-8723-11e5-9b13-14dae9d210b8">
<topic>powerdns -- Denial of Service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.4</ge><lt>3.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/">
<p>A bug was found using afl-fuzz in our packet parsing code.
This bug, when exploited, causes an assertion error and consequent
termination of the the pdns_server process, causing a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/</url>
<cvename>CVE-2015-5311</cvename>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="0cb0afd9-86b8-11e5-bf60-080027ef73ec">
<topic>PuTTY -- memory corruption in terminal emulator's erase character handling</topic>
<affects>
<package>
<name>putty</name>
<range><ge>0.54</ge><lt>0.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Harris reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html">
<p>Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a
potentially memory-corrupting integer overflow in the handling of
the ECH (erase characters) control sequence in the terminal
emulator.</p>
<p>To exploit a vulnerability in the terminal emulator, an attacker
must be able to insert a carefully crafted escape sequence into the
terminal stream. For a PuTTY SSH session, this must be before
encryption, so the attacker likely needs access to the server you're
connecting to. For instance, an attacker on a multi-user machine
that you connect to could trick you into running cat on a file they
control containing a malicious escape sequence. (Unix write(1) is
not a vector for this, if implemented correctly.)</p>
<p>Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do
not include the terminal emulator, so cannot be exploited this
way.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html</url>
<cvename>CVE-2015-5309</cvename>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="18b3c61b-83de-11e5-905b-ac9e174be3af">
<topic>OpenOffice 4.1.1 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1705368,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-4551.html">
<p>A vulnerability in OpenOffice settings of OpenDocument Format
files and templates allows silent access to files that are
readable from an user account, over-riding the user's default
configuration settings. Once these files are imported into a
maliciously-crafted document, the data can be silently hidden
in the document and possibly exported to an external party
without being observed. </p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5212.html">
<p>A crafted ODF document can be used to create a buffer that is
too small for the amount of data loaded into it, allowing an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5213.html">
<p>A crafted Microsoft Word DOC file can be used to specify a
document buffer that is too small for the amount of data
provided for it. Failure to detect the discrepancy allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5214.html">
<p>A crafted Microsoft Word DOC can contain invalid bookmark
positions leading to memory corruption when the document is
loaded or bookmarks are manipulated. The defect allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4551</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
<cvename>CVE-2015-5212</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5212.html</url>
<cvename>CVE-2015-5213</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5213.html</url>
<cvename>CVE-2015-5214</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5214.html</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-11-05</entry>
<modified>2015-11-05</modified>
</dates>
</vuln>
<vuln vid="698403a7-803d-11e5-ab94-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed an XSS attack vector in Security Library method
xss_clean().</p>
<p>Changed Config Library method base_url() to fallback to
``$_SERVER['SERVER_ADDR']`` in order to avoid Host header
injections.</p>
<p>Changed CAPTCHA Helper to try to use the operating system's PRNG
first.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-31</discovery>
<entry>2015-11-01</entry>
</dates>
</vuln>
<vuln vid="017a493f-7db6-11e5-a762-14dae9d210b8">
<topic>openafs -- information disclosure</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt">
<p>When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx
implementations do not initialize three octets of data that are padding
in the C language structure and were inadvertently included in the wire
protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75
through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include
a variable-length padding at the end of the ACK packet, in an attempt to
detect the path MTU, but only four octets of the additional padding are
initialized (CVE-2015-7763).</p>
</blockquote>
</body>
</description>
<references>
<url>http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt</url>
<cvename>CVE-2015-7762</cvename>
<cvename>CVE-2015-7763</cvename>
</references>
<dates>
<discovery>2015-10-28</discovery>
<entry>2015-10-28</entry>
</dates>
</vuln>
<vuln vid="4b9393b8-7c0c-11e5-a010-080027ddead3">
<topic>xscreensaver - lock bypass</topic>
<affects>
<package>
<name>xscreensaver</name>
<name>xscreensaver-gnome</name>
<name>xscreensaver-gnome-hacks</name>
<range><lt>5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat bugzilla reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1274452">
<p>In dual screen configurations, unplugging one screen will cause
xscreensaver to crash, leaving the screen unlocked.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jwz.org/xscreensaver/changelog.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1274452</url>
<cvename>CVE-2015-8025</cvename>
</references>
<dates>
<discovery>2015-10-24</discovery>
<entry>2015-10-27</entry>
<modified>2015-11-04</modified>
</dates>
</vuln>
<vuln vid="2a4a112a-7c1b-11e5-bd77-0800275369e2">
<topic>lldpd -- Buffer overflow/Denial of service</topic>
<affects>
<package>
<name>lldpd</name>
<range><ge>0.5.6</ge><lt>0.7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The lldpd developer Vincent Bernat reports:</p>
<blockquote cite="https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS">
<p>A buffer overflow may allow arbitrary code execution
only if hardening was disabled.</p>
</blockquote>
<blockquote cite="https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c46772388417a00">
<p>Malformed packets should not make lldpd crash. Ensure we can
handle them by not using assert() in this part.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8011</cvename>
<cvename>CVE-2015-8012</cvename>
<url>https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/30/2</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-26</entry>
<modified>2015-11-10</modified>
</dates>
</vuln>
<vuln vid="24e4d383-7b3e-11e5-a250-68b599b52a02">
<topic>wireshark -- Pcapng file parser crash</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html">
<p>The following vulnerability has been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-30</p>
<p>Pcapng file parser crash. (Bug 11455)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html</url>
<cvename>CVE-2015-7830</cvename>
</references>
<dates>
<discovery>2015-10-14</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="0ebc6e78-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html">
<h2>[20151001] - Core - SQL Injection</h2>
<p>Inadequate filtering of request data leads to a SQL Injection
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html">
<h2>[20151002] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_contenthistory provide potential read
access to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7297</cvename>
<cvename>CVE-2015-7857</cvename>
<cvename>CVE-2015-7858</cvename>
<cvename>CVE-2015-7859</cvename>
<url>http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html</url>
<url>http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="03e54e42-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html">
<h2>[20151003] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_content provide potential read access
to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7899</cvename>
<url>http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="f8c37915-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.4.0</ge><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html">
<h2>[20150908] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in login module.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6939</cvename>
<url>http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html</url>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="ec2d1cfd-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - CSRF Protection vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html">
<h2>[20150602] - Core - CSRF Protection</h2>
<p>Lack of CSRF checks potentially enabled uploading malicious code.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5397</cvename>
<url>http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="deaba148-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Open Redirect vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html">
<h2>[20150601] - Core - Open Redirect</h2>
<p>Inadequate checking of the return value allowed to redirect to an
external page.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5608</cvename>
<url>http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="cec4d01a-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.6</lt></range>
<range><ge>3.3.0</ge><lt>3.3.5</lt></range>
</package>
<package>
<name>joomla2</name>
<range><ge>2.5.4</ge><lt>2.5.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html">
<h2>[20140903] - Core - Remote File Inclusion</h2>
<p>Inadequate checking allowed the potential for remote files to be
executed.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html">
<h2>[20140904] - Core - Denial of Service</h2>
<p>Inadequate checking allowed the potential for a denial of service
attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7228</cvename>
<cvename>CVE-2014-7229</cvename>
<url>http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html</url>
<url>http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html</url>
<url>https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html</url>
</references>
<dates>
<discovery>2014-09-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="beb3d5fc-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Unauthorized Login vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
<package>
<name>joomla2</name>
<range><lt>2.5.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html">
<h2>[20140902] - Core - Unauthorized Logins</h2>
<p>Inadequate checking allowed unauthorized logins via LDAP
authentication.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6632</cvename>
<url>http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="adbb32d9-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html">
<h2>[20140901] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in com_media.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6631</cvename>
<url>http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="75f39413-7a00-11e5-a2a1-002590263bf5">
<topic>drupal -- open redirect vulnerability</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-004">
<p>The Overlay module in Drupal core displays administrative pages
as a layer over the current page (using JavaScript), rather than
replacing the page in the browser window. The Overlay module does
not sufficiently validate URLs prior to displaying their contents,
leading to an open redirect vulnerability.</p>
<p>This vulnerability is mitigated by the fact that it can only be
used against site users who have the "Access the administrative
overlay" permission, and that the Overlay module must be enabled.
</p>
<p>An incomplete fix for this issue was released as part of
SA-CORE-2015-002.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7943</cvename>
<url>https://www.drupal.org/SA-CORE-2015-004</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/23/6</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-24</entry>
</dates>
</vuln>
<vuln vid="08d11134-79c5-11e5-8987-6805ca0b3d42">
<topic>phpMyAdmin -- Content spoofing vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.15.1</lt></range>
<range><ge>4.5.0</ge><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-5/">
<p>This vulnerability allows an attacker to perform a
content spoofing attack using the phpMyAdmin's redirection
mechanism to external sites.</p>
<p>We consider this vulnerability to be non critical since
the spoofed content is escaped and no HTML injection is
possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-5/</url>
<cvename>CVE-2015-7873</cvename>
</references>
<dates>
<discovery>2015-10-23</discovery>
<entry>2015-10-23</entry>
</dates>
</vuln>
<vuln vid="b973a763-7936-11e5-a2a1-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.11</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.4</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html">
<p>Wikipedia user RobinHood70 reported two issues in the chunked
upload API. The API failed to correctly stop adding new chunks to
the upload when the reported size was exceeded (T91203), allowing
a malicious users to upload add an infinite number of chunks for a
single file upload. Additionally, a malicious user could upload
chunks of 1 byte for very large files, potentially creating a very
large number of files on the server's filesystem (T91205).</p>
<p>Internal review discovered that it is not possible to throttle file
uploads.</p>
<p>Internal review discovered a missing authorization check when
removing suppression from a revision. This allowed users with the
'viewsuppressed' user right but not the appropriate
'suppressrevision' user right to unsuppress revisions.</p>
<p>Richard Stanway from teamliquid.net reported that thumbnails of PNG
files generated with ImageMagick contained the local file path in
the image metadata.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8001</cvename>
<cvename>CVE-2015-8002</cvename>
<cvename>CVE-2015-8003</cvename>
<cvename>CVE-2015-8004</cvename>
<cvename>CVE-2015-8005</cvename>
<cvename>CVE-2015-8006</cvename>
<cvename>CVE-2015-8007</cvename>
<cvename>CVE-2015-8008</cvename>
<cvename>CVE-2015-8009</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html</url>
<url>https://phabricator.wikimedia.org/T91203</url>
<url>https://phabricator.wikimedia.org/T91205</url>
<url>https://phabricator.wikimedia.org/T91850</url>
<url>https://phabricator.wikimedia.org/T95589</url>
<url>https://phabricator.wikimedia.org/T108616</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/29/14</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-23</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="c4a18a12-77fc-11e5-a687-206a8a720317">
<topic>ntp -- 13 low- and medium-severity vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p4</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.76</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_7</lt></range>
<range><ge>10.1</ge><lt>10.1_24</lt></range>
<range><ge>9.3</ge><lt>9.3_30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities">
<p>NTF's NTP Project has been notified of the following 13 low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p4, released on Wednesday, 21 October 2015:</p>
<ul>
<li>Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric
association authentication bypass via crypto-NAK
(Cisco ASIG)</li>
<li>Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch
instead of returning FAIL on some bogus values (IDA)</li>
<li>Bug 2921 CVE-2015-7854 Password Length Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2920 CVE-2015-7853 Invalid length data provided by a
custom refclock driver could cause a buffer overflow.
(Cisco TALOS)</li>
<li>Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2918 CVE-2015-7851 saveconfig Directory Traversal
Vulnerability. (OpenVMS) (Cisco TALOS)</li>
<li>Bug 2917 CVE-2015-7850 remote config logfile-keyfile.
(Cisco TALOS)</li>
<li>Bug 2916 CVE-2015-7849 trusted key use-after-free.
(Cisco TALOS)</li>
<li>Bug 2913 CVE-2015-7848 mode 7 loop counter underrun.
(Cisco TALOS)</li>
<li>Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC.
(Tenable)</li>
<li>Bug 2902 : CVE-2015-7703 configuration directives "pidfile"
and "driftfile" should only be allowed locally. (RedHat)</li>
<li>Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that
receive a KoD should validate the origin timestamp field.
(Boston University)</li>
<li>Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
Incomplete autokey data packet length checks. (Tenable)</li>
</ul>
<p>The only generally-exploitable bug in the above list is the
crypto-NAK bug, which has a CVSS2 score of 6.4.</p>
<p>Additionally, three bugs that have already been fixed in
ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd
have a security component, but are all below 1.8 CVSS score,
so we're reporting them here:</p>
<ul>
<li>Bug 2382 : Peer precision < -31 gives division by zero</li>
<li>Bug 1774 : Segfaults if cryptostats enabled when built
without OpenSSL</li>
<li>Bug 1593 : ntpd abort in free() with logconfig syntax error</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:25.ntp</freebsdsa>
<cvename>CVE-2015-7691</cvename>
<cvename>CVE-2015-7692</cvename>
<cvename>CVE-2015-7701</cvename>
<cvename>CVE-2015-7702</cvename>
<cvename>CVE-2015-7703</cvename>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-7705</cvename>
<cvename>CVE-2015-7848</cvename>
<cvename>CVE-2015-7849</cvename>
<cvename>CVE-2015-7850</cvename>
<cvename>CVE-2015-7851</cvename>
<cvename>CVE-2015-7852</cvename>
<cvename>CVE-2015-7853</cvename>
<cvename>CVE-2015-7854</cvename>
<cvename>CVE-2015-7855</cvename>
<cvename>CVE-2015-7871</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="95602550-76cf-11e5-a2a1-002590263bf5">
<topic>codeigniter -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed a number of XSS attack vectors in Security Library method
xss_clean (thanks to Frans Rosén from Detectify.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-20</entry>
</dates>
</vuln>
<vuln vid="7f645ee5-7681-11e5-8519-005056ac623e">
<topic>Git -- Execute arbitrary code</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git release notes:</p>
<blockquote cite="https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt">
<p>Some protocols (like git-remote-ext) can execute arbitrary code
found in the URL. The URLs that submodules use may come from
arbitrary sources (e.g., .gitmodules files in a remote
repository), and can hurt those who blindly enable recursive
fetch. Restrict the allowed protocols to well known and safe
ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7545</cvename>
<url>https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/11/7</url>
</references>
<dates>
<discovery>2015-09-23</discovery>
<entry>2015-10-19</entry>
<modified>2015-12-12</modified>
</dates>
</vuln>
<vuln vid="3934cc60-f0fa-4eca-be09-c8bd7ae42871">
<topic>Salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html">
<p>CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log</p>
<p>Updated the Git state and execution modules to no longer display HTTPS basic
authentication credentials in loglevel debug output on the Salt master. These
credentials are now replaced with REDACTED in the debug output. Thanks to
Andreas Stieger for bringing this to our attention.</p>
<p>CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug
log</p>
<p>Updated the win_useradd module return data to no longer include the password
of the newly created user. The password is now replaced with the string
XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display
win_password and sudo_password authentication credentials. Also updated the
Linode driver to no longer display authentication credentials in debug logs.
These credentials are now replaced with REDACTED in the debug output.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html</url>
<cvename>CVE-2015-6918</cvename>
<cvename>CVE-2015-6941</cvename>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-17</entry>
</dates>
</vuln>
<vuln vid="79c68ef7-c8ae-4ade-91b4-4b8221b7c72a">
<topic>firefox -- Cross-origin restriction bypass using Fetch</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Firefox Developers report:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/">
<p>Security researcher Abdulrahman Alqabandi reported that the fetch()
API did not correctly implement the Cross-Origin Resource Sharing
(CORS) specification, allowing a malicious page to access private
data from other origins. Mozilla developer Ben Kelly independently reported the
same issue.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/</url>
<cvename>CVE-2015-7184</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="84147b46-e876-486d-b746-339ee45a8bb9">
<topic>flash -- remote code execution</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.540</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-27.html">
<p>These updates resolve type confusion vulnerabilities that
could lead to code execution (CVE-2015-7645, CVE-2015-7647,
CVE-2015-7648).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7645</cvename>
<cvename>CVE-2015-7647</cvename>
<cvename>CVE-2015-7648</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-27.html</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="e75a96df-73ca-11e5-9b45-b499baebfeaf">
<topic>LibreSSL -- Memory leak and buffer overflow</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualys reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/16/1">
<p>During the code review of OpenSMTPD a memory leak and buffer overflow
(an off-by-one, usually stack-based) were discovered in LibreSSL's
OBJ_obj2txt() function. This function is called automatically during
a TLS handshake (both client-side, unless an anonymous mode is used,
and server-side, if client authentication is requested).</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.info/?l=openbsd-announce&m=144495690528446</url>
<cvename>CVE-2015-5333</cvename>
<cvename>CVE-2015-5334</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
<modified>2015-10-26</modified>
</dates>
</vuln>
<vuln vid="07a1a76c-734b-11e5-ae81-14dae9d210b8">
<topic>mbedTLS/PolarSSL -- DoS and possible remote code execution</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.17</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.14</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01">
<p>When the client creates its ClientHello message, due to
insufficient bounds checking it can overflow the heap-based buffer
containing the message while writing some extensions. Two extensions in
particular could be used by a remote attacker to trigger the overflow:
the session ticket extension and the server name indication (SNI)
extension.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01</url>
<cvename>CVE-2015-5291</cvename>
</references>
<dates>
<discovery>2015-10-05</discovery>
<entry>2015-10-15</entry>
</dates>
</vuln>
<vuln vid="ea1d2530-72ce-11e5-a2a1-002590263bf5">
<topic>magento -- multiple vulnerabilities</topic>
<affects>
<package>
<name>magento</name>
<range><lt>1.9.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Magento, Inc. reports:</p>
<blockquote cite="https://www.magentocommerce.com/download">
<p>SUPEE-6482 - This patch addresses two issues related to APIs and
two cross-site scripting risks.</p>
<p>SUPEE-6285 - This patch provides protection against several types
of security-related issues, including information leaks, request
forgeries, and cross-site scripting.</p>
<p>SUPEE-5994 - This patch addresses multiple security
vulnerabilities in Magento Community Edition software, including
issues that can put customer information at risk.</p>
<p>SUPEE-5344 - Addresses a potential remote code execution
exploit.</p>
<p>SUPEE-1533 - Addresses two potential remote code execution
exploits.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/201709</freebsdpr>
<url>https://www.magentocommerce.com/download</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html</url>
</references>
<dates>
<discovery>2014-10-03</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="705b759c-7293-11e5-a371-14dae9d210b8">
<topic>pear-twig -- remote code execution</topic>
<affects>
<package>
<name>pear-twig-twig</name>
<range><lt>1.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabien Potencier reports:</p>
<blockquote cite="http://symfony.com/blog/security-release-twig-1-20-0">
<p>End users can craft valid Twig code that allows them to
execute arbitrary code (RCEs) via the _self variable, which is always
available, even in sandboxed templates.</p>
</blockquote>
</body>
</description>
<references>
<url>http://symfony.com/blog/security-release-twig-1-20-0</url>
<cvename>CVE-2015-7809</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="06fefd2f-728f-11e5-a371-14dae9d210b8">
<topic>miniupnpc -- buffer overflow</topic>
<affects>
<package>
<name>miniupnpc</name>
<range><ge>1.9.1</ge><lt>1.9.20150917</lt></range>
<range><lt>1.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://talosintel.com/reports/TALOS-2015-0035/">
<p>An exploitable buffer overflow vulnerability exists in the
XML parser functionality of the MiniUPnP library. A specially crafted
XML response can lead to a buffer overflow on the stack resulting in
remote code execution. An attacker can set up a server on the local
network to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6031</cvename>
<url>http://talosintel.com/reports/TALOS-2015-0035/</url>
<url>https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-14</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="a63f2c06-726b-11e5-a12b-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.535</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-25.html">
<p>These updates resolve a vulnerability that could be exploited
to bypass the same-origin-policy and lead to information
disclosure (CVE-2015-7628).</p>
<p>These updates include a defense-in-depth feature in the Flash
broker API (CVE-2015-5569).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7629, CVE-2015-7631,
CVE-2015-7643, CVE-2015-7644).</p>
<p>These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-7632).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-7625, CVE-2015-7626,
CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5569</cvename>
<cvename>CVE-2015-7625</cvename>
<cvename>CVE-2015-7626</cvename>
<cvename>CVE-2015-7627</cvename>
<cvename>CVE-2015-7628</cvename>
<cvename>CVE-2015-7629</cvename>
<cvename>CVE-2015-7630</cvename>
<cvename>CVE-2015-7631</cvename>
<cvename>CVE-2015-7632</cvename>
<cvename>CVE-2015-7633</cvename>
<cvename>CVE-2015-7634</cvename>
<cvename>CVE-2015-7643</cvename>
<cvename>CVE-2015-7644</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-25.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="8301c04d-71df-11e5-9fcb-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html">
<p>24 security fixes in this release, including:</p>
<ul>
<li>[519558] High CVE-2015-6755: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[507316] High CVE-2015-6756: Use-after-free in PDFium. Credit
to anonymous.</li>
<li>[529520] High CVE-2015-6757: Use-after-free in ServiceWorker.
Credit to Collin Payne.</li>
<li>[522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte
Kettunen of OUSPG.</li>
<li>[514076] Medium CVE-2015-6759: Information leakage in
LocalStorage. Credit to Muneaki Nishimura (nishimunea).</li>
<li>[519642] Medium CVE-2015-6760: Improper error handling in
libANGLE. Credit to lastland.net.</li>
<li>[447860,532967] Medium CVE-2015-6761: Memory corruption in
FFMpeg. Credit to Aki Helin of OUSPG and anonymous.</li>
<li>[512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit
to Muneaki Nishimura (nishimunea).</li>
<li> [542517] CVE-2015-6763: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.6
branch (currently 4.6.85.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6755</cvename>
<cvename>CVE-2015-6756</cvename>
<cvename>CVE-2015-6757</cvename>
<cvename>CVE-2015-6758</cvename>
<cvename>CVE-2015-6759</cvename>
<cvename>CVE-2015-6760</cvename>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-6762</cvename>
<cvename>CVE-2015-6763</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-13</entry>
</dates>
</vuln>
<vuln vid="00dadbf0-6f61-11e5-a2a1-002590263bf5">
<topic>p5-UI-Dialog -- shell command execution vulnerability</topic>
<affects>
<package>
<name>p5-UI-Dialog</name>
<range><lt>1.09_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthijs Kooijman reports:</p>
<blockquote cite="https://rt.cpan.org/Public/Bug/Display.html?id=107364">
<p>It seems that the whiptail, cdialog and kdialog backends apply
some improper escaping in their shell commands, causing special
characters present in menu item titles to be interpreted by the
shell. This includes the backtick evaluation operator, so this
constitutes a security issue, allowing execution of arbitrary
commands if an attacker has control over the text displayed in
a menu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-7315</cvename>
<freebsdpr>ports/203667</freebsdpr>
<url>https://rt.cpan.org/Public/Bug/Display.html?id=107364</url>
<url>https://bugs.debian.org/496448</url>
<url>https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61</url>
</references>
<dates>
<discovery>2008-08-24</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="290351c9-6f5c-11e5-a2a1-002590263bf5">
<topic>devel/ipython -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ipython</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Bussonnier reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/3">
<p>Summary: Local folder name was used in HTML templates without
escaping, allowing XSS in said pages by carefully crafting folder
name and URL to access it.</p>
<p>URI with issues:</p>
<ul>
<li>GET /tree/**</li>
</ul>
</blockquote>
<p>Benjamin RK reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/16/3">
<p>Vulnerability: A maliciously forged file opened for editing can
execute javascript, specifically by being redirected to /files/ due
to a failure to treat the file as plain text.</p>
<p>URI with issues:</p>
<ul>
<li>GET /edit/**</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203668</freebsdpr>
<cvename>CVE-2015-6938</cvename>
<cvename>CVE-2015-7337</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/3</url>
<url>https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/16/3</url>
<url>https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="a0182578-6e00-11e5-a90c-0026551a22dc">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.22</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.18</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.13</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.9</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1615/">
<p>
Two security issues have been fixed in this release which affect
users of specific PostgreSQL features.
</p>
<ul>
<li>CVE-2015-5289 json or jsonb input values constructed from
arbitrary user input can crash the PostgreSQL server and cause a denial of
service.
</li>
<li>CVE-2015-5288: The crypt() function included with the optional pgCrypto
extension could be exploited to read a few additional bytes of memory.
No working exploit for this issue has been developed.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5289</cvename>
<cvename>CVE-2015-5288</cvename>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-08</entry>
</dates>
</vuln>
<vuln vid="d3324fdb-6bf0-11e5-bc5e-00505699053e">
<topic>ZendFramework1 -- SQL injection vulnerability</topic>
<affects>
<package>
<name>ZendFramework1</name>
<range><lt>1.12.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zend Framework developers report:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2015-08">
<p>The PDO adapters of Zend Framework 1 do not filter null bytes values
in SQL statements. A PDO adapter can treat null bytes in a query as a
string terminator, allowing an attacker to add arbitrary SQL
following a null byte, and thus create a SQL injection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7695</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/30/6</url>
<url>http://framework.zend.com/security/advisory/ZF2015-08</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-06</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="42852f72-6bd3-11e5-9909-002590263bf5">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.3.txt">
<p>fix an mda buffer truncation bug which allows a user to create
forward files that pass session checks but fail delivery later down
the chain, within the user mda</p>
<p>fix remote buffer overflow in unprivileged pony process</p>
<p>reworked offline enqueue to better protect against hardlink
attacks</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/10/04/2</url>
<url>https://www.opensmtpd.org/announces/release-5.7.3.txt</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="5d280761-6bcf-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.16</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.13</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released">
<p>Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach
for PKCS#1 v1.5 signatures. These releases include countermeasures
against that attack.</p>
<p>Fabian Foerg of Gotham Digital Science found a possible client-side
NULL pointer dereference, using the AFL Fuzzer. This dereference can
only occur when misusing the API, although a fix has still been
implemented.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="953aaa57-6bce-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.15</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released">
<p>In order to strengthen the minimum requirements for connections and
to protect against the Logjam attack, the minimum size of
Diffie-Hellman parameters accepted by the client has been increased
to 1024 bits.</p>
<p>In addition the default size for the Diffie-Hellman parameters on
the server are increased to 2048 bits. This can be changed with
ssl_set_dh_params() in case this is necessary.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="9272a5b0-6b40-11e5-bd7f-bcaec565249c">
<topic>gdk-pixbuf2 -- head overflow and DoS</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.32.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/9">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of tga file.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/10">
<p>We found a heap overflow in the gdk-pixbuf implementation
triggered by the scaling of gif file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7673</cvename>
<cvename>CVE-2015-7674</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html</url>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/9</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/10</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="6b3374d4-6b0b-11e5-9909-002590263bf5">
<topic>plone -- multiple vulnerabilities</topic>
<affects>
<package>
<name>plone</name>
<range><lt>4.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone.org reports:</p>
<blockquote cite="https://plone.org/products/plone/security/advisories/20150910-announcement">
<p>Versions Affected: All current Plone versions.</p>
<p>Versions Not Affected: None.</p>
<p>Nature of vulnerability: Allows creation of members by anonymous
users on sites that have self-registration enabled, allowing bypass
of CAPTCHA and similar protections against scripted attacks.</p>
<p>The patch can be added to buildouts as Products.PloneHotfix20150910
(available from PyPI) or downloaded from Plone.org.</p>
<p>Immediate Measures You Should Take: Disable self-registration until
you have applied the patch.</p>
</blockquote>
<blockquote cite="https://plone.org/security/20150910/non-persistent-xss-in-plone">
<p>Plone's URL checking infrastructure includes a method for checking
if URLs valid and located in the Plone site. By passing HTML into
this specially crafted url, XSS can be achieved.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203255</freebsdpr>
<url>https://plone.org/products/plone-hotfix/releases/20150910</url>
<url>https://plone.org/products/plone/security/advisories/20150910-announcement</url>
<url>https://plone.org/security/20150910/non-persistent-xss-in-plone</url>
<url>https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="c1da8b75-6aef-11e5-9909-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-phar</name>
<range><le>5.4.45</le></range>
</package>
<package>
<name>php55-phar</name>
<range><lt>5.5.30</lt></range>
</package>
<package>
<name>php56-phar</name>
<range><lt>5.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.30">
<p>Phar:</p>
<ul>
<li>Fixed bug #69720 (Null pointer dereference in
phar_get_fp_offset()).</li>
<li>Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream
when zip entry filename is "/").</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203541</freebsdpr>
<cvename>CVE-2015-7803</cvename>
<cvename>CVE-2015-7804</cvename>
<url>http://php.net/ChangeLog-5.php#5.5.30</url>
<url>http://php.net/ChangeLog-5.php#5.6.14</url>
</references>
<dates>
<discovery>2015-10-01</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="ee7bdf7f-11bb-4eea-b054-c692ab848c20">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.2.txt">
<p>an oversight in the portable version of fgetln() that allows
attackers to read and write out-of-bounds memory</p>
<p>multiple denial-of-service vulnerabilities that allow local users
to kill or hang OpenSMTPD</p>
<p>a stack-based buffer overflow that allows local users to crash
OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd
user</p>
<p>a hardlink attack (or race-conditioned symlink attack) that allows
local users to unset the chflags() of arbitrary files</p>
<p>a hardlink attack that allows local users to read the first line of
arbitrary files (for example, root's hash from /etc/master.passwd)
</p>
<p>a denial-of-service vulnerability that allows remote attackers to
fill OpenSMTPD's queue or mailbox hard-disk partition</p>
<p>an out-of-bounds memory read that allows remote attackers to crash
OpenSMTPD, or leak information and defeat the ASLR protection</p>
<p>a use-after-free vulnerability that allows remote attackers to
crash OpenSMTPD, or execute arbitrary code as the non-chrooted
_smtpd user</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.opensmtpd.org/announces/release-5.7.2.txt</url>
<cvename>CVE-2015-7687</cvename>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-06</modified>
</dates>
</vuln>
<vuln vid="be3069c9-67e7-11e5-9909-002590263bf5">
<topic>james -- multiple vulnerabilities</topic>
<affects>
<package>
<name>james</name>
<range><lt>2.3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache James Project reports:</p>
<blockquote cite="http://james.apache.org/download.cgi#Apache_James_Server">
<p>This release has many enhancements and bug fixes over the previous
release. See the Release Notes for a detailed list of changes. Some
of the earlier defects could turn a James mail server into an Open
Relay and allow files to be written on disk. All users of James
Server are urged to upgrade to version v2.3.2.1 as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203461</freebsdpr>
<certvu>988628</certvu>
<cvename>CVE-2015-7611</cvename>
<url>http://james.apache.org/download.cgi#Apache_James_Server</url>
<url>https://blogs.apache.org/james/entry/apache_james_server_2_3</url>
</references>
<dates>
<discovery>2015-09-30</discovery>
<entry>2015-10-01</entry>
<modified>2015-10-04</modified>
</dates>
</vuln>
<vuln vid="1e7f0c11-673a-11e5-98c8-60a44c524f57">
<topic>otrs -- Scheduler Process ID File Access</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>3.2.*</gt><lt>3.2.18</lt></range>
<range><gt>3.3.*</gt><lt>3.3.15</lt></range>
<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/">
<p>An attacker with valid LOCAL credentials could access and
manipulate the process ID file for bin/otrs.schduler.pl from the
CLI.</p>
<p>The Proc::Daemon module 0.14 for Perl uses world-writable
permissions for a file that stores a process ID, which allows local
users to have an unspecified impact by modifying this file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/</url>
<cvename>CVE-2015-6842</cvename>
<cvename>CVE-2013-7135</cvename>
</references>
<dates>
<discovery>2015-09-17</discovery>
<entry>2015-09-30</entry>
</dates>
</vuln>
<vuln vid="4e3e8a50-65c1-11e5-948e-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.521</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-23.html">
<p>These updates resolve a type confusion vulnerability that could
lead to code execution (CVE-2015-5573).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).</p>
<p>These updates resolve buffer overflow vulnerabilities that could
lead to code execution (CVE-2015-6676, CVE-2015-6678).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-5575, CVE-2015-5577,
CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588,
CVE-2015-6677).</p>
<p>These updates include additional validation checks to ensure
that Flash Player rejects malicious content from vulnerable
JSONP callback APIs (CVE-2015-5571).</p>
<p>These updates resolve a memory leak vulnerability
(CVE-2015-5576).</p>
<p>These updates include further hardening to a mitigation to
defend against vector length corruptions (CVE-2015-5568).</p>
<p>These updates resolve stack corruption vulnerabilities that
could lead to code execution (CVE-2015-5567, CVE-2015-5579).</p>
<p>These updates resolve a stack overflow vulnerability that could
lead to code execution (CVE-2015-5587).</p>
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-5572).</p>
<p>These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-6679).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5567</cvename>
<cvename>CVE-2015-5568</cvename>
<cvename>CVE-2015-5570</cvename>
<cvename>CVE-2015-5571</cvename>
<cvename>CVE-2015-5572</cvename>
<cvename>CVE-2015-5573</cvename>
<cvename>CVE-2015-5574</cvename>
<cvename>CVE-2015-5575</cvename>
<cvename>CVE-2015-5576</cvename>
<cvename>CVE-2015-5577</cvename>
<cvename>CVE-2015-5578</cvename>
<cvename>CVE-2015-5588</cvename>
<cvename>CVE-2015-6676</cvename>
<cvename>CVE-2015-6677</cvename>
<cvename>CVE-2015-6678</cvename>
<cvename>CVE-2015-6679</cvename>
<cvename>CVE-2015-6682</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-23.html</url>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="5114cd11-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Fixed an SQL injection vulnerability in Active Record
method offset().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="01bce4c6-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- mysql database driver vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Removed a fallback to mysql_escape_string() in the mysql
database driver (escape_str() method) when there's no active database
connection.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-07-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="c21f4e61-6570-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Added HTTP "Host" header character validation to prevent
cache poisoning attacks when base_url auto-detection is used.</p>
<p>Security: Added FSCommand and seekSegmentTime to the "evil
attributes" list in CI_Security::xss_clean().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-04-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="f838dcb4-656f-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: The xor_encode() method in the Encrypt Class has been
removed. The Encrypt Class now requires the Mcrypt extension to be
installed.</p>
<p>Security: The Session Library now uses HMAC authentication instead
of a simple MD5 checksum.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2014-06-05</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="b7d785ea-656d-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>An improvement was made to the MySQL and MySQLi drivers to prevent
exposing a potential vector for SQL injection on sites using
multi-byte character sets in the database client connection.</p>
<p>An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7
with mysql_set_charset() creates a situation where using multi-byte
character sets on these environments may potentially expose a SQL
injection attack vector. Latin-1, UTF-8, and other "low ASCII"
character sets are unaffected on all environments.</p>
<p>If you are running or considering running a multi-byte character
set for your database connection, please pay close attention to the
server environment you are deploying on to ensure you are not
vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/156486</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2011-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="0e425bb7-64f2-11e5-b2fd-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>45.0.2454.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html">
<p>Two vulnerabilities were fixed in this release:</p>
<ul>
<li>[530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit
to Mariusz Mlynski.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1303</cvename>
<cvename>CVE-2015-1304</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2015-09-27</entry>
</dates>
</vuln>
<vuln vid="9770d6ac-614d-11e5-b379-14dae9d210b8">
<topic>libssh2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>libssh2</name>
<range><lt>1.5.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mariusz Ziulek reports:</p>
<blockquote cite="http://www.libssh2.org/adv_20150311.html">
<p>A malicious attacker could man in the middle a real server
and cause libssh2 using clients to crash (denial of service) or
otherwise read and use completely unintended memory areas in this
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libssh2.org/adv_20150311.html</url>
<url>https://trac.libssh2.org/ticket/294</url>
<cvename>CVE-2015-1782</cvename>
</references>
<dates>
<discovery>2015-01-25</discovery>
<entry>2015-09-22</entry>
<modified>2015-09-22</modified>
</dates>
</vuln>
<vuln vid="2d56c7f4-b354-428f-8f48-38150c607a05">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.3.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0
/ rv:38.3)</p>
<p>MFSA 2015-97 Memory leak in mozTCPSocket to servers</p>
<p>MFSA 2015-98 Out of bounds read in QCMS library with ICC
V4 profile attributes</p>
<p>MFSA 2015-99 Site attribute spoofing on Android by
pasting URL with unknown scheme</p>
<p>MFSA 2015-100 Arbitrary file manipulation by local user
through Mozilla updater</p>
<p>MFSA 2015-101 Buffer overflow in libvpx while parsing vp9
format video</p>
<p>MFSA 2015-102 Crash when using debugger with SavedStacks
in JavaScript</p>
<p>MFSA 2015-103 URL spoofing in reader mode</p>
<p>MFSA 2015-104 Use-after-free with shared workers and
IndexedDB</p>
<p>MFSA 2015-105 Buffer overflow while decoding WebM
video</p>
<p>MFSA 2015-106 Use-after-free while manipulating HTML
media content</p>
<p>MFSA 2015-107 Out-of-bounds read during 2D canvas display
on Linux 16-bit color depth systems</p>
<p>MFSA 2015-108 Scripted proxies can access inner
window</p>
<p>MFSA 2015-109 JavaScript immutable property enforcement
can be bypassed</p>
<p>MFSA 2015-110 Dragging and dropping images exposes final
URL after redirects</p>
<p>MFSA 2015-111 Errors in the handling of CORS preflight
request headers</p>
<p>MFSA 2015-112 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-113 Memory safety errors in libGLES in the
ANGLE graphics library</p>
<p>MFSA 2015-114 Information disclosure via the High
Resolution Time API</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4476</cvename>
<cvename>CVE-2015-4500</cvename>
<cvename>CVE-2015-4501</cvename>
<cvename>CVE-2015-4502</cvename>
<cvename>CVE-2015-4503</cvename>
<cvename>CVE-2015-4504</cvename>
<cvename>CVE-2015-4505</cvename>
<cvename>CVE-2015-4506</cvename>
<cvename>CVE-2015-4507</cvename>
<cvename>CVE-2015-4508</cvename>
<cvename>CVE-2015-4509</cvename>
<cvename>CVE-2015-4510</cvename>
<cvename>CVE-2015-4512</cvename>
<cvename>CVE-2015-4516</cvename>
<cvename>CVE-2015-4517</cvename>
<cvename>CVE-2015-4519</cvename>
<cvename>CVE-2015-4520</cvename>
<cvename>CVE-2015-4521</cvename>
<cvename>CVE-2015-4522</cvename>
<cvename>CVE-2015-7174</cvename>
<cvename>CVE-2015-7175</cvename>
<cvename>CVE-2015-7176</cvename>
<cvename>CVE-2015-7177</cvename>
<cvename>CVE-2015-7178</cvename>
<cvename>CVE-2015-7179</cvename>
<cvename>CVE-2015-7180</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-96/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-97/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-98/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-99/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-100/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-102/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-103/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-104/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-105/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-106/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-107/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-108/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-109/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-110/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-111/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-112/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-113/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-114/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-09-22</entry>
</dates>
</vuln>
<vuln vid="3d950687-b4c9-4a86-8478-c56743547af8">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.90</lt></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><lt>2.7.2,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.4</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.8</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.11</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150403 has ffmpeg-2.7.0+ (snapshot, c299fbb) -->
<range><lt>1.1.r20150822</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6818">
<p>The decode_ihdr_chunk function in libavcodec/pngdec.c in
FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR
(aka image header) chunk in a PNG image, which allows remote
attackers to cause a denial of service (out-of-bounds array
access) or possibly have unspecified other impact via a
crafted image with two or more of these chunks.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6819">
<p>Multiple integer underflows in the ff_mjpeg_decode_frame
function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2
allow remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted MJPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6820">
<p>The ff_sbr_apply function in libavcodec/aacsbr.c in
FFmpeg before 2.7.2 does not check for a matching AAC frame
syntax element before proceeding with Spectral Band
Replication calculations, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted AAC
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6821">
<p>The ff_mpv_common_init function in libavcodec/mpegvideo.c
in FFmpeg before 2.7.2 does not properly maintain the
encoding context, which allows remote attackers to cause a
denial of service (invalid pointer access) or possibly have
unspecified other impact via crafted MPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6822">
<p>The destroy_buffers function in libavcodec/sanm.c in
FFmpeg before 2.7.2 does not properly maintain height and
width values in the video context, which allows remote
attackers to cause a denial of service (segmentation
violation and application crash) or possibly have
unspecified other impact via crafted LucasArts Smush video
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6823">
<p>The allocate_buffers function in libavcodec/alac.c in
FFmpeg before 2.7.2 does not initialize certain context
data, which allows remote attackers to cause a denial of
service (segmentation violation) or possibly have
unspecified other impact via crafted Apple Lossless Audio
Codec (ALAC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6824">
<p>The sws_init_context function in libswscale/utils.c in
FFmpeg before 2.7.2 does not initialize certain pixbuf data
structures, which allows remote attackers to cause a denial
of service (segmentation violation) or possibly have
unspecified other impact via crafted video data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6825">
<p>The ff_frame_thread_init function in
libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles
certain memory-allocation failures, which allows remote
attackers to cause a denial of service (invalid pointer
access) or possibly have unspecified other impact via a
crafted file, as demonstrated by an AVI file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6826">
<p>The ff_rv34_decode_init_thread_copy function in
libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize
certain structure members, which allows remote attackers to
cause a denial of service (invalid pointer access) or
possibly have unspecified other impact via crafted (1) RV30
or (2) RV40 RealVideo data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6818</cvename>
<cvename>CVE-2015-6819</cvename>
<cvename>CVE-2015-6820</cvename>
<cvename>CVE-2015-6821</cvename>
<cvename>CVE-2015-6822</cvename>
<cvename>CVE-2015-6823</cvename>
<cvename>CVE-2015-6824</cvename>
<cvename>CVE-2015-6825</cvename>
<cvename>CVE-2015-6826</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-09-05</discovery>
<entry>2015-09-20</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="c2fcbec2-5daa-11e5-9909-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.10</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.8</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.7.10_release_notes">
<p>MSA-15-0030: Students can re-attempt answering questions in the
lesson (CVE-2015-5264)</p>
<p>MSA-15-0031: Teacher in forum can still post to "all participants"
and groups they are not members of (CVE-2015-5272 - 2.7.10 only)</p>
<p>MSA-15-0032: Users can delete files uploaded by other users in wiki
(CVE-2015-5265)</p>
<p>MSA-15-0033: Meta course synchronization enrolls suspended students
as managers for a short period of time (CVE-2015-5266)</p>
<p>MSA-15-0034: Vulnerability in password recovery mechanism
(CVE-2015-5267)</p>
<p>MSA-15-0035: Rating component does not check separate groups
(CVE-2015-5268)</p>
<p>MSA-15-0036: XSS in grouping description (CVE-2015-5269)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5264</cvename>
<cvename>CVE-2015-5272</cvename>
<cvename>CVE-2015-5265</cvename>
<cvename>CVE-2015-5266</cvename>
<cvename>CVE-2015-5267</cvename>
<cvename>CVE-2015-5268</cvename>
<cvename>CVE-2015-5269</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/21/1</url>
<url>https://docs.moodle.org/dev/Moodle_2.7.10_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.8_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.2_release_notes</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-18</entry>
<modified>2015-09-24</modified>
</dates>
</vuln>
<vuln vid="d3a98c2d-5da1-11e5-9909-002590263bf5">
<topic>squid -- TLS/SSL parser denial of service vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.0.1</ge><lt>3.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Amos Jeffries, release manager of the Squid-3 series, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/1">
<p>Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are
built with OpenSSL and configured for "SSL-Bump" decryption.</p>
<p>Integer overflows can lead to invalid pointer math reading from
random memory on some CPU architectures. In the best case this leads
to wrong TLS extensions being used for the client, worst-case a
crash of the proxy terminating all active transactions.</p>
<p>Incorrect message size checks and assumptions about the existence
of TLS extensions in the SSL/TLS handshake message can lead to very
high CPU consumption (up to and including 'infinite loop'
behaviour).</p>
<p>The above can be triggered remotely. Though there is one layer of
authorization applied before this processing to check that the
client is allowed to use the proxy, that check is generally weak. MS
Skype on Windows XP is known to trigger some of these.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<freebsdpr>ports/203186</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_3.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/1</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-09-18</entry>
<modified>2016-02-18</modified>
</dates>
</vuln>
<vuln vid="b55ecf12-5d98-11e5-9909-002590263bf5">
<topic>remind -- buffer overflow with malicious reminder file input</topic>
<affects>
<package>
<name>remind</name>
<range><lt>3.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dianne Skoll reports:</p>
<blockquote cite="http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html">
<p>BUG FIX: Fix a buffer overflow found by Alexander Keller.</p>
</blockquote>
<p>The bug can be manifested by an extended DUMP command using a system
variable (that is a special variable whose name begins with '$')</p>
</body>
</description>
<references>
<cvename>CVE-2015-5957</cvename>
<freebsdpr>ports/202942</freebsdpr>
<url>http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/08/07/1</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-09-18</entry>
</dates>
</vuln>
<vuln vid="d45ad7ae-5d56-11e5-9ad8-14dae9d210b8">
<topic>shutter -- arbitrary code execution</topic>
<affects>
<package>
<name>shutter</name>
<range><ge>0.80</ge><lt>0.93.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/541">
<p>In the "Shutter" screenshot application, I discovered that using the
"Show in folder" menu option while viewing a file with a
specially-crafted path allows for arbitrary code execution with the
permissions of the user running Shutter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/541</url>
<url>https://bugs.launchpad.net/shutter/+bug/1495163</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862</url>
<cvename>CVE-2015-0854</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="a233d51f-5d4c-11e5-9ad8-14dae9d210b8">
<topic>openjpeg -- use-after-free vulnerability</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Feist Josselin reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/550">
<p>Use-after-free was found in openjpeg. The vuln is fixed in
version 2.1.1 and was located in opj_j2k_write_mco function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/550</url>
<url>https://github.com/uclouvain/openjpeg/issues/563</url>
</references>
<dates>
<discovery>2015-08-14</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="bab05188-5d4b-11e5-9ad8-14dae9d210b8">
<topic>optipng -- use-after-free vulnerability</topic>
<affects>
<package>
<name>optipng</name>
<range><le>0.6.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/556">
<p>We found a use-after-free causing an invalid/double free in
optipng 0.6.4.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/556</url>
<cvename>CVE-2015-7801</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="3c259621-5d4a-11e5-9ad8-14dae9d210b8">
<topic>openslp -- denial of service vulnerability</topic>
<affects>
<package>
<name>openslp</name>
<range><lt>2.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qinghao Tang reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/559">
<p>The function ParseExtension() in openslp 1.2.1 contains
vulnerability: an attacker can cause a denial of service
(infinite loop) via a packet with crafted "nextoffset"
value and "extid" value.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/559</url>
<cvename>CVE-2015-5155</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="8f5c9dd6-5cac-11e5-9ad8-14dae9d210b8">
<topic>p7zip -- directory traversal vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>9.38.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Cherepanov reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660">
<p>7z (and 7zr) is susceptible to a directory traversal vulnerability.
While extracting an archive, it will extract symlinks and then follow
them if they are referenced in further entries. This can be exploited by
a rogue archive to write files outside the current directory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/2</url>
<url>http://sourceforge.net/p/p7zip/bugs/147/</url>
<cvename>CVE-2015-1038</cvename>
</references>
<dates>
<discovery>2015-01-05</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="31ea7f73-5c55-11e5-8607-74d02b9a84d5">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo reports:</p>
<blockquote cite="https://h2o.examp1e.net/vulnerabilities.html">
<p>H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL
normalization logic.</p>
<p>When file.dir directive is used, this flaw
allows a remote attacker to retrieve arbitrary files that exist
outside the directory specified by the directive.</p>
<p>H2O version 1.4.5 and version 1.5.0-beta2 have been released
to address this vulnerability.</p>
<p>Users are advised to upgrade their servers immediately.</p>
<p>The vulnerability was reported by: Yusuke OSUMI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5638</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="f4ce64c2-5bd4-11e5-9040-3c970e169bc2">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2015/09/wordpress-4-3-1/">
<p>WordPress 4.3.1 is now available. This is a security
release for all previous versions and we strongly
encourage you to update your sites immediately.</p>
<ul>
<li>WordPress versions 4.3 and earlier are vulnerable
to a cross-site scripting vulnerability when processing
shortcode tags (CVE-2015-5714). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
<li>A separate cross-site scripting vulnerability was found
in the user list table. Reported by Ben Bidner of the
WordPress security team.</li>
<li>Finally, in certain cases, users without proper
permissions could publish private posts and make
them sticky (CVE-2015-5715). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5714</cvename>
<cvename>CVE-2015-5715</cvename>
<cvename>CVE-2015-7989</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/10/28/1</url>
<url>https://wordpress.org/news/2015/09/wordpress-4-3-1/</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-09-15</entry>
<modified>2015-10-29</modified>
</dates>
</vuln>
<vuln vid="ea893f06-5a92-11e5-98c0-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.10</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.14/">
<p>Login names (usually an email address) longer than 127
characters are silently truncated in MySQL which could
cause the domain name of the email address to be
corrupted. An attacker could use this vulnerability to
create an account with an email address different from the
one originally requested. The login name could then be
automatically added to groups based on the group's regular
expression setting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4499</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1202447</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-09-14</entry>
</dates>
</vuln>
<vuln vid="4910d161-58a4-11e5-9ad8-14dae9d210b8">
<topic>openldap -- denial of service vulnerability</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.4.42_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Denis Andzakovic reports:</p>
<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240">
<p>By sending a crafted packet, an attacker may cause the
OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240</url>
<url>http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629</url>
<cvename>CVE-2015-6908</cvename>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2015-09-12</entry>
<modified>2015-09-13</modified>
</dates>
</vuln>
<vuln vid="a35f415d-572a-11e5-b0a4-f8b156b6dcc8">
<topic>vorbis-tools, opus-tools -- multiple vulnerabilities</topic>
<affects>
<package>
<name>vorbis-tools</name>
<range><lt>1.4.0_10,3</lt></range>
</package>
<package>
<name>opus-tools</name>
<range><lt>0.1.9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>I discovered an integer overflow issue in oggenc,
related to the number of channels in the input WAV file.
The issue triggers an out-of-bounds memory access which
causes oggenc to crash.</p>
</blockquote>
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>A crafted WAV file with number of channels set to 0
will cause oggenc to crash due to a division by zero
issue.</p>
</blockquote>
<p>pengsu reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2212">
<p>I discovered an buffer overflow issue in oggenc/audio.c
when it tries to open invalid aiff file.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/202941</freebsdpr>
<url>https://trac.xiph.org/ticket/2136</url>
<cvename>CVE-2014-9639</cvename>
<url>https://trac.xiph.org/ticket/2137</url>
<cvename>CVE-2014-9638</cvename>
<url>https://trac.xiph.org/ticket/2212</url>
<cvename>CVE-2015-6749</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-09-09</entry>
<modified>2015-09-09</modified>
</dates>
</vuln>
<vuln vid="d76961da-56f6-11e5-934b-002590263bf5">
<topic>pgbouncer -- failed auth_query lookup leads to connection as auth_user</topic>
<affects>
<package>
<name>pgbouncer</name>
<range><eq>1.6.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PgBouncer reports:</p>
<blockquote cite="http://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/">
<p>New auth_user functionality introduced in 1.6 allows login as
auth_user when client presents unknown username. It's quite likely
auth_user is superuser. Affects only setups that have enabled
auth_user in their config.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6817</cvename>
<url>https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/</url>
<url>https://github.com/pgbouncer/pgbouncer/issues/69</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/3</url>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-09</entry>
</dates>
</vuln>
<vuln vid="3904f759-5659-11e5-a207-6805ca0b3d42">
<topic>phpMyAdmin -- reCaptcha bypass</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-4/">
<p>This vulnerability allows to complete the reCaptcha test
and subsequently perform a brute force attack to guess user
credentials without having to complete further reCaptcha
tests.</p>
<p>We consider this vulnerability to be non critical since
reCaptcha is an additional opt-in security measure.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-4/</url>
<cvename>CVE-2015-6830</cvename>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="3d675519-5654-11e5-9ad8-14dae9d210b8">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-soap</name>
<name>php5-xsl</name>
<range><lt>5.4.45</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-soap</name>
<name>php55-xsl</name>
<range><lt>5.5.29</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-soap</name>
<name>php56-xsl</name>
<range><lt>5.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.4.45">
<ul><li>Core:
<ul>
<li>Fixed bug #70172 (Use After Free Vulnerability in unserialize()).</li>
<li>Fixed bug #70219 (Use after free vulnerability in session deserializer).</li>
</ul></li>
<li>EXIF:
<ul>
<li>Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).</li>
</ul></li>
<li>hash:
<ul>
<li>Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).</li>
<li>Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).</li>
</ul></li>
<li>XSLT:
<ul>
<li>Fixed bug #69782 (NULL pointer dereference).</li>
</ul></li>
<li>ZIP:
<ul>
<li>Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.4.45</url>
<url>http://php.net/ChangeLog-5.php#5.5.29</url>
<url>http://php.net/ChangeLog-5.php#5.6.13</url>
<cvename>CVE-2015-6834</cvename>
<cvename>CVE-2015-6835</cvename>
<cvename>CVE-2015-6836</cvename>
<cvename>CVE-2015-6837</cvename>
<cvename>CVE-2015-6838</cvename>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="d68df01b-564e-11e5-9ad8-14dae9d210b8">
<topic>ganglia-webfrontend -- auth bypass</topic>
<affects>
<package>
<name>ganglia-webfrontend</name>
<range><lt>3.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ivan Novikov reports:</p>
<blockquote cite="https://github.com/ganglia/ganglia-web/issues/267">
<p>It's easy to bypass auth by using boolean serialization...</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ganglia/ganglia-web/issues/267</url>
<cvename>CVE-2015-6816</cvename>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="9bdd8eb5-564a-11e5-9ad8-14dae9d210b8">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html">
<p>The following vulnerabilities have been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-21</p>
<p>Protocol tree crash. (Bug 11309)</p></li>
<li><p>wnpa-sec-2015-22</p>
<p>Memory manager crash. (Bug 11373)</p></li>
<li><p>wnpa-sec-2015-23</p>
<p>Dissector table crash. (Bug 11381)</p></li>
<li><p>wnpa-sec-2015-24</p>
<p>ZigBee crash. (Bug 11389)</p></li>
<li><p>wnpa-sec-2015-25</p>
<p>GSM RLC/MAC infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-26</p>
<p>WaveAgent crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-27</p>
<p>OpenFlow infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-28</p>
<p>Ptvcursor crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-29</p>
<p>WCCP crash. (Bug 11358)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html</url>
<cvename>CVE-2015-6241</cvename>
<cvename>CVE-2015-6242</cvename>
<cvename>CVE-2015-6243</cvename>
<cvename>CVE-2015-6244</cvename>
<cvename>CVE-2015-6245</cvename>
<cvename>CVE-2015-6246</cvename>
<cvename>CVE-2015-6247</cvename>
<cvename>CVE-2015-6248</cvename>
<cvename>CVE-2015-6249</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="98092444-5645-11e5-9ad8-14dae9d210b8">
<topic>screen -- stack overflow</topic>
<affects>
<package>
<name>screen</name>
<range><lt>4.3.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kuang-che Wu reports:</p>
<blockquote cite="https://savannah.gnu.org/bugs/?45713">
<p>screen will recursively call MScrollV to depth n/256. This
is time consuming and will overflow stack if n is huge.</p>
</blockquote>
</body>
</description>
<references>
<url>https://savannah.gnu.org/bugs/?45713</url>
<cvename>CVE-2015-6806</cvename>
</references>
<dates>
<discovery>2015-08-07</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="b5e654c3-5644-11e5-9ad8-14dae9d210b8">
<topic>libvncserver -- memory corruption</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Pisar reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=706087">
<p>libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=706087</url>
<url>https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="ed0ecad5-531d-11e5-9850-bcaec565249c">
<topic>gdk-pixbuf2 -- integer overflows</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Clasen reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html">
<p>Fix several integer overflows.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-04</entry>
</dates>
</vuln>
<vuln vid="2c5e7e23-5248-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><ge>9.9.7</ge><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/">
<p>An incorrect boundary check in openpgpkey_61.c can cause
named to terminate due to a REQUIRE assertion failure. This defect can
be deliberately exploited by an attacker who can provide a maliciously
constructed response in answer to a query.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/</url>
<cvename>CVE-2015-5986</cvename>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
</dates>
</vuln>
<vuln vid="eaf3b255-5245-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.2</ge><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/">
<p>Parsing a malformed DNSSEC key can cause a validating
resolver to exit due to a failed assertion in buffer.c. It is possible
for a remote attacker to deliberately trigger this condition, for
example by using a query which requires a response from a zone
containing a deliberately malformed key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/</url>
<cvename>CVE-2015-5722</cvename>
<freebsdsa>SA-15:23.bind</freebsdsa>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="a9350df8-5157-11e5-b5c1-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-npapi</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-pulse</name>
<range><lt>45.0.2454.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>29 security fixes in this release, including:</p>
<ul>
<li>[516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit
to anonymous.</li>
<li>[522791] High CVE-2015-1292: Cross-origin bypass in
ServiceWorker. Credit to Mariusz Mlynski.</li>
<li>[524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[492263] High CVE-2015-1294: Use-after-free in Skia. Credit
to cloudfuzzer.</li>
<li>[502562] High CVE-2015-1295: Use-after-free in Printing. Credit
to anonymous.</li>
<li>[421332] High CVE-2015-1296: Character spoofing in omnibox.
Credit to zcorpan.</li>
<li>[510802] Medium CVE-2015-1297: Permission scoping error in
Webrequest. Credit to Alexander Kashev.</li>
<li>[518827] Medium CVE-2015-1298: URL validation error in
extensions. Credit to Rob Wu.</li>
<li>[416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit
to taro.suzuki.dev.</li>
<li>[511616] Medium CVE-2015-1300: Information leak in Blink. Credit
to cgvwzq.</li>
<li>[526825] CVE-2015-1301: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1291</cvename>
<cvename>CVE-2015-1292</cvename>
<cvename>CVE-2015-1293</cvename>
<cvename>CVE-2015-1294</cvename>
<cvename>CVE-2015-1295</cvename>
<cvename>CVE-2015-1296</cvename>
<cvename>CVE-2015-1297</cvename>
<cvename>CVE-2015-1298</cvename>
<cvename>CVE-2015-1299</cvename>
<cvename>CVE-2015-1300</cvename>
<cvename>CVE-2015-1301</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="55c43f5b-5190-11e5-9ad8-14dae9d210b8">
<topic>powerdns -- denial of service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.0</ge><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/">
<p>A bug was found in our DNS packet parsing/generation code,
which, when exploited, can cause individual threads (disabling service)
or whole processes (allowing a supervisor to restart them) to crash with
just one or a few query packets.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/</url>
<cvename>CVE-2015-5230</cvename>
</references>
<dates>
<discovery>2015-09-02</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="fc1f6658-4f53-11e5-934b-002590263bf5">
<topic>ghostscript -- denial of service (crash) via crafted Postscript files</topic>
<affects>
<package>
<name>ghostscript7</name>
<name>ghostscript7-nox11</name>
<name>ghostscript7-base</name>
<name>ghostscript7-x11</name>
<range><lt>7.07_32</lt></range>
</package>
<package>
<name>ghostscript8</name>
<name>ghostscript8-nox11</name>
<name>ghostscript8-base</name>
<name>ghostscript8-x11</name>
<range><lt>8.71_19</lt></range>
</package>
<package>
<name>ghostscript9</name>
<name>ghostscript9-nox11</name>
<name>ghostscript9-base</name>
<name>ghostscript9-x11</name>
<range><lt>9.06_11</lt></range>
</package>
<package>
<name>ghostscript9-agpl</name>
<name>ghostscript9-agpl-nox11</name>
<range><lt>9.15_2</lt></range>
</package>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228">
<p>Integer overflow in the gs_heap_alloc_bytes function in
base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote
attackers to cause a denial of service (crash) via a crafted
Postscript (ps) file, as demonstrated by using the ps2pdf command,
which triggers an out-of-bounds read or write.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3228</cvename>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696041</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696070</url>
<url>http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-09-01</entry>
<modified>2015-09-02</modified>
</dates>
</vuln>
<vuln vid="80c66af0-d1c5-449e-bd31-63b12525ff88">
<topic>ffmpeg -- out-of-bounds array access</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.15,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.2</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.6</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.8</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg1</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20141223 has ffmpeg-2.5.1+ (snapshot, 03b84f2) -->
<range><lt>1.1.r20150403</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3395">
<p>The msrle_decode_pal4 function in msrledec.c in Libav
before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7,
2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6,
and 2.6.x before 2.6.2 allows remote attackers to have
unspecified impact via a crafted image, related to a pixel
pointer, which triggers an out-of-bounds array access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3395</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553</url>
<url>https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2015-04-12</discovery>
<entry>2015-09-01</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="da434a78-e342-4d9a-87e2-7497e5f117ba">
<topic>ffmpeg -- use-after-free</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.0</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.12,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.7,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.2</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.5</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<range><lt>2.3.6</lt></range>
</package>
<package>
<name>ffmpeg1</name>
<range><lt>1.2.11</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3417">
<p>Use-after-free vulnerability in the ff_h264_free_tables
function in libavcodec/h264.c in FFmpeg before 2.3.6 allows
remote attackers to cause a denial of service or possibly
have unspecified other impact via crafted H.264 data in an
MP4 file, as demonstrated by an HTML VIDEO element that
references H.264 data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3417</cvename>
<!-- ffmpeg and libav fixes are different -->
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214</url>
<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2015-09-01</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="5300711b-4e61-11e5-9ad8-14dae9d210b8">
<topic>graphviz -- format string vulnerability</topic>
<affects>
<package>
<name>graphviz</name>
<range><lt>2.38.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joshua Rogers reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q4/784">
<p>A format string vulnerability has been found in `graphviz'.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q4/784</url>
<url>https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081</url>
</references>
<dates>
<discovery>2014-11-24</discovery>
<entry>2015-08-29</entry>
</dates>
</vuln>
<vuln vid="237a201c-888b-487f-84d3-7d92266381d6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-95 Add-on notification bypass through data URLs</p>
<p>MFSA 2015-94 Use-after-free when resizing canvas element
during restyling</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4497</cvename>
<cvename>CVE-2015-4498</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-94/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-95/</url>
</references>
<dates>
<discovery>2015-08-27</discovery>
<entry>2015-08-28</entry>
</dates>
</vuln>
<vuln vid="4464212e-4acd-11e5-934b-002590263bf5">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.4.3,1</lt></range>
</package>
<package>
<name>go14</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel, Go Product Manager, reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/237">
<p>CVE-2015-5739 - "Content Length" treated as valid header</p>
<p>CVE-2015-5740 - Double content-length headers does not return 400
error</p>
<p>CVE-2015-5741 - Additional hardening, not sending Content-Length
w/Transfer-Encoding, Closing connections</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5739</cvename>
<cvename>CVE-2015-5740</cvename>
<cvename>CVE-2015-5741</cvename>
<url>https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9</url>
<url>https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e</url>
<url>https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f</url>
<url>http://seclists.org/oss-sec/2015/q3/237</url>
</references>
<dates>
<discovery>2015-07-29</discovery>
<entry>2015-08-25</entry>
</dates>
</vuln>
<vuln vid="40497e81-fee3-4e54-9d5f-175a5c633b73">
<topic>libtremor -- memory corruption</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20120120</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2012-07/">
<p>Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative the possibility of memory
corruption during the decoding of Ogg Vorbis files. This can
cause a crash during decoding and has the potential for
remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0444</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=719612</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="3dac84c9-bce1-4199-9784-d68af1eb7b2e">
<topic>libtremor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20101013</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RedHat Project reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=438125">
<p>Will Drewry of the Google Security Team reported multiple
issues in OGG Vorbis and Tremor libraries, that could cause
application using those libraries to crash (NULL pointer
dereference or divide by zero), enter an infinite loop or
cause heap overflow caused by integer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1418</cvename>
<cvename>CVE-2008-1419</cvename>
<cvename>CVE-2008-1420</cvename>
<cvename>CVE-2008-1423</cvename>
<cvename>CVE-2008-2009</cvename>
<url>http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4</url>
</references>
<dates>
<discovery>2008-03-19</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="6900e6f1-4a79-11e5-9ad8-14dae9d210b8">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guanxing Wen reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/295">
<p>PCRE library is prone to a vulnerability which leads to
Heap Overflow.
During the compilation of a malformed regular expression, more data is
written on the malloced block than the expected size output by
compile_regex().
The Heap Overflow vulnerability is caused by the following regular
expression.</p>
<p>/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/</p>
<p>A dry run of this particular regular expression with pcretest will
reports "double free or corruption (!prev)".
But it is actually a heap overflow problem.
The overflow only affects pcre 8.x branch, pcre2 branch is not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/295</url>
<url>https://bugs.exim.org/show_bug.cgi?id=1672</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-24</entry>
</dates>
</vuln>
<vuln vid="9393213d-489b-11e5-b8c7-d050996490d0">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.37</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-003">
<p>This security advisory fixes multiple vulnerabilities.
See below for a list.</p>
<h3>Cross-site Scripting - Ajax system - Drupal 7</h3>
<p>A vulnerability was found that allows a malicious
user to perform a cross-site scripting attack by
invoking Drupal.ajax() on a whitelisted HTML element.</p>
<p>This vulnerability is mitigated on sites that do not
allow untrusted users to enter HTML.</p>
<h3>Cross-site Scripting - Autocomplete system - Drupal 6 and 7</h3>
<p>A cross-site scripting vulnerability was found in
the autocomplete functionality of forms. The
requested URL is not sufficiently sanitized.</p>
<p>This vulnerability is mitigated by the fact that
the malicious user must be allowed to upload files.</p>
<h3>SQL Injection - Database API - Drupal 7</h3>
<p>A vulnerability was found in the SQL comment
filtering system which could allow a user with
elevated permissions to inject malicious code in
SQL comments.</p>
<p>This vulnerability is mitigated by the fact that
only one contributed module that the security team
found uses the comment filtering system in a way
that would trigger the vulnerability. That module
requires you to have a very high level of access
in order to perform the attack.</p>
<h3>Cross-site Request Forgery - Form API - Drupal 6 and 7</h3>
<p>A vulnerability was discovered in Drupal's form API
that could allow file upload value callbacks to run
with untrusted input, due to form token validation
not being performed early enough. This vulnerability
could allow a malicious user to upload files to the
site under another user's account.</p>
<p>This vulnerability is mitigated by the fact that
the uploaded files would be temporary, and Drupal
normally deletes temporary files automatically
after 6 hours.</p>
<h3>Information Disclosure in Menu Links - Access system - Drupal 6 and 7</h3>
<p>Users without the "access content" permission
can see the titles of nodes that they do not have
access to, if the nodes are added to a menu on the
site that the users have access to.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2015-003</url>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-08-22</entry>
</dates>
</vuln>
<vuln vid="2920c449-4850-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PAM vulnerabilities</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.0.p1,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_2</lt></range>
<range><ge>10.1</ge><lt>10.1_19</lt></range>
<range><ge>9.3</ge><lt>9.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.0">
<p>OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable.
Local attackers may be able to write arbitrary messages to
logged-in users, including terminal escape sequences. Reported
by Nikolay Edigaryev.</p>
<p>Fixed a privilege separation
weakness related to PAM support. Attackers who could successfully
compromise the pre-authentication process for remote code
execution and who had valid credentials on the host could
impersonate other users.</p>
<p>Fixed a use-after-free bug
related to PAM support that was reachable by attackers who could
compromise the pre-authentication process for remote code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.0</url>
<cvename>CVE-2015-6563</cvename>
<cvename>CVE-2015-6564</cvename>
<cvename>CVE-2015-6565</cvename>
<freebsdsa>SA-15:22.openssh</freebsdsa>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="27fed73e-484f-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PermitRootLogin may allow password connections with 'without-password'</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><eq>7.0.p1,1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.1">
<p>OpenSSH 7.0 contained a logic error in PermitRootLogin=
prohibit-password/without-password that could, depending on
compile-time configuration, permit password authentication to
root while preventing other forms of authentication. This problem
was reported by Mantas Mikulenas.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.1</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="2fe40238-480f-11e5-adde-14dae9d210b8">
<topic>tarsnap -- buffer overflow and local DoS</topic>
<affects>
<package>
<name>tarsnap</name>
<range><lt>1.0.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Percival reports:</p>
<blockquote cite="http://mail.tarsnap.com/tarsnap-announce/msg00032.html">
<p>1. SECURITY FIX: When constructing paths of objects being archived, a buffer
could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte
paths. Theoretically this could be exploited by an unprivileged user whose
files are being archived; I do not believe it is exploitable in practice,
but I am offering a $1000 bounty for the first person who can prove me wrong:
http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</p>
<p>2. SECURITY FIX: An attacker with a machine's write keys, or with read keys
and control of the tarsnap service, could make tarsnap allocate a large
amount of memory upon listing archives or reading an archive the attacker
created; on 32-bit machines, tarsnap can be caused to crash under the
aforementioned conditions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail.tarsnap.com/tarsnap-announce/msg00032.html</url>
<url>http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="a0a4e24c-4760-11e5-9391-3c970e169bc2">
<topic>vlc -- arbitrary pointer dereference vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.1_5,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="https://www.ocert.org/advisories/ocert-2015-009.html">
<p>The stable VLC version suffers from an arbitrary pointer
dereference vulnerability.</p>
<p>The vulnerability affects the 3GP file format parser,
insufficient restrictions on a writable buffer can be
exploited to execute arbitrary code via the heap memory.
A specific 3GP file can be crafted to trigger the
vulnerability.</p>
<p>Credit: vulnerability reported by Loren Maggiore of
Trail of Bits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5949</cvename>
<url>https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd</url>
<url>https://www.ocert.org/advisories/ocert-2015-009.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-20</entry>
</dates>
</vuln>
<vuln vid="9a71953a-474a-11e5-adde-14dae9d210b8">
<topic>libpgf -- use-after-free</topic>
<affects>
<package>
<name>libpgf</name>
<range><le>6.14.12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pengsu Cheng reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/404">
<p>An use-after-free issue in Decoder.cpp was reported to
upstream. The problem is due to lack of validation of ColorTableSize.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/404</url>
<url>https://sourceforge.net/p/libpgf/code/147/</url>
<url>https://sourceforge.net/p/libpgf/code/148/</url>
<cvename>CVE-2015-6673</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-08-20</entry>
<modified>2015-08-26</modified>
</dates>
</vuln>
<vuln vid="f5b8b670-465c-11e5-a49d-bcaec565249c">
<topic>gdk-pixbuf2 -- heap overflow and DoS</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of a malformed bmp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4491</cvename>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-08-19</entry>
</dates>
</vuln>
<vuln vid="b0e54dc1-45d2-11e5-adde-14dae9d210b8">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<range><lt>1.8.4</lt></range>
</package>
<package>
<name>py27-django17</name>
<name>py32-django17</name>
<name>py33-django17</name>
<name>py34-django17</name>
<range><lt>1.7.10</lt></range>
</package>
<package>
<name>py27-django14</name>
<name>py32-django14</name>
<name>py33-django14</name>
<name>py34-django14</name>
<range><lt>1.4.22</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/aug/18/security-releases/">
<p>Denial-of-service possibility in logout() view by filling
session store</p>
<p>Previously, a session could be created when anonymously
accessing the django.contrib.auth.views.logout view
(provided it wasn't decorated with django.contrib.auth.decorators.login_required
as done in the admin). This could allow an attacker to
easily create many new session records by sending repeated
requests, potentially filling up the session store or
causing other users' session records to be evicted.</p>
<p>The django.contrib.sessions.middleware.SessionMiddleware
has been modified to no longer create empty session records.</p>
<p>This portion of the fix has been assigned CVE-2015-5963.</p>
<p>Additionally, on the 1.4 and 1.7 series only, the
contrib.sessions.backends.base.SessionBase.flush() and
cache_db.SessionStore.flush() methods have been modified
to avoid creating a new empty session. Maintainers of
third-party session backends should check if the same
vulnerability is present in their backend and correct
it if so.</p>
<p>This portion of the fix has been assigned CVE-2015-5964.
Anyone reporting a similar vulnerability in a third-party
session backend should not use this CVE ID.</p>
<p>Thanks Lin Hua Cheng for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/aug/18/security-releases/</url>
<cvename>CVE-2015-5963</cvename>
<cvename>CVE-2015-5964</cvename>
</references>
<dates>
<discovery>2015-08-18</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="0ecc1f55-45d0-11e5-adde-14dae9d210b8">
<topic>unreal -- denial of service</topic>
<affects>
<package>
<name>Unreal</name>
<range><ge>3.2.10</ge><lt>3.2.10.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unreal reports:</p>
<blockquote cite="https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt">
<p>Summary: If SASL support is enabled in UnrealIRCd (this is
not the default) and is also enabled in your services
package then a malicious user with a services account can cause
UnrealIRCd to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt</url>
<url>http://seclists.org/oss-sec/2015/q3/367</url>
</references>
<dates>
<discovery>2015-08-13</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="f1692469-45ce-11e5-adde-14dae9d210b8">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Prpic reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0">
<p>A double free flaw was found in the way JasPer's
jasper_image_stop_load() function parsed certain JPEG 2000 image files.
A specially crafted file could cause an application using JasPer to
crash.</p>
</blockquote>
<p>Feist Josselin reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/408">
<p>A new use-after-free was found in Jasper JPEG-200. The
use-after-free appears in the function mif_process_cmpt of the
src/libjasper/mif/mif_cod.c file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0</url>
<url>http://seclists.org/oss-sec/2015/q3/366</url>
<url>http://seclists.org/oss-sec/2015/q3/408</url>
<cvename>CVE-2015-5203</cvename>
<cvename>CVE-2015-5221</cvename>
</references>
<dates>
<discovery>2015-08-17</discovery>
<entry>2015-08-18</entry>
<modified>2016-02-24</modified>
</dates>
</vuln>
<vuln vid="a59e263a-45cd-11e5-adde-14dae9d210b8">
<topic>freexl -- integer overflow</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/06/7">
<p>There's an integer overflow in the allocate_cells() function
when trying to allocate the memory for worksheet with specially
crafted row/column dimensions. This can be exploited to cause a
heap memory corruption. The most likely outcome of this is a crash
when trying to initialize the cells later in the function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/07/06/7</url>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="ac98d090-45cc-11e5-adde-14dae9d210b8">
<topic>freexl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jodie Cunningham reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/03/25/1">
<p>#1: A flaw was found in the way FreeXL reads sectors from
the input file. A specially crafted file could possibly
result in stack corruption near freexl.c:3752.</p>
<p>#2: A flaw was found in the function allocate_cells(). A
specially crafted file with invalid workbook dimensions
could possibly result in stack corruption near freexl.c:1074</p>
<p>#3: A flaw was found in the way FreeXL handles a premature EOF. A
specially crafted input file could possibly result in stack corruption
near freexl.c:1131</p>
<p>#4: FreeXL 1.0.0g did not properly check requests for workbook memory
allocation. A specially crafted input file could cause a Denial of
Service, or possibly write onto the stack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/03/25/1</url>
<cvename>CVE-2015-2776</cvename>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-08-18</entry>
</dates>
</vuln>
<vuln vid="47aa4343-44fa-11e5-9daa-14dae9d210b8">
<topic>mod_jk -- information disclosure</topic>
<affects>
<package>
<name>ap22-mod_jk</name>
<name>ap24-mod_jk</name>
<range><lt>1.2.41,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="http://www.cvedetails.com/cve/CVE-2014-8111/">
<p>Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores
JkUnmount rules for subtrees of previous JkMount rules, which allows
remote attackers to access otherwise restricted artifacts via
unspecified vectors. </p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html</url>
<url>http://readlist.com/lists/tomcat.apache.org/users/27/135512.html</url>
<url>http://www.cvedetails.com/cve/CVE-2014-8111/</url>
<cvename>CVE-2014-8111</cvename>
</references>
<dates>
<discovery>2015-01-15</discovery>
<entry>2015-08-17</entry>
</dates>
</vuln>
<vuln vid="f06f20dc-4347-11e5-93ad-002590263bf5">
<topic>qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-140.html">
<p>The QEMU model of the RTL8139 network card did not sufficiently
validate inputs in the C+ mode offload emulation. This results in
uninitialized memory from the QEMU process's heap being leaked to
the domain as well as to the network.</p>
<p>A guest may be able to read sensitive host-level data relating to
itself which resides in the QEMU process.</p>
<p>Such information may include things such as information relating to
real devices backing emulated devices or passwords which the host
administrator does not intend to share with the guest admin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5165</cvename>
<url>http://xenbits.xen.org/xsa/advisory-140.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef</url>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2015-08-17</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="ee99899d-4347-11e5-93ad-002590263bf5">
<topic>qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-139.html">
<p>When unplugging an emulated block device the device was not fully
unplugged, meaning a second unplug attempt would attempt to unplug
the device a second time using a previously freed pointer.</p>
<p>An HVM guest which has access to an emulated IDE disk device may be
able to exploit this vulnerability in order to take over the qemu
process elevating its privilege to that of the qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5166</cvename>
<url>http://xenbits.xen.org/xsa/advisory-139.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52</url>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2015-08-17</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="787ef75e-44da-11e5-93ad-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-openssl</name>
<name>php5-phar</name>
<name>php5-soap</name>
<range><lt>5.4.44</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-openssl</name>
<name>php55-phar</name>
<name>php55-soap</name>
<range><lt>5.5.28</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-openssl</name>
<name>php56-phar</name>
<name>php56-soap</name>
<range><lt>5.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php">
<p>Core:</p>
<ul>
<li>Fixed bug #69793 (Remotely triggerable stack exhaustion via
recursive method calls).</li>
<li>Fixed bug #70121 (unserialize() could lead to unexpected methods
execution / NULL pointer deref).</li>
</ul>
<p>OpenSSL:</p>
<ul>
<li>Fixed bug #70014 (openssl_random_pseudo_bytes() is not
cryptographically secure).</li>
</ul>
<p>Phar:</p>
<ul>
<li>Improved fix for bug #69441.</li>
<li>Fixed bug #70019 (Files extracted from archive may be placed
outside of destination directory).</li>
</ul>
<p>SOAP:</p>
<ul>
<li>Fixed bug #70081 (SoapClient info leak / null pointer
dereference via multiple type confusions).</li>
</ul>
<p>SPL:</p>
<ul>
<li>Fixed bug #70068 (Dangling pointer in the unserialization of
ArrayObject items).</li>
<li>Fixed bug #70166 (Use After Free Vulnerability in unserialize()
with SPLArrayObject).</li>
<li>Fixed bug #70168 (Use After Free Vulnerability in unserialize()
with SplObjectStorage).</li>
<li>Fixed bug #70169 (Use After Free Vulnerability in unserialize()
with SplDoublyLinkedList).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.4.44</url>
<url>http://php.net/ChangeLog-5.php#5.5.28</url>
<url>http://php.net/ChangeLog-5.php#5.6.12</url>
<cvename>CVE-2015-6831</cvename>
<cvename>CVE-2015-6832</cvename>
<cvename>CVE-2015-6833</cvename>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2015-08-17</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="6241b5df-42a1-11e5-93ad-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.10</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.3</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html">
<p>Internal review discovered that Special:DeletedContributions did
not properly protect the IP of autoblocked users. This fix makes
the functionality of Special:DeletedContributions consistent with
Special:Contributions and Special:BlockList.</p>
<p>Internal review discovered that watchlist anti-csrf tokens were not
being compared in constant time, which could allow various timing
attacks. This could allow an attacker to modify a user's watchlist
via csrf</p>
<p>John Menerick reported that MediaWiki's thumb.php failed to sanitize
various error messages, resulting in xss.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6727</cvename>
<cvename>CVE-2013-7444</cvename>
<cvename>CVE-2015-6728</cvename>
<cvename>CVE-2015-6729</cvename>
<cvename>CVE-2015-6730</cvename>
<cvename>CVE-2015-6731</cvename>
<cvename>CVE-2015-6733</cvename>
<cvename>CVE-2015-6734</cvename>
<cvename>CVE-2015-6735</cvename>
<cvename>CVE-2015-6736</cvename>
<cvename>CVE-2015-6737</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html</url>
<url>https://phabricator.wikimedia.org/T106893</url>
<url>https://phabricator.wikimedia.org/T94116</url>
<url>https://phabricator.wikimedia.org/T97391</url>
<url>http://www.openwall.com/lists/oss-security/2015/08/27/6</url>
</references>
<dates>
<discovery>2015-08-10</discovery>
<entry>2015-08-14</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="0c2c4d84-42a2-11e5-9daa-14dae9d210b8">
<topic>freeradius3 -- insufficient validation on packets</topic>
<affects>
<package>
<name>freeradius3</name>
<range><lt>3.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://freeradius.org/security.html#eap-pwd-2015">
<p>The EAP-PWD module performed insufficient validation on
packets received from an EAP peer. This module is not enabled in the
default configuration. Administrators must manually enable it for their
server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://freeradius.org/security.html#eap-pwd-2015</url>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2015-08-14</entry>
</dates>
</vuln>
<vuln vid="ec6a2a1e-429d-11e5-9daa-14dae9d210b8">
<topic>gnutls -- double free in certificate DN decoding</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="http://www.gnutls.org/security.html#GNUTLS-SA-2015-3">
<p>Kurt Roeckx reported that decoding a specific certificate with very
long DistinguishedName (DN) entries leads to double free, which may
result to a denial of service. Since the DN decoding occurs in almost
all applications using certificates it is recommended to upgrade the
latest GnuTLS version fixing the issue. Recommendation: Upgrade to
GnuTLS 3.4.4, or 3.3.17.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-3</url>
<mlist>http://seclists.org/oss-sec/2015/q3/308</mlist>
<url>https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12</url>
<cvename>CVE-2015-6251</cvename>
</references>
<dates>
<discovery>2015-07-20</discovery>
<entry>2015-08-14</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="3de36a19-429d-11e5-9daa-14dae9d210b8">
<topic>gnutls -- MD5 downgrade in TLS signatures</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Karthikeyan Bhargavan reports:</p>
<blockquote cite="http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132">
<p>GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5
signature-hash algorithm needs to be explicitly enabled using the
priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE
profiles, GnuTLS clients do not offer RSA-MD5 in the signature
algorithms extension. However, we find that all GnuTLS clients still
accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still
accept RSA-MD5 in the ClientCertificateVerify.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132</mlist>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2015-2</url>
<mlist>http://seclists.org/oss-sec/2015/q2/367</mlist>
</references>
<dates>
<discovery>2015-04-25</discovery>
<entry>2015-08-14</entry>
</dates>
</vuln>
<vuln vid="9ee72858-4159-11e5-93ad-002590263bf5">
<topic>froxlor -- database password information leak</topic>
<affects>
<package>
<name>froxlor</name>
<range><lt>0.9.33.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oss-security-list@demlak.de reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/238">
<p>An unauthenticated remote attacker is able to get the database
password via webaccess due to wrong file permissions of the /logs/
folder in froxlor version 0.9.33.1 and earlier. The plain SQL
password and username may be stored in the /logs/sql-error.log file.
This directory is publicly reachable under the default
configuration/setup.</p>
</blockquote>
<p>Note that froxlor 0.9.33.2 prevents future logging of passwords but
does not retroactively remove passwords already logged. Michael
Kaufmann, the Froxlor lead developer reports:</p>
<blockquote cite="http://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/#entry30025">
<p>Removing all .log files from the directory should do the job,
alternatively just use the class.ConfigIO.php from Github</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5959</cvename>
<freebsdpr>ports/202262</freebsdpr>
<url>http://seclists.org/oss-sec/2015/q3/238</url>
<url>https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/</url>
</references>
<dates>
<discovery>2015-07-29</discovery>
<entry>2015-08-13</entry>
</dates>
</vuln>
<vuln vid="83b38a2c-413e-11e5-bfcf-6805ca0b3d42">
<topic>RT -- two XSS vulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.12</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0.0</ge><lt>4.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html">
<p>RT 4.0.0 and above are vulnerable to a cross-site
scripting (XSS) attack via the user and group rights
management pages. This vulnerability is assigned
CVE-2015-5475. It was discovered and reported by Marcin
Kopec at Data Reliance Shared Service Center.</p>
<p>RT 4.2.0 and above are vulnerable to a cross-site
scripting (XSS) attack via the cryptography interface.
This vulnerability could allow an attacker with a
carefully-crafted key to inject JavaScript into RT's user
interface. Installations which use neither GnuPG nor
S/MIME are unaffected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5475</cvename>
<cvename>CVE-2015-6506</cvename>
<url>http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html</url>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-08-12</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="09fff0d9-4126-11e5-9f01-14dae9d210b8">
<topic>py-foolscap -- local file inclusion</topic>
<affects>
<package>
<name>py27-foolscap</name>
<name>py32-foolscap</name>
<name>py33-foolscap</name>
<name>py34-foolscap</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brian Warner reports:</p>
<blockquote cite="https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS">
<p>The "flappserver" feature was found to have a vulnerability in the
service-lookup code which, when combined with an attacker who has the ability
to write files to a location where the flappserver process could read them,
would allow that attacker to obtain control of the flappserver process.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS</url>
<url>http://foolscap.lothar.com/trac/ticket/226</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="42c98cef-62b1-4b8b-9065-f4621e08d526">
<topic>libvpx -- out-of-bounds write</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.1.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>33.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.30</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.1.2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2014-77/">
<p>Using the Address Sanitizer tool, security researcher
Abhishek Arya (Inferno) of the Google Chrome Security Team
found an out-of-bounds write when buffering WebM format
video containing frames with invalid tile sizes. This can
lead to a potentially exploitable crash during WebM video
playback.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1578</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2014-77/</url>
<url>https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba</url>
</references>
<dates>
<discovery>2014-10-14</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="f3778328-d288-4b39-86a4-65877331eaf7">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.508</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.508</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-19.html">
<p>Adobe has released security updates for Adobe Flash Player.
These updates address critical vulnerabilities that could
potentially allow an attacker to take control of the affected
system.</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2015-5128, CVE-2015-5554,
CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).</p>
<p>These updates include further hardening to a mitigation
introduced in version 18.0.0.209 to defend against vector
length corruptions (CVE-2015-5125).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2015-5550, CVE-2015-5551,
CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134,
CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559,
CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124,
CVE-2015-5564).</p>
<p>These updates resolve heap buffer overflow vulnerabilities
that could lead to code execution (CVE-2015-5129,
CVE-2015-5541).</p>
<p>These updates resolve buffer overflow vulnerabilities that
could lead to code execution (CVE-2015-5131, CVE-2015-5132,
CVE-2015-5133).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-5544, CVE-2015-5545,
CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549,
CVE-2015-5552, CVE-2015-5553).</p>
<p>These updates resolve an integer overflow vulnerability that
could lead to code execution (CVE-2015-5560).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3107</cvename>
<cvename>CVE-2015-5124</cvename>
<cvename>CVE-2015-5125</cvename>
<cvename>CVE-2015-5127</cvename>
<cvename>CVE-2015-5128</cvename>
<cvename>CVE-2015-5129</cvename>
<cvename>CVE-2015-5130</cvename>
<cvename>CVE-2015-5131</cvename>
<cvename>CVE-2015-5132</cvename>
<cvename>CVE-2015-5133</cvename>
<cvename>CVE-2015-5134</cvename>
<cvename>CVE-2015-5539</cvename>
<cvename>CVE-2015-5540</cvename>
<cvename>CVE-2015-5541</cvename>
<cvename>CVE-2015-5544</cvename>
<cvename>CVE-2015-5545</cvename>
<cvename>CVE-2015-5546</cvename>
<cvename>CVE-2015-5547</cvename>
<cvename>CVE-2015-5548</cvename>
<cvename>CVE-2015-5549</cvename>
<cvename>CVE-2015-5550</cvename>
<cvename>CVE-2015-5551</cvename>
<cvename>CVE-2015-5552</cvename>
<cvename>CVE-2015-5553</cvename>
<cvename>CVE-2015-5554</cvename>
<cvename>CVE-2015-5555</cvename>
<cvename>CVE-2015-5556</cvename>
<cvename>CVE-2015-5557</cvename>
<cvename>CVE-2015-5558</cvename>
<cvename>CVE-2015-5559</cvename>
<cvename>CVE-2015-5560</cvename>
<cvename>CVE-2015-5561</cvename>
<cvename>CVE-2015-5562</cvename>
<cvename>CVE-2015-5563</cvename>
<cvename>CVE-2015-5564</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-19.html</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-12</entry>
</dates>
</vuln>
<vuln vid="34e60332-2448-4ed6-93f0-12713749f250">
<topic>libvpx -- multiple buffer overflows</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0.488</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-89/">
<p>Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team used the Address Sanitizer tool to
discover two buffer overflow issues in the Libvpx library
used for WebM video when decoding a malformed WebM video
file. These buffer overflows result in potentially
exploitable crashes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4485</cvename>
<cvename>CVE-2015-4486</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-89/</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-11</entry>
<modified>2015-08-14</modified>
</dates>
</vuln>
<vuln vid="c66a5632-708a-4727-8236-d65b2d5b2739">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><ge>2.36</ge><lt>2.37</lt></range>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><ge>2.36</ge><lt>2.37</lt></range>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.2.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.2.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.2.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0
/ rv:38.2)</p>
<p>MFSA 2015-80 Out-of-bounds read with malformed MP3
file</p>
<p>MFSA 2015-81 Use-after-free in MediaStream playback</p>
<p>MFSA 2015-82 Redefinition of non-configurable JavaScript object properties</p>
<p>MFSA 2015-83 Overflow issues in libstagefright</p>
<p>MFSA 2015-84 Arbitrary file overwriting through Mozilla
Maintenance Service with hard links</p>
<p>MFSA 2015-85 Out-of-bounds write with Updater and
malicious MAR file</p>
<p>MFSA 2015-86 Feed protocol with POST bypasses mixed
content protections</p>
<p>MFSA 2015-87 Crash when using shared memory in
JavaScript</p>
<p>MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling
bitmap images</p>
<p>MFSA 2015-90 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-91 Mozilla Content Security Policy allows for
asterisk wildcards in violation of CSP specification</p>
<p>MFSA 2015-92 Use-after-free in XMLHttpRequest with shared
workers</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4473</cvename>
<cvename>CVE-2015-4474</cvename>
<cvename>CVE-2015-4475</cvename>
<cvename>CVE-2015-4477</cvename>
<cvename>CVE-2015-4478</cvename>
<cvename>CVE-2015-4479</cvename>
<cvename>CVE-2015-4480</cvename>
<cvename>CVE-2015-4481</cvename>
<cvename>CVE-2015-4482</cvename>
<cvename>CVE-2015-4483</cvename>
<cvename>CVE-2015-4484</cvename>
<cvename>CVE-2015-4487</cvename>
<cvename>CVE-2015-4488</cvename>
<cvename>CVE-2015-4489</cvename>
<cvename>CVE-2015-4490</cvename>
<cvename>CVE-2015-4491</cvename>
<cvename>CVE-2015-4492</cvename>
<cvename>CVE-2015-4493</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-79/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-80/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-81/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-82/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-83/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-84/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-85/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-86/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-87/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-88/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-90/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-91/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-92/</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-11</entry>
<modified>2015-08-22</modified>
</dates>
</vuln>
<vuln vid="dd7f29cc-3ee9-11e5-93ad-002590263bf5">
<topic>lighttpd -- Log injection vulnerability in mod_auth</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3200">
<p>mod_auth in lighttpd before 1.4.36 allows remote attackers to
inject arbitrary log entries via a basic HTTP authentication string
without a colon character, as demonstrated by a string containing a
NULL and new line character.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3200</cvename>
<url>http://redmine.lighttpd.net/issues/2646</url>
</references>
<dates>
<discovery>2015-05-25</discovery>
<entry>2015-08-10</entry>
</dates>
</vuln>
<vuln vid="ff0acfb4-3efa-11e5-93ad-002590263bf5">
<topic>pcre -- heap overflow vulnerability in '(?|' situations</topic>
<affects>
<package>
<name>pcre</name>
<range><le>8.37_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1667">
<p>PCRE library is prone to a vulnerability which leads to Heap
Overflow. During the compilation of a malformed regular expression,
more data is written on the malloced block than the expected size
output by compile_regex. Exploits with advanced Heap Fengshui
techniques may allow an attacker to execute arbitrary code in the
context of the user running the affected application.</p>
<p>Latest version of PCRE is prone to a Heap Overflow vulnerability
which could caused by the following regular expression.</p>
<p>/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/202209</freebsdpr>
<url>https://bugs.exim.org/show_bug.cgi?id=1667</url>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2015-08-10</entry>
</dates>
</vuln>
<vuln vid="8eee06d4-c21d-4f07-a669-455151ff426f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>39.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>39.0.3,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.1.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-78 Same origin violation and local file
stealing via PDF reader</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4495</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-78/</url>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2015-08-07</entry>
</dates>
</vuln>
<vuln vid="ac5ec8e3-3c6c-11e5-b921-00a0986f28c4">
<topic>wordpress -- Multiple vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.4,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/">
<p>WordPress 4.2.4 fixes three cross-site scripting vulnerabilities
and a potential SQL injection that could be used to compromise a
site.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/</url>
<cvename>CVE-2015-2213</cvename>
<cvename>CVE-2015-5730</cvename>
<cvename>CVE-2015-5731</cvename>
<cvename>CVE-2015-5732</cvename>
<cvename>CVE-2015-5733</cvename>
<cvename>CVE-2015-5734</cvename>
</references>
<dates>
<discovery>2015-08-04</discovery>
<entry>2015-08-06</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="57bb5e3d-3c4f-11e5-a4d4-001e8c75030d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.8.0</ge><lt>1.8.14</lt></range>
<range><ge>1.7.0</ge><lt>1.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion reports:</p>
<blockquote cite="http://svn.haxx.se/dev/archive-2015-08/0024.shtml">
<p>CVE-2015-3184:<br/>
Subversion's mod_authz_svn does not properly restrict anonymous access
in some mixed anonymous/authenticated environments when
using Apache httpd 2.4.</p>
<p>CVE-2015-3187:<br/>
Subversion servers, both httpd and svnserve, will reveal some
paths that should be hidden by path-based authz.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3184</cvename>
<url>http://subversion.apache.org/security/CVE-2015-3184-advisory.txt</url>
<cvename>CVE-2015-3187</cvename>
<url>http://subversion.apache.org/security/CVE-2015-3187-advisory.txt</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-08-06</entry>
</dates>
</vuln>
<vuln vid="ae8c09cb-32da-11e5-a4a5-002590263bf5">
<topic>elasticsearch -- directory traversal attack via snapshot API</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.0.0</ge><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0
are vulnerable to a directory traversal attack.</p>
<p>Remediation Summary: Users should upgrade to 1.6.1 or later, or
constrain access to the snapshot API to trusted sources.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5531</cvename>
<freebsdpr>ports/201834</freebsdpr>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-16</discovery>
<entry>2015-08-05</entry>
</dates>
</vuln>
<vuln vid="fb3668df-32d7-11e5-a4a5-002590263bf5">
<topic>elasticsearch -- remote code execution via transport protocol</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are
vulnerable to an attack that can result in remote code execution.</p>
<p>Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0.
Alternately, ensure that only trusted applications have access to
the transport protocol port.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5377</cvename>
<freebsdpr>ports/201834</freebsdpr>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-16</discovery>
<entry>2015-08-05</entry>
</dates>
</vuln>
<vuln vid="da451130-365d-11e5-a4a5-002590263bf5">
<topic>qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><le>0.11.1_20</le></range>
<range><ge>0.12</ge><le>2.3.0_2</le></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-138.html">
<p>A heap overflow flaw was found in the way QEMU's IDE subsystem
handled I/O buffer access while processing certain ATAPI
commands.</p>
<p>A privileged guest user in a guest with CDROM drive enabled could
potentially use this flaw to execute arbitrary code on the host
with the privileges of the host's QEMU process corresponding to
the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5154</cvename>
<url>http://xenbits.xen.org/xsa/advisory-138.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-08-04</entry>
<modified>2015-08-19</modified>
</dates>
</vuln>
<vuln vid="4622635f-37a1-11e5-9970-14dae9d210b8">
<topic>net-snmp -- snmptrapd crash</topic>
<affects>
<package>
<name>net-snmp</name>
<range><ge>5.7.0</ge><le>5.7.2.1</le></range>
<range><ge>5.6.0</ge><le>5.6.2.1</le></range>
<range><ge>5.5.0</ge><le>5.5.2.1</le></range>
<range><ge>5.4.0</ge><le>5.4.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Murray McAllister reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q3/473">
<p>A remote denial-of-service flaw was found in the way
snmptrapd handled certain SNMP traps when started with the
"-OQ" option. If an attacker sent an SNMP trap containing a
variable with a NULL type where an integer variable type was
expected, it would cause snmptrapd to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q3/473</url>
<url>http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/</url>
<url>https://sourceforge.net/p/net-snmp/official-patches/48/</url>
<cvename>CVE-2014-3565</cvename>
</references>
<dates>
<discovery>2014-07-31</discovery>
<entry>2015-07-31</entry>
</dates>
</vuln>
<vuln vid="381183e8-3798-11e5-9970-14dae9d210b8">
<topic>net-snmp -- snmp_pdu_parse() function incomplete initialization</topic>
<affects>
<package>
<name>net-snmp</name>
<range><le>5.7.3_7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qinghao Tang reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/116">
<p>Incompletely initialized vulnerability exists in the function
‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory
leak, DOS and possible command executions by sending malicious packets.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q2/116</url>
<url>http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1212408</url>
<cvename>CVE-2015-5621</cvename>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-07-31</entry>
</dates>
</vuln>
<vuln vid="731cdeaa-3564-11e5-9970-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.2P3</lt></range>
</package>
<package>
<name>bind99</name>
<range><lt>9.9.7P2</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_21</lt></range>
<range><ge>8.4</ge><lt>8.4_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01272/">
<p>An error in the handling of TKEY queries can be exploited
by an attacker for use as a denial-of-service vector, as a constructed
packet can use the defect to trigger a REQUIRE assertion failure,
causing BIND to exit.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:17.bind</freebsdsa>
<cvename>CVE-2015-5477</cvename>
<url>https://kb.isc.org/article/AA-01272/</url>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="5b74a5bc-348f-11e5-ba05-c80aa9043978">
<topic>OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>6.9.p1_2,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
<range><ge>9.3</ge><lt>9.3_21</lt></range>
<range><ge>8.4</ge><lt>8.4_36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://access.redhat.com/security/cve/CVE-2015-5600">
<p>It was discovered that the OpenSSH sshd daemon did not check the
list of keyboard-interactive authentication methods for duplicates.
A remote attacker could use this flaw to bypass the MaxAuthTries
limit, making it easier to perform password guessing attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/CVE-2015-5600</url>
<cvename>CVE-2015-5600</cvename>
<freebsdsa>SA-15:16.openssh</freebsdsa>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="c470bcc7-33fe-11e5-a4a5-002590263bf5">
<topic>logstash -- SSL/TLS vulnerability with Lumberjack input</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.4</lt></range>
<range><ge>1.5.0</ge><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Logstash versions prior to 1.5.2 that
use Lumberjack input (in combination with Logstash Forwarder agent)
are vulnerable to a SSL/TLS security issue called the FREAK attack.
This allows an attacker to intercept communication and access secure
data. Users should upgrade to 1.5.3 or 1.4.4.</p>
<p>Remediation Summary: Users that do not want to upgrade can address
the vulnerability by disabling the Lumberjack input.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5378</cvename>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-07-22</discovery>
<entry>2015-07-27</entry>
</dates>
</vuln>
<vuln vid="9d732078-32c7-11e5-b263-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>44.0.2403.89</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>44.0.2403.89</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>44.0.2403.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>43 security fixes in this release, including:</p>
<ul>
<li>[446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium.
Credit to cloudfuzzer.</li>
<li>[459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium.
Credit to makosoft.</li>
<li>[461858] High CVE-2015-1274: Settings allowed executable files
to run immediately after download. Credit to andrewm.bpi.</li>
<li>[462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit
to WangTao(neobyte) of Baidu X-Team.</li>
<li>[472614] High CVE-2015-1276: Use-after-free in IndexedDB.
Credit to Collin Payne.</li>
<li>[483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium.
Credit to mlafon.</li>
<li>[486947] High CVE-2015-1280: Memory corruption in skia. Credit
to cloudfuzzer.</li>
<li>[487155] High CVE-2015-1281: CSP bypass. Credit to Masato
Kinugawa.</li>
<li>[487928] High CVE-2015-1282: Use-after-free in pdfium. Credit
to Chamal de Silva.</li>
<li>[492052] High CVE-2015-1283: Heap-buffer-overflow in expat.
Credit to sidhpurwala.huzaifa.</li>
<li>[493243] High CVE-2015-1284: Use-after-free in blink. Credit to
Atte Kettunen of OUSPG.</li>
<li>[504011] High CVE-2015-1286: UXSS in blink. Credit to
anonymous.</li>
<li>[505374] High CVE-2015-1290: Memory corruption in V8. Credit to
Yongjun Liu of NSFOCUS Security Team.</li>
<li>[419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to
filedescriptor.</li>
<li>[444573] Medium CVE-2015-1270: Uninitialized memory read in
ICU. Credit to Atte Kettunen of OUSPG.</li>
<li>[451456] Medium CVE-2015-1272: Use-after-free related to
unexpected GPU process termination. Credit to Chamal de
Silva.</li>
<li>[479743] Medium CVE-2015-1277: Use-after-free in accessibility.
Credit to SkyLined.</li>
<li>[482380] Medium CVE-2015-1278: URL spoofing using pdf files.
Credit to Chamal de Silva.</li>
<li>[498982] Medium CVE-2015-1285: Information leak in XSS auditor.
Credit to gazheyes.</li>
<li>[479162] Low CVE-2015-1288: Spell checking dictionaries fetched
over HTTP. Credit to mike@michaelruddy.com.</li>
<li>[512110] CVE-2015-1289: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1270</cvename>
<cvename>CVE-2015-1271</cvename>
<cvename>CVE-2015-1272</cvename>
<cvename>CVE-2015-1273</cvename>
<cvename>CVE-2015-1274</cvename>
<cvename>CVE-2015-1275</cvename>
<cvename>CVE-2015-1276</cvename>
<cvename>CVE-2015-1277</cvename>
<cvename>CVE-2015-1278</cvename>
<cvename>CVE-2015-1279</cvename>
<cvename>CVE-2015-1280</cvename>
<cvename>CVE-2015-1281</cvename>
<cvename>CVE-2015-1282</cvename>
<cvename>CVE-2015-1283</cvename>
<cvename>CVE-2015-1284</cvename>
<cvename>CVE-2015-1285</cvename>
<cvename>CVE-2015-1286</cvename>
<cvename>CVE-2015-1287</cvename>
<cvename>CVE-2015-1288</cvename>
<cvename>CVE-2015-1289</cvename>
<cvename>CVE-2015-1290</cvename>
<url>http://googlechromereleases.blogspot.nl/</url>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-25</entry>
</dates>
</vuln>
<vuln vid="b202e4ce-3114-11e5-aa32-0026551a22dc">
<topic>shibboleth-sp -- DoS vulnerability</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.5.5</lt></range>
</package>
<package>
<name>opensaml2</name>
<range><lt>2.5.5</lt></range>
</package>
<package>
<name>shibboleth-sp</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="http://shibboleth.net/community/advisories/secadv_20150721.txt">
<p>
Shibboleth SP software crashes on well-formed but invalid XML.
</p>
<p>
The Service Provider software contains a code path with an uncaught
exception that can be triggered by an unauthenticated attacker by
supplying well-formed but schema-invalid XML in the form of SAML
metadata or SAML protocol messages. The result is a crash and so
causes a denial of service.
</p>
<p>
You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or
later. The easiest way to do so is to update the whole chain including
shibboleth-2.5.5 an opensaml2.5.5.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://shibboleth.net/community/advisories/secadv_20150721.txt</url>
<cvename>CVE-2015-2684</cvename>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="c80b27a2-3165-11e5-8a1d-14dae9d210b8">
<topic>wordpress -- XSS vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/07/wordpress-4-2-3/">
<p>WordPress versions 4.2.2 and earlier are affected by a
cross-site scripting vulnerability, which could allow users with the
Contributor or Author role to compromise a site. This was reported by
Jon Cave and fixed by Robert Chapin, both of the WordPress security
team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/07/wordpress-4-2-3/</url>
<cvename>CVE-2015-5622</cvename>
<cvename>CVE-2015-5623</cvename>
</references>
<dates>
<discovery>2015-07-23</discovery>
<entry>2015-07-23</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="4caf01e2-30e6-11e5-a4a5-002590263bf5">
<topic>libidn -- out-of-bounds read issue with invalid UTF-8 input</topic>
<affects>
<package>
<name>libidn</name>
<range><lt>1.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Josefsson reports:</p>
<blockquote cite="http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31">
<p>stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function
has always been documented to not validate that the input UTF-8
string is actually valid UTF-8...
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2059</cvename>
<url>http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31</url>
</references>
<dates>
<discovery>2015-02-09</discovery>
<entry>2015-07-23</entry>
<modified>2015-08-03</modified>
</dates>
</vuln>
<vuln vid="9dd761ff-30cb-11e5-a4a5-002590263bf5">
<topic>sox -- memory corruption vulnerabilities</topic>
<affects>
<package>
<name>sox</name>
<range><le>14.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michele Spagnuolo, Google Security Team, reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/167">
<p>The write heap buffer overflows are related to ADPCM handling in
WAV files, while the read heap buffer overflow is while opening a
.VOC.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/167</url>
</references>
<dates>
<discovery>2015-07-22</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="92cda470-30cb-11e5-a4a5-002590263bf5">
<topic>sox -- input sanitization errors</topic>
<affects>
<package>
<name>sox</name>
<range><lt>14.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-010.html">
<p>The sox command line tool is affected by two heap-based buffer
overflows, respectively located in functions start_read() and
AdpcmReadBlock().</p>
<p>A specially crafted wav file can be used to trigger the
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<bid>71774</bid>
<cvename>CVE-2014-8145</cvename>
<url>http://www.ocert.org/advisories/ocert-2014-010.html</url>
</references>
<dates>
<discovery>2014-11-20</discovery>
<entry>2015-07-23</entry>
</dates>
</vuln>
<vuln vid="95eee71d-3068-11e5-a9b5-bcaec565249c">
<topic>gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gustavo.grieco@imag.fr reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=752297">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of a malformed bmp.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=752297</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-22</entry>
</dates>
</vuln>
<vuln vid="8a1d0e63-1e07-11e5-b43d-002590263bf5">
<topic>pcre -- Heap Overflow Vulnerability in find_fixedlength()</topic>
<affects>
<package>
<name>pcre</name>
<range><le>8.37_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1651">
<p>PCRE library is prone to a vulnerability which leads to Heap
Overflow. During subpattern calculation of a malformed regular
expression, an offset that is used as an array index is fully
controlled and can be large enough so that unexpected heap
memory regions are accessed.</p>
<p>One could at least exploit this issue to read objects nearby of
the affected application's memory.</p>
<p>Such information disclosure may also be used to bypass memory
protection method such as ASLR.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5073</cvename>
<url>https://bugs.exim.org/show_bug.cgi?id=1651</url>
<url>http://vcs.pcre.org/pcre?view=revision&revision=1571</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/1</mlist>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-06-29</entry>
</dates>
</vuln>
<vuln vid="0bfda05f-2e6f-11e5-a4a5-002590263bf5">
<topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8e.php">
<p>Important Security Fixes</p>
<ul>
<li>Multiple XSS and SQL injection vulnerabilities</li>
<li>CVE-2015-4634 - SQL injection in graphs.php</li>
</ul>
<p>Changelog</p>
<ul>
<li>bug: Fixed various SQL Injection vectors</li>
<li>bug#0002574: SQL Injection Vulnerabilities in graph items and
graph template items</li>
<li>bug#0002577: CVE-2015-4634 - SQL injection in graphs.php</li>
<li>bug#0002579: SQL Injection Vulnerabilities in data sources</li>
<li>bug#0002580: SQL Injection in cdef.php</li>
<li>bug#0002582: SQL Injection in data_templates.php</li>
<li>bug#0002583: SQL Injection in graph_templates.php</li>
<li>bug#0002584: SQL Injection in host_templates.php</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4634</cvename>
<freebsdpr>ports/201702</freebsdpr>
<url>http://www.cacti.net/release_notes_0_8_8e.php</url>
<mlist>http://seclists.org/oss-sec/2015/q3/150</mlist>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-20</entry>
</dates>
</vuln>
<vuln vid="8b1f53f3-2da5-11e5-86ff-14dae9d210b8">
<topic>php-phar -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php56-phar</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-phar</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-phar</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/141">
<p>Segfault in Phar::convertToData on invalid file.</p>
<p>Buffer overflow and stack smashing error in phar_fix_filepath.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://seclists.org/oss-sec/2015/q3/141</mlist>
<url>https://bugs.php.net/bug.php?id=69958</url>
<url>http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf</url>
<url>https://bugs.php.net/bug.php?id=69923</url>
<url>http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f</url>
<cvename>CVE-2015-5589</cvename>
<cvename>CVE-2015-5590</cvename>
</references>
<dates>
<discovery>2015-06-24</discovery>
<entry>2015-07-18</entry>
<modified>2015-12-18</modified>
</dates>
</vuln>
<vuln vid="43891162-2d5e-11e5-a4a5-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.9</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.7</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/94">
<p>MSA-15-0026: Possible phishing when redirecting to external site
using referer header. (CVE-2015-3272)</p>
<p>MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not
respected when using 'Post a copy to all groups' in forum
(CVE-2015-3273)</p>
<p>MSA-15-0028: Possible XSS through custom text profile fields in Web
Services (CVE-2015-3274)</p>
<p>MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3272</cvename>
<cvename>CVE-2015-3273</cvename>
<cvename>CVE-2015-3274</cvename>
<cvename>CVE-2015-3275</cvename>
<mlist>http://seclists.org/oss-sec/2015/q3/94</mlist>
<url>https://docs.moodle.org/dev/Moodle_2.7.9_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.7_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.1_release_notes</url>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-07-18</entry>
<modified>2015-07-19</modified>
</dates>
</vuln>
<vuln vid="29083f8e-2ca8-11e5-86ff-14dae9d210b8">
<topic>apache22 -- chunk header parsing defect</topic>
<affects>
<package>
<name>apache22</name>
<name>apache22-event-mpm</name>
<name>apache22-itk-mpm</name>
<name>apache22-peruser-mpm</name>
<name>apache22-worker-mpm</name>
<range><le>2.2.29_5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Foundation reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.2.html">
<p>CVE-2015-3183 core: Fix chunk header parsing defect. Remove
apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN
filter, parse chunks in a single pass with zero copy. Limit accepted
chunk-size to 2^63-1 and be strict about chunk-ext authorized
characters.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache.org/dist/httpd/Announcement2.2.html</url>
<url>https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e</url>
<cvename>CVE-2015-3183</cvename>
</references>
<dates>
<discovery>2015-06-24</discovery>
<entry>2015-07-17</entry>
</dates>
</vuln>
<vuln vid="5c399624-2bef-11e5-86ff-14dae9d210b8">
<topic>zenphoto -- multiple vulnerabilities</topic>
<affects>
<package>
<name>zenphoto</name>
<range><lt>1.4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zenphoto reports:</p>
<blockquote cite="http://www.zenphoto.org/news/zenphoto-1.4.9">
<p>Fixes several SQL Injection, XSS and path traversal
security issues</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.zenphoto.org/news/zenphoto-1.4.9</url>
<mlist>http://seclists.org/oss-sec/2015/q3/123</mlist>
<url>https://github.com/zenphoto/zenphoto/pull/935</url>
<cvename>CVE-2015-5591</cvename>
<cvename>CVE-2015-5592</cvename>
<cvename>CVE-2015-5593</cvename>
<cvename>CVE-2015-5594</cvename>
<cvename>CVE-2015-5595</cvename>
</references>
<dates>
<discovery>2015-05-24</discovery>
<entry>2015-07-16</entry>
<modified>2015-07-18</modified>
</dates>
</vuln>
<vuln vid="67b3fef2-2bea-11e5-86ff-14dae9d210b8">
<topic>groovy -- remote execution of untrusted code</topic>
<affects>
<package>
<name>groovy</name>
<range><ge>1.7.0</ge><lt>2.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cédric Champeau reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/121">
<p>Description</p>
<p>When an application has Groovy on the classpath and that
it uses standard Java serialization mechanism to communicate
between servers, or to store local data, it is possible for
an attacker to bake a special serialized object that will
execute code directly when deserialized. All applications
which rely on serialization and do not isolate the code which
deserializes objects are subject to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://seclists.org/oss-sec/2015/q3/121</mlist>
<url>http://groovy-lang.org/security.html</url>
<url>https://issues.apache.org/jira/browse/GROOVY-7504</url>
<cvename>CVE-2015-3253</cvename>
</references>
<dates>
<discovery>2015-07-09</discovery>
<entry>2015-07-16</entry>
</dates>
</vuln>
<vuln vid="a928960a-2bdc-11e5-86ff-14dae9d210b8">
<topic>libav -- divide by zero</topic>
<affects>
<package>
<name>libav</name>
<range><le>11.3_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Agostino Sarubbo reports:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/">
<p>libav: divide-by-zero in ff_h263_decode_mba()</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/</url>
<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f</url>
<cvename>CVE-2015-5479</cvename>
</references>
<dates>
<discovery>2015-06-21</discovery>
<entry>2015-07-16</entry>
</dates>
</vuln>
<vuln vid="44d9daee-940c-4179-86bb-6e3ffd617869">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>39.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>39.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<!-- seamonkey-2.35 milestone.txt: 38.2.0esrpre -->
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.8.0,1</lt></range>
<range><ge>38.0,1</ge><lt>38.1.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.8.0</lt></range>
<range><ge>38.0</ge><lt>38.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0
/ rv:31.8 / rv:38.1)</p>
<p>MFSA 2015-60 Local files or privileged URLs in pages can
be opened into new tabs</p>
<p>MFSA 2015-61 Type confusion in Indexed Database
Manager</p>
<p>MFSA 2015-62 Out-of-bound read while computing an
oscillator rendering range in Web Audio</p>
<p>MFSA 2015-63 Use-after-free in Content Policy due to
microtask execution error</p>
<p>MFSA 2015-64 ECDSA signature validation fails to handle
some signatures correctly</p>
<p>MFSA 2015-65 Use-after-free in workers while using
XMLHttpRequest</p>
<p>MFSA 2015-66 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-67 Key pinning is ignored when overridable
errors are encountered</p>
<p>MFSA 2015-68 OS X crash reports may contain entered key
press information</p>
<p>MFSA 2015-69 Privilege escalation through internal
workers</p>
<p>MFSA 2015-70 NSS accepts export-length DHE keys with
regular DHE cipher suites</p>
<p>MFSA 2015-71 NSS incorrectly permits skipping of
ServerKeyExchange</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2721</cvename>
<cvename>CVE-2015-2722</cvename>
<cvename>CVE-2015-2724</cvename>
<cvename>CVE-2015-2725</cvename>
<cvename>CVE-2015-2726</cvename>
<cvename>CVE-2015-2727</cvename>
<cvename>CVE-2015-2728</cvename>
<cvename>CVE-2015-2729</cvename>
<cvename>CVE-2015-2730</cvename>
<cvename>CVE-2015-2731</cvename>
<cvename>CVE-2015-2733</cvename>
<cvename>CVE-2015-2734</cvename>
<cvename>CVE-2015-2735</cvename>
<cvename>CVE-2015-2736</cvename>
<cvename>CVE-2015-2737</cvename>
<cvename>CVE-2015-2738</cvename>
<cvename>CVE-2015-2739</cvename>
<cvename>CVE-2015-2740</cvename>
<cvename>CVE-2015-2741</cvename>
<cvename>CVE-2015-2742</cvename>
<cvename>CVE-2015-2743</cvename>
<cvename>CVE-2015-4000</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-59/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-60/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-61/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-62/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-63/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-64/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-65/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-66/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-67/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-68/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-69/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-70/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-71/</url>
</references>
<dates>
<discovery>2015-07-02</discovery>
<entry>2015-07-16</entry>
<modified>2015-09-22</modified>
</dates>
</vuln>
<vuln vid="d3216606-2b47-11e5-a668-080027ef73ec">
<topic>PolarSSL -- Security Fix Backports</topic>
<affects>
<package>
<name>polarssl</name>
<range><lt>1.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Bakker reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released">
<p>PolarSSL 1.2.14 fixes one remotely-triggerable issues that was
found by the Codenomicon Defensics tool, one potential remote crash
and countermeasures against the "Lucky 13 strikes back" cache-based
attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="ca139c7f-2a8c-11e5-a4a5-002590263bf5">
<topic>libwmf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libwmf</name>
<range><lt>0.2.8.4_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0941">
<p>Multiple buffer overflows in the gd graphics library (libgd) 2.0.21
and earlier may allow remote attackers to execute arbitrary code via
malformed image files that trigger the overflows due to improper
calls to the gdMalloc function, a different set of vulnerabilities
than CVE-2004-0990.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0455">
<p>Buffer overflow in the gdImageStringFTEx function in gdft.c in GD
Graphics Library 2.0.33 and earlier allows remote attackers to cause
a denial of service (application crash) and possibly execute
arbitrary code via a crafted string with a JIS encoded font.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756">
<p>The gdPngReadData function in libgd 2.0.34 allows user-assisted
attackers to cause a denial of service (CPU consumption) via a
crafted PNG image with truncated data, which causes an infinite loop
in the png_read_info function in libpng.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472">
<p>Integer overflow in gdImageCreateTrueColor function in the GD
Graphics Library (libgd) before 2.0.35 allows user-assisted remote
attackers to have unspecified attack vectors and impact.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473">
<p>The gdImageCreateXbm function in the GD Graphics Library (libgd)
before 2.0.35 allows user-assisted remote attackers to cause a
denial of service (crash) via unspecified vectors involving a
gdImageCreate failure.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477">
<p>The (a) imagearc and (b) imagefilledarc functions in GD Graphics
Library (libgd) before 2.0.35 allow attackers to cause a denial of
service (CPU consumption) via a large (1) start or (2) end angle
degree value.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546">
<p>The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before
5.3.1, and the GD Graphics Library 2.x, does not properly verify a
certain colorsTotal structure member, which might allow remote
attackers to conduct buffer overflow or buffer over-read attacks via
a crafted GD file, a different vulnerability than CVE-2009-3293.
NOTE: some of these details are obtained from third party
information.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0848">
<p>Heap-based buffer overflow in libwmf 0.2.8.4 allows remote
attackers to cause a denial of service (crash) or possibly execute
arbitrary code via a crafted BMP image.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4695">
<p>meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial
of service (out-of-bounds read) via a crafted WMF file.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4696">
<p>Use-after-free vulnerability in libwmf 0.2.8.4 allows remote
attackers to cause a denial of service (crash) via a crafted WMF
file to the (1) wmf2gd or (2) wmf2eps command.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4588">
<p>Heap-based buffer overflow in the DecodeImage function in libwmf
0.2.8.4 allows remote attackers to cause a denial of service (crash)
or possibly execute arbitrary code via a crafted "run-length count"
in an image in a WMF file.</p>
</blockquote>
</body>
</description>
<references>
<bid>11663</bid>
<bid>22289</bid>
<bid>24089</bid>
<bid>24651</bid>
<bid>36712</bid>
<freebsdpr>ports/201513</freebsdpr>
<cvename>CVE-2004-0941</cvename>
<cvename>CVE-2007-0455</cvename>
<cvename>CVE-2007-2756</cvename>
<cvename>CVE-2007-3472</cvename>
<cvename>CVE-2007-3473</cvename>
<cvename>CVE-2007-3477</cvename>
<cvename>CVE-2009-3546</cvename>
<cvename>CVE-2015-0848</cvename>
<cvename>CVE-2015-4695</cvename>
<cvename>CVE-2015-4696</cvename>
<cvename>CVE-2015-4588</cvename>
</references>
<dates>
<discovery>2004-10-12</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="a12494c1-2af4-11e5-86ff-14dae9d210b8">
<topic>apache24 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jim Jagielski reports:</p>
<blockquote cite="https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E">
<p>CVE-2015-3183 (cve.mitre.org)
core: Fix chunk header parsing defect.
Remove apr_brigade_flatten(), buffering and duplicated code from
the HTTP_IN filter, parse chunks in a single pass with zero copy.
Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext
authorized characters.</p>
<p>CVE-2015-3185 (cve.mitre.org)
Replacement of ap_some_auth_required (unusable in Apache httpd 2.4)
with new ap_some_authn_required and ap_force_authn hook.</p>
<p>CVE-2015-0253 (cve.mitre.org)
core: Fix a crash with ErrorDocument 400 pointing to a local URL-path
with the INCLUDES filter active, introduced in 2.4.11. PR 57531.</p>
<p>CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script
calls r:wsupgrade() can cause a child process crash.</p>
</blockquote>
</body>
</description>
<references>
<mlist>https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E</mlist>
<cvename>CVE-2015-3183</cvename>
<cvename>CVE-2015-3185</cvename>
<cvename>CVE-2015-0253</cvename>
<cvename>CVE-2015-0228</cvename>
</references>
<dates>
<discovery>2015-02-04</discovery>
<entry>2015-07-15</entry>
</dates>
</vuln>
<vuln vid="8d2d6bbd-2a02-11e5-a0af-bcaec565249c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.491</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.491</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-18.html">
<p>Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have
been identified. Successful exploitation could cause a crash
and potentially allow an attacker to take control of the
affected system. Adobe is aware of reports that exploits
targeting these vulnerabilities have been published publicly.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5122</cvename>
<cvename>CVE-2015-5123</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-18.html</url>
</references>
<dates>
<discovery>2015-07-10</discovery>
<entry>2015-07-14</entry>
<modified>2015-07-16</modified>
</dates>
</vuln>
<vuln vid="3d39e927-29a2-11e5-86ff-14dae9d210b8">
<topic>php -- use-after-free vulnerability</topic>
<affects>
<package>
<name>php56-sqlite3</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-sqlite3</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-sqlite3</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Symeon Paraschoudis reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69972">
<p>Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69972</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="af7fbd91-29a1-11e5-86ff-14dae9d210b8">
<topic>php -- use-after-free vulnerability</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Symeon Paraschoudis reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69970">
<p>Use-after-free vulnerability in spl_recursive_it_move_forward_ex()</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69970</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="5a1d5d74-29a0-11e5-86ff-14dae9d210b8">
<topic>php -- arbitrary code execution</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cmb reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=69768">
<p>When delayed variable substitution is enabled (can be set in the
Registry, for instance), !ENV! works similar to %ENV%, and the
value of the environment variable ENV will be subsituted.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69768</url>
</references>
<dates>
<discovery>2015-06-07</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="36bd352d-299b-11e5-86ff-14dae9d210b8">
<topic>mysql -- SSL Downgrade</topic>
<affects>
<package>
<name>php56-mysql</name>
<name>php56-mysqli</name>
<range><lt>5.6.11</lt></range>
</package>
<package>
<name>php55-mysql</name>
<name>php55-mysqli</name>
<range><lt>5.5.27</lt></range>
</package>
<package>
<name>php5-mysql</name>
<name>php5-mysqli</name>
<range><lt>5.4.43</lt></range>
</package>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.44</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Duo Security reports:</p>
<blockquote cite="https://www.duosecurity.com/blog/backronym-mysql-vulnerability">
<p>Researchers have identified a serious vulnerability in some
versions of Oracle’s MySQL database product that allows an attacker to
strip SSL/TLS connections of their security wrapping transparently.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69669</url>
<url>https://www.duosecurity.com/blog/backronym-mysql-vulnerability</url>
<url>http://www.ocert.org/advisories/ocert-2015-003.html</url>
<url>https://mariadb.atlassian.net/browse/MDEV-7937</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/</url>
<cvename>CVE-2015-3152</cvename>
</references>
<dates>
<discovery>2015-03-20</discovery>
<entry>2015-07-13</entry>
<modified>2015-07-18</modified>
</dates>
</vuln>
<vuln vid="81326883-2905-11e5-a4a5-002590263bf5">
<topic>devel/ipython -- CSRF possible remote execution vulnerability</topic>
<affects>
<package>
<name>ipython</name>
<range><ge>0.12</ge><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kyle Kelley reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/92">
<p>Summary: POST requests exposed via the IPython REST API are
vulnerable to cross-site request forgery (CSRF). Web pages on
different domains can make non-AJAX POST requests to known IPython
URLs, and IPython will honor them. The user's browser will
automatically send IPython cookies along with the requests. The
response is blocked by the Same-Origin Policy, but the request
isn't.</p>
<p>API paths with issues:</p>
<ul>
<li>POST /api/contents/<path>/<file></li>
<li>POST /api/contents/<path>/<file>/checkpoints</li>
<li>POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id></li>
<li>POST /api/kernels</li>
<li>POST /api/kernels/<kernel_id>/<action></li>
<li>POST /api/sessions</li>
<li>POST /api/clusters/<cluster_id>/<action></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5607</cvename>
<url>http://seclists.org/oss-sec/2015/q3/92</url>
<url>http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1</url>
</references>
<dates>
<discovery>2015-07-12</discovery>
<entry>2015-07-13</entry>
<modified>2015-07-22</modified>
</dates>
</vuln>
<vuln vid="379788f3-2900-11e5-a4a5-002590263bf5">
<topic>freeradius -- insufficient CRL application vulnerability</topic>
<affects>
<package>
<name>freeradius2</name>
<range><lt>2.2.8</lt></range>
</package>
<package>
<name>freeradius3</name>
<range><lt>3.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-008.html">
<p>The FreeRADIUS server relies on OpenSSL to perform certificate
validation, including Certificate Revocation List (CRL) checks. The
FreeRADIUS usage of OpenSSL, in CRL application, limits the checks
to leaf certificates, therefore not detecting revocation of
intermediate CA certificates.</p>
<p>An unexpired client certificate, issued by an intermediate CA with
a revoked certificate, is therefore accepted by FreeRADIUS.</p>
<p>Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf
certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL
for CRL checks on the complete trust chain.</p>
<p>The FreeRADIUS project advises that the recommended configuration
is to use self-signed CAs for all EAP-TLS methods.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4680</cvename>
<freebsdpr>ports/201058</freebsdpr>
<freebsdpr>ports/201059</freebsdpr>
<url>http://www.ocert.org/advisories/ocert-2015-008.html</url>
<url>http://freeradius.org/security.html</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-07-13</entry>
</dates>
</vuln>
<vuln vid="f1deed23-27ec-11e5-a4a5-002590263bf5">
<topic>xen-tools -- xl command line config handling stack overflow</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.0_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-137.html">
<p>The xl command line utility mishandles long configuration values
when passed as command line arguments, with a buffer overrun.</p>
<p>A semi-trusted guest administrator or controller, who is intended
to be able to partially control the configuration settings for a
domain, can escalate their privileges to that of the whole host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3259</cvename>
<url>http://xenbits.xen.org/xsa/advisory-137.html</url>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="8c31b288-27ec-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- vulnerability in the iret hypercall handler</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.1</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-136.html">
<p>A buggy loop in Xen's compat_iret() function iterates the wrong way
around a 32-bit index. Any 32-bit PV guest kernel can trigger this
vulnerability by attempting a hypercall_iret with EFLAGS.VM set.</p>
<p>Given the use of __get/put_user(), and that the virtual addresses
in question are contained within the lower canonical half, the guest
cannot clobber any hypervisor data. Instead, Xen will take up to
2^33 pagefaults, in sequence, effectively hanging the host.</p>
<p>Malicious guest administrators can cause a denial of service
affecting the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4164</cvename>
<url>http://xenbits.xen.org/xsa/advisory-136.html</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="80e846ff-27eb-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.2</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-134.html">
<p>With the introduction of version 2 grant table operations, a
version check became necessary for most grant table related
hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a
check. As a result, the subsequent code behaved as if version 2 was
in use, when a guest issued this hypercall without a prior
GNTTABOP_setup_table or GNTTABOP_set_version.</p>
<p>The effect is a possible NULL pointer dereferences. However, this
cannot be exploited to elevate privileges of the attacking domain,
as the maximum memory address that can be wrongly accessed this way
is bounded to far below the start of hypervisor memory.</p>
<p>Malicious or buggy guest domain kernels can mount a denial of
service attack which, if successful, can affect the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4163</cvename>
<url>http://xenbits.xen.org/xsa/advisory-134.html</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="ce658051-27ea-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.0</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-132.html">
<p>The handler for XEN_DOMCTL_gettscinfo failed to initialize a
padding field subsequently copied to guest memory.</p>
<p>A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is
being addressed here regardless of that operation being declared
unsafe for disaggregation by XSA-77.</p>
<p>Malicious or buggy stub domain kernels or tool stacks otherwise
living outside of Domain0 may be able to read sensitive data
relating to the hypervisor or other guests not under the control of
that domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3340</cvename>
<url>http://xenbits.xen.org/xsa/advisory-132.html</url>
</references>
<dates>
<discovery>2015-04-20</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="3d657340-27ea-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Unmediated PCI register access in qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-131.html">
<p>Qemu allows guests to not only read, but also write all parts of
the PCI config space (but not extended config space) of passed
through PCI devices not explicitly dealt with for (partial)
emulation purposes.</p>
<p>Since the effect depends on the specific purpose of the the config
space field, it's not possible to give a general statement about the
exact impact on the host or other guests. Privilege escalation,
host crash (Denial of Service), and leaked information all cannot be
excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4106</cvename>
<url>http://xenbits.xen.org/xsa/advisory-131.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="cbe1a0f9-27e9-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Guest triggerable qemu MSI-X pass-through error messages</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-130.html">
<p>Device model code dealing with guest PCI MSI-X interrupt management
activities logs messages on certain (supposedly) invalid guest
operations.</p>
<p>A buggy or malicious guest repeatedly invoking such operations may
result in the host disk to fill up, possibly leading to a Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4105</cvename>
<url>http://xenbits.xen.org/xsa/advisory-130.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="4db8a0f4-27e9-11e5-a4a5-002590263bf5">
<topic>xen-tools -- PCI MSI mask bits inadvertently exposed to guests</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-129.html">
<p>The mask bits optionally available in the PCI MSI capability
structure are used by the hypervisor to occasionally suppress
interrupt delivery. Unprivileged guests were, however, nevertheless
allowed direct control of these bits.</p>
<p>Interrupts may be observed by Xen at unexpected times, which may
lead to a host crash and therefore a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4104</cvename>
<url>http://xenbits.xen.org/xsa/advisory-129.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="af38cfec-27e7-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Potential unintended writes to host MSI message data field via qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-128.html">
<p>Logic is in place to avoid writes to certain host config space
fields when the guest must nevertheless be able to access their
virtual counterparts. A bug in how this logic deals with accesses
spanning multiple fields allows the guest to write to the host MSI
message data field.</p>
<p>While generally the writes write back the values previously read,
their value in config space may have got changed by the host between
the qemu read and write. In such a case host side interrupt handling
could become confused, possibly losing interrupts or allowing
spurious interrupt injection into other guests.</p>
<p>Certain untrusted guest administrators may be able to confuse host
side interrupt handling, leading to a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4103</cvename>
<url>http://xenbits.xen.org/xsa/advisory-128.html</url>
</references>
<dates>
<discovery>2015-06-02</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="103a47d5-27e7-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Certain domctl operations may be abused to lock up the host</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.3</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-127.html">
<p>XSA-77 put the majority of the domctl operations on a list
excepting them from having security advisories issued for them if
any effects their use might have could hamper security. Subsequently
some of them got declared disaggregation safe, but for a small
subset this was not really correct: Their (mis-)use may result in
host lockups.</p>
<p>As a result, the potential security benefits of toolstack
disaggregation are not always fully realised.</p>
<p>Domains deliberately given partial management control may be able
to deny service to the entire host.</p>
<p>As a result, in a system designed to enhance security by radically
disaggregating the management, the security may be reduced. But,
the security will be no worse than a non-disaggregated design.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2751</cvename>
<url>http://xenbits.xen.org/xsa/advisory-127.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="79f401cd-27e6-11e5-a4a5-002590263bf5">
<topic>xen-tools -- Unmediated PCI command register access in qemu</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.3</ge><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-126.html">
<p>HVM guests are currently permitted to modify the memory and I/O
decode bits in the PCI command register of devices passed through to
them. Unless the device is an SR-IOV virtual function, after
disabling one or both of these bits subsequent accesses to the MMIO
or I/O port ranges would - on PCI Express devices - lead to
Unsupported Request responses. The treatment of such errors is
platform specific.</p>
<p>Furthermore (at least) devices under control of the Linux pciback
driver in the host are handed to guests with the aforementioned bits
turned off. This means that such accesses can similarly lead to
Unsupported Request responses until these flags are set as needed by
the guest.</p>
<p>In the event that the platform surfaces aforementioned UR responses
as Non-Maskable Interrupts, and either the OS is configured to treat
NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to
treat these errors as fatal, the host would crash, leading to a
Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2756</cvename>
<url>http://xenbits.xen.org/xsa/advisory-126.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="d40c66cb-27e4-11e5-a4a5-002590263bf5">
<topic>xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-125.html">
<p>The XEN_DOMCTL_memory_mapping hypercall allows long running
operations without implementing preemption.</p>
<p>This hypercall is used by the device model as part of the emulation
associated with configuration of PCI devices passed through to HVM
guests and is therefore indirectly exposed to those guests.</p>
<p>This can cause a physical CPU to become busy for a significant
period, leading to a host denial of service in some cases.</p>
<p>If a host denial of service is not triggered then it may instead be
possible to deny service to the domain running the device model,
e.g. domain 0.</p>
<p>This hypercall is also exposed more generally to all toolstacks.
However the uses of it in libxl based toolstacks are not believed
to open up any avenue of attack from an untrusted guest. Other
toolstacks may be vulnerable however.</p>
<p>The vulnerability is exposed via HVM guests which have a PCI device
assigned to them. A malicious HVM guest in such a configuration can
mount a denial of service attack affecting the whole system via its
associated device model (qemu-dm).</p>
<p>A guest is able to trigger this hypercall via operations which it
is legitimately expected to perform, therefore running the device
model as a stub domain does not offer protection against the host
denial of service issue. However it does offer some protection
against secondary issues such as denial of service against dom0.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2752</cvename>
<url>http://xenbits.xen.org/xsa/advisory-125.html</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="83a28417-27e3-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-123.html">
<p>Instructions with register operands ignore eventual segment
overrides encoded for them. Due to an insufficiently conditional
assignment such a bogus segment override can, however, corrupt a
pointer used subsequently to store the result of the instruction.</p>
<p>A malicious guest might be able to read sensitive data relating to
other guests, or to cause denial of service on the host. Arbitrary
code execution, and therefore privilege escalation, cannot be
excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2151</cvename>
<url>http://xenbits.xen.org/xsa/advisory-123.html</url>
</references>
<dates>
<discovery>2015-03-10</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="ef9d041e-27e2-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak through version information hypercall</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-122.html">
<p>The code handling certain sub-operations of the
HYPERVISOR_xen_version hypercall fails to fully initialize all
fields of structures subsequently copied back to guest memory. Due
to this hypervisor stack contents are copied into the destination of
the operation, thus becoming visible to the guest.</p>
<p>A malicious guest might be able to read sensitive data relating to
other guests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2045</cvename>
<url>http://xenbits.xen.org/xsa/advisory-122.html</url>
</references>
<dates>
<discovery>2015-03-05</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="5023f559-27e2-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- Information leak via internal x86 system device emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-121.html">
<p>Emulation routines in the hypervisor dealing with certain system
devices check whether the access size by the guest is a supported
one. When the access size is unsupported these routines failed to
set the data to be returned to the guest for read accesses, so that
hypervisor stack contents are copied into the destination of the
operation, thus becoming visible to the guest.</p>
<p>A malicious HVM guest might be able to read sensitive data relating
to other guests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2044</cvename>
<url>http://xenbits.xen.org/xsa/advisory-121.html</url>
</references>
<dates>
<discovery>2015-03-05</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="0d732fd1-27e0-11e5-a4a5-002590263bf5">
<topic>xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-119.html">
<p>When instantiating an emulated VGA device for an x86 HVM guest qemu
will by default enable a backend to expose that device, either SDL
or VNC depending on the version of qemu and the build time
configuration.</p>
<p>The libxl toolstack library does not explicitly disable these
default backends when they are not enabled, leading to an unexpected
backend running.</p>
<p>If either SDL or VNC is explicitly enabled in the guest
configuration then only the expected backends will be enabled.</p>
<p>This affects qemu-xen and qemu-xen-traditional differently.</p>
<p>If qemu-xen was compiled with SDL support then this would result in
an SDL window being opened if $DISPLAY is valid, or a failure to
start the guest if not.</p>
<p>If qemu-xen was compiled without SDL support then qemu would
instead start a VNC server listening on ::1 (IPv6 localhost) or
127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC
password will not be configured even if one is present in the guest
configuration.</p>
<p>qemu-xen-traditional will never start a vnc backend unless
explicitly configured. However by default it will start an SDL
backend if it was built with SDL support and $DISPLAY is valid.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2152</cvename>
<url>http://xenbits.xen.org/xsa/advisory-119.html</url>
</references>
<dates>
<discovery>2015-03-13</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="912cb7f7-27df-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-118.html">
<p>On ARM systems the code which deals with virtualizing the GIC
distributor would, under various circumstances, log messages on a
guest accessible code path without appropriate rate limiting.</p>
<p>A malicious guest could cause repeated logging to the hypervisor
console, leading to a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1563</cvename>
<url>http://xenbits.xen.org/xsa/advisory-118.html</url>
</references>
<dates>
<discovery>2015-01-29</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="785c86b1-27d6-11e5-a4a5-002590263bf5">
<topic>xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.5</ge><lt>4.5.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-117.html">
<p>When decoding a guest write to a specific register in the virtual
interrupt controller Xen would treat an invalid value as a critical
error and crash the host.</p>
<p>By writing an invalid value to the GICD.SGIR register a guest can
crash the host, resulting in a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0268</cvename>
<url>http://xenbits.xen.org/xsa/advisory-117.html</url>
</references>
<dates>
<discovery>2015-02-12</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="7313b0e3-27b4-11e5-a15a-50af736ef1c0">
<topic>pivotx -- Multiple unrestricted file upload vulnerabilities</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pivotx reports:</p>
<blockquote cite="http://pivotx.net/page/security">
<p>Multiple unrestricted file upload vulnerabilities in fileupload.php
in PivotX before 2.3.9 allow remote authenticated users to execute
arbitrary PHP code by uploading a file with a (1) .php or (2) .php#
extension, and then accessing it via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0341</cvename>
</references>
<dates>
<discovery>2014-04-15</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="14d846d6-27b3-11e5-a15a-50af736ef1c0">
<topic>pivotx -- cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>pivotx</name>
<range><lt>2.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>pivotx reports:</p>
<blockquote cite="http://pivotx.net/page/security">
<p>cross-site scripting (XSS) vulnerability in the nickname (and
possibly the email) field. Mitigated by the fact that an attacker
must have a PivotX account.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0341</cvename>
</references>
<dates>
<discovery>2014-04-15</discovery>
<entry>2015-07-11</entry>
</dates>
</vuln>
<vuln vid="c93c9395-25e1-11e5-a4a5-002590263bf5">
<topic>wpa_supplicant -- WPS_NFC option payload length validation vulnerability</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt">
<p>Incomplete WPS and P2P NFC NDEF record payload length
validation. (2015-5)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8041</cvename>
<url>http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt</url>
</references>
<dates>
<discovery>2015-07-08</discovery>
<entry>2015-07-09</entry>
<modified>2015-11-10</modified>
</dates>
</vuln>
<vuln vid="075952fe-267e-11e5-9d03-3c970e169bc2">
<topic>openssl -- alternate chains certificate forgery vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.2_2</ge><lt>1.0.2_4</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.2b</ge><lt>1.0.2d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150709.txt">
<p>During certificate verification, OpenSSL (starting from version
1.0.1n and 1.0.2b) will attempt to find an alternative certificate
chain if the first attempt to build such a chain fails. An error
in the implementation of this logic can mean that an attacker could
cause certain checks on untrusted certificates to be bypassed,
such as the CA flag, enabling them to use a valid leaf certificate
to act as a CA and "issue" an invalid certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1793</cvename>
<url>https://www.openssl.org/news/secadv_20150709.txt</url>
</references>
<dates>
<discovery>2015-07-09</discovery>
<entry>2015-07-09</entry>
</dates>
</vuln>
<vuln vid="37ed8e9c-2651-11e5-86ff-14dae9d210b8">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4.0</ge><lt>1.4.21</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.7.0</ge><lt>1.7.9</lt></range>
</package>
<package>
<name>py27-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.8.0</ge><lt>1.8.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py32-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py33-django-devel</name>
<range><le>20150531,1</le></range>
</package>
<package>
<name>py34-django-devel</name>
<range><le>20150531,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/jul/08/security-releases/">
<p>In accordance with our security release policy, the Django
team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3.
These releases are now available on PyPI and our download page. These
releases address several security issues detailed below. We encourage
all users of Django to upgrade as soon as possible. The Django master
branch has also been updated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/jul/08/security-releases/</url>
<url>https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680</url>
<url>https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44</url>
<url>https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e</url>
<cvename>CVE-2015-5143</cvename>
<cvename>CVE-2015-5144</cvename>
<cvename>CVE-2015-5145</cvename>
</references>
<dates>
<discovery>2015-06-10</discovery>
<entry>2015-07-09</entry>
</dates>
</vuln>
<vuln vid="348bfa69-25a2-11e5-ade1-0011d823eebd">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.481</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.481</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-16.html">
<p>
Adobe has released security updates for Adobe Flash Player. These
updates address critical vulnerabilities that could potentially
allow an attacker to take control of the affected system. Adobe is
aware of a report that an exploit targeting CVE-2015-5119 has been
publicly published.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-16.html</url>
<cvename>CVE-2015-5119</cvename>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-08</entry>
</dates>
</vuln>
<vuln vid="c93533a3-24f1-11e5-8b74-3c970e169bc2">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.2P2</lt></range>
</package>
<package>
<name>bind99</name>
<range><lt>9.9.7P1</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_19</lt></range>
<range><ge>8.4</ge><lt>8.4_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01267/">
<p>A very uncommon combination of zone data has been found
that triggers a bug in BIND, with the result that named
will exit with a "REQUIRE" failure in name.c when validating
the data returned in answer to a recursive query.</p>
<p>A recursive resolver that is performing DNSSEC validation
can be deliberately terminated by any attacker who can
cause a query to be performed against a maliciously
constructed zone. This will result in a denial of
service to clients who rely on that resolver.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:11.bind</freebsdsa>
<cvename>CVE-2015-4620</cvename>
<url>https://kb.isc.org/article/AA-01267/</url>
</references>
<dates>
<discovery>2015-07-07</discovery>
<entry>2015-07-07</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="cbfa8bd7-24b6-11e5-86ff-14dae9d210b8">
<topic>haproxy -- information leak vulnerability</topic>
<affects>
<package>
<name>haproxy</name>
<range><ge>1.5.0</ge><lt>1.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAProxy reports:</p>
<blockquote cite="http://www.haproxy.org/news.html">
<p>A vulnerability was found when HTTP pipelining is used. In
some cases, a client might be able to cause a buffer alignment issue and
retrieve uninitialized memory contents that exhibit data from a past
request or session. I want to address sincere congratulations to Charlie
Smurthwaite of aTech Media for the really detailed traces he provided
which made it possible to find the cause of this bug. Every user of
1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev
snapshot to fix this issue, or use the backport of the fix provided by
their operating system vendors. CVE-2015-3281 was assigned to this bug.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.haproxy.org/news.html</url>
<url>http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4</url>
<mlist>http://seclists.org/oss-sec/2015/q3/61</mlist>
<cvename>CVE-2015-3281</cvename>
</references>
<dates>
<discovery>2015-07-02</discovery>
<entry>2015-07-07</entry>
</dates>
</vuln>
<vuln vid="038a5808-24b3-11e5-b0c8-bf4d8935d4fa">
<topic>roundcube -- multiple vulnerabilities</topic>
<affects>
<package>
<name>roundcube</name>
<range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
<range><lt>1.0.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/">
<p>We just published updates to both stable versions 1.0 and
1.1 after fixing many minor bugs and adding some security improvements
to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes
from the more recent version to ensure proper long term support
especially in regards of security and compatibility.<br/>
<br/>
The security-related fixes in particular are:<br/>
<br/>
* XSS vulnerability in _mbox argument<br/>
* security improvement in contact photo handling<br/>
* potential info disclosure from temp directory</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5381</cvename>
<cvename>CVE-2015-5383</cvename>
<mlist>http://openwall.com/lists/oss-security/2015/07/06/10</mlist>
<url>https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/</url>
</references>
<dates>
<discovery>2015-05-30</discovery>
<entry>2015-07-07</entry>
</dates>
</vuln>
<vuln vid="543b5939-2067-11e5-a4a5-002590263bf5">
<topic>turnserver -- SQL injection vulnerability</topic>
<affects>
<package>
<name>turnserver</name>
<range><lt>4.4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oleg Moskalenko reports:</p>
<blockquote cite="http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog">
<p>SQL injection security hole fixed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog</url>
<mlist>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J</mlist>
</references>
<dates>
<discovery>2015-06-20</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="150d1538-23fa-11e5-a4a5-002590263bf5">
<topic>squid -- Improper Protection of Alternate Path with CONNECT requests</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2015:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_2.txt">
<p>Squid configured with cache_peer and operating on explicit proxy
traffic does not correctly handle CONNECT method peer responses.</p>
<p>The bug is important because it allows remote clients to bypass
security in an explicit gateway proxy.</p>
<p>However, the bug is exploitable only if you have configured
cache_peer to receive CONNECT requests.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_2.txt</url>
<cvename>CVE-2015-5400</cvename>
</references>
<dates>
<discovery>2015-07-06</discovery>
<entry>2015-07-06</entry>
<modified>2015-07-17</modified>
</dates>
</vuln>
<vuln vid="b6da24da-23f7-11e5-a4a5-002590263bf5">
<topic>squid -- client-first SSL-bump does not correctly validate X509 server certificate</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5</ge><lt>3.5.4</lt></range>
<range><ge>3.4</ge><lt>3.4.13</lt></range>
</package>
<package>
<name>squid33</name>
<range><ge>3.3</ge><lt>3.3.14</lt></range>
</package>
<package>
<name>squid32</name>
<range><ge>3.2</ge><lt>3.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2015:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2015_1.txt">
<p>Squid configured with client-first SSL-bump does not correctly
validate X509 server certificate domain / hostname fields.</p>
<p>The bug is important because it allows remote servers to bypass
client certificate validation. Some attackers may also be able
to use valid certificates for one domain signed by a global
Certificate Authority to abuse an unrelated domain.</p>
<p>However, the bug is exploitable only if you have configured
Squid to perform SSL Bumping with the "client-first" or "bump"
mode of operation.</p>
<p>Sites that do not use SSL-Bump are not vulnerable.</p>
<p>All Squid built without SSL support are not vulnerable to the
problem.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2015-3455</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_1.txt</url>
</references>
<dates>
<discovery>2015-05-01</discovery>
<entry>2015-07-06</entry>
</dates>
</vuln>
<vuln vid="72fccfdf-2061-11e5-a4a5-002590263bf5">
<topic>ansible -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Ensure that hostnames match certificate names when using HTTPS -
resolved in Ansible 1.9.2</p>
<p>Improper symlink handling in zone, jail, and chroot connection
plugins could lead to escape from confined environment - resolved
in Ansible 1.9.2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3908</cvename>
<cvename>CVE-2015-6240</cvename>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md</url>
</references>
<dates>
<discovery>2015-06-25</discovery>
<entry>2015-07-02</entry>
<modified>2015-08-18</modified>
</dates>
</vuln>
<vuln vid="e308c61a-2060-11e5-a4a5-002590263bf5">
<topic>ansible -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Arbitrary execution from data from compromised remote hosts or
local data when using a legacy Ansible syntax - resolved in
Ansible 1.7</p>
<p>ansible-galaxy command when used on local tarballs (and not
galaxy.ansible.com) can install a malformed tarball if so provided
- resolved in Ansible 1.7</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-08-06</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="9dae9d62-205f-11e5-a4a5-002590263bf5">
<topic>ansible -- code execution from compromised remote host data or untrusted local data</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Arbitrary execution from data from compromised remote hosts or
untrusted local data - resolved in Ansible 1.6.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4966</cvename>
<bid>68794</bid>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-07-21</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="2c493ac8-205e-11e5-a4a5-002590263bf5">
<topic>ansible -- remote code execution vulnerability</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible, Inc. reports:</p>
<blockquote cite="http://www.ansible.com/security">
<p>Incomplete Fix Remote Code Execution Vulnerability - Fixed in
Ansible 1.6.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4678</cvename>
<bid>68335</bid>
<url>http://www.ansible.com/security</url>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
</references>
<dates>
<discovery>2014-06-25</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="a6a9f9d5-205c-11e5-a4a5-002590263bf5">
<topic>ansible -- local symlink exploits</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4259">
<p>runner/connection_plugins/ssh.py in Ansible before 1.2.3, when
using ControlPersist, allows local users to redirect a ssh session
via a symlink attack on a socket file with a predictable name in
/tmp/.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4260">
<p>lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3,
when playbook does not run due to an error, allows local users to
overwrite arbitrary files via a symlink attack on a retry file with
a predictable name in /var/tmp/ansible/.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-4259</cvename>
<cvename>CVE-2013-4260</cvename>
<url>http://www.ansible.com/security</url>
<url>https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg</url>
</references>
<dates>
<discovery>2013-08-21</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="a478421e-2059-11e5-a4a5-002590263bf5">
<topic>ansible -- enable host key checking in paramiko connection type</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible changelog reports:</p>
<blockquote cite="https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md">
<p>Host key checking is on by default. Disable it if you like by
adding host_key_checking=False in the [default] section of
/etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting
ANSIBLE_HOST_KEY_CHECKING=False.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2233</cvename>
<url>https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md</url>
<url>http://www.ansible.com/security</url>
<url>https://github.com/ansible/ansible/issues/857</url>
</references>
<dates>
<discovery>2012-08-13</discovery>
<entry>2015-07-02</entry>
</dates>
</vuln>
<vuln vid="d7b9a28d-238c-11e5-86ff-14dae9d210b8">
<topic>bitcoin -- denial of service</topic>
<affects>
<package>
<name>bitcoin</name>
<range><lt>0.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gregory Maxwell reports:</p>
<blockquote cite="http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core">
<p>On July 7th I will be making public details of several
serious denial of service vulnerabilities which have fixed in recent
versions of Bitcoin Core, including including CVE-2015-3641.
I strongly recommend anyone running production nodes exposed to inbound
connections from the internet upgrade to 0.10.2 as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3641</cvename>
<url>http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core</url>
<url>https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures</url>
</references>
<dates>
<discovery>2015-06-27</discovery>
<entry>2015-07-06</entry>
</dates>
</vuln>
<vuln vid="864e6f75-2372-11e5-86ff-14dae9d210b8">
<topic>node, iojs, and v8 -- denial of service</topic>
<affects>
<package>
<name>node</name>
<range><lt>0.12.6</lt></range>
</package>
<package>
<name>node-devel</name>
<range><lt>0.12.6</lt></range>
</package>
<package>
<name>iojs</name>
<range><lt>2.3.3</lt></range>
</package>
<package>
<name>v8</name>
<range><le>3.18.5</le></range>
</package>
<package>
<name>v8-devel</name>
<range><le>3.27.7_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node reports:</p>
<blockquote cite="http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/">
<p>This release of Node.js fixes a bug that triggers an
out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to
String conversions. This is an important security update as this bug can
be used to cause a denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/</url>
<url>https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6</url>
<url>https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676</url>
<url>https://codereview.chromium.org/1226493003</url>
<cvename>CVE-2015-5380</cvename>
</references>
<dates>
<discovery>2015-07-03</discovery>
<entry>2015-07-06</entry>
<modified>2015-07-10</modified>
</dates>
</vuln>
<vuln vid="bf1d9331-21b6-11e5-86ff-14dae9d210b8">
<topic>cups-filters -- texttopdf integer overflow</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.0.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius from Red Hat reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/07/03/2">
<p>An integer overflow flaw leading to a heap-based buffer overflow was
discovered in the way the texttopdf utility of cups-filter processed
print jobs with a specially crafted line size. An attacker being able
to submit print jobs could exploit this flaw to crash texttopdf or,
possibly, execute arbitrary code with the privileges of the 'lp' user.</p>
</blockquote>
<p>Tim Waugh reports:</p>
<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365">
<p>The Page allocation is moved into textcommon.c, where it does all the
necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds
for CVE-2015-3259 due to integer overflows for the calloc() call
initializing Page[0] and the memset() call in texttopdf.c's
WritePage() function zeroing the entire array.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3279</cvename>
<url>https://access.redhat.com/security/cve/CVE-2015-3279</url>
<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365</url>
<mlist>http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html</mlist>
</references>
<dates>
<discovery>2015-07-03</discovery>
<entry>2015-07-03</entry>
<modified>2015-07-07</modified>
</dates>
</vuln>
<vuln vid="9c7177ff-1fe1-11e5-9a01-bcaec565249c">
<topic>libxml2 -- Enforce the reader to run in constant memory</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.2_3</lt></range>
</package>
<package>
<name>linux-c6-libxml2</name>
<range><lt>2.7.6_5</lt></range>
</package>
<package>
<name>linux-f10-libxml2</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Veilland reports:</p>
<blockquote cite="https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9">
<p>Enforce the reader to run in constant memory. One of the
operation on the reader could resolve entities leading to
the classic expansion issue. Make sure the buffer used for
xmlreader operation is bounded. Introduce a new allocation
type for the buffers for this effect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1819</cvename>
<url>https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9</url>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-07-01</entry>
<modified>2016-01-31</modified>
</dates>
</vuln>
<vuln vid="2a8b7d21-1ecc-11e5-a4a5-002590263bf5">
<topic>wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension</topic>
<affects>
<package>
<name>wesnoth</name>
<range><lt>1.12.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ignacio R. Morelle reports:</p>
<blockquote cite="http://forums.wesnoth.org/viewtopic.php?t=42776">
<p>As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release
announcements, a security vulnerability targeting add-on authors
was found (bug #23504) which allowed a malicious user to obtain
add-on server passphrases from the client's .pbl files and transmit
them over the network, or store them in saved game files intended
to be shared by the victim. This vulnerability affects all existing
releases up to and including versions 1.12.2 and 1.13.0.
Additionally, version 1.12.3 included only a partial fix that failed
to guard users against attempts to read from .pbl files with an
uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070
have been assigned to the vulnerability affecting .pbl files with a
lowercase extension, and .pbl files with an uppercase or mixed-case
extension, respectively.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5069</cvename>
<cvename>CVE-2015-5070</cvename>
<url>http://forums.wesnoth.org/viewtopic.php?t=42776</url>
<url>http://forums.wesnoth.org/viewtopic.php?t=42775</url>
</references>
<dates>
<discovery>2015-06-28</discovery>
<entry>2015-07-01</entry>
</dates>
</vuln>
<vuln vid="b19da422-1e02-11e5-b43d-002590263bf5">
<topic>cups-filters -- buffer overflow in texttopdf size allocation</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.0.70</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Cornelius from Red Hat reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/26/4">
<p>A heap-based buffer overflow was discovered in the way the
texttopdf utility of cups-filters processed print jobs with a
specially crafted line size. An attacker being able to submit
print jobs could exploit this flaw to crash texttopdf or,
possibly, execute arbitrary code.</p>
</blockquote>
<p>Till Kamppeter reports:</p>
<blockquote cite="http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363">
<p>texttopdf: Fixed buffer overflow on size allocation of texttopdf
when working with extremely small line sizes, which causes the size
calculation to result in 0 (CVE-2015-3258, thanks to Stefan
Cornelius from Red Hat for the patch).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3258</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/26/4</mlist>
<url>http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2015-06-29</entry>
</dates>
</vuln>
<vuln vid="0d0f3050-1f69-11e5-9ba9-d050996490d0">
<topic>ntp -- control message remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p3</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi">
<p>Under limited and specific circumstances an attacker can send a
crafted packet to cause a vulnerable ntpd instance to crash.
This requires each of the following to be true:</p>
<ul>
<li>ntpd set up to allow for remote configuration (not
allowed by default), and</li>
<li>knowledge of the configuration password, and</li>
<li>access to a computer entrusted to perform remote
configuration.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.ntp.org/show_bug.cgi?id=2853</url>
<url>https://www.kb.cert.org/vuls/id/668167</url>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi</url>
</references>
<dates>
<discovery>2015-06-29</discovery>
<entry>2015-06-30</entry>
</dates>
</vuln>
<vuln vid="acd5d037-1c33-11e5-be9c-6805ca1d3bb1">
<topic>qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209)</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.11.1_20</lt></range>
<range><ge>0.12</ge><lt>2.3.0_2</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<range><lt>2.3.50.g20150618_1</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The QEMU security team reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-135.html">
<p>A guest which has access to an emulated PCNET network
device (e.g. with "model=pcnet" in their VIF configuration)
can exploit this vulnerability to take over the qemu
process elevating its privilege to that of the qemu
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-135.html</url>
<cvename>CVE-2015-3209</cvename>
</references>
<dates>
<discovery>2015-04-10</discovery>
<entry>2015-06-26</entry>
<modified>2015-07-11</modified>
</dates>
</vuln>
<vuln vid="23232028-1ba4-11e5-b43d-002590263bf5">
<topic>elasticsearch -- security fix for shared file-system repositories</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.0.0</ge><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Elasticsearch versions from 1.0.0 to
1.5.2 are vulnerable to an attack that uses Elasticsearch to modify
files read and executed by certain other applications.</p>
<p>Remediation Summary: Users should upgrade to 1.6.0. Alternately,
ensure that other applications are not present on the system, or
that Elasticsearch cannot write into areas where these applications
would read.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4165</cvename>
<freebsdpr>ports/201008</freebsdpr>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-6-0-released</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="a71e7440-1ba3-11e5-b43d-002590263bf5">
<topic>elasticsearch -- directory traversal attack with site plugins</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.4.5</lt></range>
<range><ge>1.5.0</ge><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: All Elasticsearch versions prior to 1.5.2
and 1.4.5 are vulnerable to a directory traversal attack that allows
an attacker to retrieve files from the server running Elasticsearch
when one or more site plugins are installed, or when Windows is the
server OS.</p>
<p>Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users
that do not want to upgrade can address the vulnerability by
disabling site plugins. See the CVE description for additional
options.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3337</cvename>
<bid>74353</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released</url>
<url>https://www.exploit-db.com/exploits/37054/</url>
<url>https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html</url>
<url>http://www.securityfocus.com/archive/1/535385</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="026759e0-1ba3-11e5-b43d-002590263bf5">
<topic>elasticsearch -- remote OS command execution via Groovy scripting engine</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><ge>1.3.0</ge><lt>1.3.8</lt></range>
<range><ge>1.4.0</ge><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and
1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that
were introduced in 1.3.0. The vulnerability allows an attacker to
construct Groovy scripts that escape the sandbox and execute shell
commands as the user running the Elasticsearch Java VM.</p>
<p>Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users
that do not want to upgrade can address the vulnerability by setting
script.groovy.sandbox.enabled to false in elasticsearch.yml and
restarting the node.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1427</cvename>
<bid>72585</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released</url>
<url>http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded</url>
<url>https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html</url>
<url>https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html</url>
</references>
<dates>
<discovery>2015-02-11</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="5951fb49-1ba2-11e5-b43d-002590263bf5">
<topic>elasticsearch -- cross site scripting vulnerability in the CORS functionality</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: Elasticsearch versions 1.3.x and prior have
a default configuration for CORS that allows an attacker to craft
links that could cause a user's browser to send requests to
Elasticsearch instances on their local network. These requests could
cause data loss or compromise.</p>
<p>Remediation Summary: Users should either set "http.cors.enabled" to
false, or set "http.cors.allow-origin" to the value of the server
that should be allowed access, such as localhost or a server hosting
Kibana. Disabling CORS entirely with the former setting is more
secure, but may not be suitable for all use cases.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6439</cvename>
<bid>70233</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released</url>
<url>https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html</url>
<url>http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded</url>
</references>
<dates>
<discovery>2014-10-01</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="43ac9d42-1b9a-11e5-b43d-002590263bf5">
<topic>elasticsearch and logstash -- remote OS command execution via dynamic scripting</topic>
<affects>
<package>
<name>elasticsearch</name>
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security">
<p>Vulnerability Summary: In Elasticsearch versions 1.1.x and prior,
dynamic scripting is enabled by default. This could allow an
attacker to execute OS commands.</p>
<p>Remediation Summary: Disable dynamic scripting.</p>
</blockquote>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is
vulnerable to CVE-2014-3120. These binaries are used in
Elasticsearch output specifically when using the node protocol.
Since a node client joins the Elasticsearch cluster, the attackers
could use scripts to execute commands on the host OS using the node
client's URL endpoint. With 1.4.3 release, we are packaging Logstash
with Elasticsearch 1.5.2 binaries which by default disables the
ability to run scripts. This also affects users who are using the
configuration option embedded=>true in the Elasticsearch output
which starts a local embedded Elasticsearch cluster. This is
typically used in development environment and proof of concept
deployments. Regardless of this vulnerability, we strongly recommend
not using embedded in production.</p>
<p>Note that users of transport and http protocol are not vulnerable
to this attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3120</cvename>
<bid>67731</bid>
<url>https://www.elastic.co/community/security</url>
<url>https://www.elastic.co/blog/elasticsearch-1-2-0-released</url>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.exploit-db.com/exploits/33370/</url>
<url>http://bouk.co/blog/elasticsearch-rce/</url>
<url>http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce</url>
<url>https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch</url>
</references>
<dates>
<discovery>2014-05-22</discovery>
<entry>2015-06-26</entry>
</dates>
</vuln>
<vuln vid="24bde04f-1a10-11e5-b43d-002590263bf5">
<topic>logstash -- Directory traversal vulnerability in the file output plugin</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>An attacker could use the File output plugin with dynamic field
references in the path option to traverse paths outside of Logstash
directory. This technique could also be used to overwrite any files
which can be accessed with permissions associated with Logstash
user. This release sandboxes the paths which can be traversed using
the configuration. We have also disallowed use of dynamic field
references if the path options is pointing to an absolute path.</p>
<p>We have added this vulnerability to our CVE page and are working
on filling out the CVE. We would like to thank Colin Coghill for
reporting the issue and working with us on the resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4152</cvename>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="2184ccad-1a10-11e5-b43d-002590263bf5">
<topic>logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs</topic>
<affects>
<package>
<name>logstash</name>
<range><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-2">
<p>The vulnerability impacts deployments that use the either the
zabbix or the nagios_nsca outputs. In these cases, an attacker
with an ability to send crafted events to any source of data for
Logstash could execute operating system commands with the
permissions of the Logstash process.</p>
<p>Deployments that do not use the zabbix or the nagios_nsca outputs
are not vulnerable and do not need to upgrade for this reason.</p>
<p>We have added this vulnerability to our CVE page and are working
on filling out the CVE.</p>
<p>We would like to thank Jan Karwowski and Danila Borisiuk for
reporting the issue and working with us on the resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-4326</cvename>
<url>https://www.elastic.co/blog/logstash-1-4-2</url>
<url>https://www.elastic.co/community/security</url>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="ad4d3871-1a0d-11e5-b43d-002590263bf5">
<topic>logstash-forwarder and logstash -- susceptibility to POODLE vulnerability</topic>
<affects>
<package>
<name>logstash-forwarder</name>
<range><lt>0.4.0.20150507</lt></range>
</package>
<package>
<name>logstash</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-1-4-3-released">
<p>The combination of Logstash Forwarder and Lumberjack input (and
output) was vulnerable to the POODLE attack in SSLv3 protocol. We
have disabled SSLv3 for this combination and set the minimum version
to be TLSv1.0. We have added this vulnerability to our CVE page and
are working on filling out the CVE.</p>
<p>Thanks to Tray Torrance, Marc Chadwick, and David Arena for
reporting this.</p>
</blockquote>
<blockquote cite="https://www.elastic.co/blog/logstash-forwarder-0-4-0-released">
<p>SSLv3 is no longer supported; TLS 1.0+ is required (compatible
with Logstash 1.4.2+).</p>
</blockquote>
</body>
</description>
<references>
<!-- POODLE CVE pending -->
<freebsdpr>ports/201065</freebsdpr>
<freebsdpr>ports/201065</freebsdpr>
<url>https://www.elastic.co/blog/logstash-1-4-3-released</url>
<url>https://www.elastic.co/blog/logstash-forwarder-0-4-0-released</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-24</entry>
<modified>2015-06-24</modified>
</dates>
</vuln>
<vuln vid="d02f6b01-1a3f-11e5-8bd6-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-14.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address a critical
vulnerability (CVE-2015-3113) that could potentially allow an
attacker to take control of the affected system.
</p>
<p>
Adobe is aware of reports that CVE-2015-3113 is being actively
exploited in the wild via limited, targeted attacks. Systems running
Internet Explorer for Windows 7 and below, as well as Firefox on
Windows XP, are known targets.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-14.html</url>
<cvename>CVE-2015-3113</cvename>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-06-24</entry>
</dates>
</vuln>
<vuln vid="f5225b23-192d-11e5-a1cf-002590263bf5">
<topic>rubygem-bson -- DoS and possible injection</topic>
<affects>
<package>
<name>rubygem-bson</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Phill MV reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/06/06/1">
<p>By submitting a specially crafted string to a service relying on
the bson rubygem, an attacker may trigger denials of service or even
inject data into victim's MongoDB instances.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4412</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/06/06/1</mlist>
<url>http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html</url>
<url>https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999</url>
</references>
<dates>
<discovery>2015-06-04</discovery>
<entry>2015-06-23</entry>
</dates>
</vuln>
<vuln vid="cdff0af2-1492-11e5-a1cf-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-dom</name>
<name>php5-ftp</name>
<name>php5-gd</name>
<name>php5-pgsql</name>
<range><lt>5.4.42</lt></range>
</package>
<package>
<name>php55-dom</name>
<name>php55-ftp</name>
<name>php55-gd</name>
<name>php55-pgsql</name>
<range><lt>5.5.26</lt></range>
</package>
<package>
<name>php56-dom</name>
<name>php56-ftp</name>
<name>php56-gd</name>
<name>php56-psql</name>
<range><lt>5.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>DOM and GD:</p>
<ul>
<li>Fixed bug #69719 (Incorrect handling of paths with NULs).</li>
</ul>
<p>FTP:</p>
<ul>
<li>Improved fix for bug #69545 (Integer overflow in ftp_genlist()
resulting in heap overflow). (CVE-2015-4643)</li>
</ul>
<p>Postgres:</p>
<ul>
<li>Fixed bug #69667 (segfault in php_pgsql_meta_data).
(CVE-2015-4644)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4643</cvename>
<cvename>CVE-2015-4644</cvename>
<url>http://www.php.net/ChangeLog-5.php#5.4.42</url>
<url>http://www.php.net/ChangeLog-5.php#5.5.26</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.10</url>
<mlist>http://openwall.com/lists/oss-security/2015/06/18/3</mlist>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-23</entry>
</dates>
</vuln>
<vuln vid="a4460ac7-192c-11e5-9c01-bcaec55be5e5">
<topic>devel/ipython -- remote execution</topic>
<affects>
<package>
<name>ipython</name>
<range><lt>3.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kyle Kelley reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/779">
<p>Summary: JSON error responses from the IPython notebook REST API
contained URL parameters and were incorrectly reported as text/html
instead of application/json. The error messages included some of these
URL params, resulting in a cross site scripting attack. This affects
users on Mozilla Firefox but not Chromium/Google Chrome.</p>
<p>API paths with issues:</p>
<ul>
<li>/api/contents (3.0-3.1)</li>
<li>/api/notebooks (2.0-2.4, 3.0-3.1)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4706</cvename>
<cvename>CVE-2015-4707</cvename>
<url>http://seclists.org/oss-sec/2015/q2/779</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="d46ed7b8-1912-11e5-9fdf-00262d5ed8ee">
<topic>www/chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>43.0.2357.130</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>43.0.2357.130</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>43.0.2357.130</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html">
<p>4 security fixes in this release:</p>
<ul>
<li>[464922] High CVE-2015-1266: Scheme validation error in WebUI.
Credit to anonymous.</li>
<li>[494640] High CVE-2015-1268: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[497507] Medium CVE-2015-1267: Cross-origin bypass in Blink.
Credit to anonymous.</li>
<li>[461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP
preload list. Credit to Mike Ruddy.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1266</cvename>
<cvename>CVE-2015-1267</cvename>
<cvename>CVE-2015-1268</cvename>
<cvename>CVE-2015-1269</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html</url>
</references>
<dates>
<discovery>2015-06-22</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="0f154810-16e4-11e5-a1cf-002590263bf5">
<topic>rubygem-paperclip -- validation bypass vulnerability</topic>
<affects>
<package>
<name>rubygem-paperclip</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Yurek reports:</p>
<blockquote cite="https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57">
<p>Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.</p>
<p>There is an issue where if an HTML file is uploaded with a .html
extension, but the content type is listed as being `image/jpeg`,
this will bypass a validation checking for images. But it will also
pass the spoof check, because a file named .html and containing
actual HTML passes the spoof check.</p>
<p>This change makes it so that we also check the supplied content
type. So even if the file contains HTML and ends with .html, it
doesn't match the content type of `image/jpeg` and so it fails.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2963</cvename>
<url>https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57</url>
<url>https://robots.thoughtbot.com/paperclip-security-release</url>
<url>http://jvn.jp/en/jp/JVN83881261/index.html</url>
</references>
<dates>
<discovery>2015-06-05</discovery>
<entry>2015-06-22</entry>
</dates>
</vuln>
<vuln vid="0da404ad-1891-11e5-a1cf-002590263bf5">
<topic>chicken -- Potential buffer overrun in string-translate*</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.10.0.r2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chicken developer Peter Bex reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html">
<p>Using gcc's Address Sanitizer, it was discovered that the string-translate*
procedure from the data-structures unit can scan beyond the input string's
length up to the length of the source strings in the map that's passed to
string-translate*. This issue was fixed in master 8a46020, and it will
make its way into CHICKEN 4.10.</p>
<p>This bug is present in all released versions of CHICKEN.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4556</cvename>
<freebsdpr>ports/200980</freebsdpr>
<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html</mlist>
</references>
<dates>
<discovery>2015-06-15</discovery>
<entry>2015-06-22</entry>
<modified>2015-07-31</modified>
</dates>
</vuln>
<vuln vid="e7b7f2b5-177a-11e5-ad33-f8d111029e6a">
<topic>chicken -- buffer overrun in substring-index[-ci]</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.10.0.r1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chicken developer Moritz Heidkamp reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html">
<p>The substring-index[-ci] procedures of the data-structures unit are
vulnerable to a buffer overrun attack when passed an integer greater
than zero as the optional START argument.</p>
<p>As a work-around you can switch to SRFI 13's
string-contains procedure which also returns the substring's index in
case it is found.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9651</cvename>
<mlist>http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html</mlist>
<mlist>http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt</mlist>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-06-22</entry>
<modified>2015-06-23</modified>
</dates>
</vuln>
<vuln vid="a3929112-181b-11e5-a1cf-002590263bf5">
<topic>cacti -- Multiple XSS and SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8d.php">
<p>Important Security Fixes</p>
<ul>
<li>Multiple XSS and SQL injection vulnerabilities</li>
</ul>
<p>Changelog</p>
<ul>
<li>bug: Fixed SQL injection VN: JVN#78187936 /
TN:JPCERT#98968540</li>
<li>bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting
Vulnerability Notification</li>
<li>bug#0002571: SQL Injection and Location header injection from
cdef id CVE-2015-4342</li>
<li>bug#0002572: SQL injection in graph template</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4342</cvename>
<freebsdpr>ports/200963</freebsdpr>
<url>http://www.cacti.net/release_notes_0_8_8d.php</url>
<mlist>http://seclists.org/fulldisclosure/2015/Jun/19</mlist>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-21</entry>
</dates>
</vuln>
<vuln vid="a0e74731-181b-11e5-a1cf-002590263bf5">
<topic>cacti -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8c.php">
<p>Important Security Fixes</p>
<ul>
<li>CVE-2013-5588 - XSS issue via installer or device editing</li>
<li>CVE-2013-5589 - SQL injection vulnerability in device editing</li>
<li>CVE-2014-2326 - XSS issue via CDEF editing</li>
<li>CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability</li>
<li>CVE-2014-2328 - Remote Command Execution Vulnerability in graph export</li>
<li>CVE-2014-4002 - XSS issues in multiple files</li>
<li>CVE-2014-5025 - XSS issue via data source editing</li>
<li>CVE-2014-5026 - XSS issues in multiple files</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-5588</cvename>
<cvename>CVE-2013-5589</cvename>
<cvename>CVE-2014-2326</cvename>
<cvename>CVE-2014-2327</cvename>
<cvename>CVE-2014-2328</cvename>
<cvename>CVE-2014-4002</cvename>
<cvename>CVE-2014-5025</cvename>
<cvename>CVE-2014-5026</cvename>
<freebsdpr>ports/198586</freebsdpr>
<mlist>http://sourceforge.net/p/cacti/mailman/message/33072838/</mlist>
<url>http://www.cacti.net/release_notes_0_8_8c.php</url>
</references>
<dates>
<discovery>2014-11-23</discovery>
<entry>2015-06-21</entry>
</dates>
</vuln>
<vuln vid="968d1e74-1740-11e5-a643-40a8f0757fb4">
<topic>p5-Dancer -- possible to abuse session cookie values</topic>
<affects>
<package>
<name>p5-Dancer</name>
<range><lt>1.3138</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Russell Jenkins reports:</p>
<blockquote cite="INSERT URL HERE">
<p>It was possible to abuse session cookie values so that
file-based session stores such as Dancer::Session::YAML or
Dancer2::Session::YAML would attempt to read/write from
any file on the filesystem with the same extension the
file-based store uses, such as '*.yml' for the YAML
stores.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html</url>
</references>
<dates>
<discovery>2015-06-12</discovery>
<entry>2015-06-20</entry>
</dates>
</vuln>
<vuln vid="d605edb1-1616-11e5-a000-d050996490d0">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.36</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-002">
<h3>Impersonation (OpenID module - Drupal 6 and 7 - Critical)</h3>
<p>A vulnerability was found in the OpenID module that allows
a malicious user to log in as other users on the site,
including administrators, and hijack their accounts.</p>
<p>This vulnerability is mitigated by the fact that the victim
must have an account with an associated OpenID identity from
a particular set of OpenID providers (including, but not
limited to, Verisign, LiveJournal, or StackExchange).</p>
<h3>Open redirect (Field UI module - Drupal 7 - Less critical)</h3>
<p>The Field UI module uses a "destinations" query string parameter
in URLs to redirect users to new destinations after completing
an action on a few administration pages. Under certain
circumstances, malicious users can use this parameter to
construct a URL that will trick users into being redirected
to a 3rd party website, thereby exposing the users to potential
social engineering attacks.</p>
<p>This vulnerability is mitigated by the fact that only sites
with the Field UI module enabled are affected.</p>
<p>Drupal 6 core is not affected, but see the similar advisory
for the Drupal 6 contributed CCK module:
<a href="https://www.drupal.org/node/2507753">SA-CONTRIB-2015-126</a></p>
<h3>Open redirect (Overlay module - Drupal 7 - Less critical)</h3>
<p>The Overlay module displays administrative pages as a layer
over the current page (using JavaScript), rather than replacing
the page in the browser window. The Overlay module does not
sufficiently validate URLs prior to displaying their contents,
leading to an open redirect vulnerability.</p>
<p>This vulnerability is mitigated by the fact that it can only
be used against site users who have the "Access the administrative
overlay" permission, and that the Overlay module must be enabled.</p>
<h3>Information disclosure (Render cache system - Drupal 7
- Less critical)</h3>
<p>On sites utilizing Drupal 7's render cache system to cache
content on the site by user role, private content viewed by
user 1 may be included in the cache and exposed to non-privileged
users.</p>
<p>This vulnerability is mitigated by the fact that render caching
is not used in Drupal 7 core itself (it requires custom code or
the contributed <a href="https://www.drupal.org/project/render_cache">Render
Cache</a> module to enable) and that it only affects sites that
have user 1 browsing the live site. Exposure is also limited if an
administrative role has been assigned to the user 1 account (which
is done, for example, by the Standard install profile that ships
with Drupal core).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3231</cvename>
<cvename>CVE-2015-3232</cvename>
<cvename>CVE-2015-3233</cvename>
<cvename>CVE-2015-3234</cvename>
<url>https://www.drupal.org/SA-CORE-2015-002</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-06-19</entry>
</dates>
</vuln>
<vuln vid="2438d4af-1538-11e5-a106-3c970e169bc2">
<topic>cURL -- Multiple Vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.40</ge><lt>7.43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150617A.html">
<p>libcurl can wrongly send HTTP credentials when re-using
connections.</p>
<p>libcurl allows applications to set credentials for the
upcoming transfer with HTTP Basic authentication, like
with CURLOPT_USERPWD for example. Name and password.
Just like all other libcurl options the credentials
are sticky and are kept associated with the "handle"
until something is made to change the situation.</p>
<p>Further, libcurl offers a curl_easy_reset() function
that resets a handle back to its pristine state in
terms of all settable options. A reset is of course
also supposed to clear the credentials. A reset is
typically used to clear up the handle and prepare
it for a new, possibly unrelated, transfer.</p>
<p>Within such a handle, libcurl can also store a
set of previous connections in case a second transfer
is requested to a host name for which an existing
connection is already kept alive.</p>
<p>With this flaw present, using the handle even
after a reset would make libcurl accidentally use
those credentials in a subsequent request if done
to the same host name and connection as was
previously accessed.</p>
<p>An example case would be first requesting a password
protected resource from one section of a web site, and
then do a second request of a public resource from a
completely different part of the site without
authentication. This flaw would then inadvertently
leak the credentials in the second request.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150617B.html">
<p>libcurl can get tricked by a malicious SMB server to
send off data it did not intend to.</p>
<p>In libcurl's state machine function handling the SMB
protocol (smb_request_state()), two length and offset
values are extracted from data that has arrived over
the network, and those values are subsequently used
to figure out what data range to send back.</p>
<p>The values are used and trusted without boundary
checks and are just assumed to be valid. This allows
carefully handcrafted packages to trick libcurl
into responding and sending off data that was not
intended. Or just crash if the values cause libcurl
to access invalid memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3236</cvename>
<cvename>CVE-2015-3237</cvename>
<url>http://curl.haxx.se/docs/adv_20150617A.html</url>
<url>http://curl.haxx.se/docs/adv_20150617B.html</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-06-17</entry>
</dates>
</vuln>
<vuln vid="eb8a8978-8dd5-49ce-87f4-49667b2166dd">
<topic>rubygem-rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-activesupport</name>
<range><lt>3.2.22</lt></range>
</package>
<package>
<name>rubygem-activesupport4</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>rubygem-jquery-rails</name>
<range><lt>3.1.3</lt></range>
</package>
<package>
<name>rubygem-jquery-rails4</name>
<range><lt>4.0.4</lt></range>
</package>
<package>
<name>rubygem-rack</name>
<range><lt>1.4.6</lt></range>
</package>
<package>
<name>rubygem-rack15</name>
<range><lt>1.5.4</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><lt>1.6.2</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>rubygem-web-console</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/">
<p>Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web
console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1840</cvename>
<cvename>CVE-2015-3224</cvename>
<cvename>CVE-2015-3225</cvename>
<cvename>CVE-2015-3226</cvename>
<cvename>CVE-2015-3227</cvename>
<url>http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/</url>
</references>
<dates>
<discovery>2015-06-16</discovery>
<entry>2015-06-17</entry>
</dates>
</vuln>
<vuln vid="c67069dc-0986-11e5-bb90-002590263bf5">
<topic>testdisk -- buffer overflow with malicious disk image</topic>
<affects>
<package>
<name>testdisk</name>
<range><lt>7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CGSecurity TestDisk Changelog reports:</p>
<blockquote cite="http://www.cgsecurity.org/wiki/TestDisk_7.0_Release">
<p>Various fix including security fix, thanks to:</p>
<ul>
<li><p>Coverity scan (Static Analysis of source code)</p></li>
<li><p>afl-fuzz (security-oriented fuzzer).</p></li>
<li><p>Denis Andzakovic from Security Assessment for reporting an
exploitable Stack Buffer Overflow.</p></li>
</ul>
</blockquote>
<p>Denis Andzakovic reports:</p>
<blockquote cite="http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf">
<p>A buffer overflow is triggered within the software when a malicious
disk image is attempted to be recovered. This may be leveraged by an
attacker to crash TestDisk and gain control of program execution. An
attacker would have to coerce the victim to run TestDisk against
their malicious image.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cgsecurity.org/wiki/TestDisk_7.0_Release</url>
<url>http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf</url>
</references>
<dates>
<discovery>2015-04-30</discovery>
<entry>2015-06-16</entry>
</dates>
</vuln>
<vuln vid="25e0593d-13c0-11e5-9afb-3c970e169bc2">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.44</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.55</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.9</lt></range>
</package>
<package>
<name>hadoop2</name>
<range><le>2.6.0</le></range>
</package>
<package>
<name>oozie</name>
<range><le>4.1.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44">
<p>Low: Denial of Service CVE-2014-0230</p>
<p>When a response for a request with a request body is
returned to the user agent before the request body is
fully read, by default Tomcat swallows the remaining
request body so that the next request on the connection
may be processed. There was no limit to the size of
request body that Tomcat would swallow. This permitted
a limited Denial of Service as Tomcat would never close
the connection and a processing thread would remain
allocated to the connection.</p>
<p>Moderate: Security Manager bypass CVE-2014-7810</p>
<p>Malicious web applications could use expression
language to bypass the protections of a Security
Manager as expressions were evaluated within a
privileged code section.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-0230</cvename>
<cvename>CVE-2014-7810</cvename>
<url>https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-06-16</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="c470db07-1098-11e5-b6a8-002590263bf5">
<topic>security/ossec-hids-* -- root escalation via syscheck feature</topic>
<affects>
<package>
<name>ossec-hids-server</name>
<name>ossec-hids-client</name>
<name>ossec-hids-local</name>
<range><ge>2.7</ge><lt>2.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSSEC reports:</p>
<blockquote cite="http://www.ossec.net/?p=1198">
<p>The CVE-2015-3222 vulnerability, which allows for root escalation
via sys check has been fixed in OSSEC 2.8.2. This issue does not
affect agents.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3222</cvename>
<freebsdpr>ports/200801</freebsdpr>
<url>http://www.ossec.net/?p=1198</url>
<url>https://github.com/ossec/ossec-hids/releases/tag/2.8.2</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-12</entry>
</dates>
</vuln>
<vuln vid="8305e215-1080-11e5-8ba2-000c2980a9f3">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_2</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2b</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_6</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.1.7</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_12</lt></range>
<range><ge>9.3</ge><lt>9.3_16</lt></range>
<range><ge>8.4</ge><lt>8.4_30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL team reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150611.txt">
<ul>
<li>Missing DHE man-in-the-middle protection (Logjam)
(CVE-2015-4000)</li>
<li>Malformed ECParameters causes infinite loop (CVE-2015-1788)</li>
<li>Exploitable out-of-bounds read in X509_cmp_time
(CVE-2015-1789)</li>
<li>PKCS#7 crash with missing EnvelopedContent (CVE-2015-1790)</li>
<li>CMS verify infinite loop with unknown hash function
(CVE-2015-1792)</li>
<li>Race condition handling NewSessionTicket (CVE-2015-1791)</li>
<li>Invalid free in DTLS (CVE-2014-8176)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8176</cvename>
<cvename>CVE-2015-1788</cvename>
<cvename>CVE-2015-1789</cvename>
<cvename>CVE-2015-1790</cvename>
<cvename>CVE-2015-1791</cvename>
<cvename>CVE-2015-1792</cvename>
<cvename>CVE-2015-4000</cvename>
<freebsdsa>SA-15:10.openssl</freebsdsa>
<url>https://www.openssl.org/news/secadv_20150611.txt</url>
</references>
<dates>
<discovery>2015-06-11</discovery>
<entry>2015-06-11</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="1e63db88-1050-11e5-a4df-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.466</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-11.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system.
</p>
<p>
These updates resolve a vulnerability (CVE-2015-3096) that could be
exploited to bypass the fix for CVE-2014-5333.
</p>
<p>
These updates improve memory address randomization of the Flash heap
for the Window 7 64-bit platform (CVE-2015-3097).
</p>
<p>
These updates resolve vulnerabilities that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).
</p>
<p>
These updates resolve a stack overflow vulnerability that could lead
to code execution (CVE-2015-3100).
</p>
<p>
These updates resolve a permission issue in the Flash broker for
Internet Explorer that could be exploited to perform privilege
escalation from low to medium integrity level (CVE-2015-3101).
</p>
<p>
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-3104).
</p>
<p>
These updates resolve a memory corruption vulnerability that could
lead to code execution (CVE-2015-3105).
</p>
<p>
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).
</p>
<p>
These updates resolve a memory leak vulnerability that could be used
to bypass ASLR (CVE-2015-3108).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-11.html</url>
<cvename>CVE-2015-3096</cvename>
<cvename>CVE-2015-3097</cvename>
<cvename>CVE-2015-3098</cvename>
<cvename>CVE-2015-3099</cvename>
<cvename>CVE-2015-3100</cvename>
<cvename>CVE-2015-3101</cvename>
<cvename>CVE-2015-3102</cvename>
<cvename>CVE-2015-3103</cvename>
<cvename>CVE-2015-3104</cvename>
<cvename>CVE-2015-3105</cvename>
<cvename>CVE-2015-3106</cvename>
<cvename>CVE-2015-3107</cvename>
<cvename>CVE-2015-3108</cvename>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-11</entry>
</dates>
</vuln>
<vuln vid="10a6d0aa-0b1c-11e5-bb90-002590263bf5">
<topic>libzmq4 -- V3 protocol handler vulnerable to downgrade attacks</topic>
<affects>
<package>
<name>libzmq4</name>
<range><ge>4.0.0</ge><lt>4.0.6</lt></range>
<range><ge>4.1.0</ge><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pieter Hintjens reports:</p>
<blockquote cite="https://github.com/zeromq/libzmq/issues/1273">
<p>It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by
sending a ZMTP v2 or earlier header. The library accepts such
connections without applying its security mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9721</cvename>
<url>https://github.com/zeromq/libzmq/issues/1273</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/05/07/8</mlist>
<freebsdpr>ports/200502</freebsdpr>
</references>
<dates>
<discovery>2014-12-04</discovery>
<entry>2015-06-10</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="8fbd4187-0f18-11e5-b6a8-002590263bf5">
<topic>pgbouncer -- remote denial of service</topic>
<affects>
<package>
<name>pgbouncer</name>
<range><lt>1.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PgBouncer reports:</p>
<blockquote cite="https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/">
<p>Fix remote crash - invalid packet order causes lookup of NULL pointer. Not
exploitable, just DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4054</cvename>
<url>https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/05/21/2</mlist>
<freebsdpr>ports/200507</freebsdpr>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2015-06-10</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="a40ec970-0efa-11e5-90e4-d050996490d0">
<topic>cups -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cups-base</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CUPS development team reports:</p>
<blockquote cite="https://cups.org/blog.php?L1082">
<p>The new release addresses two security vulnerabilities,
add localizations for German and Russian, and includes
several general bug fixes. Changes include:</p>
<p>Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159
exploiting the dynamic linker (STR #4609)</p>
<p>Security: The scheduler could hang with malformed
gzip data (STR #4602)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1158</cvename>
<cvename>CVE-2015-1159</cvename>
<url>https://cups.org/blog.php?L1082</url>
<url>https://www.kb.cert.org/vuls/id/810572</url>
</references>
<dates>
<discovery>2015-06-09</discovery>
<entry>2015-06-09</entry>
</dates>
</vuln>
<vuln vid="55363e65-0e71-11e5-8027-00167671dd1d">
<topic>strongswan -- Denial-of-service and potential remote code execution vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>5.2.2</ge><lt>5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>StrongSwan Project reports</p>
<blockquote cite="https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html">
<p>A denial-of-service and potential remote code execution vulnerability
triggered by crafted IKE messages was discovered in strongSwan. Versions
5.2.2 and 5.3.0 are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3991</cvename>
<url>https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html</url>
</references>
<dates>
<discovery>2015-05-15</discovery>
<entry>2015-06-09</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="10d14955-0e45-11e5-b6a8-002590263bf5">
<topic>strongswan -- Information Leak Vulnerability</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>4.3.0</ge><lt>5.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan Project reports:</p>
<blockquote cite="http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html">
<p>An information leak vulnerability was fixed that, in certain IKEv2
setups, allowed rogue servers with a valid certificate accepted by
the client to trick it into disclosing user credentials (even plain
passwords if the client accepts EAP-GTC). This was caused because
constraints against the server's authentication were enforced too
late. All versions since 4.3.0 are affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4171</cvename>
<url>http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html</url>
</references>
<dates>
<discovery>2015-06-08</discovery>
<entry>2015-06-09</entry>
</dates>
</vuln>
<vuln vid="838fa84a-0e25-11e5-90e4-d050996490d0">
<topic>redis -- EVAL Lua Sandbox Escape</topic>
<affects>
<package>
<name>redis</name>
<name>redis-devel</name>
<range><ge>2.6.0</ge><lt>2.8.21</lt></range>
<range><ge>3.0</ge><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Murphy reports:</p>
<blockquote cite="http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/">
<p>It is possible to break out of the Lua sandbox in
Redis and execute arbitrary code.</p>
<p>This shouldn’t pose a threat to users under the
trusted Redis security model where only trusted
users can connect to the database. However, in real
deployments there could be databases that can be
accessed by untrusted users. The main deployments
that are vulnerable are developers machines, places
where redis servers can be reached via SSRF attacks
and cloud hosting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4335</cvename>
<url>http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/</url>
</references>
<dates>
<discovery>2015-06-04</discovery>
<entry>2015-06-08</entry>
</dates>
</vuln>
<vuln vid="bd1ab7a5-0e01-11e5-9976-a0f3c100ae18">
<topic>tidy -- heap-buffer-overflow</topic>
<affects>
<package>
<name>tidy4</name>
<range><le>20000804_3</le></range>
</package>
<package>
<name>tidy-devel</name>
<range><le>090315.c_2</le></range>
</package>
<package>
<name>tidy-lib</name>
<range><le>090315.c_2</le></range>
</package>
<package>
<name>tidy-html5</name>
<range><lt>4.9.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Geoff McLane reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/633">
<p>tidy is affected by a write out of bounds when processing malformed html files.</p>
<p>This issue could be abused on server side applications that use php-tidy extension with user input.</p>
<p>The issue was confirmed, analyzed, and fixed by the tidy5 maintainer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/htacg/tidy-html5/issues/217</url>
<url>http://seclists.org/oss-sec/2015/q2/633</url>
<url>http://seclists.org/oss-sec/2015/q3/116</url>
<cvename>CVE-2015-5522</cvename>
<cvename>CVE-2015-5523</cvename>
</references>
<dates>
<discovery>2015-06-03</discovery>
<entry>2015-06-08</entry>
<modified>2015-07-15</modified>
</dates>
</vuln>
<vuln vid="e69af246-0ae2-11e5-90e4-d050996490d0">
<topic>pcre -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Venustech ADLAB reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1636">
<p>PCRE library is prone to a vulnerability which leads
to Heap Overflow. During the compilation of a malformed
regular expression, more data is written on the malloced
block than the expected size output by compile_regex.</p>
</blockquote>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1638">
<p>PCRE library is prone to a vulnerability which leads to
Stack Overflow. Without enough bound checking inside
match(), the stack memory could be overflowed via a
crafted regular expression.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3210</cvename>
<cvename>CVE-2015-3217</cvename>
<url>https://bugs.exim.org/show_bug.cgi?id=1636</url>
<url>https://bugs.exim.org/show_bug.cgi?id=1638</url>
</references>
<dates>
<discovery>2015-05-29</discovery>
<entry>2015-06-04</entry>
<modified>2015-06-07</modified>
</dates>
</vuln>
<vuln vid="bbc0db92-084c-11e5-bb90-002590263bf5">
<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
<affects>
<package>
<name>hostapd</name>
<range><lt>2.4_1</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt">
<p>WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2
- CVE-2015-4141)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt">
<p>Integer underflow in AP mode WMM Action frame processing. (2015-3 -
CVE-2015-4142)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt">
<p>EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143,
CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)</p>
</blockquote>
</body>
</description>
<references>
<url>http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt</url>
<url>http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt</url>
<url>http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt</url>
<cvename>CVE-2015-4141</cvename>
<cvename>CVE-2015-4142</cvename>
<cvename>CVE-2015-4143</cvename>
<cvename>CVE-2015-4144</cvename>
<cvename>CVE-2015-4145</cvename>
<cvename>CVE-2015-4146</cvename>
<mlist>http://openwall.com/lists/oss-security/2015/05/31/6</mlist>
</references>
<dates>
<discovery>2015-05-04</discovery>
<entry>2015-06-01</entry>
</dates>
</vuln>
<vuln vid="65b14d39-d01f-419c-b0b8-5df60b929973">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<name>ffmpeg0</name>
<range><lt>0.7.17,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<cvename>CVE-2012-5150</cvename>
<cvename>CVE-2014-4609</cvename>
<cvename>CVE-2014-8541</cvename>
<cvename>CVE-2014-8542</cvename>
<cvename>CVE-2014-8543</cvename>
<cvename>CVE-2014-8545</cvename>
<cvename>CVE-2014-8547</cvename>
<cvename>CVE-2014-8548</cvename>
<cvename>CVE-2014-9316</cvename>
<cvename>CVE-2014-9317</cvename>
<cvename>CVE-2014-9603</cvename>
<cvename>CVE-2015-1872</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-03-12</discovery>
<entry>2015-06-02</entry>
</dates>
</vuln>
<vuln vid="022255be-0895-11e5-a242-5404a68ad561">
<topic>avidemux26 -- multiple vulnerabilities in bundled FFmpeg</topic>
<affects>
<package>
<name>avidemux2</name>
<range><lt>2.6.8</lt></range>
</package>
<package>
<name>avidemux26</name>
<range><lt>2.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mageia project reports:</p>
<blockquote cite="http://advisories.mageia.org/MGASA-2015-0233.html">
<p>Avidemux is built with a bundled set of FFmpeg libraries.
The bundled FFmpeg version has been updated from 1.2.10
to 1.2.12 to fix these security issues and other bugs
fixed upstream in FFmpeg.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9316</cvename>
<cvename>CVE-2014-9317</cvename>
<cvename>CVE-2014-9603</cvename>
<cvename>CVE-2014-9604</cvename>
<cvename>CVE-2015-1872</cvename>
<cvename>CVE-2015-3417</cvename>
<freebsdpr>ports/200507</freebsdpr>
<url>http://advisories.mageia.org/MGASA-2015-0233.html</url>
</references>
<dates>
<discovery>2015-05-18</discovery>
<entry>2015-06-01</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="ffe2d86c-07d9-11e5-9a28-001e67150279">
<topic>rest-client -- plaintext password disclosure</topic>
<affects>
<package>
<name>rubygem-rest-client</name>
<range><lt>1.6.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The open sourced vulnerability database reports:</p>
<blockquote cite="http://osvdb.org/show/osvdb/117461">
<p>REST Client for Ruby contains a flaw that is due to the application
logging password information in plaintext. This may allow a local
attacker to gain access to password information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3448</cvename>
<freebsdpr>ports/200504</freebsdpr>
<url>https://github.com/rest-client/rest-client/issues/349</url>
<url>http://osvdb.org/show/osvdb/117461</url>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-05-31</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="83a7a720-07d8-11e5-9a28-001e67150279">
<topic>rest-client -- session fixation vulnerability</topic>
<affects>
<package>
<name>rubygem-rest-client</name>
<range><lt>1.6.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andy Brody reports:</p>
<blockquote cite="https://github.com/rest-client/rest-client/issues/369">
<p>When Ruby rest-client processes an HTTP redirection response,
it blindly passes along the values from any Set-Cookie headers to the
redirection target, regardless of domain, path, or expiration.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1820</cvename>
<freebsdpr>ports/200504</freebsdpr>
<url>https://github.com/rest-client/rest-client/issues/369</url>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-05-31</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="cfb12f02-06e1-11e5-8fda-002590263bf5">
<topic>cabextract -- directory traversal with UTF-8 symbols in filenames</topic>
<affects>
<package>
<name>cabextract</name>
<range><lt>1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cabextract ChangeLog reports:</p>
<blockquote cite="http://www.cabextract.org.uk/#changes">
<p>It was possible for cabinet files to extract to absolute file
locations, and it was possible on Cygwin to get around cabextract's
absolute and relative path protections by using backslashes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.cabextract.org.uk/#changes</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/02/18/3</mlist>
<cvename>CVE-2015-2060</cvename>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="cc7548ef-06e1-11e5-8fda-002590263bf5">
<topic>libmspack -- frame_end overflow which could cause infinite loop</topic>
<affects>
<package>
<name>libmspack</name>
<range><lt>0.5</lt></range>
</package>
<package>
<name>cabextract</name>
<range><lt>1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>There is a denial of service vulnerability in libmspack. The
libmspack code is built into cabextract, so it is also
vulnerable.</p>
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9556">
<p>Integer overflow in the qtmd_decompress function in libmspack 0.4
allows remote attackers to cause a denial of service (hang) via a
crafted CAB file, which triggers an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9556</cvename>
<url>https://bugs.debian.org/773041</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/01/07/2</mlist>
</references>
<dates>
<discovery>2014-12-11</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="48504af7-07ad-11e5-879c-00e0814cab4e">
<topic>django -- Fixed session flushing in the cached_db backend</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.8</ge><lt>1.8.2</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150531,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/may/20/security-release/">
<p>A change to session.flush() in the cached_db session backend in
Django 1.8 mistakenly sets the session key to an empty string
rather than None. An empty string is treated as a valid session key
and the session cookie is set accordingly. Any users with an empty
string in their session cookie will use the same session store.
session.flush() is called by django.contrib.auth.logout() and, more
seriously, by django.contrib.auth.login() when a user switches accounts.
If a user is logged in and logs in again to a different account
(without logging out) the session is flushed to avoid reuse.
After the session is flushed (and its session key becomes '') the
account details are set on the session and the session is saved.
Any users with an empty string in their session cookie will now be
logged into that account.</p>
<p>Thanks to Sam Cooke for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/may/20/security-release/</url>
<cvename>CVE-2015-3982</cvename>
</references>
<dates>
<discovery>2015-05-20</discovery>
<entry>2015-05-31</entry>
</dates>
</vuln>
<vuln vid="9471ec47-05a2-11e5-8fda-002590263bf5">
<topic>proxychains-ng -- current path as the first directory for the library search path</topic>
<affects>
<package>
<name>proxychains-ng</name>
<range><lt>4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mamoru TASAKA reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q2/430">
<p>proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so
and execvp() the arbitrary command user has specified.
proxychains4 sets the current directory as the first path
to search libproxychains4.so</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2015/05/12/6</mlist>
<mlist>http://seclists.org/oss-sec/2015/q2/430</mlist>
<cvename>CVE-2015-3887</cvename>
</references>
<dates>
<discovery>2015-05-11</discovery>
<entry>2015-05-29</entry>
</dates>
</vuln>
<vuln vid="a13500d0-0570-11e5-aab1-d050996490d0">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html">
<p>The following vulnerabilities have been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-12</p>
<p>The LBMR dissector could go into an infinite loop.
(Bug 11036) CVE-2015-3808, CVE-2015-3809</p></li>
<li><p>wnpa-sec-2015-13</p>
<p>The WebSocket dissector could recurse excessively.
(Bug 10989) CVE-2015-3810</p></li>
<li><p>wnpa-sec-2015-14</p>
<p>The WCP dissector could crash while decompressing data.
(Bug 10978) CVE-2015-3811</p></li>
<li><p>wnpa-sec-2015-15</p>
<p>The X11 dissector could leak memory. (Bug 11088)
CVE-2015-3812</p></li>
<li><p>wnpa-sec-2015-16</p>
<p>The packet reassembly code could leak memory.
(Bug 11129) CVE-2015-3813</p></li>
<li><p>wnpa-sec-2015-17</p>
<p>The IEEE 802.11 dissector could go into an infinite loop.
(Bug 11110) CVE-2015-3814</p></li>
<li><p>wnpa-sec-2015-18</p>
<p>The Android Logcat file parser could crash. Discovered by
Hanno Böck. (Bug 11188) CVE-2015-3815</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3808</cvename>
<cvename>CVE-2015-3809</cvename>
<cvename>CVE-2015-3810</cvename>
<cvename>CVE-2015-3811</cvename>
<cvename>CVE-2015-3812</cvename>
<cvename>CVE-2015-3813</cvename>
<cvename>CVE-2015-3814</cvename>
<cvename>CVE-2015-3815</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-12.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-13.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-14.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-15.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-16.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-17.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2015-18.html</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-28</entry>
</dates>
</vuln>
<vuln vid="406636fe-055d-11e5-aab1-d050996490d0">
<topic>krb5 -- requires_preauth bypass in PKINIT-enabled KDC</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13.2</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MIT reports:</p>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160">
<p>In MIT krb5 1.12 and later, when the KDC is configured
with PKINIT support, an unauthenticated remote attacker
can bypass the requires_preauth flag on a client principal
and obtain a ciphertext encrypted in the principal's
long-term key. This ciphertext could be used to conduct
an off-line dictionary attack against the user's password.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2694</cvename>
<url>http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160</url>
</references>
<dates>
<discovery>2015-05-25</discovery>
<entry>2015-05-28</entry>
</dates>
</vuln>
<vuln vid="27f742f6-03f4-11e5-aab1-d050996490d0">
<topic>cURL -- sensitive HTTP server headers also sent to proxies</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.42.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150429.html">
<p>libcurl provides applications a way to set custom HTTP
headers to be sent to the server by using CURLOPT_HTTPHEADER.
A similar option is available for the curl command-line
tool with the '--header' option.</p>
<p>When the connection passes through an HTTP proxy the
same set of headers is sent to the proxy as well by default.
While this is by design, it has not necessarily been clear
nor understood by application programmers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3153</cvename>
<url>http://curl.haxx.se/docs/adv_20150429.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-26</entry>
</dates>
</vuln>
<vuln vid="6294f75f-03f2-11e5-aab1-d050996490d0">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.42.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422A.html">
<p>libcurl keeps a pool of its last few connections around
after use to facilitate easy, convenient, and completely
transparent connection re-use for applications.</p>
<p>When doing HTTP requests NTLM authenticated, the entire
connection becomes authenticated and not just the
specific HTTP request which is otherwise how HTTP works.
This makes NTLM special and a subject for special
treatment in the code. With NTLM, once the connection is
authenticated, no further authentication is necessary until
the connection gets closed.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422B.html">
<p>When doing HTTP requests Negotiate authenticated, the
entire connection may become authenticated and not just
the specific HTTP request which is otherwise how HTTP
works, as Negotiate can basically use NTLM under the hood.
curl was not adhering to this fact but would assume that
such requests would also be authenticated per request.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422C.html">
<p>libcurl supports HTTP "cookies" as documented in RFC 6265.
Together with each individual cookie there are several
different properties, but for this vulnerability we
focus on the associated "path" element. It tells
information about for which path on a given host the
cookies is valid.</p>
<p>The internal libcurl function called sanitize_cookie_path()
that cleans up the path element as given to it from a
remote site or when read from a file, did not properly
validate the input. If given a path that consisted of a
single double-quote, libcurl would index a newly
allocated memory area with index -1 and assign a zero
to it, thus destroying heap memory it wasn't supposed to.</p>
</blockquote>
<blockquote cite="http://curl.haxx.se/docs/adv_20150422D.html">
<p>There is a private function in libcurl called fix_hostname()
that removes a trailing dot from the host name if there is
one. The function is called after the host name has been
extracted from the URL libcurl has been told to act on.</p>
<p>If a URL is given with a zero-length host name, like in
"http://:80" or just ":80", fix_hostname() will index the
host name pointer with a -1 offset (as it blindly assumes
a non-zero length) and both read and assign that address.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20150422A.html</url>
<url>http://curl.haxx.se/docs/adv_20150422B.html</url>
<url>http://curl.haxx.se/docs/adv_20150422C.html</url>
<url>http://curl.haxx.se/docs/adv_20150422D.html</url>
<cvename>CVE-2014-3143</cvename>
<cvename>CVE-2014-3144</cvename>
<cvename>CVE-2014-3145</cvename>
<cvename>CVE-2014-3148</cvename>
</references>
<dates>
<discovery>2015-04-22</discovery>
<entry>2015-05-26</entry>
</dates>
</vuln>
<vuln vid="607f4d44-0158-11e5-8fda-002590263bf5">
<topic>cassandra -- remote execution of arbitrary code</topic>
<affects>
<package>
<name>cassandra</name>
<range><ge>1.2.0</ge><le>1.2.19</le></range>
</package>
<package>
<name>cassandra2</name>
<range><ge>2.0.0</ge><lt>2.0.14</lt></range>
<range><ge>2.1.0</ge><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jake Luciani reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/">
<p>Under its default configuration, Cassandra binds an unauthenticated
JMX/RMI interface to all network interfaces. As RMI is an API for the
transport and remote execution of serialized Java, anyone with access
to this interface can execute arbitrary code as the running user.</p>
<p>Mitigation:</p>
<p>1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade
to a supported version of Cassandra, or manually configure encryption
and authentication of JMX,
(see https://wiki.apache.org/cassandra/JmxSecurity).</p>
<p>2.0.x users should upgrade to 2.0.14</p>
<p>2.1.x users should upgrade to 2.1.4</p>
<p>Alternately, users of any version not wishing to upgrade can
reconfigure JMX/RMI to enable encryption and authentication according
to https://wiki.apache.org/cassandra/JmxSecurityor
http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html</p>
<p>Credit:</p>
<p>This issue was discovered by Georgi Geshev of MWR InfoSecurity</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/</url>
<cvename>CVE-2015-0225</cvename>
</references>
<dates>
<discovery>2015-04-01</discovery>
<entry>2015-05-24</entry>
</dates>
</vuln>
<vuln vid="865863af-fb5e-11e4-8fda-002590263bf5">
<topic>py-salt -- potential shell injection vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colton Myers reports:</p>
<blockquote cite="http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html">
<p>In order to fix potential shell injection vulnerabilities in salt
modules, a change has been made to the various cmd module functions.
These functions now default to python_shell=False, which means that
the commands will not be sent to an actual shell.</p>
<p>The largest side effect of this change is that "shellisms", such as
pipes, will not work by default. The modules shipped with salt have
been audited to fix any issues that might have arisen from this
change. Additionally, the cmd state module has been unaffected, and
use of cmd.run in jinja is also unaffected. cmd.run calls on the
CLI will also allow shellisms.</p>
<p>However, custom execution modules which use shellisms in cmd calls
will break, unless you pass python_shell=True to these calls.</p>
<p>As a temporary workaround, you can set cmd_safe: False in your
minion and master configs. This will revert the default, but is
also less secure, as it will allow shell injection vulnerabilities
to be written in custom code. We recommend you only set this
setting for as long as it takes to resolve these issues in your
custom code, then remove the override.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html</url>
</references>
<dates>
<discovery>2015-05-11</discovery>
<entry>2015-05-24</entry>
</dates>
</vuln>
<vuln vid="384fc0b2-0144-11e5-8fda-002590263bf5">
<topic>davmail -- fix potential CVE-2014-3566 vulnerability (POODLE)</topic>
<affects>
<package>
<name>davmail</name>
<range><lt>4.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mickaël Guessant reports:</p>
<blockquote cite="http://sourceforge.net/p/davmail/mailman/message/33279118/">
<p>DavMail 4.6.0 released</p>
<p>Enhancements: Fix potential CVE-2014-3566 vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sourceforge.net/p/davmail/mailman/message/33279118/</url>
<url>http://sourceforge.net/p/davmail/code/2322/</url>
<cvename>CVE-2014-3566</cvename>
</references>
<dates>
<discovery>2014-10-27</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="7927165a-0126-11e5-9d98-080027ef73ec">
<topic>dnsmasq -- remotely exploitable buffer overflow in release candidate</topic>
<affects>
<package>
<name>dnsmasq-devel</name>
<range><ge>2.73rc6</ge><lt>2.73rc8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Kelley reports:</p>
<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html">
<p>Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a
remotely exploitable buffer overflow in those trees. I just tagged
2.[73]rc8, which includes the fix.
</p>
</blockquote>
<p>(Corrections from second URL.)</p>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html</url>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html</url>
</references>
<dates>
<discovery>2015-05-15</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="37569eb7-0125-11e5-9d98-080027ef73ec">
<topic>dnsmasq -- data exposure and denial of service</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.72_1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.73rc4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:
</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3294"><p>The tcp_request function in Dnsmasq before 2.73rc4
does not properly handle the return value of the setup_reply function,
which allows remote attackers to read process memory and cause a
denial of service (out-of-bounds read and crash) via a malformed DNS
request."</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html</url>
<cvename>CVE-2015-3294</cvename>
<url>http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-05-23</entry>
</dates>
</vuln>
<vuln vid="4a88e3ed-00d3-11e5-a072-d050996490d0">
<topic>pcre -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PCRE development team reports:</p>
<blockquote cite="http://www.pcre.org/original/changelog.txt">
<p>A pattern such as "((?2){0,1999}())?", which has a group
containing a forward reference repeated a large (but limited)
number of times within a repeated outer group that has a zero
minimum quantifier, caused incorrect code to be compiled,
leading to the error "internal error: previously-checked
referenced subpattern not found" when an incorrect memory
address was read. This bug was reported as "heap overflow",
discovered by Kai Lu of Fortinet's FortiGuard Labs and given
the CVE number CVE-2015-2325.</p>
<p>A pattern such as "((?+1)(\1))/" containing a forward
reference subroutine call within a group that also contained
a recursive back reference caused incorrect code to be
compiled. This bug was reported as "heap overflow",
discovered by Kai Lu of Fortinet's FortiGuard Labs,
and given the CVE number CVE-2015-2326.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2325</cvename>
<cvename>CVE-2015-2326</cvename>
<url>http://www.pcre.org/original/changelog.txt</url>
</references>
<dates>
<discovery>2015-04-28</discovery>
<entry>2015-05-22</entry>
<modified>2015-06-07</modified>
</dates>
</vuln>
<vuln vid="31de2e13-00d2-11e5-a072-d050996490d0">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.41</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.25</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP development team reports:</p>
<blockquote cite="https://php.net/ChangeLog-5.php#5.6.9">
<p>Fixed bug #69364 (PHP Multipart/form-data remote DoS
Vulnerability). (CVE-2015-4024)</p>
<p>Fixed bug #69418 (CVE-2006-7243 fix regressions in
5.4+). (CVE-2015-4025)</p>
<p>Fixed bug #69545 (Integer overflow in ftp_genlist()
resulting in heap overflow). (CVE-2015-4022)</p>
<p>Fixed bug #68598 (pcntl_exec() should not allow null
char). (CVE-2015-4026)</p>
<p>Fixed bug #69453 (Memory Corruption in phar_parse_tarfile
when entry filename starts with null). (CVE-2015-4021)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4021</cvename>
<cvename>CVE-2015-4022</cvename>
<cvename>CVE-2015-4024</cvename>
<cvename>CVE-2015-4025</cvename>
<cvename>CVE-2015-4026</cvename>
<url>https://php.net/ChangeLog-5.php#5.6.9</url>
</references>
<dates>
<discovery>2015-05-14</discovery>
<entry>2015-05-22</entry>
</dates>
</vuln>
<vuln vid="fc38cd83-00b3-11e5-8ebd-0026551a22dc">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.20</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.16</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.11</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.7</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1587/">
<p>
This update fixes three security vulnerabilities reported in
PostgreSQL over the past few months. Nether of these issues is seen as
particularly urgent. However, users should examine them in case their
installations are vulnerable:.
</p>
<ul>
<li>CVE-2015-3165 Double "free" after authentication timeout.</li>
<li>CVE-2015-3166 Unanticipated errors from the standard library.</li>
<li>CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3165</cvename>
<cvename>CVE-2015-3166</cvename>
<cvename>CVE-2015-3167</cvename>
</references>
<dates>
<discovery>2015-04-10</discovery>
<entry>2015-05-22</entry>
</dates>
</vuln>
<vuln vid="d0034536-ff24-11e4-a072-d050996490d0">
<topic>proftpd -- arbitrary code execution vulnerability with chroot</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ProFTPd development team reports:</p>
<blockquote cite="http://bugs.proftpd.org/show_bug.cgi?id=4169">
<p>Vadim Melihow reported a critical issue with proftpd
installations that use the mod_copy module's SITE CPFR/SITE
CPTO commands; mod_copy allows these commands to be used by
*unauthenticated clients*.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3306</cvename>
<url>http://bugs.proftpd.org/show_bug.cgi?id=4169</url>
</references>
<dates>
<discovery>2015-04-15</discovery>
<entry>2015-05-20</entry>
</dates>
</vuln>
<vuln vid="35431f79-fe3e-11e4-ba63-000c292ee6b8">
<topic>ipsec-tools -- Memory leak leading to denial of service</topic>
<affects>
<package>
<name>ipsec-tools</name>
<range><lt>0.8.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Javantea reports:</p>
<blockquote cite="https://www.altsci.com/ipsec/">
<p>It is a null dereference crash, leading to denial of
service against the IKE daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.altsci.com/ipsec/</url>
</references>
<dates>
<discovery>2015-05-18</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="a9d456b4-fe4c-11e4-ad15-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>43.0.2357.65</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>43.0.2357.65</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>43.0.2357.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html">
<p>37 security fixes in this release, including:</p>
<ul>
<li>[474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit
to anonymous.</li>
<li>[464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit
to anonymous.</li>
<li>[444927] High CVE-2015-1254: Cross-origin bypass in Editing.
Credit to armin@rawsec.net.</li>
<li>[473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit
to Khalil Zhani.</li>
<li>[478549] High CVE-2015-1256: Use-after-free in SVG. Credit to
Atte Kettunen of OUSPG.</li>
<li>[481015] High CVE-2015-1251: Use-after-free in Speech. Credit
to SkyLined working with HP's Zero Day Initiative.</li>
<li>[468519] Medium CVE-2015-1257: Container-overflow in SVG.
Credit to miaubiz.</li>
<li>[450939] Medium CVE-2015-1258: Negative-size parameter in
libvpx. Credit to cloudfuzzer</li>
<li>[468167] Medium CVE-2015-1259: Uninitialized value in PDFium.
Credit to Atte Kettunen of OUSPG</li>
<li>[474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit
to Khalil Zhani.</li>
<li>[466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho
Nurminen.</li>
<li>[476647] Medium CVE-2015-1262: Uninitialized value in Blink.
Credit to miaubiz.</li>
<li>[479162] Low CVE-2015-1263: Insecure download of spellcheck
dictionary. Credit to Mike Ruddy.</li>
<li>[481015] Low CVE-2015-1264: Cross-site scripting in bookmarks.
Credit to K0r3Ph1L.</li>
<li>[489518] CVE-2015-1265: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.3
branch (currently 4.3.61.21).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html</url>
<cvename>CVE-2015-1251</cvename>
<cvename>CVE-2015-1252</cvename>
<cvename>CVE-2015-1253</cvename>
<cvename>CVE-2015-1254</cvename>
<cvename>CVE-2015-1255</cvename>
<cvename>CVE-2015-1256</cvename>
<cvename>CVE-2015-1257</cvename>
<cvename>CVE-2015-1258</cvename>
<cvename>CVE-2015-1259</cvename>
<cvename>CVE-2015-1260</cvename>
<cvename>CVE-2015-1261</cvename>
<cvename>CVE-2015-1262</cvename>
<cvename>CVE-2015-1263</cvename>
<cvename>CVE-2015-1264</cvename>
<cvename>CVE-2015-1265</cvename>
</references>
<dates>
<discovery>2015-05-19</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="3d0428b2-fdfb-11e4-894f-d050996490d0">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.98.7</lt></range>
</package>
<package>
<name>clamav-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ClamAV project reports:</p>
<blockquote cite="http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html">
<p>ClamAV 0.98.7 is here! This release contains new
scanning features and bug fixes.</p>
<p>Fix infinite loop condition on crafted y0da cryptor file.
Identified and patch suggested by Sebastian Andrzej Siewior.
CVE-2015-2221.</p>
<p>Fix crash on crafted petite packed file. Reported and patch
supplied by Sebastian Andrzej Siewior. CVE-2015-2222.</p>
<p>Fix an infinite loop condition on a crafted "xz" archive
file. This was reported by Dimitri Kirchner and Goulven
Guiheux. CVE-2015-2668.</p>
<p>Apply upstream patch for possible heap overflow in Henry
Spencer's regex library. CVE-2015-2305.</p>
<p>Fix crash in upx decoder with crafted file. Discovered and
patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2170</cvename>
<cvename>CVE-2015-2221</cvename>
<cvename>CVE-2015-2222</cvename>
<cvename>CVE-2015-2305</cvename>
<cvename>CVE-2015-2668</cvename>
<url>http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-19</entry>
</dates>
</vuln>
<vuln vid="a0089e18-fc9e-11e4-bc58-001e67150279">
<topic>rubygems -- request hijacking vulnerability</topic>
<affects>
<package>
<name>ruby20-gems</name>
<range><lt>2.4.7</lt></range>
</package>
<package>
<name>ruby21-gems</name>
<range><lt>2.4.7</lt></range>
</package>
<package>
<name>ruby22-gems</name>
<range><lt>2.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathan Claudius reports:</p>
<blockquote cite="http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html">
<p>RubyGems provides the ability of a domain to direct clients to a
separate host that is used to fetch gems and make API calls against.
This mechanism is implemented via DNS, specifically a SRV record
_rubygems._tcp under the original requested domain.</p>
<p>RubyGems did not validate the hostname returned in the SRV record
before sending requests to it. This left clients open to a DNS
hijack attack, whereby an attacker could return a SRV of their
choosing and get the client to use it.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/200264</freebsdpr>
<cvename>CVE-2015-3900</cvename>
<url>http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html</url>
</references>
<dates>
<discovery>2015-05-14</discovery>
<entry>2015-05-17</entry>
</dates>
</vuln>
<vuln vid="2780e442-fc59-11e4-b18b-6805ca1d3bb1">
<topic>qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM")</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>0.11.1_19</lt></range>
<range><ge>0.12</ge><lt>2.3.0_1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<range><lt>2.3.50.g20150501_1</lt></range>
</package>
<package>
<name>virtualbox-ose</name>
<range><lt>4.3.28</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><ge>4.5.0</ge><lt>4.5.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Geffner, CrowdStrike Senior Security Researcher reports:</p>
<blockquote cite="http://venom.crowdstrike.com/">
<p>VENOM, CVE-2015-3456, is a security vulnerability in
the virtual floppy drive code used by many computer
virtualization platforms. This vulnerability may allow
an attacker to escape from the confines of an affected
virtual machine (VM) guest and potentially obtain
code-execution access to the host. Absent mitigation,
this VM escape could open access to the host system and
all other VMs running on that host, potentially giving
adversaries significant elevated access to the host's
local network and adjacent systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3456</cvename>
<freebsdpr>ports/200255</freebsdpr>
<freebsdpr>ports/200256</freebsdpr>
<freebsdpr>ports/200257</freebsdpr>
<url>http://venom.crowdstrike.com/</url>
<url>http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html</url>
<url>http://xenbits.xen.org/xsa/advisory-133.html</url>
</references>
<dates>
<discovery>2015-04-29</discovery>
<entry>2015-05-17</entry>
<modified>2015-09-28</modified>
</dates>
</vuln>
<vuln vid="49d9c28c-fbad-11e4-b0fb-00269ee29e57">
<topic>Quassel IRC -- SQL injection vulnerability</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quassel IRC developers report:</p>
<blockquote cite="http://www.quassel-irc.org/node/127">
<p>Restarting a PostgreSQL database while Quassel Core is running
would not properly re-initialize the database session inside Quassel,
bringing back an old security issue (CVE-2013-4422).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283</url>
<cvename>CVE-2015-3427</cvename>
</references>
<dates>
<discovery>2015-04-23</discovery>
<entry>2015-05-16</entry>
</dates>
</vuln>
<vuln vid="c368155a-fa83-11e4-bc58-001e67150279">
<topic>rubygem-redcarpet -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-redcarpet</name>
<range><lt>3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel LeCheminant reports:</p>
<blockquote cite="https://hackerone.com/reports/46916">
<p>When markdown is being presented as HTML, there seems to be a
strange interaction between _ and @ that lets an attacker insert
malicious tags.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2015/04/07/11</mlist>
<url>https://hackerone.com/reports/46916</url>
<url>http://danlec.com/blog/bug-in-sundown-and-redcarpet</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-05-14</entry>
</dates>
</vuln>
<vuln vid="57325ecf-facc-11e4-968f-b888e347c638">
<topic>dcraw -- integer overflow condition</topic>
<affects>
<package>
<name>cinepaint</name>
<!-- no known fixed version -->
<range><ge>0.22.0</ge></range>
</package>
<package>
<name>darktable</name>
<range><lt>1.6.7</lt></range>
</package>
<package>
<name>dcraw</name>
<range><ge>7.00</ge><lt>9.26</lt></range>
</package>
<package>
<name>dcraw-m</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>exact-image</name>
<range><lt>0.9.1</lt></range>
</package>
<package>
<name>flphoto</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>freeimage</name>
<range><ge>3.13.0</ge><lt>3.16.0_1</lt></range>
</package>
<package>
<name>kodi</name>
<range><lt>14.2_1</lt></range>
</package>
<package>
<name>libraw</name>
<range><lt>0.16.1</lt></range>
</package>
<package>
<name>lightzone</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>netpbm</name>
<range><lt>10.35.96</lt></range>
</package>
<package>
<name>opengtl</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>rawstudio</name>
<range><lt>2.0_11</lt></range>
</package>
<package>
<name>ufraw</name>
<range><lt>0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ocert reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-006.html">
<p>The dcraw tool, as well as several other projects re-using its
code, suffers from an integer overflow condition which lead to a
buffer overflow.</p>
<p>The vulnerability concerns the 'len' variable, parsed without
validation from opened images, used in the ljpeg_start()
function.</p>
<p>A maliciously crafted raw image file can be used to trigger the
vulnerability, causing a Denial of Service condition.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3885</cvename>
<url>http://www.ocert.org/advisories/ocert-2015-006.html</url>
<url>https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e</url>
<url>https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5</url>
<url>https://sourceforge.net/p/netpbm/code/2512/</url>
</references>
<dates>
<discovery>2015-04-24</discovery>
<entry>2015-05-15</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="c6e31869-f99f-11e4-9f91-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php">
<p>XSRF/CSRF vulnerability in phpMyAdmin setup.</p>
<p>By deceiving a user to click on a crafted URL, it is
possible to alter the configuration file being generated
with phpMyAdmin setup.</p>
<p>This vulnerability only affects the configuration file
generation process and does not affect the effective
configuration file. Moreover, the configuration file being
generated is at risk only during the period when it's
writable.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php">
<p> Vulnerability allowing man-in-the-middle attack on API
call to GitHub.</p>
<p>A vulnerability in the API call to GitHub can be
exploited to perform a man-in-the-middle attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php</url>
<cvename>CVE-2015-3902</cvename>
<cvename>CVE-2015-3903</cvename>
</references>
<dates>
<discovery>2015-05-13</discovery>
<entry>2015-05-13</entry>
</dates>
</vuln>
<vuln vid="e206df57-f97b-11e4-b799-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.457</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.457</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-09.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system. Adobe recommends users update their product
installations to the latest versions.
</p>
<p>
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090,
CVE-2015-3093).
</p>
<p>
These updates resolve a heap overflow vulnerability that could lead
to code execution (CVE-2015-3088).
</p>
<p>
These updates resolve a time-of-check time-of-use (TOCTOU) race
condition that could be exploited to bypass Protected Mode in
Internet Explorer (CVE-2015-3081).
</p>
<p>
These updates resolve validation bypass issues that could be
exploited to write arbitrary data to the file system under user
permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).
</p>
<p>
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-3087).
</p>
<p>
These updates resolve a type confusion vulnerability that could lead
to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).
</p>
<p>
These updates resolve a use-after-free vulnerability that could lead
to code execution (CVE-2015-3080).
</p>
<p>
These updates resolve memory leak vulnerabilities that could be used
to bypass ASLR (CVE-2015-3091, CVE-2015-3092).
</p>
<p>
These updates resolve a security bypass vulnerability that could lead
to information disclosure (CVE-2015-3079), and provide additional
hardening to protect against CVE-2015-3044.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3044</cvename>
<cvename>CVE-2015-3077</cvename>
<cvename>CVE-2015-3078</cvename>
<cvename>CVE-2015-3079</cvename>
<cvename>CVE-2015-3080</cvename>
<cvename>CVE-2015-3081</cvename>
<cvename>CVE-2015-3082</cvename>
<cvename>CVE-2015-3083</cvename>
<cvename>CVE-2015-3084</cvename>
<cvename>CVE-2015-3085</cvename>
<cvename>CVE-2015-3086</cvename>
<cvename>CVE-2015-3087</cvename>
<cvename>CVE-2015-3088</cvename>
<cvename>CVE-2015-3089</cvename>
<cvename>CVE-2015-3090</cvename>
<cvename>CVE-2015-3091</cvename>
<cvename>CVE-2015-3092</cvename>
<cvename>CVE-2015-3093</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-09.html</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-13</entry>
</dates>
</vuln>
<vuln vid="d9b43004-f5fd-4807-b1d7-dbf66455b244">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>38.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>38.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.35</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.35</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.7.0</lt></range>
<range><ge>32.0</ge><lt>38.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0
/ rv:31.7)</p>
<p>MFSA-2015-47 Buffer overflow parsing H.264 video with
Linux Gstreamer</p>
<p>MFSA-2015-48 Buffer overflow with SVG content and CSS</p>
<p>MFSA-2015-49 Referrer policy ignored when links opened by
middle-click and context menu</p>
<p>MFSA-2015-50 Out-of-bounds read and write in asm.js validation</p>
<p>MFSA-2015-51 Use-after-free during text processing with
vertical text enabled</p>
<p>MFSA-2015-52 Sensitive URL encoded information written to
Android logcat</p>
<p>MFSA-2015-53 Use-after-free due to Media Decoder Thread creation
during shutdown</p>
<p>MFSA-2015-54 Buffer overflow when parsing compressed XML</p>
<p>MFSA-2015-55 Buffer overflow and out-of-bounds read while
parsing MP4 video metadata</p>
<p>MFSA-2015-56 Untrusted site hosting trusted page can
intercept webchannel responses</p>
<p>MFSA-2015-57 Privilege escalation through IPC channel messages</p>
<p>MFSA-2015-58 Mozilla Windows updater can be run outside
of application directory</p>
<p>MFSA 2015-93 Integer overflows in libstagefright while processing
MP4 video metadata</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2011-3079</cvename>
<cvename>CVE-2015-0797</cvename>
<cvename>CVE-2015-0833</cvename>
<cvename>CVE-2015-2708</cvename>
<cvename>CVE-2015-2709</cvename>
<cvename>CVE-2015-2710</cvename>
<cvename>CVE-2015-2711</cvename>
<cvename>CVE-2015-2712</cvename>
<cvename>CVE-2015-2713</cvename>
<cvename>CVE-2015-2714</cvename>
<cvename>CVE-2015-2715</cvename>
<cvename>CVE-2015-2716</cvename>
<cvename>CVE-2015-2717</cvename>
<cvename>CVE-2015-2718</cvename>
<cvename>CVE-2015-2720</cvename>
<cvename>CVE-2015-4496</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-46/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-47/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-48/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-49/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-50/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-51/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-52/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-53/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-54/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-55/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-56/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-57/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-58/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-93/</url>
</references>
<dates>
<discovery>2015-05-12</discovery>
<entry>2015-05-12</entry>
<modified>2015-08-28</modified>
</dates>
</vuln>
<vuln vid="fe910ed6-f88d-11e4-9ae3-0050562a4d7b">
<topic>suricata -- TLS/DER Parser Bug (DoS)</topic>
<affects>
<package>
<name>suricata</name>
<range><lt>2.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OISF Development Team reports:</p>
<blockquote cite="https://lists.openinfosecfoundation.org/pipermail/oisf-devel/2015-May/003406.html">
<p>The OISF development team is pleased to announce Suricata 2.0.8.
This release fixes a number of issues in the 2.0 series.</p>
<p>The most important issue is a bug in the DER parser which is used to
decode SSL/TLS certificates could crash Suricata. This issue was
reported by Kostya Kortchinsky of the Google Security Team and was fixed
by Pierre Chifflier of ANSSI.</p>
<p>Those processing large numbers of (untrusted) pcap files need to update
as a malformed pcap could crash Suricata. Again, credits go to Kostya
Kortchinsky.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0971</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971</url>
<url>https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7</url>
</references>
<dates>
<discovery>2015-05-06</discovery>
<entry>2015-05-12</entry>
</dates>
</vuln>
<vuln vid="0b040e24-f751-11e4-b24d-5453ed2e2b49">
<topic>libssh -- null pointer dereference</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Schneider reports:</p>
<blockquote cite="https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release/">
<p>libssh versions 0.5.1 and above have a logical error in the
handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A
detected error did not set the session into the error state
correctly and further processed the packet which leads to a null
pointer dereference. This is the packet after the initial key
exchange and doesn’t require authentication.</p>
<p>This could be used for a Denial of Service (DoS) attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3146</cvename>
<url>https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release</url>
</references>
<dates>
<discovery>2015-04-30</discovery>
<entry>2015-05-10</entry>
</dates>
</vuln>
<vuln vid="b13af778-f4fc-11e4-a95d-ac9e174be3af">
<topic>Vulnerability in HWP document filter</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>4.3.7</lt></range>
</package>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.1_9</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1677190,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1774">
<p>The HWP filter in LibreOffice before 4.3.7 and 4.4.x before
4.4.2 and Apache OpenOffice before 4.1.2 allows remote
attackers to cause a denial of service (crash) or possibly
execute arbitrary code via a crafted HWP document, which
triggers an out-of-bounds write.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1774</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-1774.html</url>
<url>https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-05-07</entry>
</dates>
</vuln>
<vuln vid="d86890da-f498-11e4-99aa-bcaec565249c">
<topic>wordpress -- 2 cross-site scripting vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2015/05/wordpress-4-2-2/">
<p>The Genericons icon font package, which is used in a number of
popular themes and plugins, contained an HTML file vulnerable to
a cross-site scripting attack. All affected themes and plugins
hosted on WordPress.org (including the Twenty Fifteen default
theme) have been updated today by the WordPress security team
to address this issue by removing this nonessential file. To
help protect other Genericons usage, WordPress 4.2.2
proactively scans the wp-content directory for this HTML
file and removes it. Reported by Robert Abela of Netsparker.</p>
<p>WordPress versions 4.2 and earlier are affected by a critical
cross-site scripting vulnerability, which could enable anonymous
users to compromise a site. WordPress 4.2.2 includes a
comprehensive fix for this issue.</p>
<p>The release also includes hardening for a potential cross-site
scripting vulnerability when using the visual editor. This issue
was reported by Mahadev Subedi.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/05/wordpress-4-2-2/</url>
</references>
<dates>
<discovery>2015-05-07</discovery>
<entry>2015-05-07</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="ba4f9b19-ed9d-11e4-9118-bcaec565249c">
<topic>wordpress -- cross-site scripting vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.2.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.2.1</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-2-1/">
<p>WordPress 4.2.1 is now available. This is a critical security
release for all previous versions and we strongly encourage you
to update your sites immediately.</p>
<p>A few hours ago, the WordPress team was made aware of a
cross-site scripting vulnerability, which could enable commenters
to compromise a site. The vulnerability was discovered by Jouko
Pynnöne.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/04/wordpress-4-2-1/</url>
</references>
<dates>
<discovery>2015-04-27</discovery>
<entry>2015-05-07</entry>
<modified>2015-09-15</modified>
</dates>
</vuln>
<vuln vid="64e6006e-f009-11e4-98c6-000c292ee6b8">
<topic>powerdns -- Label decompression bug can cause crashes or CPU spikes</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>powerdns-recursor</name>
<range><lt>3.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PowerDNS project reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/">
<p>A bug was discovered in our label decompression code, making it
possible for names to refer to themselves, thus causing a loop during
decompression. On some platforms, this bug can be abused to cause
crashes. On all platforms, this bug can be abused to cause
service-affecting CPU spikes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1868</cvename>
<cvename>CVE-2015-5470</cvename>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/</url>
<mlist>http://www.openwall.com/lists/oss-security/2015/07/10/8</mlist>
</references>
<dates>
<discovery>2015-04-23</discovery>
<entry>2015-05-01</entry>
<modified>2015-07-12</modified>
</dates>
</vuln>
<vuln vid="210f80b9-ede4-11e4-81c4-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>42.0.2311.135</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>42.0.2311.135</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>42.0.2311.135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[453279] High CVE-2015-1243: Use-after-free in DOM. Credit to
Saif El-Sherei.</li>
<li>[481777] CVE-2015-1250: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1243</cvename>
<cvename>CVE-2015-1250</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html</url>
</references>
<dates>
<discovery>2015-04-28</discovery>
<entry>2015-04-28</entry>
</dates>
</vuln>
<vuln vid="b57f690e-ecc9-11e4-876c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>42.0.2311.90</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>42.0.2311.90</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>42.0.2311.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html">
<p>45 new security fixes, including:</p>
<ul>
<li>[456518] High CVE-2015-1235: Cross-origin-bypass in HTML
parser. Credit to anonymous.</li>
<li>[313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink.
Credit to Amitay Dobo.</li>
<li>[461191] High CVE-2015-1237: Use-after-free in IPC. Credit to
Khalil Zhani.</li>
<li>[445808] High CVE-2015-1238: Out-of-bounds write in Skia.
Credit to cloudfuzzer.</li>
<li>[463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL.
Credit to w3bd3vil.</li>
<li>[418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip
Moon and Matt Weston of Sandfield Information Systems.</li>
<li>[460917] High CVE-2015-1242: Type confusion in V8. Credit to
fcole@onshape.com.</li>
<li>[455215] Medium CVE-2015-1244: HSTS bypass in WebSockets.
Credit to Mike Ruddy.</li>
<li>[444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit
to Khalil Zhani.</li>
<li>[437399] Medium CVE-2015-1246: Out-of-bounds read in Blink.
Credit to Atte Kettunen of OUSPG.</li>
<li>[429838] Medium CVE-2015-1247: Scheme issues in OpenSearch.
Credit to Jann Horn.</li>
<li>[380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to
Vittorio Gambaletta (VittGam).</li>
<li>[476786] CVE-2015-1249: Various fixes from internal audits,
fuzzing and other initiatives. Multiple vulnerabilities in V8
fixed at the tip of the 4.2 branch (currently 4.2.77.14).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html</url>
<cvename>CVE-2015-1235</cvename>
<cvename>CVE-2015-1236</cvename>
<cvename>CVE-2015-1237</cvename>
<cvename>CVE-2015-1238</cvename>
<cvename>CVE-2015-1240</cvename>
<cvename>CVE-2015-1241</cvename>
<cvename>CVE-2015-1242</cvename>
<cvename>CVE-2015-1244</cvename>
<cvename>CVE-2015-1245</cvename>
<cvename>CVE-2015-1246</cvename>
<cvename>CVE-2015-1247</cvename>
<cvename>CVE-2015-1248</cvename>
<cvename>CVE-2015-1249</cvename>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-27</entry>
</dates>
</vuln>
<vuln vid="cb9d2fcd-eb47-11e4-b03e-002590263bf5">
<topic>wpa_supplicant -- P2P SSID processing vulnerability</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.4_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt">
<p>A vulnerability was found in how wpa_supplicant uses SSID information
parsed from management frames that create or update P2P peer entries
(e.g., Probe Response frame or number of P2P Public Action frames). SSID
field has valid length range of 0-32 octets. However, it is transmitted
in an element that has a 8-bit length field and potential maximum
payload length of 255 octets. wpa_supplicant was not sufficiently
verifying the payload length on one of the code paths using the SSID
received from a peer device.</p>
<p>This can result in copying arbitrary data from an attacker to a fixed
length buffer of 32 bytes (i.e., a possible overflow of up to 223
bytes). The SSID buffer is within struct p2p_device that is allocated
from heap. The overflow can override couple of variables in the struct,
including a pointer that gets freed. In addition about 150 bytes (the
exact length depending on architecture) can be written beyond the end of
the heap allocation.</p>
<p>This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to wpa_supplicant process crash, exposure of memory contents during
GO Negotiation, and potentially arbitrary code execution.</p>
<p>Vulnerable versions/configurations</p>
<p>wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled
(which is not compiled by default).</p>
<p>Attacker (or a system controlled by the attacker) needs to be within
radio range of the vulnerable system to send a suitably constructed
management frame that triggers a P2P peer device information to be
created or updated.</p>
<p>The vulnerability is easiest to exploit while the device has started an
active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control
interface command in progress). However, it may be possible, though
significantly more difficult, to trigger this even without any active
P2P operation in progress.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1863</cvename>
<url>http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt</url>
</references>
<dates>
<discovery>2015-04-22</discovery>
<entry>2015-04-25</entry>
</dates>
</vuln>
<vuln vid="1e232a0c-eb57-11e4-b595-4061861086c1">
<topic>Several vulnerabilities found in PHP</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.40</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.24</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2015.php#id2015-04-16-2">
<p>The PHP development team announces the immediate
availability of PHP 5.4.40. 14 security-related
bugs were fixed in this release, including
CVE-2014-9709, CVE-2015-2301, CVE-2015-2783,
CVE-2015-1352. All PHP 5.4 users are encouraged to
upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.5.24. Several bugs have been
fixed, some of them being security related, like
CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users
are encouraged to upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.6.8. Several bugs have been
fixed, some of them being security related, like
CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users
are encouraged to upgrade to this version.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2015.php#id2015-04-16-2</url>
<cvename>CVE-2014-9709</cvename>
<cvename>CVE-2015-2301</cvename>
<cvename>CVE-2015-2783</cvename>
<cvename>CVE-2015-1351</cvename>
<cvename>CVE-2015-1352</cvename>
<freebsdpr>ports/199585</freebsdpr>
</references>
<dates>
<discovery>2015-04-16</discovery>
<entry>2015-04-25</entry>
<modified>2015-05-22</modified>
</dates>
</vuln>
<vuln vid="505904d3-ea95-11e4-beaf-bcaec565249c">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_CN</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gary Pendergast reports:</p>
<blockquote cite="https://wordpress.org/news/2015/04/wordpress-4-1-2/">
<p>WordPress 4.1.2 is now available. This is a critical security
release for all previous versions and we strongly encourage you
to update your sites immediately.</p>
<p>WordPress versions 4.1.1 and earlier are affected by a critical
cross-site scripting vulnerability, which could enable anonymous
users to compromise a site. This was reported by Cedric Van
Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew
Nacin of the WordPress security team.</p>
<p>We also fixed three other security issues:</p>
<ul>
<li>In WordPress 4.1 and higher, files with invalid or unsafe
names could be uploaded. Discovered by Michael Kapfer and
Sebastian Kraemer of HSASec.</li>
<li>In WordPress 3.9 and higher, a very limited cross-site
scripting vulnerability could be used as part of a social
engineering attack. Discovered by Jakub Zoczek.</li>
<li>Some plugins were vulnerable to an SQL injection
vulnerability. Discovered by Ben Bidner of the WordPress
security team.</li>
</ul>
<p>We also made four hardening changes, discovered by J.D. Grimes,
Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and
Jeff Bowen.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2015/04/wordpress-4-1-2/</url>
</references>
<dates>
<discovery>2015-04-21</discovery>
<entry>2015-04-24</entry>
<modified>2015-04-24</modified>
</dates>
</vuln>
<vuln vid="82595123-e8b8-11e4-a008-047d7b492d07">
<topic>libtasn1 -- stack-based buffer overflow in asn1_der_decoding</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://www.debian.org/security/2015/dsa-3220.en.html">
<p>Hanno Boeck discovered a stack-based buffer overflow in
the asn1_der_decoding function in Libtasn1, a library to
manage ASN.1 structures. A remote attacker could take advantage
of this flaw to cause an application using the Libtasn1 library
to crash, or potentially to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2806</cvename>
<url>https://www.debian.org/security/2015/dsa-3220.en.html</url>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-04-22</entry>
</dates>
</vuln>
<vuln vid="738fc80d-5f13-4ccb-aa9a-7965699e5a10">
<topic>mozilla -- use-after-free</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA 2015-45 Memory corruption during failed plugin
initialization</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-2706</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/</url>
</references>
<dates>
<discovery>2015-04-20</discovery>
<entry>2015-04-21</entry>
</dates>
</vuln>
<vuln vid="dec3164f-3121-45ef-af18-bb113ac5082f">
<topic>sqlite -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3414">
<p>SQLite before 3.8.9 does not properly implement the
dequoting of collation-sequence names, which allows
context-dependent attackers to cause a denial of service
(uninitialized memory access and application crash) or
possibly have unspecified other impact via a crafted
COLLATE clause, as demonstrated by COLLATE"""""""" at the
end of a SELECT statement.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3415">
<p>The sqlite3VdbeExec function in vdbe.c in SQLite before
3.8.9 does not properly implement comparison operators,
which allows context-dependent attackers to cause a denial
of service (invalid free operation) or possibly have
unspecified other impact via a crafted CHECK clause, as
demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3416">
<p>The sqlite3VXPrintf function in printf.c in SQLite before
3.8.9 does not properly handle precision and width values
during floating-point conversions, which allows
context-dependent attackers to cause a denial of service
(integer overflow and stack-based buffer overflow) or
possibly have unspecified other impact via large integers
in a crafted printf function call in a SELECT statement.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3414</cvename>
<cvename>CVE-2015-3415</cvename>
<cvename>CVE-2015-3416</cvename>
<url>https://www.sqlite.org/src/info/eddc05e7bb31fae7</url>
<url>https://www.sqlite.org/src/info/02e3c88fbf6abdcf</url>
<url>https://www.sqlite.org/src/info/c494171f77dc2e5e</url>
<mlist>http://seclists.org/fulldisclosure/2015/Apr/31</mlist>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-18</entry>
<modified>2015-05-08</modified>
</dates>
</vuln>
<vuln vid="c4571ca8-053d-44c9-ab3c-89b1372ad0a5">
<topic>chrony -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chrony</name>
<range><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrony News reports:</p>
<blockquote cite="http://chrony.tuxfamily.org/News.html">
<p>CVE-2015-1853: DoS attack on authenticated symmetric NTP
associations</p>
<p>CVE-2015-1821: Heap-based buffer overflow in access
configuration</p>
<p>CVE-2015-1822: Use of uninitialized pointer in command
processing</p>
</blockquote>
</body>
</description>
<references>
<url>http://chrony.tuxfamily.org/News.html</url>
<cvename>CVE-2015-1821</cvename>
<cvename>CVE-2015-1822</cvename>
<cvename>CVE-2015-1853</cvename>
</references>
<dates>
<discovery>2015-02-17</discovery>
<entry>2015-04-18</entry>
</dates>
</vuln>
<vuln vid="e426eda9-dae1-11e4-8107-94de806b0af9">
<topic>Dulwich -- Remote code execution</topic>
<affects>
<package>
<name>py27-dulwich</name>
<range><lt>0.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0838">
<p>Buffer overflow in the C implementation of the apply_delta
function in _pack.c in Dulwich before 0.9.9 allows remote
attackers to execute arbitrary code via a crafted pack file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0838</cvename>
</references>
<dates>
<discovery>2015-01-07</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="3364d497-e4e6-11e4-a265-c485083ca99c">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.451</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.451</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-06.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system. Adobe is aware of a report that an exploit for
CVE-2015-3043 exists in the wild, and recommends users update their
product installations to the latest versions.
</p>
<ul>
<li>
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352,
CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360,
CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
</li>
<li>
These updates resolve a type confusion vulnerability that could lead
to code execution (CVE-2015-0356).
</li>
<li>
These updates resolve a buffer overflow vulnerability that could
lead to code execution (CVE-2015-0348).
</li>
<li>
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358,
CVE-2015-3039).
</li>
<li>
These updates resolve double-free vulnerabilities that could lead to
code execution (CVE-2015-0346, CVE-2015-0359).
</li>
<li>
These updates resolve memory leak vulnerabilities that could be used
to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
</li>
<li>
These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-3044).
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-06.html</url>
<cvename>CVE-2015-3038</cvename>
<cvename>CVE-2015-3039</cvename>
<cvename>CVE-2015-3040</cvename>
<cvename>CVE-2015-3041</cvename>
<cvename>CVE-2015-3042</cvename>
<cvename>CVE-2015-3043</cvename>
<cvename>CVE-2015-3044</cvename>
<cvename>CVE-2015-0346</cvename>
<cvename>CVE-2015-0347</cvename>
<cvename>CVE-2015-0348</cvename>
<cvename>CVE-2015-0349</cvename>
<cvename>CVE-2015-0350</cvename>
<cvename>CVE-2015-0351</cvename>
<cvename>CVE-2015-0352</cvename>
<cvename>CVE-2015-0353</cvename>
<cvename>CVE-2015-0354</cvename>
<cvename>CVE-2015-0355</cvename>
<cvename>CVE-2015-0356</cvename>
<cvename>CVE-2015-0357</cvename>
<cvename>CVE-2015-0358</cvename>
<cvename>CVE-2015-0359</cvename>
<cvename>CVE-2015-0360</cvename>
</references>
<dates>
<discovery>2015-04-14</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="ba326a36-5f02-452d-a215-31e7b06d5edf">
<topic>Wesnoth -- Remote information disclosure</topic>
<affects>
<package>
<name>wesnoth</name>
<name>wesnoth-devel</name>
<range><ge>1.7.0</ge><lt>1.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0844">
<p>The WML/Lua API in Battle for Wesnoth 1.7.x through
1.11.x and 1.12.x before 1.12.2 allows remote attackers to
read arbitrary files via a crafted (1) campaign or (2) map
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0844</cvename>
</references>
<dates>
<discovery>2015-04-11</discovery>
<entry>2015-04-17</entry>
</dates>
</vuln>
<vuln vid="5713bfda-e27d-11e4-b2ce-5453ed2e2b49">
<topic>qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling</topic>
<affects>
<package>
<name>qt4-imageformats</name>
<range><lt>4.8.6_3</lt></range>
</package>
<package>
<name>qt4-gui</name>
<range><lt>4.8.6_5</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.4.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-April/000067.html">
<p>Due to two recent vulnerabilities identified in the built-in image
format handling code, it was decided that this area required further
testing to determine if further issues remained. Fuzzing using
afl-fuzz located a number of issues in the handling of BMP, ICO and
GIF files. The issues exposed included denial of service and buffer
overflows leading to heap corruption. It is possible the latter could
be used to perform remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://lists.qt-project.org/pipermail/announce/2015-April/000067.html</mlist>
<cvename>CVE-2015-1858</cvename>
<cvename>CVE-2015-1859</cvename>
<cvename>CVE-2015-1860</cvename>
</references>
<dates>
<discovery>2015-04-12</discovery>
<entry>2015-04-14</entry>
</dates>
</vuln>
<vuln vid="d4379f59-3e9b-49eb-933b-61de4d0b0fdb">
<topic>Ruby -- OpenSSL Hostname Verification Vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<name>ruby20</name>
<range><ge>2.0,1</ge><lt>2.0.0.645,1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby21</name>
<range><ge>2.1,1</ge><lt>2.1.6,1</lt></range>
</package>
<package>
<name>ruby</name>
<name>ruby22</name>
<range><ge>2.2,1</ge><lt>2.2.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Developers report:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/">
<p>After reviewing RFC 6125 and RFC 5280, we found multiple violations
of matching hostnames and particularly wildcard certificates.</p>
<p>Ruby’s OpenSSL extension will now provide a string-based matching
algorithm which follows more strict behavior, as recommended by
these RFCs. In particular, matching of more than one wildcard per
subject/SAN is no-longer allowed. As well, comparison of these
values are now case-insensitive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/</url>
<cvename>CVE-2015-1855</cvename>
</references>
<dates>
<discovery>2015-04-13</discovery>
<entry>2015-04-14</entry>
<modified>2015-09-23</modified>
</dates>
</vuln>
<vuln vid="a5f160fa-deee-11e4-99f8-080027ef73ec">
<topic>mailman -- path traversal vulnerability</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.20</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.20</lt></range>
</package>
<package>
<name>ja-mailman</name>
<range><lt>2.1.14.j7_2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html">
<p>A path traversal vulnerability has been discovered and fixed. This
vulnerability is only exploitable by a local user on a Mailman
server where the suggested Exim transport, the Postfix
postfix_to_mailman.py transport or some other programmatic MTA
delivery not using aliases is employed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html</url>
<url>https://bugs.launchpad.net/mailman/+bug/1437145</url>
<cvename>CVE-2015-2775</cvename>
</references>
<dates>
<discovery>2015-03-27</discovery>
<entry>2015-04-09</entry>
<modified>2015-06-17</modified>
</dates>
</vuln>
<vuln vid="5fee3f02-de37-11e4-b7c3-001999f8d30b">
<topic>asterisk -- TLS Certificate Common name NULL byte exploit</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.3</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.17.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk registers to a SIP TLS device and and
verifies the server, Asterisk will accept signed certificates
that match a common name other than the one Asterisk is
expecting if the signed certificate has a common name
containing a null byte after the portion of the common
name that Asterisk expected. For example, if Asterisk is
trying to register to www.domain.com, Asterisk will accept
certificates of the form
www.domain.com\x00www.someotherdomain.com</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-003.html</url>
<cvename>CVE-2015-3008</cvename>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2015-04-08</entry>
</dates>
</vuln>
<vuln vid="ebd84c96-dd7e-11e4-854e-3c970e169bc2">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p2</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://archive.ntp.org/ntp4/ChangeLog-stable">
<ul>
<li>[Sec 2779] ntpd accepts unauthenticated packets
with symmetric key crypto.</li>
<li>[Sec 2781] Authentication doesn't protect symmetric
associations against DoS attacks.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:07.ntp</freebsdsa>
<cvename>CVE-2015-1798</cvename>
<cvename>CVE-2015-1799</cvename>
<url>http://archive.ntp.org/ntp4/ChangeLog-stable</url>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2015-04-07</entry>
</dates>
</vuln>
<vuln vid="b8321d76-24e7-4b72-a01d-d12c4445d826">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA 2015-44 Certificate verification bypass through the
HTTP/2 Alt-Svc header</p>
<p>MFSA 2015-43 Loading privileged content through Reader
mode</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0798</cvename>
<cvename>CVE-2015-0799</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-43/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-44/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-04-03</discovery>
<entry>2015-04-04</entry>
</dates>
</vuln>
<vuln vid="2f75141c-da1d-11e4-8d32-5404a68ad561">
<topic>Several vulnerabilities in libav</topic>
<affects>
<package>
<name>libav</name>
<range><lt>11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libav project reports:</p>
<blockquote cite="https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3">
<p>utvideodec: Handle slice_height being zero (CVE-2014-9604)</p>
<p>tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3</url>
<cvename>CVE-2014-8544</cvename>
<cvename>CVE-2014-9604</cvename>
</references>
<dates>
<discovery>2015-03-24</discovery>
<entry>2015-04-03</entry>
</dates>
</vuln>
<vuln vid="742563d4-d776-11e4-b595-4061861086c1">
<topic>Several vulnerabilities found in PHP</topic>
<affects>
<package>
<name>php53</name>
<range><le>5.3.29_5</le></range>
</package>
<package>
<name>php5</name>
<range><lt>5.4.39</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.23</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2015.php#id2015-03-20-2">
<p>The PHP development team announces the immediate
availability of PHP 5.6.7. Several bugs have been
fixed as well as CVE-2015-0231, CVE-2015-2305 and
CVE-2015-2331. All PHP 5.6 users are encouraged to
upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.5.23. Several bugs have been
fixed as well as CVE-2015-0231, CVE-2015-2305 and
CVE-2015-2331. All PHP 5.5 users are encouraged
to upgrade to this version.</p>
<p>The PHP development team announces the immediate
availability of PHP 5.4.39. Six security-related
bugs were fixed in this release, including
CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331.
All PHP 5.4 users are encouraged to upgrade to
this version.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2015.php#id2015-03-20-2</url>
<cvename>CVE-2015-0231</cvename>
<cvename>CVE-2015-2305</cvename>
<cvename>CVE-2015-2311</cvename>
<freebsdpr>ports/198739</freebsdpr>
</references>
<dates>
<discovery>2015-03-19</discovery>
<entry>2015-04-01</entry>
</dates>
</vuln>
<vuln vid="8e887b71-d769-11e4-b1c2-20cf30e32f6d">
<topic>subversion -- DoS vulnerabilities</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.5.0</ge><lt>1.7.20</lt></range>
<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.20</lt></range>
<range><ge>1.8.0</ge><lt>1.8.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion HTTP servers with FSFS repositories are vulnerable to a remotely
triggerable excessive memory use with certain REPORT requests.</p>
<p>Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable
assertion DoS vulnerability for certain requests with dynamically evaluated
revision numbers.</p>
<p>Subversion HTTP servers allow spoofing svn:author property values for new
revisions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/</url>
<cvename>CVE-2015-0202</cvename>
<cvename>CVE-2015-0248</cvename>
<cvename>CVE-2015-0251</cvename>
<url>http://subversion.apache.org/security/CVE-2015-0202-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2015-0248-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2015-0251-advisory.txt</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="d0c97697-df2c-4b8b-bff2-cec24dc35af8">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>37.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>37.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.34</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.6.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.34</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.6.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0
/ rv:31.6)</p>
<p>MFSA-2015-31 Use-after-free when using the Fluendo MP3
GStreamer plugin</p>
<p>MFSA-2015-32 Add-on lightweight theme installation
approval bypassed through MITM attack</p>
<p>MFSA-2015-33 resource:// documents can load privileged
pages</p>
<p>MFSA-2015-34 Out of bounds read in QCMS library</p>
<p>MFSA-2015-35 Cursor clickjacking with flash and images</p>
<p>MFSA-2015-36 Incorrect memory management for simple-type
arrays in WebRTC</p>
<p>MFSA-2015-37 CORS requests should not follow 30x
redirections after preflight</p>
<p>MFSA-2015-38 Memory corruption crashes in Off Main Thread
Compositing</p>
<p>MFSA-2015-39 Use-after-free due to type confusion flaws</p>
<p>MFSA-2015-40 Same-origin bypass through anchor navigation</p>
<p>MFSA-2015-41 PRNG weakness allows for DNS poisoning on
Android</p>
<p>MFSA-2015-42 Windows can retain access to privileged
content on navigation to unprivileged pages</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-2808</cvename>
<cvename>CVE-2015-0800</cvename>
<cvename>CVE-2015-0801</cvename>
<cvename>CVE-2015-0802</cvename>
<cvename>CVE-2015-0803</cvename>
<cvename>CVE-2015-0804</cvename>
<cvename>CVE-2015-0805</cvename>
<cvename>CVE-2015-0806</cvename>
<cvename>CVE-2015-0807</cvename>
<cvename>CVE-2015-0808</cvename>
<cvename>CVE-2015-0810</cvename>
<cvename>CVE-2015-0811</cvename>
<cvename>CVE-2015-0812</cvename>
<cvename>CVE-2015-0813</cvename>
<cvename>CVE-2015-0814</cvename>
<cvename>CVE-2015-0815</cvename>
<cvename>CVE-2015-0816</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-30/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-31/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-32/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-33/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-34/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-35/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-36/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-37/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-38/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-39/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-40/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-41/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-42/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-03-31</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="f450587b-d7bd-11e4-b5a4-14dae9d5a9d2">
<topic>osc -- shell command injection via crafted _service files</topic>
<affects>
<package>
<name>osc</name>
<range><lt>0.151.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SUSE Security Update reports:</p>
<blockquote cite="https://www.suse.com/security/cve/CVE-2015-0778.html">
<p>osc before 0.151.0 allows remote attackers to execute
arbitrary commands via shell metacharacters in a _service
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0778</cvename>
<url>https://www.suse.com/security/cve/CVE-2015-0778.html</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=901643</url>
<url>http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html</url>
</references>
<dates>
<discovery>2015-03-16</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8">
<topic>cpio -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gcpio</name>
<range><lt>2.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the Debian Security Team:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2014-9112">
<p>Heap-based buffer overflow in the process_copy_in
function in GNU Cpio 2.11 allows remote attackers to cause
a denial of service via a large block value in a cpio
archive.</p>
</blockquote>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2015-1197">
<p>cpio 2.11, when using the --no-absolute-filenames
option, allows local users to write to arbitrary files
via a symlink attack on a file in an archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9112</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2014-9112</url>
<cvename>CVE-2015-1197</cvename>
<url>https://bugzilla.suse.com/show_bug.cgi?id=658010</url>
</references>
<dates>
<discovery>2015-03-27</discovery>
<entry>2015-03-31</entry>
</dates>
</vuln>
<vuln vid="264749ae-d565-11e4-b545-00269ee29e57">
<topic>libzip -- integer overflow</topic>
<affects>
<package>
<name>libzip</name>
<range><lt>0.11.2_2</lt></range>
</package>
<package>
<name>ppsspp</name>
<range><lt>1.0.1_5</lt></range>
</package>
<package>
<name>ppsspp-devel</name>
<range><lt>1.0.1.2668_1</lt></range>
</package>
<package>
<name>radare2</name>
<range><lt>0.9.8_1</lt></range>
</package>
<package>
<name>openlierox</name>
<range><lt>0.58.r3_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libzip developers report:</p>
<blockquote cite="http://hg.nih.at/libzip/rev/9f11d54f692e">
<p>Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=69253</url>
<url>https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5</url>
<url>http://hg.nih.at/libzip/rev/9f11d54f692e</url>
<cvename>CVE-2015-2331</cvename>
</references>
<dates>
<discovery>2015-03-18</discovery>
<entry>2015-03-28</entry>
<modified>2015-09-20</modified>
</dates>
</vuln>
<vuln vid="62287f51-d43d-11e4-879c-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4</ge><lt>1.4.20</lt></range>
<range><ge>1.6</ge><lt>1.6.11</lt></range>
<range><ge>1.7</ge><lt>1.7.7</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150326,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/mar/18/security-releases/">
<p>In accordance with our security release policy, the Django team
is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and
1.8c1. These releases are now available on PyPI and our download
page. These releases address several security issues detailed
below. We encourage all users of Django to upgrade as soon as
possible. The Django master branch has also been updated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/mar/18/security-releases/</url>
<cvename>CVE-2015-2316</cvename>
<cvename>CVE-2015-2317</cvename>
</references>
<dates>
<discovery>2015-03-18</discovery>
<entry>2015-03-27</entry>
</dates>
</vuln>
<vuln vid="f6a014cd-d268-11e4-8339-001e679db764">
<topic>GNU binutils -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cross-binutils</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>x86_64-pc-mingw32-binutils</name>
<range><lt>2.25</lt></range>
</package>
<package>
<name>m6811-binutils</name>
<range><lt>2.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501">
<p>The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU
binutils 2.24 and earlier allows remote attackers to cause a
denial of service (out-of-bounds write) and possibly have other
unspecified impact via a crafted NumberOfRvaAndSizes field in the
AOUT header in a PE executable.</p>
</blockquote>
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502">
<p>Heap-based buffer overflow in the pe_print_edata function in
bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (crash) and possibly have
other unspecified impact via a truncated export table in a PE
file.</p>
</blockquote>
<p>US-CERT/NIST reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503">
<p>Stack-based buffer overflow in the ihex_scan function in
bfd/ihex.c in GNU binutils 2.24 and earlier allows remote
attackers to cause a denial of service (crash) and possibly have
other unspecified impact via a crafted ihex file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8501</cvename>
<cvename>CVE-2014-8502</cvename>
<cvename>CVE-2014-8503</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503</url>
</references>
<dates>
<discovery>2014-12-09</discovery>
<entry>2015-03-24</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="996bce94-d23d-11e4-9463-9cb654ea3e1c">
<topic>libuv -- incorrect revocation order while relinquishing privileges</topic>
<affects>
<package>
<name>node010</name>
<range><lt>0.10.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nodejs releases reports:</p>
<blockquote cite="http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable">
<h5>CVE-2015-0278</h5>
<p>This may potentially allow an attacker to gain elevated privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable</url>
<freebsdpr>ports/198861</freebsdpr>
<cvename>CVE-2015-0278</cvename>
</references>
<dates>
<discovery>2015-03-14</discovery>
<entry>2015-03-24</entry>
</dates>
</vuln>
<vuln vid="22dc4a22-d1e5-11e4-879c-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.605</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.596.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23">
<h1>Description</h1>
<h5>SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)</h5>
<p>An attacker without any access to Jenkins can navigate the user
to a carefully crafted URL and have the user execute unintended
actions. This vulnerability can be used to attack Jenkins inside
firewalls from outside so long as the location of Jenkins is known
to the attacker.</p>
<h5>SECURITY-180 (forced API token change)</h5>
<p>The part of Jenkins that issues a new API token was not
adequately protected against anonymous attackers. This allows an
attacker to escalate privileges on Jenkins.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23</url>
</references>
<dates>
<discovery>2015-03-23</discovery>
<entry>2015-03-24</entry>
</dates>
</vuln>
<vuln vid="76ff65f4-17ca-4d3f-864a-a3d6026194fb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>36.0.4,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.5.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>36.0.4,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.33.1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.33.1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-28 Privilege escalation through SVG navigation</p>
<p>MFSA-2015-29 Code execution through incorrect JavaScript
bounds checking elimination</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0817</cvename>
<cvename>CVE-2015-0818</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-28/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-29/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-03-20</discovery>
<entry>2015-03-22</entry>
</dates>
</vuln>
<vuln vid="9d15355b-ce7c-11e4-9db0-d050992ecde8">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_19</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1m</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_4</lt></range>
</package>
<package>
<name>libressl</name>
<range><le>2.1.5_1</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_8</lt></range>
<range><ge>9.3</ge><lt>9.3_12</lt></range>
<range><ge>8.4</ge><lt>8.4_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150319.txt">
<ul>
<li>Reclassified: RSA silently downgrades to EXPORT_RSA
[Client] (CVE-2015-0204). OpenSSL only.</li>
<li>Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)</li>
<li>ASN.1 structure reuse memory corruption (CVE-2015-0287)</li>
<li>PKCS#7 NULL pointer dereferences (CVE-2015-0289)</li>
<li>Base64 decode (CVE-2015-0292). OpenSSL only.</li>
<li>DoS via reachable assert in SSLv2 servers
(CVE-2015-0293). OpenSSL only.</li>
<li>Use After Free following d2i_ECPrivatekey error
(CVE-2015-0209)</li>
<li>X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:06.openssl</freebsdsa>
<freebsdpr>ports/198681</freebsdpr>
<cvename>CVE-2015-0204</cvename>
<cvename>CVE-2015-0286</cvename>
<cvename>CVE-2015-0287</cvename>
<cvename>CVE-2015-0289</cvename>
<cvename>CVE-2015-0292</cvename>
<cvename>CVE-2015-0293</cvename>
<cvename>CVE-2015-0209</cvename>
<cvename>CVE-2015-0288</cvename>
<url>https://www.openssl.org/news/secadv_20150319.txt</url>
</references>
<dates>
<discovery>2015-03-19</discovery>
<entry>2015-03-19</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="f7d79fac-cd49-11e4-898f-bcaec565249c">
<topic>libXfont -- BDF parsing issues</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>linux-c6-xorg-libs</name>
<range><lt>7.4_4</lt></range>
</package>
<package>
<name>linux-f10-xorg-libs</name>
<range><lt>7.4_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2015-March/002550.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered an issue in the parsing of BDF font files by libXfont.
Additional testing by Alan Coopersmith and William Robinet with
the American Fuzzy Lop (afl) tool uncovered two more issues in
the parsing of BDF font files.</p>
<p>As libXfont is used by the X server to read font files, and an
unprivileged user with access to the X server can tell the X
server to read a given font file from a path of their choosing,
these vulnerabilities have the potential to allow unprivileged
users to run code with the privileges of the X server
(often root access).</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.x.org/archives/xorg-announce/2015-March/002550.html</url>
<cvename>CVE-2015-1802</cvename>
<cvename>CVE-2015-1803</cvename>
<cvename>CVE-2015-1804</cvename>
</references>
<dates>
<discovery>2015-03-17</discovery>
<entry>2015-03-18</entry>
<modified>2016-01-31</modified>
</dates>
</vuln>
<vuln vid="8b3ecff5-c9b2-11e4-b71f-00bd5af88c00">
<topic>Adobe Flash Player -- critical vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.442</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.442</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-05.html">
<p>
Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh and Linux. These updates address vulnerabilities
that could potentially allow an attacker to take control of the
affected system.
These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335,
CVE-2015-0339).
These updates resolve type confusion vulnerabilities that could lead
to code execution (CVE-2015-0334, CVE-2015-0336).
These updates resolve a vulnerability that could lead to a
cross-domain policy bypass (CVE-2015-0337).
These updates resolve a vulnerability that could lead to a file
upload restriction bypass (CVE-2015-0340).
These updates resolve an integer overflow vulnerability that could
lead to code execution (CVE-2015-0338).
These updates resolve use-after-free vulnerabilities that could lead
to code execution (CVE-2015-0341, CVE-2015-0342).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-05.html</url>
<cvename>CVE-2015-0332</cvename>
<cvename>CVE-2015-0333</cvename>
<cvename>CVE-2015-0334</cvename>
<cvename>CVE-2015-0335</cvename>
<cvename>CVE-2015-0336</cvename>
<cvename>CVE-2015-0337</cvename>
<cvename>CVE-2015-0338</cvename>
<cvename>CVE-2015-0339</cvename>
<cvename>CVE-2015-0340</cvename>
<cvename>CVE-2015-0341</cvename>
<cvename>CVE-2015-0342</cvename>
</references>
<dates>
<discovery>2015-03-12</discovery>
<entry>2015-03-13</entry>
</dates>
</vuln>
<vuln vid="451a6c79-c92b-11e4-a835-000c292ee6b8">
<topic>sympa -- Remote attackers can read arbitrary files</topic>
<affects>
<package>
<name>sympa</name>
<range><lt>6.1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Sympa Project reports:</p>
<blockquote cite="https://www.sympa.org/security_advisories">
<p>The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sympa.org/security_advisories</url>
<cvename>CVE-2015-1306</cvename>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-03-13</entry>
</dates>
</vuln>
<vuln vid="d08f6002-c588-11e4-8495-6805ca0b3d42">
<topic>rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.10</lt></range>
</package>
<package>
<name>rt40</name>
<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best Practical reports:</p>
<blockquote cite="http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html">
<p>RT 3.0.0 and above, if running on Perl 5.14.0 or higher,
are vulnerable to a remote denial-of-service via the email
gateway; any installation which accepts mail from untrusted
sources is vulnerable, regardless of the permissions
configuration inside RT. This denial-of-service may
encompass both CPU and disk usage, depending on RT's logging
configuration. This vulnerability is assigned
CVE-2014-9472.</p>
<p>RT 3.8.8 and above are vulnerable to an information
disclosure attack which may reveal RSS feeds URLs, and thus
ticket data; this vulnerability is assigned
CVE-2015-1165. RSS feed URLs can also be leveraged to
perform session hijacking, allowing a user with the URL to
log in as the user that created the feed; this vulnerability
is assigned CVE-2015-1464.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html</url>
<cvename>CVE-2014-9472</cvename>
<cvename>CVE-2015-1165</cvename>
<cvename>CVE-2015-1464</cvename>
</references>
<dates>
<discovery>2015-02-26</discovery>
<entry>2015-03-08</entry>
</dates>
</vuln>
<vuln vid="81b4c118-c586-11e4-8495-6805ca0b3d42">
<topic>phpMyAdmin -- Risk of BREACH attack due to reflected parameter</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.3.0</ge><lt>4.3.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php">
<p>Risk of BREACH attack due to reflected parameter.</p>
<p>With a large number of crafted requests it was possible to infer
the CSRF token by a BREACH attack.</p>
<p>Mitigation factor: this vulnerability can only be exploited in
the presence of another vulnerability that allows the attacker to
inject JavaScript into victim's browser.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php</url>
<cvename>CVE-2015-2206</cvename>
</references>
<dates>
<discovery>2015-03-04</discovery>
<entry>2015-03-08</entry>
</dates>
</vuln>
<vuln vid="c0cae920-c4e9-11e4-898e-90e6ba741e35">
<topic>mono -- TLS bugs</topic>
<affects>
<package>
<name>mono</name>
<range><lt>3.10.1</lt></range>
<range><ge>3.12</ge><lt>3.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mono project reports:</p>
<blockquote cite="http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs">
<p>Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in <a href="https://www.smacktls.com/#skip">SKIP-TLS post</a>.</p>
<p>Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the <a href="https://www.smacktls.com/#freak">FREAK</a> attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs</url>
</references>
<dates>
<discovery>2015-03-06</discovery>
<entry>2015-03-07</entry>
</dates>
</vuln>
<vuln vid="92fc2e2b-c383-11e4-8ef7-080027ef73ec">
<topic>PuTTY -- fails to scrub private keys from memory after use</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.64</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html">
<p>When PuTTY has sensitive data in memory and has no further need for
it, it should wipe the data out of its memory, in case malware later
gains access to the PuTTY process or the memory is swapped out to
disk or written into a crash dump file. An obvious example of this
is the password typed during SSH login; other examples include
obsolete session keys, public-key passphrases, and the private
halves of public keys.</p>
<p>PuTTY 0.63 and earlier versions, after loading a private key
from a disk file, mistakenly leak a memory buffer containing a
copy of the private key, in the function ssh2_load_userkey. The
companion function ssh2_save_userkey (only called by PuTTYgen) can
also leak a copy, but only in the case where the file it tried to
save to could not be created.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html</url>
<cvename>CVE-2015-2157</cvename>
</references>
<dates>
<discovery>2015-02-28</discovery>
<entry>2015-03-05</entry>
</dates>
</vuln>
<vuln vid="8505e013-c2b3-11e4-875d-000c6e25e3e9">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>41.0.2272.76</lt></range>
</package>
<package>
<name>chromium-npapi</name>
<range><lt>41.0.2272.76</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>41.0.2272.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>51 security fixes in this release, including:</p>
<ul>
<li>[456516] High CVE-2015-1212: Out-of-bounds write in media.
Credit to anonymous.</li>
<li>[448423] High CVE-2015-1213: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[445810] High CVE-2015-1214: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[445809] High CVE-2015-1215: Out-of-bounds write in skia
filters. Credit to cloudfuzzer.</li>
<li>[454954] High CVE-2015-1216: Use-after-free in v8 bindings.
Credit to anonymous.</li>
<li>[456192] High CVE-2015-1217: Type confusion in v8 bindings.
Credit to anonymous.</li>
<li>[456059] High CVE-2015-1218: Use-after-free in dom.
Credit to cloudfuzzer.</li>
<li>[446164] High CVE-2015-1219: Integer overflow in webgl.
Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.</li>
<li>[437651] High CVE-2015-1220: Use-after-free in gif decoder.
Credit to Aki Helin of OUSPG.</li>
<li>[455368] High CVE-2015-1221: Use-after-free in web databases.
Credit to Collin Payne.</li>
<li>[448082] High CVE-2015-1222: Use-after-free in service workers.
Credit to Collin Payne.</li>
<li>[454231] High CVE-2015-1223: Use-after-free in dom.
Credit to Maksymillian Motyl.</li>
<li>High CVE-2015-1230: Type confusion in v8.
Credit to Skylined working with HP's Zero Day Initiative.</li>
<li>[449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder.
Credit to Aki Helin of OUSPG.</li>
<li>[446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium.
Credit to cloudfuzzer.</li>
<li>[456841] Medium CVE-2015-1226: Validation issue in debugger.
Credit to Rob Wu.</li>
<li>[450389] Medium CVE-2015-1227: Uninitialized value in blink.
Credit to Christoph Diehl.</li>
<li>[444707] Medium CVE-2015-1228: Uninitialized value in rendering.
Credit to miaubiz.</li>
<li>[431504] Medium CVE-2015-1229: Cookie injection via proxies.
Credit to iliwoy.</li>
<li>[463349] CVE-2015-1231: Various fixes from internal audits,
fuzzing, and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1212</cvename>
<cvename>CVE-2015-1213</cvename>
<cvename>CVE-2015-1214</cvename>
<cvename>CVE-2015-1215</cvename>
<cvename>CVE-2015-1216</cvename>
<cvename>CVE-2015-1217</cvename>
<cvename>CVE-2015-1218</cvename>
<cvename>CVE-2015-1219</cvename>
<cvename>CVE-2015-1220</cvename>
<cvename>CVE-2015-1221</cvename>
<cvename>CVE-2015-1222</cvename>
<cvename>CVE-2015-1223</cvename>
<cvename>CVE-2015-1224</cvename>
<cvename>CVE-2015-1225</cvename>
<cvename>CVE-2015-1226</cvename>
<cvename>CVE-2015-1227</cvename>
<cvename>CVE-2015-1228</cvename>
<cvename>CVE-2015-1229</cvename>
<cvename>CVE-2015-1230</cvename>
<cvename>CVE-2015-1231</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-03-03</discovery>
<entry>2015-03-04</entry>
</dates>
</vuln>
<vuln vid="c9c3374d-c2c1-11e4-b236-5453ed2e2b49">
<topic>qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler</topic>
<affects>
<package>
<name>qt4-gui</name>
<range><lt>4.8.6_4</lt></range>
</package>
<package>
<name>qt5-gui</name>
<range><lt>5.3.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Richard J. Moore reports:</p>
<blockquote cite="http://lists.qt-project.org/pipermail/announce/2015-February/000059.html">
<p>The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug
that would lead to a division by zero when loading certain corrupt
BMP files. This in turn would cause the application loading these
hand crafted BMPs to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0295</cvename>
<mlist>http://lists.qt-project.org/pipermail/announce/2015-February/000059.html</mlist>
</references>
<dates>
<discovery>2015-02-22</discovery>
<entry>2015-03-05</entry>
</dates>
</vuln>
<vuln vid="7480b6ac-adf1-443e-a33c-3a3c0becba1e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.600</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.580.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kohsuke Kawaguchi from Jenkins team reports:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27">
<h1>Description</h1>
<h5>SECURITY-125 (Combination filter Groovy script unsecured)</h5>
<p>This vulnerability allows users with the job configuration
privilege to escalate his privileges, resulting in arbitrary code
execution to the master.</p>
<h5>SECURITY-162 (directory traversal from artifacts via symlink)</h5>
<p>This vulnerability allows users with the job configuration
privilege or users with commit access to the build script to
access arbitrary files/directories on the master, resulting in
the exposure of sensitive information, such as encryption keys.</p>
<h5>SECURITY-163 (update center metadata retrieval DoS attack)</h5>
<p>This vulnerability allows authenticated users to disrupt the
operation of Jenkins by feeding malicious update center data into
Jenkins, affecting plugin installation and tool installation.</p>
<h5>SECURITY-165 (external entity injection via XPath)</h5>
<p>This vulnerability allows users with the read access to Jenkins
to retrieve arbitrary XML document on the server, resulting in
the exposure of sensitive information inside/outside Jenkins.</p>
<h5>SECURITY-166 (HudsonPrivateSecurityRealm allows creation of
reserved names)</h5>
<p>For users using "Jenkins' own user database" setting, Jenkins
doesn't refuse reserved names, thus allowing privilege escalation.</p>
<h5>SECURITY-167 (External entity processing in XML can reveal
sensitive local files)</h5>
<p>This vulnerability allows attackers to create malicious XML
documents and feed that into Jenkins, which causes Jenkins to
retrieve arbitrary XML document on the server, resulting in the
exposure of sensitive information inside/outside Jenkins.</p>
<h1>Severity</h1>
<p>SECURITY-125 is rated <strong>critical</strong>. This attack can be
only mounted by users with some trust, but it results in arbitrary
code execution on the master.</p>
<p>SECURITY-162 is rated <strong>critical</strong>. This attack can be
only mounted by users with some trust, but it results in the
exposure of sensitive information.</p>
<p>SECURITY-163 is rated <strong>medium</strong>, as it results in the
loss of functionality.</p>
<p>SECURITY-165 is rated <strong>critical</strong>. This attack is
easy to mount, and it results in the exposure of sensitive
information.</p>
<p>SECURITY-166 is rated <strong>critical</strong>. For users who use
the affected feature, this attack results in arbitrary code
execution on the master.</p>
<p>SECURITY-167 is rated <strong>critical</strong>. This attack is
easy to mount, and it results in the exposure of sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27</url>
</references>
<dates>
<discovery>2015-03-01</discovery>
<entry>2015-03-01</entry>
</dates>
</vuln>
<vuln vid="99029172-8253-407d-9d8b-2cfeab9abf81">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>36.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>36.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.33</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.5.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.33</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.5.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0
/ rv:31.5)</p>
<p>MFSA-2015-12 Invoking Mozilla updater will load locally
stored DLL files</p>
<p>MFSA-2015-13 Appended period to hostnames can bypass HPKP
and HSTS protections</p>
<p>MFSA-2015-14 Malicious WebGL content crash when writing
strings</p>
<p>MFSA-2015-15 TLS TURN and STUN connections silently fail
to simple TCP connections</p>
<p>MFSA-2015-16 Use-after-free in IndexedDB</p>
<p>MFSA-2015-17 Buffer overflow in libstagefright during MP4
video playback</p>
<p>MFSA-2015-18 Double-free when using non-default memory
allocators with a zero-length XHR</p>
<p>MFSA-2015-19 Out-of-bounds read and write while rendering
SVG content</p>
<p>MFSA-2015-20 Buffer overflow during CSS restyling</p>
<p>MFSA-2015-21 Buffer underflow during MP3 playback</p>
<p>MFSA-2015-22 Crash using DrawTarget in Cairo graphics
library</p>
<p>MFSA-2015-23 Use-after-free in Developer Console date
with OpenType Sanitiser</p>
<p>MFSA-2015-24 Reading of local files through manipulation
of form autocomplete</p>
<p>MFSA-2015-25 Local files or privileged URLs in pages can
be opened into new tabs</p>
<p>MFSA-2015-26 UI Tour whitelisted sites in background tab
can spoof foreground tabs</p>
<p>MFSA-2015-27 Caja Compiler JavaScript sandbox bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0819</cvename>
<cvename>CVE-2015-0820</cvename>
<cvename>CVE-2015-0821</cvename>
<cvename>CVE-2015-0822</cvename>
<cvename>CVE-2015-0823</cvename>
<cvename>CVE-2015-0824</cvename>
<cvename>CVE-2015-0825</cvename>
<cvename>CVE-2015-0826</cvename>
<cvename>CVE-2015-0827</cvename>
<cvename>CVE-2015-0828</cvename>
<cvename>CVE-2015-0829</cvename>
<cvename>CVE-2015-0830</cvename>
<cvename>CVE-2015-0831</cvename>
<cvename>CVE-2015-0832</cvename>
<cvename>CVE-2015-0833</cvename>
<cvename>CVE-2015-0834</cvename>
<cvename>CVE-2015-0835</cvename>
<cvename>CVE-2015-0836</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-11/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-12/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-13/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-14/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-15/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-16/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-17/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-18/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-19/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-20/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-22/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-23/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-27/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-02-24</discovery>
<entry>2015-02-27</entry>
</dates>
</vuln>
<vuln vid="f7a9e415-bdca-11e4-970c-000c292ee6b8">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<range><lt>5.4.38</lt></range>
</package>
<package>
<name>php55</name>
<range><lt>5.5.22</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Project reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php">
<p>Use after free vulnerability in unserialize() with DateTimeZone.</p>
<p>Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer
overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0235</cvename>
<cvename>CVE-2015-0273</cvename>
<url>http://php.net/ChangeLog-5.php#5.4.38</url>
<url>http://php.net/ChangeLog-5.php#5.5.22</url>
<url>http://php.net/ChangeLog-5.php#5.6.6</url>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-02-26</entry>
</dates>
</vuln>
<vuln vid="dbf9e66c-bd50-11e4-a7ba-206a8a720317">
<topic>krb5 1.11 -- New release/fix multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5-111</name>
<range><lt>1.11.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:</p>
<blockquote cite="http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt">
<p>Handle certain invalid RFC 1964 GSS tokens correctly to avoid
invalid memory reference vulnerabilities. [CVE-2014-4341</p>
<p>Fix memory management vulnerabilities in GSSAPI SPNEGO.
[CVE-2014-4343 CVE-2014-4344]</p>
<p>Fix buffer overflow vulnerability in LDAP KDB back end.
[CVE-2014-4345]</p>
<p>Fix multiple vulnerabilities in the LDAP KDC back end.
[CVE-2014-5354 CVE-2014-5353]</p>
<p>Fix multiple kadmind vulnerabilities, some of which are based
in the gssrpc library. [CVE-2014-5352 CVE-2014-9421
CVE-2014-9422 CVE-2014-9423]</p>
</blockquote>
</body>
</description>
<references>
<url>http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt</url>
</references>
<dates>
<discovery>2015-02-25</discovery>
<entry>2015-02-25</entry>
</dates>
</vuln>
<vuln vid="996c219c-bbb1-11e4-88ae-d050992ecde8">
<topic>samba -- Unexpected code execution in smbd</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.25</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.17</lt></range>
</package>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><lt>3.6.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba development team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2015-0240">
<p>All versions of Samba from 3.5.0 to 4.2.0rc4 are
vulnerable to an unexpected code execution vulnerability
in the smbd file server daemon.</p>
<p>A malicious client could send packets that may set up the
stack in such a way that the freeing of memory in a
subsequent anonymous netlogon packet could allow execution
of arbitrary code. This code would execute with root
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0240</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-0240</url>
</references>
<dates>
<discovery>2015-02-23</discovery>
<entry>2015-02-23</entry>
</dates>
</vuln>
<vuln vid="0f488b7b-bbb9-11e4-903c-080027ef73ec">
<topic>e2fsprogs -- buffer overflow if s_first_meta_bg too big</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.42.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Ts'o reports:</p>
<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4">
<p>If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.</p>
<p>The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4</url>
<url>http://www.ocert.org/advisories/ocert-2015-002.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1187032</url>
<cvename>CVE-2015-0247</cvename>
</references>
<dates>
<discovery>2014-08-09</discovery>
<entry>2015-02-24</entry>
</dates>
</vuln>
<vuln vid="2a4bcd7d-bbb8-11e4-903c-080027ef73ec">
<topic>e2fsprogs -- potential buffer overflow in closefs()</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.42.12_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Ts'o reports:</p>
<blockquote cite="http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73">
<p>On a carefully crafted filesystem that gets modified through
tune2fs or debugfs, it is possible to trigger a buffer overrun when
the file system is closed via closefs().</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73</url>
<cvename>CVE-2015-1572</cvename>
</references>
<dates>
<discovery>2015-02-06</discovery>
<entry>2015-02-24</entry>
</dates>
</vuln>
<vuln vid="58033a95-bba8-11e4-88ae-d050992ecde8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<name>bind910-base</name>
<range><lt>9.10.1P2</lt></range>
</package>
<package>
<name>bind99</name>
<name>bind99-base</name>
<range><lt>9.9.6P2</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_10</lt></range>
<range><ge>8.4</ge><lt>8.4_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01235">
<p>When configured to perform DNSSEC validation, named can
crash when encountering a rare set of conditions in the
managed trust anchors.</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:05.bind</freebsdsa>
<cvename>CVE-2015-1349</cvename>
<url>https://kb.isc.org/article/AA-01235</url>
</references>
<dates>
<discovery>2015-02-18</discovery>
<entry>2015-02-23</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="63527d0d-b9de-11e4-8a48-206a8a720317">
<topic>krb5 1.12 -- New release/fix multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5-112</name>
<range><lt>1.12.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>Fix multiple vulnerabilities in the LDAP KDC back end.
[CVE-2014-5354] [CVE-2014-5353]</p>
<p>Fix multiple kadmind vulnerabilities, some of which are based
in the gssrpc library. [CVE-2014-5352 CVE-2014-5352
CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]</p>
</blockquote>
</body>
</description>
<references>
<url>http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt</url>
</references>
<dates>
<discovery>2015-02-20</discovery>
<entry>2015-02-21</entry>
</dates>
</vuln>
<vuln vid="3680b234-b6f0-11e4-b7cc-d050992ecde8">
<topic>unzip -- heap based buffer overflow in iconv patch</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-2502-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-2502-1/">
<p>unzip could be made to run programs if it opened a specially crafted file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1315</cvename>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-1315</url>
<url>http://www.ubuntu.com/usn/usn-2502-1/</url>
</references>
<dates>
<discovery>2015-02-17</discovery>
<entry>2015-02-17</entry>
</dates>
</vuln>
<vuln vid="3a888a1e-b321-11e4-83b2-206a8a720317">
<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13.1</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.2_2</lt></range>
</package>
<package>
<name>krb5-111</name>
<range><lt>1.11.5_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MIT Kerberos team reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn
function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in
MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP,
allows remote authenticated users to cause a denial of service
(daemon crash) via a successful LDAP query with no results, as
demonstrated by using an incorrect object type for a password
policy.</p>
<p>CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in
MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when
the KDC uses LDAP, allows remote authenticated users to cause a
denial of service (NULL pointer dereference and daemon crash) by
creating a database entry for a keyless principal, as
demonstrated by a kadmin "add_principal -nokey" or "purgekeys
-all" command.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5353</cvename>
<cvename>CVE-2014-5354</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
</references>
<dates>
<discovery>2015-02-12</discovery>
<entry>2015-02-12</entry>
<modified>2015-02-13</modified>
</dates>
</vuln>
<vuln vid="54a69cf7-b2ef-11e4-b1f1-bcaec565249c">
<topic>xorg-server -- Information leak in the XkbSetGeometry request of X servers.</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.14.7_2,1</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><ge>1.15.0,1</ge><lt>1.16.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Hutterer reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/xorg/2015-February/057158.html">
<p>Olivier Fourdan from Red Hat has discovered a protocol handling
issue in the way the X server code base handles the XkbSetGeometry
request.</p>
<p>The issue stems from the server trusting the client to send valid
string lengths in the request data. A malicious client with string
lengths exceeding the request length can cause the server to copy
adjacent memory data into the XKB structs. This data is then
available to the client via the XkbGetGeometry request. The
data length is at least up to 64k, it is possible to obtain
more data by chaining strings, each string length is then
determined by whatever happens to be in that 16-bit region of
memory.</p>
<p>A similarly crafted request can likely cause the X server
to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0255</cvename>
<url>http://lists.freedesktop.org/archives/xorg/2015-February/057158.html</url>
</references>
<dates>
<discovery>2015-02-10</discovery>
<entry>2015-02-12</entry>
</dates>
</vuln>
<vuln vid="a0c45e53-ae51-11e4-8ac7-d050992ecde8">
<topic>openldap -- two remote denial of service vulnerabilities</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.4.40_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ryan Tandy reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988">
<p>With the deref overlay enabled, ldapsearch with '-E deref=member:'
causes slapd to crash.</p>
</blockquote>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991">
<p>Bill MacAllister discovered that certain queries cause slapd
to crash while freeing operation controls. This is a 2.4.40 regression.
Earlier releases are not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991</url>
</references>
<dates>
<discovery>2015-02-02</discovery>
<entry>2015-02-06</entry>
</dates>
</vuln>
<vuln vid="a6eb239f-adbe-11e4-9fce-080027593b9a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>40.0.2214.111</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>40.0.2214.111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>11 security fixes in this release, including:</p>
<ul>
<li>[447906] High CVE-2015-1209: Use-after-free in DOM. Credit to
Maksymillian.</li>
<li>[453979] High CVE-2015-1210: Cross-origin-bypass in V8
bindings. Credit to anonymous.</li>
<li>[453982] High CVE-2015-1211: Privilege escalation using service
workers. Credit to anonymous.</li>
<li>[455225] CVE-2015-1212: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1209</cvename>
<cvename>CVE-2015-1210</cvename>
<cvename>CVE-2015-1211</cvename>
<cvename>CVE-2015-1212</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-02-05</discovery>
<entry>2015-02-06</entry>
</dates>
</vuln>
<vuln vid="3b40bf2c-ad83-11e4-a2b2-0026551a22dc">
<topic>PostgreSQL -- multiple buffer overflows and memory issues</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.19</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.15</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.10</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.6</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL Project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1569/">
<p>This update fixes multiple security issues reported in PostgreSQL
over the past few months. All of these issues require prior
authentication, and some require additional conditions, and as such
are not considered generally urgent. However, users should examine
the list of security holes patched below in case they are particularly
vulnerable.</p>
<ol>
<li>CVE-2015-0241 Buffer overruns in "to_char" functions.</li>
<li>CVE-2015-0242 Buffer overrun in replacement printf family of
functions.</li>
<li>CVE-2015-0243 Memory errors in functions in the pgcrypto extension.</li>
<li>CVE-2015-0244 An error in extended protocol message reading.</li>
<li>CVE-2014-8161 Constraint violation errors can cause display of values in columns
which the user would not normally have rights to see.</li>
</ol>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0241</cvename>
<cvename>CVE-2015-0242</cvename>
<cvename>CVE-2015-0243</cvename>
<cvename>CVE-2015-0244</cvename>
<cvename>CVE-2014-8161</cvename>
</references>
<dates>
<discovery>2015-02-05</discovery>
<entry>2015-02-05</entry>
</dates>
</vuln>
<vuln vid="24ce5597-acab-11e4-a847-206a8a720317">
<topic>krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.13_1</lt></range>
</package>
<package>
<name>krb5-112</name>
<range><lt>1.12.2_1</lt></range>
</package>
<package>
<name>krb5-111</name>
<range><lt>1.11.5_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt">
<p>CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after
gss_process_context_token() is used to process a valid context
deletion token, the caller is left with a security context handle
containing a dangling pointer. Further uses of this handle will
result in use-after-free and double-free memory access violations.
libgssrpc server applications such as kadmind are vulnerable as
they can be instructed to call gss_process_context_token().</p>
<p>CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR
data from an authenticated user, it may perform use-after-free and
double-free memory access violations while cleaning up the partial
deserialization results. Other libgssrpc server applications may
also be vulnerable if they contain insufficiently defensive XDR
functions.</p>
<p>CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts
authentications to two-component server principals whose first
component is a left substring of "kadmin" or whose realm is a left
prefix of the default realm.</p>
<p>CVE-2014-9423: libgssrpc applications including kadmind output
four or eight bytes of uninitialized memory to the network as
part of an unused "handle" field in replies to clients.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-5352</cvename>
<cvename>CVE-2014-9421</cvename>
<cvename>CVE-2014-9422</cvename>
<cvename>CVE-2014-9423</cvename>
<url>http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt</url>
</references>
<dates>
<discovery>2015-02-03</discovery>
<entry>2015-02-04</entry>
</dates>
</vuln>
<vuln vid="e543c6f8-abf2-11e4-8ac7-d050992ecde8">
<topic>unzip -- out of boundary access issues in test_compr_eb</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ubuntu Security Notice USN-2489-1 reports:</p>
<blockquote cite="http://www.ubuntu.com/usn/usn-2489-1/">
<p>Michal Zalewski discovered that unzip incorrectly handled
certain malformed zip archives. If a user or automated system
were tricked into processing a specially crafted zip archive,
an attacker could possibly execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9636</cvename>
<url>http://www.ubuntu.com/usn/usn-2489-1/</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html</url>
<url>http://seclists.org/oss-sec/2014/q4/489</url>
<url>http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450</url>
</references>
<dates>
<discovery>2014-11-02</discovery>
<entry>2015-02-03</entry>
</dates>
</vuln>
<vuln vid="1c7cfd05-aaee-11e4-83b4-14dae9d210b8">
<topic>Xymon -- buffer overrun</topic>
<affects>
<package>
<name>xymon-server</name>
<range><ge>4.3.4</ge><lt>4.3.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776007">
<p>web/acknowledge.c uses a string twice in a format string, but only
allocates memory for one copy.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/01/31/4</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-1430</url>
<cvename>CVE-2015-1430</cvename>
</references>
<dates>
<discovery>2014-09-28</discovery>
<entry>2015-02-02</entry>
</dates>
</vuln>
<vuln vid="8469d41c-a960-11e4-b18e-bcaec55be5e5">
<topic>rabbitmq -- Security issues in management plugin</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><lt>3.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RabbitMQ project reports:</p>
<blockquote cite="http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100">
<p>Some user-controllable content was not properly HTML-escaped
before being presented to a user in the management web UI:</p>
<ul>
<li>When a user unqueued a message from the management UI,
message details (header names, arguments, etc.) were displayed
unescaped. An attacker could publish a specially crafted
message to add content or execute arbitrary Javascript code on
behalf of a user, if this user unqueued the message from the
management UI.</li>
<li>When viewing policies, their name was displayed unescaped.
An attacker could create a policy with a specially crafted name
to add content or execute arbitrary Javascript code on behalf
of a user who is viewing policies.</li>
<li>When listing connected AMQP network clients, client details
such as its version were displayed unescaped. An attacker could
use a client with a specially crafted version field to add
content or execute arbitrary Javascript code on behalf of a
user who is viewing connected clients.</li>
</ul>
<p>In all cases, the attacker needs a valid user account on the
targeted RabbitMQ cluster.</p>
<p>Furthermore, some admin-controllable content was not properly
escaped:</p>
<ul>
<li>user names;</li>
<li>the cluster name.</li>
</ul>
<p>Likewise, an attacker could add content or execute arbitrary
Javascript code on behalf of a user using the management web UI.
However, the attacker must be an administrator on the RabbitMQ
cluster, thus a trusted user.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100</url>
<url>http://www.rabbitmq.com/release-notes/README-3.4.3.txt</url>
<cvename>CVE-2015-0862</cvename>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-31</entry>
</dates>
</vuln>
<vuln vid="5804b9d4-a959-11e4-9363-20cf30e32f6d">
<topic>apache24 -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Apache HTTP SERVER PROJECT reports:</h1>
<blockquote cite="http://www.apache.org/dist/httpd/Announcement2.4.html">
<p>mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
with response headers' size above 8K.</p>
<p>mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.</p>
<p>mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used
in multiple Require directives with different arguments. PR57204.</p>
<p>core: HTTP trailers could be used to replace HTTP headers late during
request processing, potentially undoing or otherwise confusing modules
that examined or modified request headers earlier. Adds "MergeTrailers"
directive to restore legacy behavior.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3583</cvename>
<cvename>CVE-2014-3581</cvename>
<cvename>CVE-2014-8109</cvename>
<cvename>CVE-2013-5704</cvename>
</references>
<dates>
<discovery>2015-01-29</discovery>
<entry>2015-01-31</entry>
</dates>
</vuln>
<vuln vid="7656fc62-a7a7-11e4-96ba-001999f8d30b">
<topic>asterisk -- Mitigation for libcURL HTTP request injection vulnerability</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.2</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.15.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>CVE-2014-8150 reported an HTTP request injection
vulnerability in libcURL. Asterisk uses libcURL in its
func_curl.so module (the CURL() dialplan function), as
well as its res_config_curl.so (cURL realtime backend)
modules.</p>
<p>Since Asterisk may be configured to allow for user-supplied
URLs to be passed to libcURL, it is possible that an
attacker could use Asterisk as an attack vector to inject
unauthorized HTTP requests if the version of libcURL
installed on the Asterisk server is affected by
CVE-2014-8150.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-002.html</url>
</references>
<dates>
<discovery>2015-01-12</discovery>
<entry>2015-01-29</entry>
</dates>
</vuln>
<vuln vid="2eeb6652-a7a6-11e4-96ba-001999f8d30b">
<topic>asterisk -- File descriptor leak when incompatible codecs are offered</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk may be configured to only allow specific audio
or video codecs to be used when communicating with a
particular endpoint. When an endpoint sends an SDP offer
that only lists codecs not allowed by Asterisk, the offer
is rejected. However, in this case, RTP ports that are
allocated in the process are not reclaimed.</p>
<p>This issue only affects the PJSIP channel driver in
Asterisk. Users of the chan_sip channel driver are not
affected.</p>
<p>As the resources are allocated after authentication,
this issue only affects communications with authenticated
endpoints.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2015-001.html</url>
<cvename>CVE-2015-1558</cvename>
</references>
<dates>
<discovery>2015-01-06</discovery>
<entry>2015-01-29</entry>
<modified>2015-02-17</modified>
</dates>
</vuln>
<vuln vid="0765de84-a6c1-11e4-a0c1-c485083ca99c">
<topic>glibc -- gethostbyname buffer overflow</topic>
<affects>
<package>
<name>linux_base-c6</name>
<range><lt>6.6_2</lt></range>
</package>
<package>
<name>linux_base-f10</name>
<range><ge>0</ge></range>
</package>
<package>
<name>linux-c6-devtools</name>
<range><lt>6.6_3</lt></range>
</package>
<package>
<name>linux-f10-devtools</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Robert Krátký reports:</p>
<blockquote cite="https://access.redhat.com/discussions/1332403">
<p>
GHOST is a 'buffer overflow' bug affecting the gethostbyname() and
gethostbyname2() function calls in the glibc library. This
vulnerability allows a remote attacker that is able to make an
application call to either of these functions to execute arbitrary
code with the permissions of the user running the application.
The gethostbyname() function calls are used for DNS resolving, which
is a very common event. To exploit this vulnerability, an attacker
must trigger a buffer overflow by supplying an invalid hostname
argument to an application that performs a DNS resolution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0235</cvename>
<url>https://access.redhat.com/articles/1332213</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/27/9</url>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2015-01-28</entry>
<modified>2015-02-02</modified>
</dates>
</vuln>
<vuln vid="37a87ade-a59f-11e4-958e-0011d823eebd">
<topic>Adobe Flash Player -- critical vulnerability</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><le>11.2r202.438</le></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><le>11.2r202.438</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsa15-01.html">
<p>Successful exploitation could cause a crash and potentially allow
an attacker to take control of the affected system. We are aware
of reports that this vulnerability is being actively exploited in
the wild via drive-by-download attacks against systems running
Internet Explorer and Firefox on Windows 8.1 and below.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0311</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsa15-01.html</url>
</references>
<dates>
<discovery>2015-01-22</discovery>
<entry>2015-01-26</entry>
</dates>
</vuln>
<vuln vid="dc2d76df-a595-11e4-9363-20cf30e32f6d">
<topic>Bugzilla multiple security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="http://www.bugzilla.org/security/4.0.15/">
<h5>Command Injection</h5>
<p>Some code in Bugzilla does not properly utilize 3 arguments form
for open() and it is possible for an account with editcomponents
permissions to inject commands into product names and other
attributes.</p>
<h5>Information Leak</h5>
<p>Using the WebServices API, a user can possibly execute imported
functions from other non-WebService modules. A whitelist has now
been added that lists explicit methods that can be executed via the
API.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8630</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1079065</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1090275</url>
</references>
<dates>
<discovery>2015-01-21</discovery>
<entry>2015-01-26</entry>
</dates>
</vuln>
<vuln vid="9c7b6c20-a324-11e4-879c-00e0814cab4e">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py32-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py33-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py34-django</name>
<range><ge>1.4</ge><lt>1.4.18</lt></range>
<range><ge>1.5</ge><le>1.5.12</le></range>
<range><ge>1.6</ge><lt>1.6.10</lt></range>
<range><ge>1.7</ge><lt>1.7.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py32-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py33-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
<package>
<name>py34-django-devel</name>
<range><lt>20150124,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/jan/13/security/">
<p>Today the Django team is issuing multiple releases --
Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our
security process. These releases are now available on PyPI and our
download page.</p>
<p>These releases address several security issues. We encourage all
users of Django to upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/jan/13/security/</url>
<cvename>CVE-2015-0219</cvename>
<cvename>CVE-2015-0220</cvename>
<cvename>CVE-2015-0221</cvename>
<cvename>CVE-2015-0222</cvename>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-23</entry>
<modified>2015-01-24</modified>
</dates>
</vuln>
<vuln vid="0523fb7e-8444-4e86-812d-8de05f6f0dce">
<topic>libutp -- remote denial of service or arbitrary code execution</topic>
<affects>
<package>
<name>bittorrent-libutp</name>
<range><lt>0.20130514_1</lt></range>
</package>
<package>
<name>transmission-cli</name>
<name>transmission-deamon</name>
<name>transmission-gtk</name>
<name>transmission-qt4</name>
<range><lt>2.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6129">
<p>Stack-based buffer overflow in utp.cpp in libutp, as used
in Transmission before 2.74 and possibly other products,
allows remote attackers to cause a denial of service (crash)
and possibly execute arbitrary code via crafted "micro
transport protocol packets."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6129</cvename>
<url>https://github.com/bittorrent/libutp/issues/38</url>
<url>https://trac.transmissionbt.com/ticket/5002</url>
</references>
<dates>
<discovery>2012-08-01</discovery>
<entry>2014-12-29</entry>
</dates>
</vuln>
<vuln vid="f9c388c5-a256-11e4-992a-7b2a515a1247">
<topic>LibreSSL -- DTLS vulnerability</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL Security Advisory:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
<p>
A memory leak can occur in the dtls1_buffer_record function under certain
conditions. In particular this could occur if an attacker sent repeated DTLS
records with the same sequence number but for the next epoch. The memory leak
could be exploited by an attacker in a Denial of Service attack through memory
exhaustion.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0206</cvename>
<url>https://www.openssl.org/news/secadv_20150108.txt</url>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-22</entry>
</dates>
</vuln>
<vuln vid="cc294a2c-a232-11e4-8e9f-0011d823eebd">
<topic>Adobe Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<range><lt>11.2r202.429</lt></range>
</package>
<package>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.429</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="http://helpx.adobe.com/security/products/flash-player/apsb15-01.html">
<p>These updates address vulnerabilities that could potentially allow
an attacker to take control of the affected system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0301</cvename>
<cvename>CVE-2015-0302</cvename>
<cvename>CVE-2015-0303</cvename>
<cvename>CVE-2015-0304</cvename>
<cvename>CVE-2015-0305</cvename>
<cvename>CVE-2015-0306</cvename>
<cvename>CVE-2015-0307</cvename>
<cvename>CVE-2015-0308</cvename>
<cvename>CVE-2015-0309</cvename>
<url>http://helpx.adobe.com/security/products/flash-player/apsb15-01.html</url>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-22</entry>
</dates>
</vuln>
<vuln vid="e30e0c99-a1b7-11e4-b85c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>40.0.2214.91</lt></range>
</package>
<package>
<name>chromium-pulse</name>
<range><lt>40.0.2214.91</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/">
<p>62 security fixes in this release, including:</p>
<ul>
<li>[430353] High CVE-2014-7923: Memory corruption in ICU. Credit
to yangdingning.</li>
<li>[435880] High CVE-2014-7924: Use-after-free in IndexedDB.
Credit to Collin Payne.</li>
<li>[434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit
to mark.buer.</li>
<li>[422824] High CVE-2014-7926: Memory corruption in ICU. Credit
to yangdingning.</li>
<li>[444695] High CVE-2014-7927: Memory corruption in V8. Credit to
Christian Holler.</li>
<li>[435073] High CVE-2014-7928: Memory corruption in V8. Credit to
Christian Holler.</li>
<li>[442806] High CVE-2014-7930: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[442710] High CVE-2014-7931: Memory corruption in V8. Credit to
cloudfuzzer.</li>
<li>[443115] High CVE-2014-7929: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[429666] High CVE-2014-7932: Use-after-free in DOM. Credit to
Atte Kettunen of OUSPG.</li>
<li>[427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit
to aohelin.</li>
<li>[427249] High CVE-2014-7934: Use-after-free in DOM. Credit to
cloudfuzzer.</li>
<li>[402957] High CVE-2014-7935: Use-after-free in Speech. Credit
to Khalil Zhani.</li>
<li>[428561] High CVE-2014-7936: Use-after-free in Views. Credit
to Christoph Diehl.</li>
<li>[419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit
to Atte Kettunen of OUSPG.</li>
<li>[416323] High CVE-2014-7938: Memory corruption in Fonts. Credit
to Atte Kettunen of OUSPG.</li>
<li>[399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit
to Takeshi Terada.</li>
<li>[433866] Medium CVE-2014-7940: Uninitialized-value in ICU.
Credit to miaubiz.</li>
<li>[428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit
to Atte Kettunen of OUSPG and Christoph Diehl.</li>
<li>[426762] Medium CVE-2014-7942: Uninitialized-value in Fonts.
Credit to miaubiz.</li>
<li>[422492] Medium CVE-2014-7943: Out-of-bounds read in Skia.
Credit to Atte Kettunen of OUSPG.</li>
<li>[418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium.
Credit to cloudfuzzer.</li>
<li>[414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium.
Credit to cloudfuzzer.</li>
<li>[414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts.
Credit to miaubiz.</li>
<li>[430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium.
Credit to fuzztercluck.</li>
<li>[414026] Medium CVE-2014-7948: Caching error in AppCache.
Credit to jiayaoqijia.</li>
<li>[449894] CVE-2015-1205: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 3.30
branch (currently 3.30.33.15).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7923</cvename>
<cvename>CVE-2014-7924</cvename>
<cvename>CVE-2014-7925</cvename>
<cvename>CVE-2014-7926</cvename>
<cvename>CVE-2014-7927</cvename>
<cvename>CVE-2014-7928</cvename>
<cvename>CVE-2014-7929</cvename>
<cvename>CVE-2014-7930</cvename>
<cvename>CVE-2014-7931</cvename>
<cvename>CVE-2014-7932</cvename>
<cvename>CVE-2014-7933</cvename>
<cvename>CVE-2014-7934</cvename>
<cvename>CVE-2014-7935</cvename>
<cvename>CVE-2014-7936</cvename>
<cvename>CVE-2014-7937</cvename>
<cvename>CVE-2014-7938</cvename>
<cvename>CVE-2014-7939</cvename>
<cvename>CVE-2014-7940</cvename>
<cvename>CVE-2014-7941</cvename>
<cvename>CVE-2014-7942</cvename>
<cvename>CVE-2014-7943</cvename>
<cvename>CVE-2014-7944</cvename>
<cvename>CVE-2014-7945</cvename>
<cvename>CVE-2014-7946</cvename>
<cvename>CVE-2014-7947</cvename>
<cvename>CVE-2014-7948</cvename>
<cvename>CVE-2015-1205</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-01-21</discovery>
<entry>2015-01-21</entry>
</dates>
</vuln>
<vuln vid="a5856eba-a015-11e4-a680-1c6f65c3c4ff">
<topic>polarssl -- Remote attack using crafted certificates</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.12_1</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PolarSSL team reports:</p>
<blockquote cite="https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04">
<p>During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not
initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a
situation is created where the uninitialized pointer is passed to polarssl_free().</p>
<p>This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this
means clients when receiving a certificate from the server or servers in case they are actively
asking for a client certificate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1182</cvename>
<url>https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04</url>
<url>https://www.certifiedsecure.com/polarssl-advisory/</url>
</references>
<dates>
<discovery>2015-01-14</discovery>
<entry>2015-01-19</entry>
</dates>
</vuln>
<vuln vid="d9360908-9d52-11e4-87fd-10bf48e1088e">
<topic>unzip -- input sanitization errors</topic>
<affects>
<package>
<name>unzip</name>
<range><le>6.0_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-011.html">
<p>The UnZip tool is an open source extraction utility for archives
compressed in the zip format.</p>
<p>The unzip command line tool is affected by heap-based buffer
overflows within the CRC32 verification, the test_compr_eb() and
the getZip64Data() functions. The input errors may result in
arbitrary code execution.</p>
<p>A specially crafted zip file, passed to unzip -t, can be used to
trigger the vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8139</cvename>
<cvename>CVE-2014-8140</cvename>
<cvename>CVE-2014-8141</cvename>
<url>http://www.info-zip.org/UnZip.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174844</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1174856</url>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2015-01-16</entry>
</dates>
</vuln>
<vuln vid="d4f45676-9d33-11e4-8275-000c292e4fd8">
<topic>samba -- Elevation of privilege to Active Directory Domain Controller</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><lt>4.0.23</lt></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2014-8143">
<p>In Samba's AD DC we neglected to ensure that
attempted modifications of the userAccountControl attribute
did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8143</cvename>
<url>https://www.samba.org/samba/security/CVE-2014-8143</url>
</references>
<dates>
<discovery>2015-01-15</discovery>
<entry>2015-01-16</entry>
</dates>
</vuln>
<vuln vid="7a8a74d1-9c34-11e4-a40b-5453ed2e2b49">
<topic>kde-runtime -- incorrect CBC encryption handling</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.12_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Valentin Rusu reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20150109-1.txt">
<p>Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC
encryption blocks when encrypting secrets in kwl files. The secrets
were still encrypted, but the result binary data corresponded to an
ECB encrypted block instead of CBC.</p>
<p>The ECB encryption algorithm, even if it'll scramble user data,
will produce same encrypted byte sequence for the same input text.
As a result, attackers may eventually find-out the encrypted
text.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-7252</cvename>
<url>https://www.kde.org/info/security/advisory-20150109-1.txt</url>
</references>
<dates>
<discovery>2015-01-09</discovery>
<entry>2015-01-14</entry>
</dates>
</vuln>
<vuln vid="bd62c640-9bb9-11e4-a5ad-000c297fb80f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>35.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>35.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.32</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.4.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.32</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.4.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/">
<p>MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0
/ rv:31.4)</p>
<p>MFSA-2015-02 Uninitialized memory use during bitmap
rendering</p>
<p>MFSA-2015-03 sendBeacon requests lack an Origin header</p>
<p>MFSA-2015-04 Cookie injection through Proxy Authenticate
responses</p>
<p>MFSA-2015-05 Read of uninitialized memory in Web Audio</p>
<p>MFSA-2015-06 Read-after-free in WebRTC</p>
<p>MFSA-2015-07 Gecko Media Plugin sandbox escape</p>
<p>MFSA-2015-08 Delegated OCSP responder certificates failure
with id-pkix-ocsp-nocheck extension</p>
<p>MFSA-2015-09 XrayWrapper bypass through DOM objects</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8634</cvename>
<cvename>CVE-2014-8635</cvename>
<cvename>CVE-2014-8637</cvename>
<cvename>CVE-2014-8638</cvename>
<cvename>CVE-2014-8639</cvename>
<cvename>CVE-2014-8640</cvename>
<cvename>CVE-2014-8641</cvename>
<cvename>CVE-2014-8642</cvename>
<cvename>CVE-2014-8643</cvename>
<cvename>CVE-2014-8636</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/</url>
<url>https://www.mozilla.org/security/advisories/</url>
</references>
<dates>
<discovery>2015-01-13</discovery>
<entry>2015-01-14</entry>
</dates>
</vuln>
<vuln vid="daa8a49b-99b9-11e4-8f66-3085a9a4510d">
<topic>libevent -- integer overflow in evbuffers</topic>
<affects>
<package>
<name>libevent</name>
<range><lt>1.4.15</lt></range>
<range><ge>2.0</ge><lt>2.0.22</lt></range>
</package>
<package>
<name>libevent2</name>
<range><lt>2.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Team reports:</p>
<blockquote cite="https://www.debian.org/security/2015/dsa-3119">
<p>Andrew Bartlett of Catalyst reported a defect affecting certain
applications using the Libevent evbuffer API. This defect leaves
applications which pass insanely large inputs to evbuffers open
to a possible heap overflow or infinite loop. In order to exploit
this flaw, an attacker needs to be able to find a way to provoke
the program into trying to make a buffer chunk larger than what
will fit into a single size_t or off_t.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6272</cvename>
<url>https://www.debian.org/security/2015/dsa-3119</url>
</references>
<dates>
<discovery>2015-01-05</discovery>
<entry>2015-01-11</entry>
<modified>2017-02-20</modified>
</dates>
</vuln>
<vuln vid="caa98ffd-0a92-40d0-b234-fd79b429157e">
<topic>cURL -- URL request injection vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.40.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20150108B.html">
<p>When libcurl sends a request to a server via a HTTP proxy, it
copies the entire URL into the request and sends if off.
If the given URL contains line feeds and carriage returns those will
be sent along to the proxy too, which allows the program to for
example send a separate HTTP request injected embedded in the URL.
Many programs allow some kind of external sources to set the URL or
provide partial pieces for the URL to ask for, and if the URL as
received from the user is not stripped good enough this flaw allows
malicious users to do additional requests in a way that was not
intended, or just to insert request headers into the request that
the program didn't intend.
We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8150</cvename>
<url>http://curl.haxx.se/docs/adv_20150108B.html</url>
</references>
<dates>
<discovery>2014-12-25</discovery>
<entry>2015-01-09</entry>
</dates>
</vuln>
<vuln vid="e9ccdb28-9802-11e4-9d9c-bcaec565249c">
<topic>WebKit-gtk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<range><lt>1.4.8</lt></range>
</package>
<package>
<name>webkit-gtk3</name>
<range><lt>1.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Webkit release team reports:</p>
<blockquote cite="http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html">
<p>This release fixes the following security issues:
CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386,
CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.</p>
</blockquote>
</body>
</description>
<references>
<url>http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html</url>
<cvename>CVE-2014-1344</cvename>
<cvename>CVE-2014-1384</cvename>
<cvename>CVE-2014-1385</cvename>
<cvename>CVE-2014-1386</cvename>
<cvename>CVE-2014-1387</cvename>
<cvename>CVE-2014-1388</cvename>
<cvename>CVE-2014-1389</cvename>
<cvename>CVE-2014-1390</cvename>
</references>
<dates>
<discovery>2015-01-07</discovery>
<entry>2015-01-09</entry>
</dates>
</vuln>
<vuln vid="4e536c14-9791-11e4-977d-d050992ecde8">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1_17</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.1k</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_4</lt></range>
<range><ge>10.0</ge><lt>10.0_16</lt></range>
<range><ge>9.3</ge><lt>9.3_8</lt></range>
<range><ge>8.4</ge><lt>8.4_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv_20150108.txt">
<p>DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)</p>
<p>DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)</p>
<p>no-ssl3 configuration sets method to NULL (CVE-2014-3569)</p>
<p>ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)</p>
<p>RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)</p>
<p>DH client certificates accepted without verification [Server] (CVE-2015-0205)</p>
<p>Certificate fingerprints can be modified (CVE-2014-8275)</p>
<p>Bignum squaring may produce incorrect results (CVE-2014-3570)</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:01.openssl</freebsdsa>
<cvename>CVE-2014-3569</cvename>
<cvename>CVE-2014-3570</cvename>
<cvename>CVE-2014-3571</cvename>
<cvename>CVE-2014-3572</cvename>
<cvename>CVE-2014-8275</cvename>
<cvename>CVE-2015-0204</cvename>
<cvename>CVE-2015-0205</cvename>
<cvename>CVE-2015-0206</cvename>
<url>https://www.openssl.org/news/secadv_20150108.txt</url>
</references>
<dates>
<discovery>2015-01-08</discovery>
<entry>2015-01-08</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="5e135178-8aeb-11e4-801f-0022156e8794">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>3.7.5,1</lt></range>
<range><ge>3.8,1</ge><lt>3.8.5,1</lt></range>
<range><ge>3.9,1</ge><lt>3.9.3,1</lt></range>
<range><ge>4.0,1</ge><lt>4.0.1,1</lt></range>
</package>
<package>
<name>zh-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>ja-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
<package>
<name>ru-wordpress</name>
<range><lt>3.7.5</lt></range>
<range><ge>3.8</ge><lt>3.8.5</lt></range>
<range><ge>3.9</ge><lt>3.9.3</lt></range>
<range><ge>4.0</ge><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9039">
<p>wp-login.php in WordPress before 3.7.5, 3.8.x before
3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow
remote attackers to reset passwords by leveraging access to
an e-mail account that received a password-reset message.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9038">
<p>wp-includes/http.php in WordPress before 3.7.5, 3.8.x
before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
allows remote attackers to conduct server-side request
forgery (SSRF) attacks by referring to a 127.0.0.0/8
resource.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9037">
<p>WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
3.9.3, and 4.x before 4.0.1 might allow remote attackers to
obtain access to an account idle since 2008 by leveraging an
improper PHP dynamic type comparison for an MD5 hash.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9036">
<p>Cross-site scripting (XSS) vulnerability in WordPress
before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and
4.x before 4.0.1 allows remote attackers to inject arbitrary
web script or HTML via a crafted Cascading Style Sheets
(CSS) token sequence in a post.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9035">
<p>Cross-site scripting (XSS) vulnerability in Press This in
WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before
3.9.3, and 4.x before 4.0.1 allows remote attackers to
inject arbitrary web script or HTML via unspecified
vectors</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9034">
<p>wp-includes/class-phpass.php in WordPress before 3.7.5,
3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1
allows remote attackers to cause a denial of service (CPU
consumption) via a long password that is improperly handled
during hashing, a similar issue to CVE-2014-9016.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9033">
<p>Cross-site request forgery (CSRF) vulnerability in
wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0
allows remote attackers to hijack the authentication of
arbitrary users for requests that reset passwords.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9033</cvename>
<cvename>CVE-2014-9034</cvename>
<cvename>CVE-2014-9035</cvename>
<cvename>CVE-2014-9036</cvename>
<cvename>CVE-2014-9037</cvename>
<cvename>CVE-2014-9038</cvename>
<cvename>CVE-2014-9039</cvename>
</references>
<dates>
<discovery>2014-11-25</discovery>
<entry>2015-01-05</entry>
</dates>
</vuln>
<vuln vid="c564f9bd-8ba7-11e4-801f-0022156e8794">
<topic>png -- heap overflow for 32-bit builds</topic>
<affects>
<package>
<name>png</name>
<range><ge>1.2.6</ge><lt>1.5.21</lt></range>
<range><ge>1.6</ge><lt>1.6.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>32-bit builds of PNG library are vulnerable to an unsigned
integer overflow that is triggered by a crafted wide
interlaced images.
Overflow results in a heap corruption that will crash the
application and may lead to the controlled overwrite of a
selected portions of process address space.</p>
</body>
</description>
<references>
<url>http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt</url>
<url>http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/</url>
</references>
<dates>
<discovery>2014-12-23</discovery>
<entry>2015-01-05</entry>
</dates>
</vuln>
<vuln vid="9575259a-92d5-11e4-bce6-d050992ecde8">
<topic>file -- multiple vulnerabilities</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.21</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>8.4</ge><lt>8.4_20</lt></range>
<range><ge>9.1</ge><lt>9.1_23</lt></range>
<range><ge>9.2</ge><lt>9.2_16</lt></range>
<range><ge>9.3</ge><lt>9.3_6</lt></range>
<range><ge>10.0</ge><lt>10.0_13</lt></range>
<range><ge>10.1</ge><lt>10.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q4/1056">
<p>Thomas Jarosch of Intra2net AG reported a number of
denial of service issues (resource consumption) in
the ELF parser used by file(1). These issues were
fixed in the 5.21 release of file(1), but by mistake
are missing from the changelog.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3710</cvename>
<cvename>CVE-2014-8116</cvename>
<cvename>CVE-2014-8117</cvename>
<freebsdsa>SA-14:28.file</freebsdsa>
<url>http://seclists.org/oss-sec/2014/q4/1056</url>
</references>
<dates>
<discovery>2014-12-16</discovery>
<entry>2015-01-02</entry>
</dates>
</vuln>
<vuln vid="c3d43001-8064-11e4-801f-0022156e8794">
<topic>mutt -- denial of service via crafted mail message</topic>
<affects>
<package>
<name>mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
<package>
<name>ja-mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
<package>
<name>zh-mutt</name>
<range><ge>1.5.22</ge><lt>1.5.23_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9116">
<p>The write_one_header function in mutt 1.5.23 does not
properly handle newline characters at the beginning of a
header, which allows remote attackers to cause a denial of
service (crash) via a header with an empty body, which
triggers a heap-based buffer overflow in the mutt_substrdup
function.</p>
</blockquote>
</body>
</description>
<references>
<bid>71334</bid>
<cvename>CVE-2014-9116</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125</url>
<url>http://dev.mutt.org/trac/ticket/3716</url>
</references>
<dates>
<discovery>2014-11-26</discovery>
<entry>2014-12-23</entry>
</dates>
</vuln>
<vuln vid="4033d826-87dd-11e4-9079-3c970e169bc2">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<name>ntp-devel</name>
<range><lt>4.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="http://www.kb.cert.org/vuls/id/852879">
<p>The Network Time Protocol (NTP) provides networked
systems with a way to synchronize time for various
services and applications. ntpd version 4.2.7 and
previous versions allow attackers to overflow several
buffers in a way that may allow malicious code to
be executed. ntp-keygen prior to version 4.2.7p230
also uses a non-cryptographic random number generator
when generating symmetric keys.</p>
<p>The buffer overflow vulnerabilities in ntpd may
allow a remote unauthenticated attacker to execute
arbitrary malicious code with the privilege level
of the ntpd process. The weak default key and
non-cryptographic random number generator in
ntp-keygen may allow an attacker to gain
information regarding the integrity checking
and authentication encryption schemes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9293</cvename>
<cvename>CVE-2014-9294</cvename>
<cvename>CVE-2014-9295</cvename>
<cvename>CVE-2014-9296</cvename>
<url>http://www.kb.cert.org/vuls/id/852879</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2014-12-20</entry>
</dates>
</vuln>
<vuln vid="1d567278-87a5-11e4-879c-000c292ee6b8">
<topic>git -- Arbitrary command execution on case-insensitive filesystems</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git Project reports:</p>
<blockquote cite="http://article.gmane.org/gmane.linux.kernel/1853266">
<p>When using a case-insensitive filesystem an attacker can
craft a malicious Git tree that will cause Git to overwrite
its own .git/config file when cloning or checking out a
repository, leading to arbitrary command execution in the
client machine. If you are a hosting service whose users
may fetch from your service to Windows or Mac OS X machines,
you are strongly encouraged to update to protect such users
who use existing versions of Git.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9390</cvename>
<url>https://github.com/blog/1938-git-client-vulnerability-announced</url>
<url>http://article.gmane.org/gmane.linux.kernel/1853266</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2014-12-19</entry>
</dates>
</vuln>
<vuln vid="0c5cf7c4-856e-11e4-a089-60a44c524f57">
<topic>otrs -- Incomplete Access Control</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>3.2.*</gt><lt>3.2.17</lt></range>
<range><gt>3.3.*</gt><lt>3.3.11</lt></range>
<range><gt>4.0.*</gt><lt>4.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS project reports:</p>
<blockquote cite="http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/">
<p>An attacker with valid OTRS credentials could access and manipulate ticket data
of other users via the GenericInterface, if a ticket webservice is configured
and not additionally secured.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/</url>
<cvename>CVE-2014-9324</cvename>
</references>
<dates>
<discovery>2014-12-16</discovery>
<entry>2014-12-16</entry>
</dates>
</vuln>
<vuln vid="f5561ade-846c-11e4-b7a7-20cf30e32f6d">
<topic>subversion -- DoS vulnerabilities</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
</package>
<package>
<name>subversion16</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
</package>
<package>
<name>subversion17</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.0.0</ge><lt>1.7.19</lt></range>
<range><ge>1.8.0</ge><lt>1.8.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives a REPORT request for some invalid formatted special URIs.</p>
<p>Subversion's mod_dav_svn Apache HTTPD server module will crash when it
receives a request for some invalid formatted special URIs.</p>
<p>We consider this to be a medium risk vulnerability. Repositories which
allow for anonymous reads will be vulnerable without authentication.
Unfortunately, no special configuration is required and all mod_dav_svn
servers are vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3580</cvename>
<cvename>CVE-2014-8108</cvename>
<url>http://subversion.apache.org/security/CVE-2014-3580-advisory.txt</url>
<url>http://subversion.apache.org/security/CVE-2014-8108-advisory.txt</url>
</references>
<dates>
<discovery>2014-12-13</discovery>
<entry>2014-12-15</entry>
</dates>
</vuln>
<vuln vid="fdf72a0e-8371-11e4-bc20-001636d274f3">
<topic>NVIDIA UNIX driver -- remote denial of service or arbitrary code execution</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>340.65</lt></range>
</package>
<package>
<name>nvidia-driver-304</name>
<range><lt>304.125</lt></range>
</package>
<package>
<name>nvidia-driver-173</name>
<range><le>173.14.35_3</le></range>
</package>
<package>
<name>nvidia-driver-96</name>
<range><le>96.43.23_2</le></range>
</package>
<package>
<name>nvidia-driver-71</name>
<range><le>71.86.15_4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/3610">
<p>The GLX indirect rendering support supplied on NVIDIA products
is subject to the recently disclosed X.Org vulnerabilities
(CVE-2014-8093, CVE-2014-8098) as well as internally identified
vulnerabilities (CVE-2014-8298).</p>
<p>Depending on how it is configured, the X server typically runs
with raised privileges, and listens for GLX indirect rendering
protocol requests from a local socket and potentially a TCP/IP
port. The vulnerabilities could be exploited in a way that
causes the X server to access uninitialized memory or overwrite
arbitrary memory in the X server process. This can cause a
denial of service (e.g., an X server segmentation fault), or
could be exploited to achieve arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-8298</cvename>
<cvename>CVE-2014-8093</cvename>
<cvename>CVE-2014-8098</cvename>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2014-12-14</entry>
</dates>
</vuln>
<vuln vid="ab3e98d9-8175-11e4-907d-d050992ecde8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<name>bind99-base</name>
<range><lt>9.9.6</lt></range>
</package>
<package>
<name>bind98</name>
<name>bind98-base</name>
<name>bind96</name>
<name>bind96-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_6</lt></range>
<range><ge>9.2</ge><lt>9.2_16</lt></range>
<range><ge>9.1</ge><lt>9.1_23</lt></range>
<range><ge>8.4</ge><lt>8.4_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/important-security-advisory-posted/">
<p>We have today posted updated versions of 9.9.6 and 9.10.1
to address a significant security vulnerability in DNS
resolution. The flaw was discovered by Florian Maury of
ANSSI, and applies to any recursive resolver that does not
support a limit on the number of recursions. [<a href="http://cert.ssi.gouv.fr/site/CERTFR-2014-AVI-512/index.html">CERTFR-2014-AVI-512</a>],
[USCERT <a href="www.kb.cert.org/vuls/id/264212">VU#264212</a>]</p>
<p>A flaw in delegation handling could be exploited to put named
into an infinite loop, in which each lookup of a name server
triggered additional lookups of more name servers. This has
been addressed by placing limits on the number of levels of
recursion named will allow (default 7), and on the number of
queries that it will send before terminating a recursive query
(default 50). The recursion depth limit is configured via the
max-recursion-depth option, and the query limit via the
max-recursion-queries option. For more information, see the
security advisory at <a href="https://kb.isc.org/article/AA-01216/">https://kb.isc.org/article/AA-01216/</a>.
<a href="https://kb.isc.org/article/AA-01216/">[CVE-2014-8500]</a>
[RT #37580]</p>
<p>In addition, we have also corrected a potential security
vulnerability in the GeoIP feature in the 9.10.1 release only.
For more information on this issue, see the security advisory
at <a href="https://kb.isc.org/article/AA-01217">https://kb.isc.org/article/AA-01217</a>.
<a href="https://kb.isc.org/article/AA-01217">[CVE-2014-8680]</a></p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-14:29.bind</freebsdsa>
<cvename>CVE-2014-8500</cvename>
<cvename>CVE-2014-8680</cvename>
<url>https://www.isc.org/blogs/important-security-advisory-posted/</url>
</references>
<dates>
<discovery>2014-12-08</discovery>
<entry>2014-12-11</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="94268da0-8118-11e4-a180-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in WebSocket Server</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.14.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When handling a WebSocket frame the res_http_websocket
module dynamically changes the size of the memory used
to allow the provided payload to fit. If a payload length
of zero was received the code would incorrectly attempt
to resize to zero. This operation would succeed and end
up freeing the memory but be treated as a failure. When
the session was subsequently torn down this memory would
get freed yet again causing a crash.</p>
<p>Users of the WebSocket functionality also did not take
into account that provided text frames are not guaranteed
to be NULL terminated. This has been fixed in chan_sip
and chan_pjsip in the applicable versions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2014-019.html</url>
<cvename>CVE-2014-9374</cvename>
</references>
<dates>
<discovery>2014-10-30</discovery>
<entry>2014-12-11</entry>
<modified>2015-01-29</modified>
</dates>
</vuln>
<vuln vid="27b9b2f0-8081-11e4-b4ca-bcaec565249c">
<topic>xserver -- multiple issue with X client request handling</topic>
<affects>
<package>
<name>xorg-server</name>
<range><lt>1.12.4_10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="http://lists.x.org/archives/xorg-announce/2014-December/002500.html">
<p>Ilja van Sprundel, a security researcher with IOActive, has
discovered a large number of issues in the way the X server
code base handles requests from X clients, and has worked
with X.Org's security team to analyze, confirm, and fix
these issues.</p>
<p>The vulnerabilities could be exploited to cause the X server
to access uninitialized memory or overwrite arbitrary memory
in the X server process. This can cause a denial of service
(e.g., an X server segmentation fault), or could be exploited
to achieve arbitrary code execution.</p>
<p>The GLX extension to the X Window System allows an X client
to send X protocol to the X server, to request that the X
server perform OpenGL rendering on behalf of the X client.
This is known as "GLX indirect rendering", as opposed to
"GLX direct rendering" where the X client submits OpenGL
rendering commands directly to the GPU, bypassing the X
server and avoiding the X server code for GLX protocol
handling.</p>
<p>Most GLX indirect rendering implementations share some
common ancestry, dating back to "Sample Implementation"
code from Silicon Graphics, Inc (SGI), which SGI
originally commercially licensed to other Unix workstation
and graphics vendors, and later released as open source, so
those vulnerabilities may affect other licensees of SGI's
code base beyond those running code from the X.Org Foundation
or the XFree86 Project.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.x.org/archives/xorg-announce/2014-December/002500.html</url>
<cvename>CVE-2014-8091</cvename>
<cvename>CVE-2014-8092</cvename>
<cvename>CVE-2014-8093</cvename>
<cvename>CVE-2014-8094</cvename>
<cvename>CVE-2014-8095</cvename>
<cvename>CVE-2014-8096</cvename>
<cvename>CVE-2014-8097</cvename>
<cvename>CVE-2014-8098</cvename>
<cvename>CVE-2014-8099</cvename>
<cvename>CVE-2014-8100</cvename>
<cvename>CVE-2014-8101</cvename>
<cvename>CVE-2014-8102</cvename>
</references>
<dates>
<discovery>2014-12-09</discovery>
<entry>2014-12-10</entry>
</dates>
</vuln>
<vuln vid="10d73529-7f4b-11e4-af66-00215af774f0">
<topic>unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_14</lt></range>
<range><ge>10.1</ge><lt>10.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound developer reports:</p>
<blockquote cite="http://unbound.net/downloads/CVE-2014-8602.txt">
<p>The resolver can be tricked into following an endless series of
delegations, this consumes a lot of resources.</p>
</blockquote>
</body>
</description>
<references>
<url>http://unbound.net/downloads/CVE-2014-8602.txt</url>
<freebsdsa>SA-14:30.unbound</freebsdsa>
<cvename>CVE-2014-8602</cvename>
</references>
<dates>
<discovery>2014-12-08</discovery>
<entry>2014-12-09</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="567beb1e-7e0a-11e4-b9cc-bcaec565249c">
<topic>freetype -- Out of bounds stack-based read/write</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner LEMBERG reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html">
<p>The fix for CVE-2014-2240 was not 100% complete to fix the issue
from the CVE completly.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html</url>
<cvename>CVE-2014-2240</cvename>
</references>
<dates>
<discovery>2014-12-07</discovery>
<entry>2014-12-07</entry>
</dates>
</vuln>
<vuln vid="c9c46fbf-7b83-11e4-a96e-6805ca0b3d42">
<topic>phpMyAdmin -- XSS and DoS vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.2.0</ge><lt>4.2.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php">
<p>DoS vulnerability with long passwords.</p>
<p>With very long passwords it was possible to initiate a
denial of service attack on phpMyAdmin.</p>
<p>We consider this vulnerability to be serious.</p>
<p>This vulnerability can be mitigated by configuring
throttling in the webserver.</p>
</blockquote>
<blockquote cite="http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php">
<p>XSS vulnerability in redirection mechanism.</p>
<p>With a crafted URL it was possible to trigger an XSS in
the redirection mechanism in phpMyAdmin.</p>
<p>We consider this vulnerability to be non critical.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php</url>
<url>http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php</url>
<cvename>CVE-2014-9218</cvename>
<cvename>CVE-2014-9219</cvename>
</references>
<dates>
<discovery>2014-12-03</discovery>
<entry>2014-12-04</entry>
</dates>
</vuln>
<vuln vid="7ae61870-9dd2-4884-a2f2-f19bb5784d09">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>34.0,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>31.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>34.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.31</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.31</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>31.3.0</lt></range>
</package>
<package>
<name>nss</name>
<range><lt>3.17.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="http://www.mozilla.org/security/known-vulnerabilities/">
<p>ASN.1 DER decoding of lengths is too permissive, allowing