Index: head/security/vuxml/vuln.xml
===================================================================
--- head/security/vuxml/vuln.xml (revision 524718)
+++ head/security/vuxml/vuln.xml (revision 524719)
@@ -1,65595 +1,65631 @@
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE vuxml PUBLIC "-//vuxml.org//DTD VuXML 1.1//EN" "http://www.vuxml.org/dtd/vuxml-1/vuxml-11.dtd">
<!--
Copyright 2003-2018 Jacques Vidrine and contributors
Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
HTML, PDF, PostScript, RTF and so forth) with or without modification,
are permitted provided that the following conditions are met:
1. Redistributions of source code (VuXML) must retain the above
copyright notice, this list of conditions and the following
disclaimer as the first lines of this file unmodified.
2. Redistributions in compiled form (transformed to other DTDs,
published online in any format, converted to PDF, PostScript,
RTF and other formats) must reproduce the above copyright
notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
$FreeBSD$
QUICK GUIDE TO ADDING A NEW ENTRY
1. run 'make newentry' to add a template to the top of the document
2. fill in the template
3. use 'make validate' to verify syntax correctness (you might need to install
textproc/libxml2 for parser, and this port for catalogs)
4. fix any errors
5. use 'make VID=xxx-yyy-zzz html' to emit the entry's html file for formatting review
6. profit!
Additional tests can be done this way:
$ pkg audit -f ./vuln.xml py26-django-1.6
$ pkg audit -f ./vuln.xml py27-django-1.6.1
Extensive documentation of the format and help with writing and verifying
a new entry is available in The Porter's Handbook at:
http://www.freebsd.org/doc/en/books/porters-handbook/security-notify.html
Help is also available from ports-security@freebsd.org.
Notes:
* Please add new entries to the beginning of this file.
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="c86bfee3-4441-11ea-8be3-54e1ad3d6335">
+ <topic>spamassassin -- Nefarious rule configuration files can run system commands</topic>
+ <affects>
+ <package>
+ <name>spamassassin</name>
+ <range><lt>3.4.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Apache SpamAssassin project reports:</p>
+ <blockquote cite="ihttps://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3c0a91e67a-3190-36e5-41e9-d3553743bcd2@apache.org%3e">
+ <p>A nefarious rule configuration (.cf) files can be configured to
+ run system commands. This issue is less stealthy and attempts to
+ exploit the issue will throw warnings.</p>
+ <p>Thanks to Damian Lukowski at credativ for reporting the issue
+ ethically. With this bug unpatched, exploits can be injected in a
+ number of scenarios though doing so remotely is difficult. In
+ addition to upgrading to SA 3.4.4, we again recommend that users
+ should only use update channels or 3rd party .cf files from trusted
+ places.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3c0a91e67a-3190-36e5-41e9-d3553743bcd2@apache.org%3e</url>
+ <url>https://mail-archives.apache.org/mod_mbox/spamassassin-announce/202001.mbox/%3ccdae17ce-acde-6060-148a-6dc5f45ee728@apache.org%3e</url>
+ <cvename>CVE-2020-1930</cvename>
+ <cvename>CVE-2020-1931</cvename>
+ </references>
+ <dates>
+ <discovery>2020-01-28</discovery>
+ <entry>2020-01-31</entry>
+ </dates>
+ </vuln>
+
<vuln vid="b4e5f782-442d-11ea-9ba9-206a8a720317">
<topic>sudo -- Potential bypass of Runas user restrictions</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/alerts/pwfeedback.html">
<p>Sudo's pwfeedback option can be used to provide visual feedback
when the user is inputting their password. For each key press,
an asterisk is printed. This option was added in response to
user confusion over how the standard Password: prompt disables
the echoing of key presses. While pwfeedback is not enabled by
default in the upstream version of sudo, some systems, such as
Linux Mint and Elementary OS, do enable it in their default
sudoers files.</p>
<p>Due to a bug, when the pwfeedback option is enabled in the
sudoers file, a user may be able to trigger a stack-based buffer
overflow. This bug can be triggered even by users not listed in
the sudoers file. There is no impact unless pwfeedback has been
enabled.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/alerts/pwfeedback.html</url>
<cvename>CVE-2019-18634</cvename>
</references>
<dates>
<discovery>2020-01-30</discovery>
<entry>2020-01-30</entry>
</dates>
</vuln>
<vuln vid="c5bd9068-440f-11ea-9cdb-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.7.0</ge><lt>12.7.4</lt></range>
<range><ge>12.6.0</ge><lt>12.6.6</lt></range>
<range><ge>5.3</ge><lt>12.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/">
<p>Path Traversal to Arbitrary File Read</p>
<p>User Permissions Not Validated in ProjectExportWorker</p>
<p>XSS Vulnerability in File API</p>
<p>Package and File Disclosure through GitLab Workhorse</p>
<p>XSS Vulnerability in Create Groups</p>
<p>Issue and Merge Request Activity Counts Exposed</p>
<p>Email Confirmation Bypass Using AP</p>
<p>Disclosure of Forked Private Project Source Code</p>
<p>Private Project Names Exposed in GraphQL queries</p>
<p>Disclosure of Issues and Merge Requests via Todos</p>
<p>Denial of Service via AsciiDoc</p>
<p>Last Pipeline Status Exposed</p>
<p>Arbitrary Change of Pipeline Status</p>
<p>Grafana Token Displayed in Plaintext</p>
<p>Update excon gem</p>
<p>Update rdoc gem</p>
<p>Update rack-cors gem</p>
<p>Update rubyzip gem</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/01/30/security-release-gitlab-12-7-4-released/</url>
<cvename>CVE-2020-7966</cvename>
<cvename>CVE-2020-8114</cvename>
<cvename>CVE-2020-7973</cvename>
<cvename>CVE-2020-6833</cvename>
<cvename>CVE-2020-7971</cvename>
<cvename>CVE-2020-7967</cvename>
<cvename>CVE-2020-7972</cvename>
<cvename>CVE-2020-7968</cvename>
<cvename>CVE-2020-7979</cvename>
<cvename>CVE-2020-7969</cvename>
<cvename>CVE-2020-7978</cvename>
<cvename>CVE-2020-7974</cvename>
<cvename>CVE-2020-7977</cvename>
<cvename>CVE-2020-7976</cvename>
<cvename>CVE-2019-16779</cvename>
<cvename>CVE-2019-18978</cvename>
<cvename>CVE-2019-16892</cvename>
</references>
<dates>
<discovery>2020-01-30</discovery>
<entry>2020-01-31</entry>
</dates>
</vuln>
<vuln vid="e3404a6e-4364-11ea-b643-206a8a720317">
<topic>spamassassin -- Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the Apache Spamassassin project reports:</p>
<blockquote cite="https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.4.txt">
<p>nefarious rule configuration (.cf) files can be configured to
run system commands similar to CVE-2018-11805. This issue
is less stealthy and attempts to exploit the issue will throw
warnings.</p>
</blockquote>
</body>
</description>
<references>
<url>https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.4.txt</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1931</url>
<cvename>CVE-2020-1931</cvename>
</references>
<dates>
<discovery>2020-01-30</discovery>
<entry>2020-01-30</entry>
</dates>
</vuln>
<vuln vid="08f5c27d-4326-11ea-af8b-00155d0a0200">
<topic>OpenSMTPd -- critical LPE / RCE vulnerability</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><ge>6.4.0,1</ge><lt>6.6.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://opensmtpd.org/security.html">
<p>An incorrect check allows an attacker to trick mbox delivery
into executing arbitrary commands as root and lmtp delivery
into executing arbitrary commands as an unprivileged user</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-7247</cvename>
<url>https://www.openwall.com/lists/oss-security/2020/01/28/3</url>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="a250539d-d1d4-4591-afd3-c8bdfac335d8">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.219</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.204.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2020-01-29/">
<h1>Description</h1>
<h5>(High) SECURITY-1682 / CVE-2020-2099</h5>
<p>Inbound TCP Agent Protocol/3 authentication bypass</p>
<h5>(Medium) SECURITY-1641 / CVE-2020-2100</h5>
<p>Jenkins vulnerable to UDP amplification reflection attack</p>
<h5>(Medium) SECURITY-1659 / CVE-2020-2101</h5>
<p>Non-constant time comparison of inbound TCP agent connection secret</p>
<h5>(Medium) SECURITY-1660 / CVE-2020-2102</h5>
<p>Non-constant time HMAC comparison</p>
<h5>(Medium) SECURITY-1695 / CVE-2020-2103</h5>
<p>Diagnostic page exposed session cookies</p>
<h5>(Medium) SECURITY-1650 / CVE-2020-2104</h5>
<p>Memory usage graphs accessible to anyone with Overall/Read</p>
<h5>(Low) SECURITY-1704 / CVE-2020-2105</h5>
<p>Jenkins REST APIs vulnerable to clickjacking</p>
<h5>(Medium) SECURITY-1680 / CVE-2020-2106</h5>
<p>Stored XSS vulnerability in Code Coverage API Plugin</p>
<h5>(Medium) SECURITY-1565 / CVE-2020-2107</h5>
<p>Fortify Plugin stored credentials in plain text</p>
<h5>(High) SECURITY-1719 / CVE-2020-2108</h5>
<p>XXE vulnerability in WebSphere Deployer Plugin</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2020-2099</cvename>
<cvename>CVE-2020-2100</cvename>
<cvename>CVE-2020-2101</cvename>
<cvename>CVE-2020-2102</cvename>
<cvename>CVE-2020-2103</cvename>
<cvename>CVE-2020-2104</cvename>
<cvename>CVE-2020-2105</cvename>
<cvename>CVE-2020-2106</cvename>
<cvename>CVE-2020-2107</cvename>
<cvename>CVE-2020-2108</cvename>
<url>https://jenkins.io/security/advisory/2020-01-29/</url>
</references>
<dates>
<discovery>2020-01-29</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="2af10639-4299-11ea-aab1-98fa9bfec35a">
<topic>pkg -- vulnerability in libfetch</topic>
<affects>
<package>
<name>pkg</name>
<range><lt>1.12.0_1</lt></range>
</package>
<package>
<name>pkg-devel</name>
<range><lt>1.12.99_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A programming error allows an attacker who can specify a URL with a username
and/or password components to overflow libfetch(3) buffers.</p>
</body>
</description>
<references>
<freebsdsa>SA-20:01.libfetch</freebsdsa>
<cvename>CVE-2020-7450</cvename>
</references>
<dates>
<discovery>2020-01-28</discovery>
<entry>2020-01-29</entry>
</dates>
</vuln>
<vuln vid="5f0dd349-40a2-11ea-8d8c-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba410</name>
<range><lt>4.10.12</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/samba-4.10.12.html">
<p>CVE-2019-14902</p>
<p>The implementation of ACL inheritance in the Samba AD DC was not complete,
and so absent a 'full-sync' replication, ACLs could get out of sync between
domain controllers.</p>
<p>CVE-2019-14907</p>
<p>When processing untrusted string input Samba can read past the end of the
allocated buffer when printing a "Conversion error" message to the logs.</p>
<p>CVE-2019-19344</p>
<p>During DNS zone scavenging (of expired dynamic entries) there is a read of
memory after it has been freed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/history/samba-4.10.12.html</url>
<cvename>CVE-2019-14902</cvename>
<cvename>CVE-2019-14907</cvename>
<cvename>CVE-2019-19344</cvename>
</references>
<dates>
<discovery>2020-01-14</discovery>
<entry>2020-01-27</entry>
</dates>
</vuln>
<vuln vid="dc8cff4c-4063-11ea-8a94-3497f6939fdd">
<topic>webkit-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.26.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2020-0001.html</url>
<cvename>CVE-2019-8835</cvename>
<cvename>CVE-2019-8844</cvename>
<cvename>CVE-2019-8846</cvename>
</references>
<dates>
<discovery>2020-01-23</discovery>
<entry>2020-01-26</entry>
</dates>
</vuln>
<vuln vid="0700e76c-3eb0-11ea-8478-3085a9a95629">
<topic>Pillow -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py35-pillow</name>
<name>py36-pillow</name>
<name>py37-pillow</name>
<name>py38-pillow</name>
<range><lt>6.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pillow developers report:</p>
<blockquote cite="https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html">
<p>
This release addresses several security problems, as well as
addressing CVE-2019-19911.
</p><p>
CVE-2019-19911 is regarding FPX images. If an image reports that it
has a large number of bands, a large amount of resources will be
used when trying to process the image. This is fixed by limiting the
number of bands to those usable by Pillow.
</p><p>
Buffer overruns were found when processing an SGI, PCX or FLI image.
Checks have been added to prevent this.
</p><p>
Overflow checks have been added when calculating the size of a
memory block to be reallocated in the processing of a TIFF image.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html</url>
<cvename>CVE-2019-19911</cvename>
<cvename>CVE-2020-5310</cvename>
<cvename>CVE-2020-5311</cvename>
<cvename>CVE-2020-5312</cvename>
<cvename>CVE-2020-5313</cvename>
<freebsdpr>ports/243336</freebsdpr>
</references>
<dates>
<discovery>2019-12-19</discovery>
<entry>2020-01-24</entry>
</dates>
</vuln>
<vuln vid="a512a412-3a33-11ea-af63-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.10.3">
<ul>
<li>Hide credentials when submitting migration</li>
<li>Never allow an empty password to validate</li>
<li>Prevent redirect to Host</li>
<li>Hide public repos owned by private orgs</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.10.3</url>
<freebsdpr>ports/243437</freebsdpr>
</references>
<dates>
<discovery>2019-11-22</discovery>
<entry>2020-01-18</entry>
</dates>
</vuln>
<vuln vid="a6cf65ad-37d2-11ea-a1c7-b499baebfeaf">
<topic>MySQL -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.67</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.44</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.31</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.22</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.12</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.47</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.29</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.19</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.67</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.47</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpujan2020.html#AppendixMSQL">
<p>This Critical Patch Update contains 17 new security fixes for
Oracle MySQL. 5 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpujan2020.html</url>
<cvename>CVE-2019-1547</cvename>
<cvename>CVE-2020-2579</cvename>
<cvename>CVE-2020-2686</cvename>
<cvename>CVE-2020-2627</cvename>
<cvename>CVE-2020-2570</cvename>
<cvename>CVE-2020-2573</cvename>
<cvename>CVE-2020-2574</cvename>
<cvename>CVE-2020-2577</cvename>
<cvename>CVE-2020-2589</cvename>
<cvename>CVE-2020-2580</cvename>
<cvename>CVE-2020-2588</cvename>
<cvename>CVE-2020-2660</cvename>
<cvename>CVE-2020-2679</cvename>
<cvename>CVE-2020-2584</cvename>
<cvename>CVE-2020-2694</cvename>
<cvename>CVE-2020-2572</cvename>
<cvename>CVE-2019-8457</cvename>
</references>
<dates>
<discovery>2020-01-14</discovery>
<entry>2020-01-15</entry>
</dates>
</vuln>
<vuln vid="d2c2c815-3793-11ea-8be3-54e1ad3d6335">
<topic>drm graphics drivers -- potential information disclusure via local access</topic>
<affects>
<package>
<name>drm-fbsd11.2-kmod</name>
<range><lt>4.11.g20200115</lt></range>
</package>
<package>
<name>drm-fbsd12.0-kmod</name>
<range><lt>4.16.g20200115</lt></range>
</package>
<package>
<name>drm-current-kmod</name>
<range><lt>4.16.g20200115</lt></range>
</package>
<package>
<name>drm-devel-kmod</name>
<range><lt>5.0.g20200115</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html">
<p>.A potential security vulnerability in Intel(R) Processor Graphics
may allow information disclosure. Intel is releasing software
updates to mitigate this potential vulnerability.</p>
<p>Description: Insufficient control flow in certain data
structures for some Intel(R) Processors with Intel(R) Processor
Graphics may allow an unauthenticated user to potentially enable
information disclosure via local access.</p>
<p>This patch provides mitigation for Gen9 hardware only. Patches
for Gen7 and Gen7.5 will be provided later. Note that Gen8 is not
impacted due to a previously implemented workaround. The mitigation
involves using an existing hardware feature to forcibly clear down
all EU state at each context switch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00314.html</url>
<cvename>CVE-2019-14615</cvename>
</references>
<dates>
<discovery>2020-01-14</discovery>
<entry>2020-01-15</entry>
</dates>
</vuln>
<vuln vid="2bab995f-36d4-11ea-9dad-002590acae31">
<topic>Template::Toolkit -- Directory traversal on write</topic>
<affects>
<package>
<name>p5-Template-Toolkit</name>
<range><lt>3.004</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Art Manion and Will Dormann report:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/619785/">
<p>
By using an older and less-secure form of open(), it is
possible for untrusted template files to cause reads/writes
outside of the template directories. This vulnerability is
a component of the recent Citrix exploit.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/619785/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19781</url>
<cvename>CVE-2019-19781</cvename>
</references>
<dates>
<discovery>2019-12-13</discovery>
<entry>2020-01-14</entry>
</dates>
</vuln>
<vuln vid="f929b172-369e-11ea-9cdb-001b217b3468">
<topic>Gitlab -- Private objects exposed through project import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.6.0</ge><lt>12.6.4</lt></range>
<range><ge>12.5.0</ge><lt>12.5.7</lt></range>
<range><ge>8.9.0</ge><lt>12.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/">
<p>Private objects exposed through project importi</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/releases/2020/01/13/critical-security-release-gitlab-12-dot-6-dot-4-released/</url>
<cvename>CVE-2020-6832</cvename>
</references>
<dates>
<discovery>2020-01-13</discovery>
<entry>2020-01-14</entry>
</dates>
</vuln>
<vuln vid="8b61308b-322a-11ea-b34b-1de6fb24355d">
<topic>e2fsprogs -- rehash.c/pass 3a mutate_name() code execution vulnerability</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.45.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lilith of Cisco Talos reports:</p>
<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973">
<p>
A code execution vulnerability exists in the directory rehashing
functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4
directory can cause an out-of-bounds write on the stack, resulting
in code execution. An attacker can corrupt a partition to trigger
this vulnerability.
</p>
</blockquote>
<p>Theodore Y. Ts'o reports:</p>
<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5">
<p>
E2fsprogs 1.45.5 [...:] Fix a potential out of bounds write when
checking a maliciously corrupted file system. This is probably not
exploitable on 64-bit platforms, but may be exploitable on 32-bit
binaries depending on how the compiler lays out the stack variables.
(Addresses CVE-2019-5188)
</p>
</blockquote>
</body>
</description>
<references>
<url>https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973</url>
<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.5</url>
<cvename>CVE-2019-5188</cvename>
</references>
<dates>
<discovery>2019-12-18</discovery>
<entry>2020-01-08</entry>
</dates>
</vuln>
<vuln vid="16aed7b7-344a-11ea-9cdb-001b217b3468">
<topic>phpMyAdmin -- SQL injection</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php72</name>
<name>phpMyAdmin-php73</name>
<name>phpMyAdmin-php74</name>
<name>phpMyAdmin5</name>
<name>phpMyAdmin5-php72</name>
<name>phpMyAdmin5-php73</name>
<name>phpMyAdmin5-php74</name>
<range><lt>4.9.4</lt></range>
<range><ge>5.0.0</ge><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2020-1/">
<p>A SQL injection flaw has been discovered in the user accounts page</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2020-1/</url>
<cvename>CVE-2020-5504</cvename>
</references>
<dates>
<discovery>2020-01-05</discovery>
<entry>2020-01-11</entry>
</dates>
</vuln>
<vuln vid="86224a04-26de-11ea-97f2-001a8c5c04b6">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cacti developers reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/releases/tag/release%2F1.2.8">
<p>
When viewing graphs, some input variables are not properly checked
(SQL injection possible).
</p>
<p>
Multiple instances of lib/functions.php are affected by unsafe
deserialization of user-controlled data to populate arrays. An
authenticated attacker could use this to influence object data
values and control actions taken by Cacti or potentially cause
memory corruption in the PHP module.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.8</url>
<cvename>CVE-2019-17357</cvename>
<cvename>CVE-2019-17358</cvename>
<freebsdpr>ports/242834</freebsdpr>
</references>
<dates>
<discovery>2019-10-12</discovery>
<entry>2020-01-06</entry>
</dates>
</vuln>
<vuln vid="01bde18a-2e09-11ea-a935-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.6.0</ge><lt>12.6.2</lt></range>
<range><ge>12.5.0</ge><lt>12.5.6</lt></range>
<range><ge>5.1.0</ge><lt>12.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2020/01/02/security-release-gitlab-12-6-2-released/">
<p>Group Maintainers Can Update/Delete Group Runners Using API</p>
<p>GraphQL Queries Can Hang the Application</p>
<p>Unauthorized Users Have Access to Milestones of Releases</p>
<p>Private Group Name Revealed Through Protected Tags API</p>
<p>Users Can Publish Reviews on Locked Merge Requests</p>
<p>DoS in the Issue and Commit Comments Pages</p>
<p>Project Name Disclosed Through Unsubscribe Link</p>
<p>Private Project Name Disclosed Through Notification Settings</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2020/01/02/security-release-gitlab-12-6-2-released/</url>
<cvename>CVE-2019-20144</cvename>
<cvename>CVE-2019-20146</cvename>
<cvename>CVE-2019-20143</cvename>
<cvename>CVE-2019-20147</cvename>
<cvename>CVE-2019-20145</cvename>
<cvename>CVE-2019-20142</cvename>
<cvename>CVE-2019-20148</cvename>
<cvename>CVE-2020-5197</cvename>
</references>
<dates>
<discovery>2020-01-02</discovery>
<entry>2020-01-03</entry>
</dates>
</vuln>
<vuln vid="66e4dc99-28b3-11ea-8dde-08002728f74c">
<topic>rack -- information leak / session hijack vulnerability</topic>
<affects>
<package>
<name>rubygem-rack</name>
<range><ge>2.0.0</ge><lt>2.0.8,3</lt></range>
</package>
<package>
<name>rubygem-rack16</name>
<range><ge>1.6.0</ge><lt>1.6.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>National Vulnerability Database:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-16782">
<p>There's a possible information leak / session hijack vulnerability in
Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12
and 2.0.8. Attackers may be able to find and hijack sessions by using
timing attacks targeting the session id. Session ids are usually stored
and indexed in a database that uses some kind of scheme for speeding up
lookups of that session id. By carefully measuring the amount of time
it takes to look up a session, an attacker may be able to find a valid
session id and hijack the session. The session id itself may be
generated randomly, but the way the session is indexed by the backing
store does not use a secure comparison.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-16782</url>
<url>https://github.com/rack/rack/blob/master/CHANGELOG.md</url>
<cvename>CVE-2019-16782</cvename>
</references>
<dates>
<discovery>2019-12-08</discovery>
<entry>2019-12-29</entry>
</dates>
</vuln>
<vuln vid="e4d9dffb-2a32-11ea-9693-e1b3f6feec79">
<topic>OpenEXR -- heap buffer overflow, and out-of-memory bugs</topic>
<affects>
<package>
<name>ilmbase</name>
<range><lt>2.3.0_4</lt></range>
</package>
<package>
<name>openexr</name>
<range><lt>2.3.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cary Phillips reports:</p>
<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0">
<p>OpenEXR (IlmBase) v2.4.0 fixes the following security vulnerabilities:</p>
<ul>
<li>CVE-2018-18444 Issue #351 Out of Memory</li>
<li>CVE-2018-18443 Issue #350 heap-buffer-overflow</li>
</ul>
<p>The relevant patches have been backported to the FreeBSD ports.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.0</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/issues/350</url>
<url>https://github.com/AcademySoftwareFoundation/openexr/issues/351</url>
<cvename>CVE-2018-18443</cvename>
<cvename>CVE-2018-18444</cvename>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2019-12-29</entry>
</dates>
</vuln>
<vuln vid="7b97b32e-27c4-11ea-9673-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/">
<p>Four security issues affect WordPress versions 5.3 and earlier; version 5.3.1 fixes them, so youll want to upgrade.
If you havent yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.
-Props to Daniel Bachhuber for finding an issue where an unprivileged user could make a post sticky via the REST API.
-Props to Simon Scannell of RIPS Technologies for finding and disclosing an issue where cross-site scripting (XSS)
could be stored in well-crafted links.
-Props to the WordPress.org Security Team for hardening wp_kses_bad_protocol() to ensure that it is aware of the named
colon attribute.
-Props to Nguyen The Duc for discovering a stored XSS vulnerability using block editor content.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2019-12-13</discovery>
<entry>2019-12-26</entry>
</dates>
</vuln>
<vuln vid="1c9178aa-2709-11ea-9673-4c72b94353b5">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8</name>
<range><lt>8.7.30</lt></range>
</package>
<package>
<name>typo3-9</name>
<range><lt>9.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-10-2-1-9-5-12-and-8-7-30-security-releases-published">
<p>It has been discovered that the output of field validation errors in the Form Framework is vulnerable
to cross-site scripting.</p>
<p>It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site
scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering
with typolink.</p>
<p>It has been discovered that the output table listing in the Files backend module is vulnerable to cross-site
scripting when a file extension contains malicious sequences. Access to the file system of the server - either
directly or through synchronization - is required to exploit the vulnerability.</p>
<p>It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable
to directory traversal. Admin privileges are required in order to exploit this vulnerability. Since TYPO3 v9 LTS,
System Maintainer privileges are required as well.</p>
<p>Failing to properly escape user submitted content, class QueryGenerator is vulnerable to SQL injection.
Having system extension ext:lowlevel installed and a valid backend user having administrator privileges are
required to exploit this vulnerability.</p>
<p>It has been discovered that classes QueryGenerator and QueryView are vulnerable to insecure deserialization.
Requirements for successfully exploiting this vulnerability (one of the following):
- having system extension ext:lowlevel (Backend Module: DB Check) installed and valid backend user having
administrator privileges
- having system extension ext:sys_action installed and valid backend user having limited privileges</p>
<p>TYPO3 allows to upload files either in the backend user interface as well as in custom developed extensions.
To reduce the possibility to upload potential malicious code TYPO3 uses the fileDenyPattern to deny e.g. user
submitted PHP scripts from being persisted. Besides that it is possible for any editor to upload file assets
using the file module (fileadmin) or changing their avatar image shown in the TYPO3 backend.
Per default TYPO3 allows to upload and store HTML and SVG files as well using the mentioned functionalities.
Custom extension implementations probably would also accept those files when only the fileDenyPattern is evaluated.
Since HTML and SVG files - which might contain executable JavaScript code per W3C standard - could be directly
displayed in web clients, the whole web application is exposed to be vulnerable concerning Cross-Site Scripting.
Currently the following scenarios are known - given an authenticated regular editor is able to upload files using
the TYPO3 backend:
- directly target a potential victim to a known public resource in a URL, e.g. /fileadmin/malicious.svg or
/fileadmin/malicious.html
- using the TypoScript content object “SVG” (implemented in class ScalableVectorGraphicsContentObject)
having renderMode set to inline for SVG files (available since TYPO3 v9.0)
- custom implementations that directly output and render markup of HTML and SVG files
SVG files that are embedded using an img src=”malicious.svg” tag are not vulnerable since potential
scripts are not executed in these scenarios (see https://www.w3.org/wiki/SVG_Security). The icon API of TYPO3
is not scope of this announcement since SVG icons need to be registered using an individual implementation,
which is not considered as user submitted content.</p>
<p>It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization.
User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey
as secret - invalid or unsigned payload is not deserialized.
However, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly
known and unprotected backup files), there is the possibility that attackers know the private encryptionKey
and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized.
Requirements for successfully exploiting this vulnerability (all of the following):
- rendering at least one Extbase plugin in the frontend
- encryptionKey has been leaked (from LocalConfiguration.php or corresponding .env file). </p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-021/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-022/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-023/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-024/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-025/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2019-026/</url>
<url>https://typo3.org/security/advisory/typo3-psa-2019-010/</url>
<url>https://typo3.org/security/advisory/typo3-psa-2019-011/</url>
</references>
<dates>
<discovery>2019-12-17</discovery>
<entry>2019-12-25</entry>
</dates>
</vuln>
<vuln vid="ad3451b9-23e0-11ea-8b36-f1925a339a82">
<topic>e2fsprogs -- maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.45.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ted Y. Ts'o reports:</p>
<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4">
<p>A maliciously corrupted file systems can trigger buffer overruns in the quota code used by e2fsck.</p>
</blockquote>
</body>
</description>
<references>
<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4</url>
<cvename>CVE-2019-5094</cvename>
</references>
<dates>
<discovery>2019-09-23</discovery>
<entry>2019-12-21</entry>
</dates>
</vuln>
<vuln vid="3da0352f-2397-11ea-966e-000ffec0b3e1">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.69</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2019-009">
<p>A visit to install.php can cause cached data to become corrupted.
This could cause a site to be impaired until caches are rebuilt.</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-010">
<p>Drupal 8 core's file_save_upload() function does not strip the
leading and trailing dot ('.') from filenames, like Drupal 7 did.
Users with the ability to upload files with any extension in
conjunction with contributed modules may be able to use this to
upload system files such as .htaccess in order to bypass protections
afforded by Drupal's default .htaccess file. After this fix,
file_save_upload() now trims leading and trailing dots from filenames.
</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-011">
<p>The Media Library module has a security vulnerability whereby it
doesn't sufficiently restrict access to media items in certain
configurations.
</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-012">
<p>The Drupal project uses the third-party library Archive_Tar, which
has released a security-related feature that impacts some Drupal
configurations. Multiple vulnerabilities are possible if Drupal is
configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and
processes them. The latest versions of Drupal update Archive_Tar to
1.4.9 to mitigate the file processing vulnerabilities.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2019-009</url>
<url>https://www.drupal.org/sa-core-2019-010</url>
<url>https://www.drupal.org/sa-core-2019-011</url>
<url>https://www.drupal.org/sa-core-2019-012</url>
</references>
<dates>
<discovery>2019-12-18</discovery>
<entry>2019-12-21</entry>
</dates>
</vuln>
<vuln vid="ed8cbad5-21a8-11ea-9b6d-901b0e934d69">
<topic>py-matrix-synapse -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.7.1">
<p>The [synapse 1.7.1] release includes several security fixes as well
as a fix to a bug exposed by the security fixes. All previous releases
of Synapse are affected. Administrators are encouraged to upgrade as
soon as possible.</p>
<ul>
<li>Fix a bug which could cause room events to be incorrectly authorized
using events from a different room.</li>
<li>Fix a bug causing responses to the /context client endpoint to not
use the pruned version of the event.</li>
<li>Fix a cause of state resets in room versions 2 onwards.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.7.1</url>
</references>
<dates>
<discovery>2019-12-18</discovery>
<entry>2019-12-18</entry>
</dates>
</vuln>
<vuln vid="d778ddb0-2338-11ea-a1c7-b499baebfeaf">
<topic>OpenSSL -- Overflow vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2u,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20191206.txt">
<p>rsaz_512_sqr overflow bug on x86_64 (CVE-2019-1551) (Low)<br/>
There is an overflow bug in the x64_64 Montgomery squaring procedure
used in exponentiation with 512-bit moduli. No EC algorithms are
affected. Analysis suggests that attacks against 2-prime RSA1024,
3-prime RSA1536, and DSA1024 as a result of this defect would be very
difficult to perform and are not believed likely. Attacks against
DH512 are considered just feasible. However, for an attack the target
would have to re-use the DH512 private key, which is not recommended
anyway. Also applications directly using the low level API BN_mod_exp
may be affected if they use BN_FLG_CONSTTIME.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20191206.txt</url>
<cvename>CVE-2019-1551</cvename>
</references>
<dates>
<discovery>2019-12-06</discovery>
<entry>2019-12-20</entry>
</dates>
</vuln>
<vuln vid="70111759-1dae-11ea-966a-206a8a720317">
<topic>spamassassin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the Apache Spamassassin project reports:</p>
<blockquote cite="https://www.cybersecurity-help.cz/vdb/SB2019121311">
<p>An input validation error of user-supplied input parsing
multipart emails. Specially crafted emails can consume all
resources on the system.</p>
<p>A local user is able to execute arbitrary shell commands
through specially crafted nefarious CF files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.cybersecurity-help.cz/vdb/SB2019121311</url>
<cvename>CVE-2019-12420</cvename>
<cvename>CVE-2018-11805</cvename>
</references>
<dates>
<discovery>2019-12-11</discovery>
<entry>2019-12-13</entry>
</dates>
</vuln>
<vuln vid="1edae47e-1cdd-11ea-8c2a-08002743b791">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba48</name>
<range><ge>4.8.0</ge></range>
</package>
<package>
<name>samba410</name>
<range><lt>4.10.11</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Samba Team reports:</p>
<blockquote cite="https://www.samba.org/samba/history/samba-4.10.11.html">
<p>CVE-2019-14861:</p>
<p>An authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name.</p>
<p>CVE-2019-14870:</p>
<p>The DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/history/samba-4.10.11.html</url>
<cvename>CVE-2019-14861</cvename>
<cvename>CVE-2019-14870</cvename>
</references>
<dates>
<discovery>2019-12-10</discovery>
<entry>2019-12-12</entry>
</dates>
</vuln>
<vuln vid="b7dc4dde-2e48-43f9-967a-c68461537cf2">
<topic>dovecot -- null pointer deref in notify with empty headers</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>2.3.9</ge><lt>2.3.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot/2019-December/117894.html">
<p>Mail with group address as sender will cause a signal 11 crash in push
notification drivers. Group address as recipient can cause crash in some
drivers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot/2019-December/117894.html</url>
<cvename>CVE-2019-19722</cvename>
</references>
<dates>
<discovery>2019-12-10</discovery>
<entry>2019-12-13</entry>
</dates>
</vuln>
<vuln vid="21944144-1b90-11ea-a2d4-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.5.0</ge><lt>12.5.4</lt></range>
<range><ge>12.4.0</ge><lt>12.4.6</lt></range>
<range><ge>10.5.0</ge><lt>12.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/">
<p>Path traversal with potential remote code execution</p>
<p>Disclosure of private code via Elasticsearch integration</p>
<p>Update Git dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/12/10/critical-security-release-gitlab-12-5-4-released/</url>
<cvename>CVE-2019-19628</cvename>
<cvename>CVE-2019-19629</cvename>
<cvename>CVE-2019-19604</cvename>
</references>
<dates>
<discovery>2019-12-10</discovery>
<entry>2019-12-10</entry>
</dates>
</vuln>
<vuln vid="22ae307a-1ac4-11ea-b267-001cc0382b2f">
<topic>Ghostscript -- Security bypass vulnerabilities</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cedric Buissart (Red Hat) reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14811">
<p>A flaw was found in, ghostscript versions prior to 9.50, in the
.pdf_hook_DSC_Creator procedure where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14812">
<p>A flaw was found in all ghostscript versions 9.x before 9.50, in
the .setuserparams2 procedure where it did not properly secure its
privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14813">
<p>A flaw was found in ghostscript, versions 9.x before 9.50, in the
setsystemparams procedure where it did not properly secure its
privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14817">
<p>A flaw was found in, ghostscript versions prior to 9.50, in the
.pdfexectoken and other procedures where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER`
restrictions. A specially crafted PostScript file could disable
security protection and then have access to the file system, or
execute arbitrary commands.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-14811</cvename>
<cvename>CVE-2019-14812</cvename>
<cvename>CVE-2019-14813</cvename>
<cvename>CVE-2019-14817</cvename>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-12-09</entry>
</dates>
</vuln>
<vuln vid="ca3fe5b3-185e-11ea-9673-4c72b94353b5">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the phpmyadmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/">
<p>This security fix is part of an ongoing effort to improve the security of the Designer feature
and is designated PMASA-2019-5. There is also an improvement for how we sanitize git version
information shown on the home page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/</url>
</references>
<dates>
<discovery>2019-11-22</discovery>
<entry>2019-12-06</entry>
</dates>
</vuln>
<vuln vid="4e3fa78b-1577-11ea-b66e-080027bdabe8">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<name>py38-django21</name>
<range><lt>2.1.15</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<name>py38-django22</name>
<range><lt>2.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/dec/02/security-releases/">
<p>CVE-2019-19118: Privilege escalation in the Django admin.</p>
<p>Since Django 2.1, a Django model admin displaying a parent model with related
model inlines, where the user has view-only permissions to a parent model but
edit permissions to the inline model, would display a read-only view of the parent
model but editable forms for the inline.</p>
<p>Submitting these forms would not allow direct edits to the parent model, but would
trigger the parent model's save() method, and cause pre and post-save signal handlers
to be invoked. This is a privilege escalation as a user who lacks permission to edit
a model should not be able to trigger its save-related signals.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2019/dec/02/security-releases/</url>
<cvename>CVE-2019-19118</cvename>
</references>
<dates>
<discovery>2019-11-25</discovery>
<entry>2019-12-03</entry>
</dates>
</vuln>
<vuln vid="9c36d41c-11df-11ea-9b6d-901b0e934d69">
<topic>py-matrix-synapse -- incomplete cleanup of 3rd-party-IDs on user deactivation</topic>
<affects>
<package>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/releases/tag/v1.6.1">
<p>Clean up local threepids from user on account deactivation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.6.1</url>
<url>https://github.com/matrix-org/synapse/pull/6426</url>
</references>
<dates>
<discovery>2019-11-28</discovery>
<entry>2019-11-28</entry>
</dates>
</vuln>
<vuln vid="42675046-fa70-11e9-ba4e-901b0e934d69">
<topic>py-matrix-synapse -- missing signature checks on some federation APIs</topic>
<affects>
<package>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://github.com/matrix-org/synapse/pull/6262">
<p>Make sure that [...] events sent over /send_join, /send_leave, and
/invite, are correctly signed and come from the expected servers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/matrix-org/synapse/pull/6262</url>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.5.0</url>
</references>
<dates>
<discovery>2019-10-29</discovery>
<entry>2019-10-29</entry>
</dates>
</vuln>
<vuln vid="4ce7c28a-11ac-11ea-b537-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.5.0</ge><lt>12.5.2</lt></range>
<range><ge>12.4.0</ge><lt>12.4.5</lt></range>
<range><ge>11.9.0</ge><lt>12.3.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/">
<p>Unauthorized access to grafana metrics</p>
<p>Update Mattermost dependency</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-2-released/</url>
<cvename>CVE-2019-19262</cvename>
</references>
<dates>
<discovery>2019-11-27</discovery>
<entry>2019-11-28</entry>
</dates>
</vuln>
<vuln vid="1aa7a094-1147-11ea-b537-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.5.0</ge><lt>12.5.1</lt></range>
<range><ge>12.4.0</ge><lt>12.4.4</lt></range>
<range><lt>12.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/">
<p>Path traversal with potential remote code execution</p>
<p>Private objects exposed through project import</p>
<p>Disclosure of notes via Elasticsearch integration</p>
<p>Disclosure of comments via Elasticsearch integration</p>
<p>DNS Rebind SSRF in various chat notifications</p>
<p>Disclosure of vulnerability status in dependency list</p>
<p>Disclosure of commit count in Cycle Analytics</p>
<p>Exposure of related branch names</p>
<p>Tags pushes from blocked users</p>
<p>Branches and Commits exposed to Guest members via integration</p>
<p>IDOR when adding users to protected environments</p>
<p>Former project members able to access repository information</p>
<p>Unauthorized access to grafana metrics</p>
<p>Todos created for former project members</p>
<p>Update Mattermost dependency</p>
<p>Disclosure of AWS secret keys on certain Admin pages</p>
<p>Stored XSS in Group and User profile fields</p>
<p>Forked project information disclosed via Project API</p>
<p>Denial of Service in the issue and commit comment pages</p>
<p>Tokens stored in plaintext</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/11/27/security-release-gitlab-12-5-1-released/</url>
<cvename>CVE-2019-19088</cvename>
<cvename>CVE-2019-19309</cvename>
<cvename>CVE-2019-19086</cvename>
<cvename>CVE-2019-19087</cvename>
<cvename>CVE-2019-19261</cvename>
<cvename>CVE-2019-19256</cvename>
<cvename>CVE-2019-19254</cvename>
<cvename>CVE-2019-19257</cvename>
<cvename>CVE-2019-19263</cvename>
<cvename>CVE-2019-19258</cvename>
<cvename>CVE-2019-19259</cvename>
<cvename>CVE-2019-19260</cvename>
<cvename>CVE-2019-19262</cvename>
<cvename>CVE-2019-19255</cvename>
<cvename>CVE-2019-19310</cvename>
<cvename>CVE-2019-19311</cvename>
<cvename>CVE-2019-19312</cvename>
<cvename>CVE-2019-19313</cvename>
<cvename>CVE-2019-19314</cvename>
</references>
<dates>
<discovery>2019-11-27</discovery>
<entry>2019-11-27</entry>
</dates>
</vuln>
<vuln vid="3e748551-c732-45f6-bd88-928da16f23a8">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.26.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0006.html</url>
<cvename>CVE-2019-8710</cvename>
<cvename>CVE-2019-8743</cvename>
<cvename>CVE-2019-8764</cvename>
<cvename>CVE-2019-8765</cvename>
<cvename>CVE-2019-8766</cvename>
<cvename>CVE-2019-8782</cvename>
<cvename>CVE-2019-8783</cvename>
<cvename>CVE-2019-8808</cvename>
<cvename>CVE-2019-8811</cvename>
<cvename>CVE-2019-8812</cvename>
<cvename>CVE-2019-8813</cvename>
<cvename>CVE-2019-8814</cvename>
<cvename>CVE-2019-8815</cvename>
<cvename>CVE-2019-8816</cvename>
<cvename>CVE-2019-8819</cvename>
<cvename>CVE-2019-8820</cvename>
<cvename>CVE-2019-8821</cvename>
<cvename>CVE-2019-8822</cvename>
<cvename>CVE-2019-8823</cvename>
</references>
<dates>
<discovery>2019-11-08</discovery>
<entry>2019-11-27</entry>
</dates>
</vuln>
<vuln vid="87270ba5-03d3-11ea-b81f-3085a9a95629">
<topic>urllib3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-urllib3</name>
<name>py35-urllib3</name>
<name>py36-urllib3</name>
<name>py37-urllib3</name>
<name>py38-urllib3</name>
<range><lt>1.24.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports: (by search in the range 2018/01/01 - 2019/11/10):</p>
<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=urllib3&search_type=all&pub_start_date=01%2F01%2F2018&pub_end_date=11%2F10%2F2019">
<p>urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.</p>
<p>In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.</p>
<p>The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=urllib3&search_type=all&pub_start_date=01%2F01%2F2018&pub_end_date=11%2F10%2F2019</url>
<cvename>CVE-2018-20060</cvename>
<cvename>CVE-2019-11236</cvename>
<cvename>CVE-2019-11324</cvename>
<freebsdpr>ports/229322</freebsdpr>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2019-11-26</entry>
</dates>
</vuln>
<vuln vid="fbe10a8a-05a1-11ea-9dfa-f8b156ac3ff9">
<topic>FreeBSD -- Intel CPU Microcode Update</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_1</lt></range>
<range><ge>12.0</ge><lt>12.0_12</lt></range>
<range><ge>11.3</ge><lt>11.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Starting with version 1.26, the devcpu-data port/package includes
updates and mitigations for the following technical and security
advisories (depending on CPU model).</p>
<p>Intel TSX Updates (TAA) CVE-2019-11135 Voltage Modulation
Vulnerability CVE-2019-11139 MD_CLEAR Operations
CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2018-11091
TA Indirect Sharing CVE-2017-5715 EGETKEY CVE-2018-12126
CVE-2018-12127 CVE-2018-12130 CVE-2018-11091 JCC SKX102
Erratum </p>
<p>Updated microcode includes mitigations for
CPU issues, but may also cause a performance regression due
to the JCC erratum mitigation. Please visit
http://www.intel.com/benchmarks for further information.
</p>
<p>Please visit http://www.intel.com/security for
detailed information on these advisories as well as a list of
CPUs that are affected.</p>
<p>Operating a CPU without the latest microcode may result in erratic or
unpredictable behavior, including system crashes and lock ups.
Certain issues listed in this advisory may result in the leakage of
privileged system information to unprivileged users. Please refer to
the security advisories listed above for detailed information.</p>
</body>
</description>
<references>
<cvename>CVE-2019-11135</cvename>
<cvename>CVE-2019-11139</cvename>
<cvename>CVE-2018-12126</cvename>
<cvename>CVE-2018-12127</cvename>
<cvename>CVE-2018-12130</cvename>
<cvename>CVE-2018-11091</cvename>
<cvename>CVE-2017-5715</cvename>
<freebsdsa>SA-19:26.mcu</freebsdsa>
</references>
<dates>
<discovery>2019-11-14</discovery>
<entry>2019-11-25</entry>
</dates>
</vuln>
<vuln vid="edc0bf7e-05a1-11ea-9dfa-f8b156ac3ff9">
<topic>FreeBSD -- Machine Check Exception on Page Size Change</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.1</ge><lt>12.1_1</lt></range>
<range><ge>12.0</ge><lt>12.0_12</lt></range>
<range><ge>11.3</ge><lt>11.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel discovered a previously published erratum on some Intel
platforms can be exploited by malicious software to potentially cause
a denial of service by triggering a machine check that will crash or
hang the system.</p>
<p>Malicious guest operating systems may be able to crash the host.</p>
</body>
</description>
<references>
<cvename>CVE-2018-12207</cvename>
<freebsdsa>SA-19:25.mcepsc</freebsdsa>
</references>
<dates>
<discovery>2019-11-14</discovery>
<entry>2019-11-25</entry>
</dates>
</vuln>
<vuln vid="6ade62d9-0f62-11ea-9673-4c72b94353b5">
<topic>clamav -- Denial-of-Service (DoS) vulnerability</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.102.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html">
<p>A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email
file as a result of excessively long scan times. The issue is resolved by implementing
several maximums in parsing MIME messages and by optimizing use of memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html</url>
<cvename>CVE-2019-15961</cvename>
</references>
<dates>
<discovery>2019-09-06</discovery>
<entry>2019-11-25</entry>
</dates>
</vuln>
<vuln vid="ffc80e58-0dcb-11ea-9673-4c72b94353b5">
<topic>unbound -- parsing vulnerability</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound Security Advisories:</p>
<blockquote cite="https://nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-ipsec-module">
<p>Recent versions of Unbound contain a vulnerability that can cause shell
code execution after receiving a specially crafted answer. This issue
can only be triggered if unbound was compiled with --enable-ipsecmod
support, and ipsecmod is enabled and used in the configuration.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-ipsec-module</url>
<cvename>CVE-2019-18934</cvename>
</references>
<dates>
<discovery>2019-11-19</discovery>
<entry>2019-11-23</entry>
</dates>
</vuln>
<vuln vid="b12a341a-0932-11ea-bf09-080027e0baa0">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/11/gitea-1.10.0-is-released/">
<p>This release contains five security fixes, so we recommend updating:</p>
<ul>
<li>Fix issue with user.fullname</li>
<li>Ignore mentions for users with no access</li>
<li>Be more strict with git arguments</li>
<li>Extract the username and password from the mirror url</li>
<li>Reserve .well-known username</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/11/gitea-1.10.0-is-released/</url>
<freebsdpr>ports/241981</freebsdpr>
</references>
<dates>
<discovery>2019-11-17</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="94c6951a-0d04-11ea-87ca-001999f8d30b">
<topic>asterisk -- Re-invite with T.38 and malformed SDP causes crash</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.29.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If Asterisk receives a re-invite initiating T.38 faxing
and has a port of 0 and no c line in the SDP, a crash
will occur.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-008.html</url>
<cvename>CVE-2019-18976</cvename>
</references>
<dates>
<discovery>2019-11-07</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="49b61ab6-0d04-11ea-87ca-001999f8d30b">
<topic>asterisk -- AMI user could execute system commands</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.29.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A remote authenticated Asterisk Manager Interface (AMI)
user without system authorization could use a specially
crafted Originate AMI request to execute arbitrary system
commands.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-007.html</url>
<cvename>CVE-2019-18610</cvename>
</references>
<dates>
<discovery>2019-10-10</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="a8d94711-0d03-11ea-87ca-001999f8d30b">
<topic>asterisk -- SIP request can change address of a SIP peer</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.29.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A SIP request can be sent to Asterisk that can change
a SIP peers IP address. A REGISTER does not need to occur,
and calls can be hijacked as a result. The only thing
that needs to be known is the peers name; authentication
details such as passwords do not need to be known. This
vulnerability is only exploitable when the nat option is
set to the default, or auto_force_rport.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-006.html</url>
<cvename>CVE-2019-18790</cvename>
</references>
<dates>
<discovery>2019-10-17</discovery>
<entry>2019-11-22</entry>
</dates>
</vuln>
<vuln vid="ecb7fdec-0b82-11ea-874d-0c9d925bbbc0">
<topic>drm graphics drivers -- Local privilege escalation and denial of service</topic>
<affects>
<package>
<name>drm-current-kmod</name>
<range><lt>4.16.g20191120</lt></range>
</package>
<package>
<name>drm-devel-kmod</name>
<range><lt>5.0.g20191120</lt></range>
</package>
<package>
<name>drm-fbsd12.0-kmod</name>
<range><lt>4.16.g20191120</lt></range>
</package>
<package>
<name>drm-fbsd11.2-kmod</name>
<range><lt>4.11.g20191204</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel reports:</p>
<blockquote cite="https://blogs.intel.com/technology/2019/11/ipas-november-2019-intel-platform-update-ipu">
<p>As part of IPU 2019.2, INTEL-SA-00242 advises that insufficient
access control may allow an authenticated user to potentially
enable escalation of privilege via local access.</p>
<p>INTEL-SA-00260 advises that insufficient access control may
allow an authenticated user to potentially enable denial of
service via local access.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.intel.com/technology/2019/11/ipas-november-2019-intel-platform-update-ipu</url>
<url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html</url>
<url>https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00260.html</url>
<cvename>CVE-2019-0154</cvename>
<cvename>CVE-2019-11112</cvename>
</references>
<dates>
<discovery>2019-11-12</discovery>
<entry>2019-11-20</entry>
<modified>2019-12-04</modified>
</dates>
</vuln>
<vuln vid="620685d6-0aa3-11ea-9673-4c72b94353b5">
<topic>squid -- Vulnerable to HTTP Digest Authentication</topic>
<affects>
<package>
<name>squid</name>
<range><lt>4.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid Team reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2019_11.txt">
<p>Problem Description: Due to incorrect data management Squid is
vulnerable to a information disclosure when processing HTTP Digest
Authentication.</p>
<p>Severity: Nonce tokens contain the raw byte value of a pointer which sits
within heap memory allocation. This information reduces ASLR protections
and may aid attackers isolating memory areas to target for remote code
execution attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2019_11.txt</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18679</url>
<cvename>CVE-2019-18679</cvename>
</references>
<dates>
<discovery>2019-11-05</discovery>
<entry>2019-11-19</entry>
</dates>
</vuln>
<vuln vid="f04f840d-0840-11ea-8d66-75d3253ef913">
<topic>libidn2 -- roundtrip check vulnerability</topic>
<affects>
<package>
<name>libidn2</name>
<range><lt>2.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE list:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290">
<p>.</p>
<p>GNU libidn2 before 2.2.0 fails to perform the roundtrip checks
specified in RFC3490 Section 4.2 when converting A-labels to U-labels.
This makes it possible in some circumstances for one domain to
impersonate another. By creating a malicious domain that matches a
target domain except for the inclusion of certain punycoded Unicode
characters (that would be discarded when converted first to a Unicode
label and then back to an ASCII label), arbitrary domains can be
impersonated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.com/libidn/libidn2/blob/master/NEWS</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290</url>
<cvename>CVE-2019-12290</cvename>
</references>
<dates>
<discovery>2019-11-14</discovery>
<entry>2019-11-18</entry>
<modified>2019-12-10</modified>
</dates>
</vuln>
<vuln vid="f59af308-07f3-11ea-8c56-f8b156b6dcc8">
<topic>GNU cpio -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gcpio</name>
<range><lt>2.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sergey Poznyakoff reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html">
<p>This stable release fixes several potential vulnerabilities</p>
<p>CVE-2015-1197: cpio, when using the --no-absolute-filenames
option, allows local users to write to arbitrary files
via a symlink attack on a file in an archive.</p>
<p>CVE-2016-2037: The cpio_safer_name_suffix function in
util.c allows remote attackers to cause a denial of service
(out-of-bounds write) via a crafted cpio file.</p>
<p>CVE-2019-14866: Improper input validation when writing
tar header fields leads to unexpected tar generation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html</url>
<cvename>CVE-2015-1197</cvename>
<cvename>CVE-2016-2037</cvename>
<cvename>CVE-2019-14866</cvename>
</references>
<dates>
<discovery>2019-11-06</discovery>
<entry>2019-11-15</entry>
</dates>
</vuln>
<vuln vid="b48e7b14-052a-11ea-a1de-53b029d2b061">
<topic>libmad -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libmad</name>
<range><lt>0.15.1b_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>National Vulnerability Database:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8372">
<p>CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD
libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a
denial of service (assertion failure and application exit) via a crafted
audio file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8373">
<p>CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD
libmad 0.15.1b allows remote attackers to cause a denial of service
(heap-based buffer overflow and application crash) or possibly have
unspecified other impact via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-8374">
<p>CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD
libmad 0.15.1b allows remote attackers to cause a denial of service
(heap-based buffer over-read and application crash) via a crafted audio
file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133#15</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-8372</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-8373</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-8374</url>
<url>https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-c/</url>
<url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_layer_iii-layer3-c/</url>
<url>https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-in-mad_bit_skip-bit-c/</url>
<cvename>CVE-2017-8372</cvename>
<cvename>CVE-2017-8373</cvename>
<cvename>CVE-2017-8374</cvename>
</references>
<dates>
<discovery>2017-04-30</discovery>
<entry>2019-11-13</entry>
</dates>
</vuln>
<vuln vid="88d00176-058e-11ea-bd1c-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>78.0.3904.97</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html">
<p>Four security issues were fixed, including:</p>
<ul>
<li>[1021723] Various fixes from internal audits, fuzzing and other
initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2019-11-06</discovery>
<entry>2019-11-12</entry>
</dates>
</vuln>
<vuln vid="459df1ba-051c-11ea-9673-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.2.4,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/">
<p>Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting)
could be added via the Customizer.</p>
<p>rops to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.</p>
<p>Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript
into style tags.</p>
<p>rops to David Newman for highlighting a method to poison the cache of JSON GET requests
via the Vary: Origin header.</p>
<p>Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs
are validated.</p>
<p>Props to Ben Bidner of the WordPress Security Team who discovered issues related to
referrer validation in the admin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/</url>
</references>
<dates>
<discovery>2019-10-14</discovery>
<entry>2019-11-12</entry>
</dates>
</vuln>
<vuln vid="b2f9573a-008c-11ea-9801-10c37b4ac2ea">
<topic>nexus2-oss -- Multiple vulerabilities</topic>
<affects>
<package>
<name>nexus2-oss</name>
<range><lt>2.14.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sonatype reports:</p>
<blockquote cite="https://help.sonatype.com/repomanager2/release-notes/2019-release-notes#id-2019ReleaseNotes-RepositoryManager2.14.15">
<p>Several RCE vulnerabilities have been found and corrected in 2.14.15:</p>
<p>CVE-2019-16530: An attacker with elevated privileges can upload a
specially crafted file. That file can contain commands that will
be executed on the system, with the same privileges as the user
running the server.</p>
<p>CVE-2019-15893: A Remote Code Execution vulnerability has been
discovered in Nexus Repository Manager requiring immediate
action. The vulnerability allows for an attacker with
administrative access to NXRM to create repostories that can
grant access to read/execute system data outside the scope of
NXRM.</p>
<p>CVE-2019-5475: A vulnerability has been found that can allow
user's with administrative privileges to run processes on the
target server, that the nxrm os user has access to.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16530</cvename>
<cvename>CVE-2019-15893</cvename>
<cvename>CVE-2019-5475</cvename>
</references>
<dates>
<discovery>2019-09-19</discovery>
<entry>2019-11-07</entry>
</dates>
</vuln>
<vuln vid="6a7c2ab0-00dd-11ea-83ce-705a0f828759">
<topic>php -- env_path_info underflow in fpm_main.c can lead to RCE</topic>
<affects>
<package>
<name>php71</name>
<range><lt>7.1.33</lt></range>
</package>
<package>
<name>php72</name>
<range><lt>7.2.24</lt></range>
</package>
<package>
<name>php73</name>
<range><lt>7.3.11</lt></range>
</package>
<package>
<name>php74</name>
<range><lt>7.4.0.rc5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-2">
<p>The PHP development team announces the immediate availability of PHP 7.3.11. This is a security release which also contains several bug fixes.</p>
</blockquote>
<blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-1">
<p>The PHP development team announces the immediate availability of PHP 7.2.24. This is a security release which also contains several bug fixes.</p>
</blockquote>
<blockquote cite="https://www.php.net/archive/2019.php#2019-10-24-3">
<p>The PHP development team announces the immediate availability of PHP 7.1.33. This is a security release which also contains several bug fixes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11043</cvename>
<url>https://www.php.net/archive/2019.php#2019-10-24-1</url>
<url>https://www.php.net/archive/2019.php#2019-10-24-2</url>
<url>https://www.php.net/archive/2019.php#2019-10-24-3</url>
</references>
<dates>
<discovery>2019-10-24</discovery>
<entry>2019-11-06</entry>
</dates>
</vuln>
<vuln vid="c32285fe-fde4-11e9-9525-000c29c4dc65">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki131</name>
<range><lt>1.31.5</lt></range>
</package>
<package>
<name>mediawiki132</name>
<range><lt>1.32.5</lt></range>
</package>
<package>
<name>mediawiki133</name>
<range><lt>1.33.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-October/000236.html">
<p>Security fixes:
T230402, CVE-2019-16738 SECURITY: Add permission check for suppressed account
to Special:Redirect.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16738</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-October/000236.html</url>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-11-03</entry>
</dates>
</vuln>
<vuln vid="fc91f2ef-fd7b-11e9-a1c7-b499baebfeaf">
<topic>MySQL -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.66</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.42</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.28</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.19</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.9</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.46</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.28</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.18</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.66</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.46</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/security-alerts/cpuoct2019.html">
<p>This Critical Patch Update contains 31 new security fixes for
Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/security-alerts/cpuoct2019.html</url>
<cvename>CVE-2019-5443</cvename>
<cvename>CVE-2019-1543</cvename>
<cvename>CVE-2019-3011</cvename>
<cvename>CVE-2019-2966</cvename>
<cvename>CVE-2019-2967</cvename>
<cvename>CVE-2019-2974</cvename>
<cvename>CVE-2019-2946</cvename>
<cvename>CVE-2019-3004</cvename>
<cvename>CVE-2019-2914</cvename>
<cvename>CVE-2019-2969</cvename>
<cvename>CVE-2019-2991</cvename>
<cvename>CVE-2019-2920</cvename>
<cvename>CVE-2019-2993</cvename>
<cvename>CVE-2019-2922</cvename>
<cvename>CVE-2019-2923</cvename>
<cvename>CVE-2019-2924</cvename>
<cvename>CVE-2019-2963</cvename>
<cvename>CVE-2019-2968</cvename>
<cvename>CVE-2019-3003</cvename>
<cvename>CVE-2019-2997</cvename>
<cvename>CVE-2019-2948</cvename>
<cvename>CVE-2019-2950</cvename>
<cvename>CVE-2019-2982</cvename>
<cvename>CVE-2019-2998</cvename>
<cvename>CVE-2019-2960</cvename>
<cvename>CVE-2019-2957</cvename>
<cvename>CVE-2019-2938</cvename>
<cvename>CVE-2019-3018</cvename>
<cvename>CVE-2019-3009</cvename>
<cvename>CVE-2019-2910</cvename>
<cvename>CVE-2019-2911</cvename>
</references>
<dates>
<discovery>2019-10-15</discovery>
<entry>2019-11-02</entry>
</dates>
</vuln>
<vuln vid="381deebb-f5c9-11e9-9c4f-74d435e60b7c">
<topic>file -- Heap buffer overflow possible</topic>
<affects>
<package>
<name>file</name>
<range><lt>5.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre reports</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18218">
<p>cdf_read_property_info in cdf.c in file through 5.37 does not
restrict the number of CDF_VECTOR elements, which allows a heap-based
buffer overflow (4-byte out-of-bounds write).</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780</url>
<url>https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84</url>
</references>
<dates>
<discovery>2019-08-26</discovery>
<entry>2019-11-02</entry>
</dates>
</vuln>
<vuln vid="92243b6a-5775-4aea-8727-a938058df5ba">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0005.html</url>
<cvename>CVE-2019-8625</cvename>
<cvename>CVE-2019-8674</cvename>
<cvename>CVE-2019-8707</cvename>
<cvename>CVE-2019-8719</cvename>
<cvename>CVE-2019-8720</cvename>
<cvename>CVE-2019-8726</cvename>
<cvename>CVE-2019-8733</cvename>
<cvename>CVE-2019-8735</cvename>
<cvename>CVE-2019-8763</cvename>
<cvename>CVE-2019-8768</cvename>
<cvename>CVE-2019-8769</cvename>
<cvename>CVE-2019-8771</cvename>
</references>
<dates>
<discovery>2019-10-29</discovery>
<entry>2019-10-31</entry>
</dates>
</vuln>
<vuln vid="fd10aa77-fb5e-11e9-af7b-0800274e5f20">
<topic>gitea -- information disclosure</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/8303">
<p>When a comment in an issue or PR mentions a user using
@username, the mentioned user receives a mail notification even if
they don't have permission to see the originating repository.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.5</url>
<url>https://blog.gitea.io/2019/10/gitea-1.9.5-is-released/</url>
</references>
<dates>
<discovery>2019-09-27</discovery>
<entry>2019-10-30</entry>
</dates>
</vuln>
<vuln vid="50a1bbc9-fb80-11e9-9e70-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba48</name>
<range><le>4.8.12</le></range>
</package>
<package>
<name>samba410</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>samba411</name>
<range><lt>4.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-10218.html">
<p>Malicious servers can cause Samba client code to return filenames containing
path separators to calling code.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-14833.html">
<p>When the password contains multi-byte (non-ASCII) characters, the check
password script does not receive the full password string.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-14847.html">
<p>Users with the "get changes" extended access right can crash the AD DC LDAP
server by requesting an attribute using the range= syntax.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2019-10218.html</url>
<cvename>CVE-2019-10218</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-14833.html</url>
<cvename>CVE-2019-14833</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-14847.html</url>
<cvename>CVE-2019-14847</cvename>
</references>
<dates>
<discovery>2019-09-29</discovery>
<entry>2019-10-29</entry>
</dates>
</vuln>
<vuln vid="6eddfa51-fb44-11e9-86e9-001b217b3468">
<topic>Gitlab -- Disclosure Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.4.0</ge><lt>12.4.1</lt></range>
<range><ge>12.3.0</ge><lt>12.3.6</lt></range>
<range><ge>0</ge><lt>12.2.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/">
<p>Source branch of a MR could be removed by an unauthorised user</p>
<p>Private group members could be listed</p>
<p>Disclosure of System Notes via Elasticsearch integration</p>
<p>Disclosure of Private Comments via Elasticsearch integration</p>
<p>Confirm existence of private repositories</p>
<p>Private group membership could be disclosed</p>
<p>Disclosure of Project Labels</p>
<p>Disclosure of Private Project Path and Labels</p>
<p>Uncontrolled Resource Consumption due to Nested GraphQL Queries</p>
<p>Improper access control on comments</p>
<p>Sentry Token Access Control</p>
<p>Authorisation check for Project Transfer option</p>
<p>XSS in Wiki Pages Using RDoc</p>
<p>Untrusted Input could be used for Internal Redirect</p>
<p>Access control for protected environments</p>
<p>Private Sub Group path Disclosure</p>
<p>Disclosure of Group Packages List</p>
<p>Private Repository Name Disclosure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/blog/2019/10/30/security-release-gitlab-12-dot-4-dot-1-released/</url>
<cvename>CVE-2019-18446</cvename>
<cvename>CVE-2019-18447</cvename>
<cvename>CVE-2019-18460</cvename>
<cvename>CVE-2019-18456</cvename>
<cvename>CVE-2019-18448</cvename>
<cvename>CVE-2019-18449</cvename>
<cvename>CVE-2019-18450</cvename>
<cvename>CVE-2019-18452</cvename>
<cvename>CVE-2019-18455</cvename>
<cvename>CVE-2019-18453</cvename>
<cvename>CVE-2019-18457</cvename>
<cvename>CVE-2019-18458</cvename>
<cvename>CVE-2019-18454</cvename>
<cvename>CVE-2019-18451</cvename>
<cvename>CVE-2019-18459</cvename>
<cvename>CVE-2019-18461</cvename>
<cvename>CVE-2019-18463</cvename>
<cvename>CVE-2019-18462</cvename>
</references>
<dates>
<discovery>2019-10-30</discovery>
<entry>2019-10-30</entry>
</dates>
</vuln>
<vuln vid="53b3474c-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Reference count overflow in mqueue filesystem 32-bit compat</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_10</lt></range>
<range><ge>11.3</ge><lt>11.3_3</lt></range>
<range><ge>11.2</ge><lt>11.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>System calls operating on file descriptors obtain a
reference to relevant struct file which due to a programming
error was not always put back, which in turn could be used
to overflow the counter of affected struct file.</p>
<h1>Impact:</h1>
<p>A local user can use this flaw to obtain access to files,
directories, sockets, etc., opened by processes owned by
other users. If obtained struct file represents a directory
from outside of user's jail, it can be used to access files
outside of the jail. If the user in question is a jailed
root they can obtain root privileges on the host system.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5603</cvename>
<freebsdsa>SA-19:24.mqueuefs</freebsdsa>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="5027b62e-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- kernel memory disclosure from /dev/midistat</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_10</lt></range>
<range><ge>11.3</ge><lt>11.3_3</lt></range>
<range><ge>11.2</ge><lt>11.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel driver for /dev/midistat implements a handler
for read(2). This handler is not thread-safe, and a
multi-threaded program can exploit races in the handler to
cause it to copy out kernel memory outside the boundaries
of midistat's data buffer.</p>
<h1>Impact:</h1>
<p>The races allow a program to read kernel memory within
a 4GB window centered at midistat's data buffer. The buffer
is allocated each time the device is opened, so an attacker
is not limited to a static 4GB region of memory.</p>
<p>On 32-bit platforms, an attempt to trigger the race may
cause a page fault in kernel mode, leading to a panic.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5612</cvename>
<freebsdsa>SA-19:23.midi</freebsdsa>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="4d3d4f64-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- IPv6 remote Denial-of-Service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_10</lt></range>
<range><ge>11.3</ge><lt>11.3_3</lt></range>
<range><ge>11.2</ge><lt>11.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due do a missing check in the code of m_pulldown(9) data
returned may not be contiguous as requested by the caller.</p>
<h1>Impact:</h1>
<p>Extra checks in the IPv6 code catch the error condition
and trigger a kernel panic leading to a remote DoS
(denial-of-service) attack with certain Ethernet interfaces.
At this point it is unknown if any other than the IPv6 code
paths can trigger a similar condition.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5611</cvename>
<freebsdsa>SA-19:22.mbuf</freebsdsa>
</references>
<dates>
<discovery>2019-08-20</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="499b22a3-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Insufficient validation of guest-supplied data (e1000 device)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The e1000 network adapters permit a variety of modifications
to an Ethernet packet when it is being transmitted. These
include the insertion of IP and TCP checksums, insertion
of an Ethernet VLAN header, and TCP segmentation offload
("TSO"). The e1000 device model uses an on-stack buffer to
generate the modified packet header when simulating these
modifications on transmitted packets.</p>
<p>When TCP segmentation offload is requested for a transmitted
packet, the e1000 device model used a guest-provided value
to determine the size of the on-stack buffer without
validation. The subsequent header generation could overflow
an incorrectly sized buffer or indirect a pointer composed
of stack garbage.</p>
<h1>Impact:</h1>
<p>A misbehaving bhyve guest could overwrite memory in the
bhyve process on the host.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5609</cvename>
<freebsdsa>SA-19:21.bhyve</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="45a95fdd-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Insufficient message length validation in bsnmp library</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A function extracting the length from type-length-value
encoding is not properly validating the submitted length.</p>
<h1>Impact:</h1>
<p>A remote user could cause, for example, an out-of-bounds
read, decoding of unrelated data, or trigger a crash of the
software such as bsnmpd resulting in a denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5610</cvename>
<freebsdsa>SA-19:20.bsnmp</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="41d2f3e6-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- ICMPv6 / MLDv2 out-of-bounds memory access</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The ICMPv6 input path incorrectly handles cases where
an MLDv2 listener query packet is internally fragmented
across multiple mbufs.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause an out-of-bounds
read or write that may cause the kernel to attempt to access
an unmapped page and subsequently panic.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5608</cvename>
<freebsdsa>SA-19:19.mldv2</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="3c7edc7a-f680-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Multiple vulnerabilities in bzip2</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_9</lt></range>
<range><ge>11.3</ge><lt>11.3_2</lt></range>
<range><ge>11.2</ge><lt>11.2_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The decompressor used in bzip2 contains a bug which can
lead to an out-of-bounds write when processing a specially
crafted bzip2(1) file.</p>
<p>bzip2recover contains a heap use-after-free bug which
can be triggered when processing a specially crafted bzip2(1)
file.</p>
<h1>Impact:</h1>
<p>An attacker who can cause maliciously crafted input to
be processed may trigger either of these bugs. The bzip2recover
bug may cause a crash, permitting a denial-of-service. The
bzip2 decompressor bug could potentially be exploited to
execute arbitrary code.</p>
<p>Note that some utilities, including the tar(1) archiver
and the bspatch(1) binary patching utility (used in portsnap(8)
and freebsd-update(8)) decompress bzip2(1)-compressed data
internally; system administrators should assume that their
systems will at some point decompress bzip2(1)-compressed
data even if they never explicitly invoke the bunzip2(1)
utility.</p>
</body>
</description>
<references>
<cvename>CVE-2016-3189</cvename>
<cvename>CVE-2019-1290</cvename>
<freebsdsa>SA-19:18.bzip2</freebsdsa>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="2d4076eb-f679-11e9-a87f-a4badb2f4699">
<topic>varnish -- Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>varnish6</name>
<range><lt>6.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish Software reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00004.html#vsv00004">
<p>A bug has been discovered in Varnish Cache where we fail to
clear a pointer between the handling of one client requests and the next
on the same connection. This can under specific circumstances lead to
information being leaked from the connection workspace.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00004.html#vsv00004</url>
</references>
<dates>
<discovery>2019-10-21</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="3a1474ba-f646-11e9-b0af-b888e347c638">
<topic>sudo -- Potential bypass of Runas user restrictions</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/alerts/minus_1_uid.html">
<p>When sudo is configured to allow a user to run commands as an
arbitrary user via the ALL keyword in a Runas specification, it
is possible to run commands as root by specifying the user ID -1
or 4294967295.</p>
<p>This can be used by a user with sufficient sudo privileges to
run commands as root even if the Runas specification explicitly
disallows root access as long as the ALL keyword is listed first
in the Runas specification.</p>
<p>Log entries for commands run this way will list the target user
as 4294967295 instead of root. In addition, PAM session modules
will not be run for the command.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/alerts/minus_1_uid.html</url>
<cvename>CVE-2019-14287</cvename>
</references>
<dates>
<discovery>2019-10-15</discovery>
<entry>2019-10-24</entry>
</dates>
</vuln>
<vuln vid="a90d040e-f5b0-11e9-acc4-4576b265fda6">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/171">
<p>This issue has been created for public disclosure of an XSS
vulnerability that was responsibly reported by
https://hackerone.com/vxhex</p>
<p>In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/171</url>
<cvename>CVE-2019-15587</cvename>
</references>
<dates>
<discovery>2019-10-22</discovery>
<entry>2019-10-23</entry>
</dates>
</vuln>
<vuln vid="9b7491fb-f253-11e9-a50c-000c29c4dc65">
<topic>python 3.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python changelog:</p>
<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final">
<p>bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering
the document page as HTML.</p>
<p>bpo-38174: Update vendorized expat library version to 2.2.8, which resolves
CVE-2019-15903.</p>
<p>bpo-37764: Fixes email._header_value_parser.get_unstructured going into an infinite
loop for a specific case in which the email header does not have trailing whitespace,
and the case in which it contains an invalid encoded word.</p>
<p>bpo-37461: Fix an infinite loop when parsing specially crafted email headers.</p>
<p>bpo-34155: Fix parsing of invalid email addresses with more than one @
(e.g. a@b@c.com.) to not return the part before 2nd @ as valid email address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-5-final</url>
<cvename>CVE-2019-15903</cvename>
</references>
<dates>
<discovery>2019-09-14</discovery>
<entry>2019-10-19</entry>
</dates>
</vuln>
<vuln vid="998ca824-ef55-11e9-b81f-3085a9a95629">
<topic>Pillow -- Allocation of resources without limits or throttling</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py35-pillow</name>
<name>py36-pillow</name>
<name>py37-pillow</name>
<range><lt>6.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16865">
<p>An issue was discovered in Pillow before 6.2.0. When reading specially
crafted invalid image files, the library can either allocate very large
amounts of memory or take an extremely long period of time to process
the image.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python-pillow/Pillow/issues/4123</url>
<cvename>CVE-2019-16865</cvename>
<freebsdpr>ports/241268</freebsdpr>
</references>
<dates>
<discovery>2019-09-24</discovery>
<entry>2019-10-15</entry>
</dates>
</vuln>
<vuln vid="fd2e0ca8-e3ae-11e9-8af7-08002720423d">
<topic>mongodb -- Bump Windows package dependencies</topic>
<affects>
<package>
<name>mongodb34</name>
<range><lt>3.4.22</lt></range>
</package>
<package>
<name>mongodb36</name>
<range><lt>3.6.14</lt></range>
</package>
<package>
<name>mongodb40</name>
<range><lt>4.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Rich Mirch reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-42233">
<p>An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the utility.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-2390</cvename>
<url>https://jira.mongodb.org/browse/SERVER-42233</url>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-09-30</entry>
</dates>
</vuln>
<vuln vid="273c6c43-e3ad-11e9-8af7-08002720423d">
<topic>mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name.</topic>
<affects>
<package>
<name>mongodb34</name>
<range><lt>3.4.22</lt></range>
</package>
<package>
<name>mongodb36</name>
<range><lt>3.6.14</lt></range>
</package>
<package>
<name>mongodb40</name>
<range><lt>4.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-40563">
<p>Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-2389</cvename>
<url>https://jira.mongodb.org/browse/SERVER-40563</url>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-09-30</entry>
</dates>
</vuln>
<vuln vid="880bca8f-e201-11e9-8af7-08002720423d">
<topic>mongodb -- Attach IDs to users</topic>
<affects>
<package>
<name>mongodb34</name>
<range><lt>3.4.22</lt></range>
</package>
<package>
<name>mongodb36</name>
<range><lt>3.6.13</lt></range>
</package>
<package>
<name>mongodb40</name>
<range><lt>4.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitch Wasson of Cisco's Advanced Malware Protection Group reports:</p>
<blockquote cite="https://jira.mongodb.org/browse/SERVER-38984">
<p>After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-2386</cvename>
<url>https://jira.mongodb.org/browse/SERVER-38984</url>
</references>
<dates>
<discovery>2019-08-06</discovery>
<entry>2019-09-28</entry>
</dates>
</vuln>
<vuln vid="c360d057-ea8b-11e9-859b-b885849ded8e">
<topic>mod_perl2 -- execute arbitrary Perl code</topic>
<affects>
<package>
<name>ap24-mod_perl2</name>
<range><lt>2.0.11,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mod_perl2 2.0.11 fixes Arbitrary Perl code execution in the context
of the user account via a user-owned .htaccess.</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2011-2767">
<p>mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary
Perl code by placing it in a user-owned .htaccess file, because
(contrary to the documentation) there is no configuration option
that permits Perl code for the administrator's control of HTTP
request processing without also permitting unprivileged users
to run Perl code in the context of the user account that runs
Apache HTTP Server processes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2767</url>
<url>https://www.securityfocus.com/bid/105195</url>
<url>https://access.redhat.com/errata/RHSA-2018:2826</url>
<url>https://bugs.debian.org/644169</url>
<url>https://usn.ubuntu.com/3825-2/</url>
</references>
<dates>
<discovery>2011-07-19</discovery>
<entry>2019-10-09</entry>
</dates>
</vuln>
<vuln vid="791e8f79-e7d1-11e9-8b31-206a8a720317">
<topic>Xpdf -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>xpdf</name>
<range><lt>4.02,1</lt></range>
</package>
<package>
<name>xpdf4</name>
<range><lt>4.02,1</lt></range>
</package>
<package>
<name>xpdf3</name>
<range><lt>3.04_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Xpdf 4.02 fixes two vulnerabilities. Both fixes have been
backported to 3.04.</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-9877">
<p>An invalid memory access vulnerability in TextPage::findGaps()
in Xpdf 4.01 through a crafted PDF document can cause a
segfault.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-16927">
<p>An out of bounds write exists in TextPage::findGaps() of
Xpdf 4.01.01 </p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-9877</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-16927</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9877</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1692</url>
</references>
<dates>
<discovery>2019-10-01</discovery>
<entry>2019-10-06</entry>
</dates>
</vuln>
<vuln vid="108a4be3-e612-11e9-9963-5f1753e0aca0">
<topic>unbound -- parsing vulnerability</topic>
<affects>
<package>
<name>unbound</name>
<range><ge>1.7.1</ge><lt>1.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound Security Advisories:</p>
<blockquote cite="https://www.nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-parsing-notify-queries">
<p>Due to an error in parsing NOTIFY queries, it is possible for Unbound
to continue processing malformed queries and may ultimately result in a
pointer dereference in uninitialized memory. This results in a crash of
the Unbound daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.nlnetlabs.nl/projects/unbound/security-advisories/#vulnerability-in-parsing-notify-queries</url>
<cvename>CVE-2019-16866</cvename>
</references>
<dates>
<discovery>2019-10-03</discovery>
<entry>2019-10-03</entry>
</dates>
</vuln>
<vuln vid="f7fcb75c-e537-11e9-863e-b9b7af01ba9e">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.4.0,1</ge><lt>2.4.9,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.7,1</lt></range>
<range><ge>2.6.0,1</ge><lt>2.6.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/">
<p>This release includes security fixes. Please check the topics below for
details.</p>
<p>CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and
File.fnmatch?</p>
<p>A NUL injection vulnerability of Ruby built-in methods (File.fnmatch
and File.fnmatch?) was found. An attacker who has the control of the
path pattern parameter could exploit this vulnerability to make path
matching pass despite the intention of the program author.</p>
<p>CVE-2019-16201: Regular Expression Denial of Service vulnerability of
WEBrick's Digest access authentication</p>
<p>Regular expression denial of service vulnerability of WEBrick's Digest
authentication module was found. An attacker can exploit this
vulnerability to cause an effective denial of service against a WEBrick
service.</p>
<p>CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)</p>
<p>There is an HTTP response splitting vulnerability in WEBrick bundled
with Ruby.</p>
<p>CVE-2019-16255: A code injection vulnerability of Shell#[] and
Shell#test</p>
<p>A code injection vulnerability of Shell#[] and Shell#test in a standard
library (lib/shell.rb) was found.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-6-5-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-5-7-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/ruby-2-4-8-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/</url>
<url>https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/</url>
<cvename>CVE-2019-15845</cvename>
<cvename>CVE-2019-16201</cvename>
<cvename>CVE-2019-16254</cvename>
<cvename>CVE-2019-16255</cvename>
</references>
<dates>
<discovery>2019-10-01</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="0762fa72-e530-11e9-86e9-001b217b3468">
<topic>Gitlab -- Disclosure Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.3.0</ge><lt>12.3.3</lt></range>
<range><ge>12.2.0</ge><lt>12.2.7</lt></range>
<range><ge>8.17.0</ge><lt>12.1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/">
<p>Disclosure of Private Code, Merge Requests and Commits via Elasticsearch integration</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/10/02/security-release-gitlab-12-dot-3-dot-3-released/</url>
</references>
<dates>
<discovery>2019-10-02</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="b17c86b9-e52e-11e9-86e9-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.3.0</ge><lt>12.3.2</lt></range>
<range><ge>12.2.0</ge><lt>12.2.6</lt></range>
<range><ge>7.12.0</ge><lt>12.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/">
<p>XSS in Markdown Preview Using Mermaid</p>
<p>Bypass Email Verification using Salesforce Authentication</p>
<p>Account Takeover using SAML</p>
<p>Uncontrolled Resource Consumption in Markdown using Mermaid</p>
<p>Disclosure of Private Project Path and Labels</p>
<p>Disclosure of Assignees via Milestones</p>
<p>Disclosure of Project Path via Unsubscribe Link</p>
<p>Disclosure of Project Milestones via Groups</p>
<p>Disclosure of Private System Notes via GraphQL</p>
<p>GIT Command Injection via API</p>
<p>Bypass User Blocking via CI/CD token</p>
<p>IDOR Adding Groups to Protected Environments</p>
<p>Disclosure of Group Membership via Merge Request Approval Rules</p>
<p>Disclosure of Head Pipeline via Blocking Merge Request Feature</p>
<p>Grafana update</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/09/30/security-release-gitlab-12-dot-3-dot-2-released/</url>
<cvename>CVE-2019-19039</cvename>
</references>
<dates>
<discovery>2019-09-30</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="ed18aa92-e4f4-11e9-b6fa-3085a9a95629">
<topic>cacti -- Authenticated users may bypass authorization checks</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cacti developers reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16723">
<p>In Cacti through 1.2.6, authenticated users may bypass authorization checks
(for viewing a graph) via a direct graph_json.php request with a modified
local_graph_id parameter.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16723</cvename>
<url>https://github.com/Cacti/cacti/releases/tag/release%2F1.2.7</url>
</references>
<dates>
<discovery>2019-09-23</discovery>
<entry>2019-10-02</entry>
</dates>
</vuln>
<vuln vid="e917caba-e291-11e9-89f1-152fed202bb7">
<topic>Exim -- heap-based buffer overflow in string_vformat leading to RCE</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.92</ge><lt>4.92.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers team report:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html">
<p>There is a heap overflow in string_vformat().Using a EHLO message, remote code
execution seems to be possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openwall.com/lists/oss-security/2019/09/28/1</url>
</references>
<dates>
<discovery>2019-09-28</discovery>
<entry>2019-09-29</entry>
</dates>
</vuln>
<vuln vid="a92dcc5c-e05c-11e9-b589-10c37b4ac2ea">
<topic>go -- invalid headers are normalized, allowing request smuggling</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.13.1,1</lt></range>
</package>
<package>
<name>go-devel</name>
<range><lt>g20190925</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://github.com/golang/go/issues/34540">
<p>net/http (through net/textproto) used to accept and normalize invalid
HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.
If a Go server is used behind a reverse proxy that accepts and forwards
but doesn't normalize such invalid headers, the reverse proxy and the
server can interpret the headers differently. This can lead to filter
bypasses or request smuggling, the latter if requests from separate clients
are multiplexed onto the same connection by the proxy. Such invalid headers
are now rejected by Go servers, and passed without normalization to Go
client applications.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-16276</cvename>
<url>https://github.com/golang/go/issues/34540</url>
</references>
<dates>
<discovery>2019-09-25</discovery>
<entry>2019-09-26</entry>
</dates>
</vuln>
<vuln vid="81fcc2f9-e15a-11e9-abbf-800dd28b22bd">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis-php71</name>
<name>mantis-php72</name>
<name>mantis-php73</name>
<name>mantis-php74</name>
<range><lt>2.22.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mantis developers report:</p>
<blockquote cite="https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.22.1">
<p>CVE-2019-15715: [Admin Required - Post Authentication] Command Execution / Injection Vulnerability</p>
<p>CVE-2019-8331: In Bootstrap before 3.4.1, XSS is possible in the tooltip or popover data-template attribute</p>
<p>Missing integrity hashes for CSS resources from CDNs</p>
</blockquote>
</body>
</description>
<references>
<url>https://mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=2.22.1</url>
<cvename>CVE-2019-15715</cvename>
<cvename>CVE-2019-8331</cvename>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-09-27</entry>
</dates>
</vuln>
<vuln vid="9720bb39-f82a-402f-9fe4-e2c875bdda83">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.196</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.176.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-09-25/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1498 / CVE-2019-10401</h5>
<p>Stored XSS vulnerability in expandable textbox form control</p>
<h5>(Medium) SECURITY-1525 / CVE-2019-10402</h5>
<p>XSS vulnerability in combobox form control</p>
<h5>(Medium) SECURITY-1537 (1) / CVE-2019-10403</h5>
<p>Stored XSS vulnerability in SCM tag action tooltip</p>
<h5>(Medium) SECURITY-1537 (2) / CVE-2019-10404</h5>
<p>Stored XSS vulnerability in queue item tooltip</p>
<h5>(Medium) SECURITY-1505 / CVE-2019-10405</h5>
<p>Diagnostic web page exposed Cookie HTTP header</p>
<h5>(Medium) SECURITY-1471 / CVE-2019-10406</h5>
<p>XSS vulnerability in Jenkins URL setting</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10401</cvename>
<cvename>CVE-2019-10402</cvename>
<cvename>CVE-2019-10403</cvename>
<cvename>CVE-2019-10404</cvename>
<cvename>CVE-2019-10405</cvename>
<cvename>CVE-2019-10406</cvename>
<url>https://jenkins.io/security/advisory/2019-09-25/</url>
</references>
<dates>
<discovery>2019-09-25</discovery>
<entry>2019-09-25</entry>
</dates>
</vuln>
<vuln vid="20b92374-d62a-11e9-af73-001b217e4ee5">
<topic>ISC KEA -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>kea</name>
<range><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Internet Systems Consortium, Inc. reports:</p>
<blockquote cite="https://gitlab.isc.org/isc-projects/kea/issues">
<p>A packet containing a malformed DUID can cause the kea-dhcp6 server to terminate (CVE-2019-6472) [Medium]</p>
<p>An invalid hostname option can cause the kea-dhcp4 server to terminate (CVE-2019-6473) [Medium]</p>
<p>An oversight when validating incoming client requests can lead to a situation where the Kea server<br/>
will exit when trying to restart (CVE-2019-6474) [Medium]</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.isc.org/isc-projects/kea/issues</url>
<cvename>CVE-2019-6472</cvename>
<cvename>CVE-2019-6473</cvename>
<cvename>CVE-2019-6474</cvename>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-09-20</entry>
</dates>
</vuln>
<vuln vid="6856d798-d950-11e9-aae4-f079596b62f9">
<topic>expat2 -- Fix extraction of namespace prefixes from XML names</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>expat project reports:</p>
<blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes">
<p>
Fix heap overflow triggered by
XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber),
and deny internal entities closing the doctype
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes</url>
</references>
<dates>
<discovery>2019-09-13</discovery>
<entry>2019-09-17</entry>
</dates>
</vuln>
<vuln vid="b2789b2d-d521-11e9-86e9-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.2.0</ge><lt>12.2.5</lt></range>
<range><ge>12.1.0</ge><lt>12.1.9</lt></range>
<range><ge>11.6.0</ge><lt>12.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/">
<p>Project Template Functionality Could Be Used to Access Restricted Project Data</p>
<p>Security Enhancements in GitLab Pages</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/</url>
<cvename>CVE-2019-16170</cvename>
</references>
<dates>
<discovery>2019-09-10</discovery>
<entry>2019-09-12</entry>
</dates>
</vuln>
<vuln vid="1c948fd3-dac0-11e9-81b2-0011d823eebd">
<topic>Mbed TLS -- Side channel attack on deterministic ECDSA</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.16.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10">
<p>Mbed TLS does not have a constant-time/constant-trace arithmetic
library and uses blinding to protect against side channel
attacks.</p>
<p>In the ECDSA signature routine previous Mbed TLS versions used the
same RNG object for generating the ephemeral key pair and for
generating the blinding values. The deterministic ECDSA function
reused this by passing the RNG object created from the private key
and the message to be signed as prescribed by RFC 6979. This meant
that the same RNG object was used whenever the same message was
signed, rendering the blinding ineffective.</p>
<p>If the victim can be tricked to sign the same message repeatedly,
the private key may be recoverable through side channels.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-10</url>
</references>
<dates>
<discovery>2019-09-06</discovery>
<entry>2019-09-19</entry>
</dates>
</vuln>
<vuln vid="55571619-454e-4769-b1e5-28354659e152">
<topic>bro -- invalid memory access or heap buffer over-read</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS">
<p>This is a security patch release to address a potential
Denial of Service vulnerability:</p>
<ul>
<li>
The NTLM analyzer did not properly handle AV Pair sequences
that were either empty or unterminated, resulting in
invalid memory access or heap buffer over-read. The NTLM
analyzer is enabled by default and used in the analysis
of SMB, DCE/RPC, and GSSAPI protocols.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS</url>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-09-17</entry>
</dates>
</vuln>
<vuln vid="c5bd8a25-99a6-11e9-a598-f079596b62f9">
<topic>expat2 -- Fix extraction of namespace prefixes from XML names</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>expat project reports:</p>
<blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes">
<p>
XML names with multiple colons could end up in the
wrong namespace, and take a high amount of RAM and CPU
resources while processing, opening the door to
use for denial-of-service attacks
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes</url>
</references>
<dates>
<discovery>2019-06-19</discovery>
<entry>2019-09-16</entry>
</dates>
</vuln>
<vuln vid="9fb4e57b-d65a-11e9-8a5f-e5c82b486287">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.19.4</ge><lt>7.66.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2019-5481: FTP-KRB double-free</p>
<p>libcurl can be told to use kerberos over FTP to a server, as set with
the CURLOPT_KRBLEVEL option.</p>
<p>During such kerberos FTP data transfer, the server sends data to curl
in blocks with the 32 bit size of each block first and then that amount
of data immediately following.</p>
<p>A malicious or just broken server can claim to send a very large block
and if by doing that it makes curl's subsequent call to realloc() to
fail, curl would then misbehave in the exit path and double-free the
memory.</p>
<p>In practical terms, an up to 4 GB memory area may very well be fine to
allocate on a modern 64 bit system but on 32 bit systems it will fail.</p>
<p>Kerberos FTP is a rarely used protocol with curl. Also, Kerberos
authentication is usually only attempted and used with servers that the
client has a previous association with.</p>
<p>CVE-2019-5482: TFTP small blocksize heap buffer overflow</p>
<p>libcurl contains a heap buffer overflow in the function
(tftp_receive_packet()) that receives data from a TFTP server. It can
call recvfrom() with the default size for the buffer rather than with
the size that was used to allocate it. Thus, the content that might
overwrite the heap memory is controlled by the server.</p>
<p>This flaw is only triggered if the TFTP server sends an OACK without
the BLKSIZE option, when a BLKSIZE smaller than 512 bytes was requested
by the TFTP client. OACK is a TFTP extension and is not used by all
TFTP servers.</p>
<p>Users choosing a smaller block size than default should be rare as the
primary use case for changing the size is to make it larger.</p>
<p>It is rare for users to use TFTP across the Internet. It is most
commonly used within local networks. TFTP as a protocol is always
inherently insecure.</p>
<p>This issue was introduced by the add of the TFTP BLKSIZE option
handling. It was previously incompletely fixed by an almost identical
issue called CVE-2019-5436.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5481.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5482.html</url>
<cvename>CVE-2019-5481</cvename>
<cvename>CVE-2019-5482</cvename>
</references>
<dates>
<discovery>2019-09-11</discovery>
<entry>2019-09-14</entry>
</dates>
</vuln>
<vuln vid="9e0c6f7a-d46d-11e9-a1c7-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2t,1</lt></range>
</package>
<package>
<name>openssl111</name>
<range><lt>1.1.1d</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20190910.txt">
<p>ECDSA remote timing attack (CVE-2019-1547) [Low]</p>
<p>Fork Protection (CVE-2019-1549) [Low]<br/>
(OpenSSL 1.1.1 only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20190910.txt</url>
<cvename>CVE-2019-1547</cvename>
<cvename>CVE-2019-1549</cvename>
</references>
<dates>
<discovery>2019-09-10</discovery>
<entry>2019-09-11</entry>
</dates>
</vuln>
<vuln vid="c6f19fe6-d42a-11e9-b4f9-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.255</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-46.html">
<ul>
<li>This update resolves a same origin method execution
vulnerability that could lead to arbitrary code execution
(CVE-2019-8069).</li>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-8070).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-8069</cvename>
<cvename>CVE-2019-8070</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-46.html</url>
</references>
<dates>
<discovery>2019-09-10</discovery>
<entry>2019-09-10</entry>
</dates>
</vuln>
<vuln vid="a8d87c7a-d1b1-11e9-a616-0992a4564e7c">
<topic>oniguruma -- multiple vulnerabilities</topic>
<affects>
<package>
<name>oniguruma</name>
<range><lt>6.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224">
<p>
A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe().
</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225">
<p>A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular expression.</p>
<p>Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13224</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13224</url>
<url>https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55</url>
<cvename>CVE-2019-13225</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13225</url>
<url>https://github.com/kkos/oniguruma/commit/c509265c5f6ae7264f7b8a8aae1cfa5fc59d108c</url>
</references>
<dates>
<discovery>2019-07-03</discovery>
<entry>2019-09-07</entry>
</dates>
</vuln>
<vuln vid="10e1d580-d174-11e9-a87f-a4badb2f4699">
<topic>xymon-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xymon-server</name>
<range><lt>4.3.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Japheth Cleaver reports:</p>
<blockquote cite="https://lists.xymon.com/archive/2019-July/046570.html">
<p>Several buffer overflows were reported by University of
Cambridge Computer Security Incident Response Team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.xymon.com/archive/2019-July/046570.html</url>
<cvename>CVE-2019-13451</cvename>
<cvename>CVE-2019-13452</cvename>
<cvename>CVE-2019-13455</cvename>
<cvename>CVE-2019-13273</cvename>
<cvename>CVE-2019-13274</cvename>
<cvename>CVE-2019-13484</cvename>
<cvename>CVE-2019-13485</cvename>
<cvename>CVE-2019-13486</cvename>
</references>
<dates>
<discovery>2019-07-23</discovery>
<entry>2019-09-07</entry>
</dates>
</vuln>
<vuln vid="8a9f86de-d080-11e9-9051-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.2.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/">
<p>Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues.
The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors.
The second was a cross-site scripting vulnerability in stored comments.</p>
<p>Props to Tim Coen for disclosing an issue where validation and sanitization
of a URL could lead to an open redirect.</p>
<p>Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.</p>
<p>Props to Zhouyuan Yang of Fortinets FortiGuard Labs who disclosed a vulnerability
for cross-site scripting (XSS) in shortcode previews.</p>
<p>Props to Ian Dunn of the Core Security Team for finding and disclosing a case where
reflected cross-site scripting could be found in the dashboard.</p>
<p>Props to Soroush Dalilifrom NCC Group for disclosing an issue with URL
sanitization that can lead to cross-site scripting (XSS) attacks.</p>
<p>In addition to the above changes, we are also updating jQuery on older versions of WordPress.
This change was added in 5.2.1 and is now being brought to older versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2019-09-05</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="61db9b88-d091-11e9-8d41-97657151f8c2">
<topic>Exim -- RCE with root privileges in TLS SNI handler</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.92.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers report:</p>
<blockquote cite="https://git.exim.org/exim.git/blob/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt">
<p>If your Exim server accepts TLS connections, it is vulnerable. This does
not depend on the TLS libray, so both, GnuTLS and OpenSSL are affected.</p>
<p>The vulnerability is exploitable by sending a SNI ending in a
backslash-null sequence during the initial TLS handshake. The exploit
exists as a POC. For more details see the document qualys.mbx</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.exim.org/exim.git/blob_plain/2600301ba6dbac5c9d640c87007a07ee6dcea1f4:/doc/doc-txt/cve-2019-15846/cve.txt</url>
</references>
<dates>
<discovery>2019-09-02</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="7d53d8da-d07a-11e9-8f1a-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in audio transcoding</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.28.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When audio frames are given to the audio transcoding
support in Asterisk the number of samples are examined
and as part of this a message is output to indicate that
no samples are present. A change was done to suppress
this message for a particular scenario in which the message
was not relevant. This change assumed that information
about the origin of a frame will always exist when in
reality it may not.</p>
<p>This issue presented itself when an RTP packet containing
no audio (and thus no samples) was received. In a particular
transcoding scenario this audio frame would get turned
into a frame with no origin information. If this new frame
was then given to the audio transcoding support a crash
would occur as no samples and no origin information would
be present. The transcoding scenario requires the genericplc
option to be set to enabled (the default) and a transcoding
path from the source format into signed linear and then
from signed linear into another format.</p>
<p>Note that there may be other scenarios that have not
been found which can cause an audio frame with no origin
to be given to the audio transcoding support and thus
cause a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-005.html</url>
<cvename>CVE-2019-15639</cvename>
</references>
<dates>
<discovery>2019-08-07</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="d94c08d2-d079-11e9-8f1a-001999f8d30b">
<topic>asterisk -- Crash when negotiating for T.38 with a declined stream</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.7.4</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk sends a re-invite initiating T.38 faxing,
and the endpoint responds with a declined media stream a
crash will then occur in Asterisk.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-004.html</url>
<cvename>CVE-2019-15297</cvename>
</references>
<dates>
<discovery>2019-08-05</discovery>
<entry>2019-09-06</entry>
</dates>
</vuln>
<vuln vid="145a3e17-cea2-11e9-81e2-005056a311d1">
<topic>samba -- combination of parameters and permissions can allow user to escape from the share path definition</topic>
<affects>
<package>
<name>samba410</name>
<range><lt>4.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-10197.html">
<p>On a Samba SMB server for all versions of Samba from 4.9.0 clients are
able to escape outside the share root directory if certain
configuration parameters set in the smb.conf file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10197</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-10197.html</url>
</references>
<dates>
<discovery>2019-09-01</discovery>
<entry>2019-09-03</entry>
</dates>
</vuln>
<vuln vid="05463e0a-abd3-4fa4-bd5f-cd5ed132d4c6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>69.0,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.14</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>61.0,1</ge><lt>68.1.0,1</lt></range>
<range><lt>60.9.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>61.0,2</ge><lt>68.1.0,2</lt></range>
<range><lt>60.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>61.0</ge><lt>68.1.0</lt></range>
<range><lt>60.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/">
<p>CVE-2019-11751: Malicious code execution through command line parameters</p>
<p>CVE-2019-11746: Use-after-free while manipulating video</p>
<p>CVE-2019-11744: XSS by breaking out of title and textarea elements using innerHTML</p>
<p>CVE-2019-11742: Same-origin policy violation with SVG filters and canvas to steal cross-origin images</p>
<p>CVE-2019-11736: File manipulation and privilege escalation in Mozilla Maintenance Service</p>
<p>CVE-2019-11753: Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location</p>
<p>CVE-2019-11752: Use-after-free while extracting a key value in IndexedDB</p>
<p>CVE-2019-9812: Sandbox escape through Firefox Sync</p>
<p>CVE-2019-11741: Isolate addons.mozilla.org and accounts.firefox.com</p>
<p>CVE-2019-11743: Cross-origin access to unload event attributes</p>
<p>CVE-2019-11748: Persistence of WebRTC permissions in a third party context</p>
<p>CVE-2019-11749: Camera information available without prompting using getUserMedia</p>
<p>CVE-2019-5849: Out-of-bounds read in Skia</p>
<p>CVE-2019-11750: Type confusion in Spidermonkey</p>
<p>CVE-2019-11737: Content security policy directives ignore port and path if host is a wildcard</p>
<p>CVE-2019-11738: Content security policy bypass through hash-based sources in directives</p>
<p>CVE-2019-11747: 'Forget about this site' removes sites from pre-loaded HSTS list</p>
<p>CVE-2019-11734: Memory safety bugs fixed in Firefox 69</p>
<p>CVE-2019-11735: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1</p>
<p>CVE-2019-11740: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11734</cvename>
<cvename>CVE-2019-11735</cvename>
<cvename>CVE-2019-11736</cvename>
<cvename>CVE-2019-11737</cvename>
<cvename>CVE-2019-11738</cvename>
<cvename>CVE-2019-11740</cvename>
<cvename>CVE-2019-11741</cvename>
<cvename>CVE-2019-11742</cvename>
<cvename>CVE-2019-11743</cvename>
<cvename>CVE-2019-11744</cvename>
<cvename>CVE-2019-11746</cvename>
<cvename>CVE-2019-11747</cvename>
<cvename>CVE-2019-11748</cvename>
<cvename>CVE-2019-11749</cvename>
<cvename>CVE-2019-11750</cvename>
<cvename>CVE-2019-11751</cvename>
<cvename>CVE-2019-11752</cvename>
<cvename>CVE-2019-11753</cvename>
<cvename>CVE-2019-5849</cvename>
<cvename>CVE-2019-9812</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-27/</url>
</references>
<dates>
<discovery>2019-09-03</discovery>
<entry>2019-09-03</entry>
</dates>
</vuln>
<vuln vid="ce231189-ce56-11e9-9fa0-0050569f0b83">
<topic>www/varnish6 -- Denial of Service</topic>
<affects>
<package>
<name>varnish6</name>
<range><lt>6.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Varnish Team reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00003.html">
<p>A failure in HTTP/1 parsing can allow a remote attacker to trigger
an assertion in varnish, restarting the daemon and clearing the cache.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00003.html</url>
</references>
<dates>
<discovery>2019-09-02</discovery>
<entry>2019-09-03</entry>
</dates>
</vuln>
<vuln vid="c9c6c2f8-cd54-11e9-af89-080027ef1a23">
<topic>libgcrypt -- ECDSA timing attack</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627">
<p>Mitigate an ECDSA timing attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13627</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627</url>
</references>
<dates>
<discovery>2019-08-29</discovery>
<entry>2019-09-02</entry>
</dates>
</vuln>
<vuln vid="e45c3669-caf2-11e9-851a-dcf3aaa3f3ff">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.24.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports many vulnerabilities,
including several arbitrary code execution vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0004.html</url>
<cvename>CVE-2019-8644</cvename>
<cvename>CVE-2019-8649</cvename>
<cvename>CVE-2019-8658</cvename>
<cvename>CVE-2019-8666</cvename>
<cvename>CVE-2019-8669</cvename>
<cvename>CVE-2019-8671</cvename>
<cvename>CVE-2019-8672</cvename>
<cvename>CVE-2019-8673</cvename>
<cvename>CVE-2019-8676</cvename>
<cvename>CVE-2019-8677</cvename>
<cvename>CVE-2019-8678</cvename>
<cvename>CVE-2019-8679</cvename>
<cvename>CVE-2019-8680</cvename>
<cvename>CVE-2019-8681</cvename>
<cvename>CVE-2019-8683</cvename>
<cvename>CVE-2019-8684</cvename>
<cvename>CVE-2019-8686</cvename>
<cvename>CVE-2019-8687</cvename>
<cvename>CVE-2019-8688</cvename>
<cvename>CVE-2019-8689</cvename>
<cvename>CVE-2019-8690</cvename>
</references>
<dates>
<discovery>2019-08-29</discovery>
<entry>2019-08-30</entry>
</dates>
</vuln>
<vuln vid="b68cc195-cae7-11e9-86e9-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.2.0</ge><lt>12.2.3</lt></range>
<range><ge>12.1.0</ge><lt>12.1.8</lt></range>
<range><ge>0.0.0</ge><lt>12.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/">
<p>Kubernetes Integration Server-Side Request Forgery</p>
<p>Server-Side Request Forgery in Jira Integration</p>
<p>Improved Protection Against Credential Stuffing Attacks</p>
<p>Markdown Clientside Resource Exhaustion</p>
<p>Pipeline Status Disclosure</p>
<p>Group Runner Authorization Issue</p>
<p>CI Metrics Disclosure</p>
<p>User IP Disclosed by Embedded Image and Media</p>
<p>Label Description HTML Injection</p>
<p>IDOR in Epic Notes API</p>
<p>Push Rule Bypass</p>
<p>Project Visibility Restriction Bypass</p>
<p>Merge Request Discussion Restriction Bypass</p>
<p>Disclosure of Merge Request IDs</p>
<p>Weak Authentication In Certain Account Actions</p>
<p>Disclosure of Commit Title and Comments</p>
<p>Stored XSS via Markdown</p>
<p>EXIF Geolocation Data Exposure</p>
<p>Multiple SSRF Regressions on Gitaly</p>
<p>Default Branch Name Exposure</p>
<p>Potential Denial of Service via CI Pipelines</p>
<p>Privilege Escalation via Logrotate</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/</url>
<cvename>CVE-2019-15728</cvename>
<cvename>CVE-2019-15730</cvename>
<cvename>CVE-2019-15722</cvename>
<cvename>CVE-2019-15729</cvename>
<cvename>CVE-2019-15721</cvename>
<cvename>CVE-2019-15727</cvename>
<cvename>CVE-2019-15726</cvename>
<cvename>CVE-2019-15724</cvename>
<cvename>CVE-2019-15725</cvename>
<cvename>CVE-2019-15723</cvename>
<cvename>CVE-2019-15732</cvename>
<cvename>CVE-2019-15731</cvename>
<cvename>CVE-2019-15738</cvename>
<cvename>CVE-2019-15737</cvename>
<cvename>CVE-2019-15734</cvename>
<cvename>CVE-2019-15739</cvename>
<cvename>CVE-2019-15740</cvename>
<cvename>CVE-2019-15733</cvename>
<cvename>CVE-2019-15736</cvename>
<cvename>CVE-2019-15741</cvename>
</references>
<dates>
<discovery>2019-08-29</discovery>
<entry>2019-08-30</entry>
</dates>
</vuln>
<vuln vid="ed8d5535-ca78-11e9-980b-999ff59c22ea">
<topic>RDoc -- multiple jQuery vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.4.0,1</ge><lt>2.4.7,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.6,1</lt></range>
<range><ge>2.6.0,1</ge><lt>2.6.3,1</lt></range>
</package>
<package>
<name>rubygem-rdoc</name>
<range><lt>6.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/">
<p>There are multiple vulnerabilities about Cross-Site Scripting (XSS) in
jQuery shipped with RDoc which bundled in Ruby. All Ruby users are
recommended to update Ruby to the latest release which includes the
fixed version of RDoc.</p>
<p>The following vulnerabilities have been reported.</p>
<p>CVE-2012-6708</p>
<p>CVE-2015-9251</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/</url>
<cvename>CVE-2012-6708</cvename>
<cvename>CVE-2015-9251</cvename>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-08-29</entry>
<modified>2019-08-31</modified>
</dates>
</vuln>
<vuln vid="abaaecda-ea16-43e2-bad0-d34a9ac576b1">
<topic>Dovecot -- improper input validation</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.7.2</lt></range>
</package>
<package>
<name>dovecot-pigeonhole</name>
<range><lt>0.5.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot/2019-August/116874.html">
<p>Vulnerability Details:
IMAP and ManageSieve protocol parsers do not properly handle NUL byte
when scanning data in quoted strings, leading to out of bounds heap
memory writes.
Risk:
This vulnerability allows for out-of-bounds writes to objects stored on
the heap up to 8096 bytes in pre-login phase, and 65536 bytes post-login
phase, allowing sufficiently skilled attacker to perform complicated
attacks that can lead to leaking private information or remote code
execution. Abuse of this bug is very difficult to observe, as it does
not necessarily cause a crash. Attempts to abuse this bug are not
directly evident from logs.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot/2019-August/116874.html</url>
<cvename>CVE-2019-11500</cvename>
</references>
<dates>
<discovery>2019-04-13</discovery>
<entry>2019-08-28</entry>
</dates>
</vuln>
<vuln vid="7a7891fc-6318-447a-ba45-31d525ec11a0">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.191</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.176.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-08-28/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1453 / CVE-2019-10383</h5>
<p>Stored XSS vulnerability in update center</p>
<h5>(High) SECURITY-1491 / CVE-2019-10384</h5>
<p>CSRF protection tokens for anonymous users did not expire in some circumstances</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10383</cvename>
<cvename>CVE-2019-10384</cvename>
<url>https://jenkins.io/security/advisory/2019-08-28/</url>
</references>
<dates>
<discovery>2019-08-28</discovery>
<entry>2019-08-28</entry>
</dates>
</vuln>
<vuln vid="0f31b4e9-c827-11e9-9626-589cfc01894a">
<topic>Mozilla -- Stored passwords in 'Saved Logins' can be copied without master password entry</topic>
<affects>
<package>
<name>cliqz</name>
<range><lt>1.28.2</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>68.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/">
<h1>CVE-2019-11733: Stored passwords in 'Saved Logins' can
be copied without master password entry</h1>
<p>When a master password is set, it is required to be
entered again before stored passwords can be accessed in the 'Saved
Logins' dialog. It was found that locally stored passwords can be
copied to the clipboard thorough the 'copy password' context menu item
without re-entering the master password if the master password had
been previously entered in the same session, allowing for potential
theft of stored passwords.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2019-24/</url>
<cvename>CVE-2019-11733</cvename>
</references>
<dates>
<discovery>2019-08-14</discovery>
<entry>2019-08-28</entry>
</dates>
</vuln>
<vuln vid="72a5579e-c765-11e9-8052-0028f8d09152">
<topic>h2o -- multiple HTTP/2 vulnerabilities</topic>
<affects>
<package>
<name>h2o-devel</name>
<range><lt>2.3.0.b2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathon Loomey of Netflix reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/605641/">
<p>HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion</p>
<p>Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:</p>
<ul>
<li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/issues/2090</url>
<url>https://www.kb.cert.org/vuls/id/605641/</url>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9514</cvename>
<cvename>CVE-2019-9515</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-25</entry>
</dates>
</vuln>
<vuln vid="73b1e734-c74e-11e9-8052-0028f8d09152">
<topic>h2o -- multiple HTTP/2 vulnerabilities</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jonathon Loomey of Netflix reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/605641/">
<p>HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion</p>
<p>Recently, a series of DoS attack vulnerabilities have been reported on a broad range of HTTP/2 stacks. Among the vulnerabilities, H2O is exposed to the following:</p>
<ul>
<li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/issues/2090</url>
<url>https://www.kb.cert.org/vuls/id/605641/</url>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9514</cvename>
<cvename>CVE-2019-9515</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-25</entry>
</dates>
</vuln>
<vuln vid="e7392840-c520-11e9-a4ef-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/08/gitea-1.9.2-is-released/">
<p>This release contains two security fixes, so we highly recommend updating.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.2</url>
<url>https://blog.gitea.io/2019/08/gitea-1.9.2-is-released/</url>
</references>
<dates>
<discovery>2019-08-22</discovery>
<entry>2019-08-22</entry>
</dates>
</vuln>
<vuln vid="dbd1f627-c43b-11e9-a923-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.101.4,1</lt></range>
</package>
<package>
<name>clamav-milter</name>
<range><lt>0.101.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html">
<ul>
<li>An out of bounds write was possible within ClamAV&s NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.</li>
<li> The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html</url>
<cvename>CVE-2019-12625</cvename>
<cvename>CVE-2019-12900</cvename>
</references>
<dates>
<discovery>2019-08-21</discovery>
<entry>2019-08-21</entry>
</dates>
</vuln>
<vuln vid="c97a940b-c392-11e9-bb38-000d3ab229d6">
<topic>Node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>12.8.1</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.16.3</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/">
<p>Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information.</p>
<p>Updates are now available for all active Node.js release lines, including Linux ARMv6 builds for Node.js 8.x (which had been delayed).</p>
<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
<h1>Vulnerabilities Fixed</h1>
<p>Impact: All versions of Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium"), and Node.js 12 (Current) are vulnerable to the following:</p>
<ul>
<li>CVE-2019-9511 "Data Dribble": The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9512 "Ping Flood": The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9513 "Resource Loop": The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service.</li>
<li>CVE-2019-9514 "Reset Flood": The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9515 "Settings Flood": The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9516 "0-Length Headers Leak": The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service.</li>
<li>CVE-2019-9517 "Internal Data Buffering": The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service.</li>
<li>CVE-2019-9518 "Empty Frames Flood": The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/</url>
<cvename>CVE-2019-9511</cvename>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9513</cvename>
<cvename>CVE-2019-9514</cvename>
<cvename>CVE-2019-9515</cvename>
<cvename>CVE-2019-9516</cvename>
<cvename>CVE-2019-9517</cvename>
<cvename>CVE-2019-9518</cvename>
</references>
<dates>
<discovery>2019-08-16</discovery>
<entry>2019-08-21</entry>
</dates>
</vuln>
<vuln vid="795442e7-c355-11e9-8224-5404a68ad561">
<topic>vlc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.8,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
<p>Security:
* Fix a buffer overflow in the MKV demuxer (CVE-2019-14970)
* Fix a read buffer overflow in the avcodec decoder (CVE-2019-13962)
* Fix a read buffer overflow in the FAAD decoder
* Fix a read buffer overflow in the OGG demuxer (CVE-2019-14437, CVE-2019-14438)
* Fix a read buffer overflow in the ASF demuxer (CVE-2019-14776)
* Fix a use after free in the MKV demuxer (CVE-2019-14777, CVE-2019-14778)
* Fix a use after free in the ASF demuxer (CVE-2019-14533)
* Fix a couple of integer underflows in the MP4 demuxer (CVE-2019-13602)
* Fix a null dereference in the dvdnav demuxer
* Fix a null dereference in the ASF demuxer (CVE-2019-14534)
* Fix a null dereference in the AVI demuxer
* Fix a division by zero in the CAF demuxer (CVE-2019-14498)
* Fix a division by zero in the ASF demuxer (CVE-2019-14535)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.videolan.org/developers/vlc-branch/NEWS</url>
<cvename>CVE-2019-13602</cvename>
<cvename>CVE-2019-13962</cvename>
<cvename>CVE-2019-14437</cvename>
<cvename>CVE-2019-14438</cvename>
<cvename>CVE-2019-14498</cvename>
<cvename>CVE-2019-14533</cvename>
<cvename>CVE-2019-14534</cvename>
<cvename>CVE-2019-14535</cvename>
<cvename>CVE-2019-14776</cvename>
<cvename>CVE-2019-14777</cvename>
<cvename>CVE-2019-14778</cvename>
<cvename>CVE-2019-14970</cvename>
</references>
<dates>
<discovery>2019-07-14</discovery>
<entry>2019-08-20</entry>
</dates>
</vuln>
<vuln vid="56778a31-c2a1-11e9-9051-4c72b94353b5">
<topic>nsd -- Stack-based Buffer Overflow</topic>
<affects>
<package>
<name>nsd</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-13207">
<p>nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer
Overflow in the dname_concatenate() function in dname.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-13207</url>
<url>https://github.com/NLnetLabs/nsd/issues/20</url>
<cvename>CVE-2019-13207</cvename>
</references>
<dates>
<discovery>2019-07-28</discovery>
<entry>2019-08-19</entry>
</dates>
</vuln>
<vuln vid="ece65d3b-c20c-11e9-8af4-bcaec55be5e5">
<topic>webmin -- unauthenticated remote code execution</topic>
<affects>
<package>
<name>webmin</name>
<range><lt>1.930</lt></range>
</package>
<package>
<name>usermin</name>
<range><lt>1.780</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joe Cooper reports:</p>
<blockquote cite="https://virtualmin.com/node/66890">
<p>I've rolled out Webmin version 1.930 and Usermin version 1.780
for all repositories. This release includes several security
fixes, including one potentially serious one caused by malicious
code inserted into Webmin and Usermin at some point on our build
infrastructure. We're still investigating how and when, but the
exploitable code has never existed in our github repositories, so
we've rebuilt from git source on new infrastructure (and checked
to be sure the result does not contain the malicious code).</p>
<p>I don't have a changelog for these releases yet, but I wanted
to announce them immediately due to the severity of this issue.
To exploit the malicious code, your Webmin installation must have
Webmin -> Webmin Configuration -> Authentication -> Password
expiry policy set to Prompt users with expired passwords to enter
a new one. This option is not set by default, but if it is set,
it allows remote code execution.</p>
<p>This release addresses CVE-2019-15107, which was disclosed
earlier today. It also addresses a handful of XSS issues that we
were notified about, and a bounty was awarded to the researcher
(a different one) who found them.</p>
</blockquote>
</body>
</description>
<references>
<url>https://virtualmin.com/node/66890</url>
<cvename>CVE-2019-15107</cvename>
</references>
<dates>
<discovery>2019-08-17</discovery>
<entry>2019-08-17</entry>
</dates>
</vuln>
<vuln vid="3b2ee737-c12d-11e9-aabc-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/08/gitea-1.9.1-is-released/">
<p>This release contains two security fixes, so we highly recommend updating.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/08/gitea-1.9.1-is-released/</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.1</url>
</references>
<dates>
<discovery>2019-07-31</discovery>
<entry>2019-07-31</entry>
</dates>
</vuln>
<vuln vid="d905b219-c1ca-11e9-8c46-0c9d925bbbc0">
<topic>xdm -- remote denial of service</topic>
<affects>
<package>
<name>xdm</name>
<range><lt>1.1.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nvd.nist.gov reports</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2013-2179">
<p>X.Org xdm 1.1.10, 1.1.11, and possibly other versions,
when performing authentication using certain implementations of
the crypt API function that can return NULL, allows remote
attackers to cause a denial of service (NULL pointer dereference
and crash) by attempting to log into an account whose password
field contains invalid characters, as demonstrated using the crypt
function from glibc 2.17 and later with (1) the "!" character in
the salt portion of a password field or (2) a password that has
been encrypted using DES or MD5 in FIPS-140 mode.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2013-2179</url>
<cvename>CVE-2013-2179</cvename>
</references>
<dates>
<discovery>2013-06-07</discovery>
<entry>2019-08-18</entry>
</dates>
</vuln>
<vuln vid="d51b52cf-c199-11e9-b13f-001b217b3468">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.28.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.28.3">
<p>A carefully constructed commit object with a very large number
of parents may lead to potential out-of-bounds writes or
potential denial of service.</p>
<p>The ProgramData configuration file is always read for compatibility
with Git for Windows and Portable Git installations. The ProgramData
location is not necessarily writable only by administrators, so we
now ensure that the configuration file is owned by the administrator
or the current user.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.28.3</url>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-18</entry>
</dates>
</vuln>
<vuln vid="caf545f2-c0d9-11e9-9051-4c72b94353b5">
<topic>Apache -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="http://www.apache.org/dist/httpd/CHANGES_2.4">
<h1>SECURITY: CVE-2019-10081</h1>
<p>mod_http2: HTTP/2 very early pushes, for example configured with "H2PushResource",
could lead to an overwrite of memory in the pushing request's pool,
leading to crashes. The memory copied is that of the configured push
link header values, not data supplied by the client.</p>
<h1>SECURITY: CVE-2019-9517</h1>
<p>mod_http2: a malicious client could perform a DoS attack by flooding
a connection with requests and basically never reading responses
on the TCP connection. Depending on h2 worker dimensioning, it was
possible to block those with relatively few connections.</p>
<h1>SECURITY: CVE-2019-10098</h1>
<p>rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable
matches and substitutions with encoded line break characters.</p>
<h1>SECURITY: CVE-2019-10092</h1>
<p>Remove HTML-escaped URLs from canned error responses to prevent misleading
text/links being displayed via crafted links.</p>
<h1>SECURITY: CVE-2019-10097</h1>
<p>mod_remoteip: Fix stack buffer overflow and NULL pointer deference
when reading the PROXY protocol header.</p>
<h1>CVE-2019-10082</h1>
<p>mod_http2: Using fuzzed network input, the http/2 session
handling could be made to read memory after being freed,
during connection shutdown.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache.org/dist/httpd/CHANGES_2.4</url>
<cvename>CVE-2019-10081</cvename>
<cvename>CVE-2019-9517</cvename>
<cvename>CVE-2019-10098</cvename>
<cvename>CVE-2019-10092</cvename>
<cvename>CVE-2019-10082</cvename>
</references>
<dates>
<discovery>2019-08-14</discovery>
<entry>2019-08-17</entry>
</dates>
</vuln>
<vuln vid="121fec01-c042-11e9-a73f-b36f5969f162">
<topic>nghttp2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libnghttp2</name>
<name>nghttp2</name>
<range><lt>1.39.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 GitHub releases:</p>
<blockquote cite="https://github.com/nghttp2/nghttp2/releases">
<p>This release fixes CVE-2019-9511 "Data Dribble" and CVE-2019-9513
"Resource Loop" vulnerability in nghttpx and nghttpd. Specially crafted
HTTP/2 frames cause Denial of Service by consuming CPU time. Check out
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
for details. For nghttpx, additionally limiting inbound traffic by
--read-rate and --read-burst options is quite effective against this
kind of attack.</p>
<p>CVE-2019-9511 "Data Dribble": The attacker requests a large amount of
data from a specified resource over multiple streams. They manipulate
window size and stream priority to force the server to queue the data in
1-byte chunks. Depending on how efficiently this data is queued, this
can consume excess CPU, memory, or both, potentially leading to a
denial of service.</p>
<p>CVE-2019-9513 "Ping Flood": The attacker sends continual pings to an
HTTP/2 peer, causing the peer to build an internal queue of responses.
Depending on how efficiently this data is queued, this can consume
excess CPU, memory, or both, potentially leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/nghttp2/nghttp2/releases</url>
<url>https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md</url>
<cvename>CVE-2019-9511</cvename>
<cvename>CVE-2019-9513</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-16</entry>
</dates>
</vuln>
<vuln vid="60e991ac-c013-11e9-b662-001cc0382b2f">
<topic>CUPS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cups</name>
<range><lt>2.2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apple reports:</p>
<blockquote cite="https://github.com/apple/cups/releases/tag/v2.2.12">
<ul>
<li>CVE-2019-8696 and CVE-2019-8675: SNMP buffer overflows.</li>
<li>IPP buffer overflow.</li>
<li>Memory disclosure in the scheduler.</li>
<li>DoS issues in the scheduler.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/apple/cups/releases/tag/v2.2.12</url>
<cvename>CVE-2019-8675</cvename>
<cvename>CVE-2019-8696</cvename>
</references>
<dates>
<discovery>2019-08-15</discovery>
<entry>2019-08-16</entry>
</dates>
</vuln>
<vuln vid="41f4baac-bf77-11e9-8d2f-5404a68ad561">
<topic>traefik -- Denial of service in HTTP/2</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>1.7.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The traefik project reports:</p>
<blockquote cite="https://github.com/containous/traefik/releases/tag/v1.7.14">
<p>Update of dependency to go go1.12.8 resolves potential HTTP/2
denial of service in traefik.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/containous/traefik/releases/tag/v1.7.14</url>
<cvename>CVE-2019-9512</cvename>
<cvename>CVE-2019-9514</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-15</entry>
</dates>
</vuln>
<vuln vid="87679fcb-be60-11e9-9051-4c72b94353b5">
<topic>NGINX -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.16.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.17.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX Team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>Several security issues were identified in nginx HTTP/2
implementation which might cause excessive memory consumption
and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516).
The issues affect nginx compiled with the ngx_http_v2_module (not
compiled by default) if the http2 option of the listen directive
is used in a configuration file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nginx.org/en/security_advisories.html</url>
<cvename>CVE-2019-9511</cvename>
<cvename>CVE-2019-9513</cvename>
<cvename>CVE-2019-9516</cvename>
</references>
<dates>
<discovery>2019-08-13</discovery>
<entry>2019-08-14</entry>
<modified>2019-08-14</modified>
</dates>
</vuln>
<vuln vid="0569146e-bdef-11e9-bd31-8de4a4470bbb">
<topic>Nokogiri -- injection vulnerability</topic>
<affects>
<package>
<name>rubygem-nokogiri</name>
<range><lt>1.10.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nokogiri GitHub release:</p>
<blockquote cite="https://github.com/sparklemotion/nokogiri/releases">
<p>A command injection vulnerability in Nokogiri v1.10.3 and earlier
allows commands to be executed in a subprocess by Ruby's Kernel.open
method. Processes are vulnerable only if the undocumented method
Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.</p>
<p>This vulnerability appears in code generated by the Rexical gem
versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate
lexical scanner code for parsing CSS queries. The underlying
vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to
this version of Rexical in Nokogiri v1.10.4.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/sparklemotion/nokogiri/releases</url>
<url>https://github.com/sparklemotion/nokogiri/issues/1915</url>
<cvename>CVE-2019-5477</cvename>
</references>
<dates>
<discovery>2019-08-11</discovery>
<entry>2019-08-13</entry>
</dates>
</vuln>
<vuln vid="ddd48087-bd86-11e9-b13f-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.1.0</ge><lt>12.1.6</lt></range>
<range><ge>12.0.0</ge><lt>12.0.6</lt></range>
<range><ge>10.0.0</ge><lt>11.11.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/">
<p>Insecure Authentication Methods Disabled for Grafana By Default</p>
<p>Multiple Command-Line Flag Injection Vulnerabilities</p>
<p>Insecure Cookie Handling on GitLab Pages</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/</url>
<cvename>CVE-2019-14943</cvename>
<cvename>CVE-2019-14944</cvename>
<cvename>CVE-2019-14942</cvename>
</references>
<dates>
<discovery>2019-08-12</discovery>
<entry>2019-08-13</entry>
</dates>
</vuln>
<vuln vid="f5f0a640-bae8-11e9-bb3a-001e2a3f778d">
<topic>KDE Frameworks -- malicious .desktop files execute code</topic>
<affects>
<package>
<name>kf5-kconfig</name>
<range><lt>5.60.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE Community has released a security announcement:</p>
<blockquote cite="https://kde.org/info/security/advisory-20190807-1.txt">
<p>The syntax Key[$e]=$(shell command) in *.desktop files, .directory files, and configuration files
(typically found in ~/.config) was an intentional feature of KConfig, to allow flexible configuration.
This could however be abused by malicious people to make the users install such files and get code
executed even without intentional action by the user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-14744</cvename>
<url>https://kde.org/info/security/advisory-20190807-1.txt</url>
</references>
<dates>
<discovery>2019-08-07</discovery>
<entry>2019-08-09</entry>
</dates>
</vuln>
<vuln vid="7f7d6412-bae5-11e9-be92-3085a9a95629">
<topic>doas -- Prevent passing of environment variables</topic>
<affects>
<package>
<name>doas</name>
<range><lt>6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jesse Smith (upstream author of the doas program) reported:</p>
<blockquote cite="https://github.com/slicer69/doas/releases/tag/6.1">
<p>Previous versions of "doas" transferred most environment variables, such
as USER, HOME, and PATH from the original user to the target user.
Passing these variables could cause files in the wrong path or
home directory to be read (or written to), which resulted in potential
security problems.</p>
<p>Many thanks to Sander Bos for reporting this issue and explaining
how it can be exploited.</p>
</blockquote>
</body>
</description>
<references>
<mlist msgid="2a5cda45ef35e885c9a8b1e@tedunangst.com">https://marc.info/?l=openbsd-tech&m=156105665713340&w=2</mlist>
<url>https://github.com/slicer69/doas/releases/tag/6.1</url>
</references>
<dates>
<discovery>2019-08-03</discovery>
<entry>2019-08-09</entry>
<modified>2019-08-15</modified>
</dates>
</vuln>
<vuln vid="f56669f5-d799-4ff5-9174-64a6d571c451">
<topic>bro -- Null pointer dereference and Signed integer overflow</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS">
<p>This is a security patch release to address potential
Denial of Service vulnerabilities:</p>
<ul>
<li>
Null pointer dereference in the RPC analysis code. RPC
analyzers (e.g. MOUNT or NFS) are not enabled in the
default configuration.</li>
<li>
Signed integer overflow in BinPAC-generated parser code.
The result of this is Undefined Behavior with respect to
the array bounds checking conditions that BinPAC generates,
so it's unpredictable what an optimizing compiler may
actually do under the assumption that signed integer
overlows should never happen. The specific symptom which
lead to finding this issue was with the PE analyzer causing
out-of-memory crashes due to large allocations that were
otherwise prevented when the array bounds checking logic
was changed to prevent any possible signed integer overlow.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS</url>
</references>
<dates>
<discovery>2019-06-22</discovery>
<entry>2019-08-09</entry>
</dates>
</vuln>
<vuln vid="9de4c1c1-b9ee-11e9-82aa-6cc21735f730">
<topic>PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.5</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.10</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.15</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.19</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1960/">
<p>
Versions Affected: 9.4 - 11
</p>
<p>
Given a suitable `SECURITY DEFINER` function, an attacker can execute arbitrary
SQL under the identity of the function owner. An attack requires `EXECUTE`
permission on the function, which must itself contain a function call having
inexact argument type match. For example, `length('foo'::varchar)` and
`length('foo')` are inexact, while `length('foo'::text)` is exact.
As part of exploiting this vulnerability, the attacker uses `CREATE DOMAIN`
to create a type in a `pg_temp` schema. The attack pattern and fix are similar
to that for CVE-2007-2138.
</p>
<p>
Writing `SECURITY DEFINER` functions continues to require following
the considerations noted in the documentation:
</p>
<p>
https://www.postgresql.org/docs/devel/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY
</p>
</blockquote>
<blockquote cite="https://www.postgresql.org/about/news/1960/">
<p>
Versions Affected: 11
</p>
<p>
In a database containing hypothetical, user-defined hash equality operators,
an attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators.
It is possible for operators not purpose-crafted for attack to have
the properties that enable an attack, but we are not aware of specific examples.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1960/</url>
<cvename>CVE-2019-10208</cvename>
<cvename>CVE-2019-10209</cvename>
</references>
<dates>
<discovery>2019-08-08</discovery>
<entry>2019-08-08</entry>
</dates>
</vuln>
<vuln vid="6e65dfea-b614-11e9-a3a2-1506e15611cc">
<topic>Django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.23</lt></range>
</package>
<package>
<name>py27-django21</name>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.11</lt></range>
</package>
<package>
<name>py27-django22</name>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.23/">
<p>CVE-2019-14232: Denial-of-service possibility in
django.utils.text.Truncator</p>
<p>If django.utils.text.Truncator's chars() and words() methods were
passed the html=True argument, they were extremely slow to evaluate
certain inputs due to a catastrophic backtracking vulnerability in a
regular expression. The chars() and words() methods are used to
implement the truncatechars_html and truncatewords_html template
filters, which were thus vulnerable</p>
<p>The regular expressions used by Truncator have been simplified in
order to avoid potential backtracking issues. As a consequence, trailing
punctuation may now at times be included in the truncated output.</p>
<p>CVE-2019-14233: Denial-of-service possibility in strip_tags()</p>
<p>Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML
entities. The strip_tags() method is used to implement the corresponding
striptags template filter, which was thus also vulnerable.</p>
<p>strip_tags() now avoids recursive calls to HTMLParser when progress
removing tags, but necessarily incomplete HTML entities, stops being
made.</p>
<p>Remember that absolutely NO guarantee is provided about the results of
strip_tags() being HTML safe. So NEVER mark safe the result of a
strip_tags() call without escaping it first, for example with
django.utils.html.escape().</p>
<p>CVE-2019-14234: SQL injection possibility in key and index lookups for
JSONField/HStoreField</p>
<p>Key and index lookups for JSONField and key lookups for HStoreField
were subject to SQL injection, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to QuerySet.filter().</p>
<p>CVE-2019-14235: Potential memory exhaustion in
django.utils.encoding.uri_to_iri()</p>
<p>If passed certain inputs, django.utils.encoding.uri_to_iri() could lead
to significant memory usage due to excessive recursion when
re-percent-encoding invalid UTF-8 octet sequences.</p>
<p>uri_to_iri() now avoids recursion when re-percent-encoding invalid
UTF-8 octet sequences.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/1.11/releases/1.11.23/</url>
<url>https://docs.djangoproject.com/en/2.1/releases/2.1.11/</url>
<url>https://docs.djangoproject.com/en/2.2/releases/2.2.4/</url>
<cvename>CVE-2019-14232</cvename>
<cvename>CVE-2019-14233</cvename>
<cvename>CVE-2019-14234</cvename>
<cvename>CVE-2019-14235</cvename>
</references>
<dates>
<discovery>2019-08-01</discovery>
<entry>2019-08-03</entry>
</dates>
</vuln>
<vuln vid="e7b69694-b3b5-11e9-9bb6-0800274e5f20">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/07/gitea-1.9.0-is-released/">
<p>This version of Gitea contains security fixes that could not be
backported to 1.8. For this reason, we strongly recommend updating.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/07/gitea-1.9.0-is-released/</url>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.9.0</url>
</references>
<dates>
<discovery>2019-07-31</discovery>
<entry>2019-07-31</entry>
</dates>
</vuln>
<vuln vid="0d3f99f7-b30c-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- File description reference count leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If a process attempts to transmit rights over a UNIX-domain
socket and an error causes the attempt to fail, references
acquired on the rights are not released and are leaked.
This bug can be used to cause the reference counter to wrap
around and free the corresponding file structure.</p>
<h1>Impact:</h1>
<p>A local user can exploit the bug to gain root privileges
or escape from a jail.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5607</cvename>
<freebsdsa>SA-19:17.fd</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="edf064fb-b30b-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Bhyve out-of-bounds read in XHCI device</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The pci_xhci_device_doorbell() function does not validate
the 'epid' and 'streamid' provided by the guest, leading
to an out-of-bounds read.</p>
<h1>Impact:</h1>
<p>A misbehaving bhyve guest could crash the system or
access memory that it should not be able to.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5604</cvename>
<freebsdsa>SA-19:16.bhyve</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="deb6e164-b30b-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Reference count overflow in mqueue filesystem</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>System calls operating on file descriptors obtain a
reference to relevant struct file which due to a programming
error was not always put back, which in turn could be used
to overflow the counter of affected struct file.</p>
<h1>Impact:</h1>
<p>A local user can use this flaw to obtain access to files,
directories, sockets etc. opened by processes owned by other
users. If obtained struct file represents a directory from
outside of user's jail, it can be used to access files
outside of the jail. If the user in question is a jailed
root they can obtain root privileges on the host system.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5603</cvename>
<freebsdsa>SA-19:15.mqueuefs</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="6b856e00-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Kernel memory disclosure in freebsd32_ioctl</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient initialization of memory copied to
userland in the components listed above small amounts of
kernel memory may be disclosed to userland processes.</p>
<h1>Impact:</h1>
<p>A user who can invoke 32-bit FreeBSD ioctls may be able
to read the contents of small portions of kernel memory.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5605</cvename>
<freebsdsa>SA-19:14.freebsd32</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="5721ae65-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- pts(4) write-after-free</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The code which handles a close(2) of a descriptor created
by posix_openpt(2) fails to undo the configuration which
causes SIGIO to be raised. This bug can lead to a
write-after-free of kernel memory.</p>
<h1>Impact:</h1>
<p>The bug permits malicious code to trigger a write-after-free,
which may be used to gain root privileges or escape a
jail.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5606</cvename>
<freebsdsa>SA-19:13.pts</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="39f6cbff-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- telnet(1) client multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_8</lt></range>
<range><ge>11.2</ge><lt>11.2_12</lt></range>
<range><ge>11.3</ge><lt>11.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation of environment variables in the
telnet client supplied in FreeBSD can lead to stack-based
buffer overflows. A stack- based overflow is present in the
handling of environment variables when connecting via the
telnet client to remote telnet servers.</p>
<p>This issue only affects the telnet client. Inbound telnet
sessions to telnetd(8) are not affected by this issue.</p>
<h1>Impact:</h1>
<p>These buffer overflows may be triggered when connecting
to a malicious server, or by an active attacker in the
network path between the client and server. Specially crafted
TELNET command sequences may cause the execution of arbitrary
code with the privileges of the user invoking telnet(1).</p>
</body>
</description>
<references>
<cvename>CVE-2019-0053</cvename>
<freebsdsa>SA-19:12.telnet</freebsdsa>
</references>
<dates>
<discovery>2019-07-24</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="14a3b376-b30a-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Privilege escalation in cd(4) driver</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_7</lt></range>
<range><ge>11.2</ge><lt>11.2_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>To implement one particular ioctl, the Linux emulation
code used a special interface present in the cd(4) driver
which allows it to copy subchannel information directly to
a kernel address. This interface was erroneously made
accessible to userland, allowing users with read access to
a cd(4) device to arbitrarily overwrite kernel memory when
some media is present in the device.</p>
<h1>Impact:</h1>
<p>A user in the operator group can make use of this interface
to gain root privileges on a system with a cd(4) device
when some media is present in the device.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5602</cvename>
<freebsdsa>SA-19:11.cd_ioctl</freebsdsa>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="ff82610f-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Kernel stack disclosure in UFS/FFS</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_7</lt></range>
<range><ge>11.2</ge><lt>11.2_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A bug causes up to three bytes of kernel stack memory
to be written to disk as uninitialized directory entry
padding. This data can be viewed by any user with read
access to the directory. Additionally, a malicious user
with write access to a directory can cause up to 254 bytes
of kernel stack memory to be exposed.</p>
<h1>Impact:</h1>
<p>Some amount of the kernel stack is disclosed and written
out to the filesystem.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5601</cvename>
<freebsdsa>SA-19:10.ufs</freebsdsa>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="f62bba56-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- iconv buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_7</lt></range>
<range><ge>11.2</ge><lt>11.2_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>With certain inputs, iconv may write beyond the end of
the output buffer.</p>
<h1>Impact:</h1>
<p>Depending on the way in which iconv is used, an attacker
may be able to create a denial of service, provoke incorrect
program behavior, or induce a remote code execution. iconv
is a libc library function and the nature of possible attacks
will depend on the way in which iconv is used by applications
or daemons.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5600</cvename>
<freebsdsa>SA-19:09.iconv</freebsdsa>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="c294c2e6-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in non-default RACK TCP stack</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>While processing acknowledgements, the RACK code uses
several linked lists to maintain state entries. A malicious
attacker can cause the lists to grow unbounded. This can
cause an expensive list traversal on every packet being
processed, leading to resource exhaustion and a denial of
service.</p>
<h1>Impact:</h1>
<p>An attacker with the ability to send specially crafted
TCP traffic to a victim system can degrade network performance
and/or consume excessive CPU by exploiting the inefficiency
of traversing the potentially very large RACK linked lists
with relatively small bandwidth cost.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5599</cvename>
<freebsdsa>SA-19:08.rack</freebsdsa>
</references>
<dates>
<discovery>2019-06-19</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="a633651b-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- Microarchitectural Data Sampling (MDS)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_5</lt></range>
<range><ge>11.2</ge><lt>11.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>On some Intel processors utilizing speculative execution
a local process may be able to infer stale information from
microarchitectural buffers to obtain a memory disclosure.</p>
<h1>Impact:</h1>
<p>An attacker may be able to read secret data from the
kernel or from a process when executing untrusted code (for
example, in a web browser).</p>
</body>
</description>
<references>
<cvename>CVE-2018-1212</cvename>
<cvename>CVE-2018-1213</cvename>
<cvename>CVE-2019-1109</cvename>
<freebsdsa>SA-19:07.mds</freebsdsa>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="59c5f255-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- ICMP/ICMP6 packet filter bypass in pf</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_4</lt></range>
<range><ge>11.2</ge><lt>11.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>States in pf(4) let ICMP and ICMP6 packets pass if they
have a packet in their payload matching an existing condition.
pf(4) does not check if the outer ICMP or ICMP6 packet has
the same destination IP as the source IP of the inner
protocol packet.</p>
<h1>Impact:</h1>
<p>A maliciously crafted ICMP/ICMP6 packet could bypass the
packet filter rules and be passed to a host that would
otherwise be unavailable.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5598</cvename>
<freebsdsa>SA-19:06.pf</freebsdsa>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="3d02520d-b309-11e9-a87f-a4badb2f4699">
<topic>FreeBSD -- IPv6 fragment reassembly panic in pf(4)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_4</lt></range>
<range><ge>11.2</ge><lt>11.2_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A bug in the pf(4) IPv6 fragment reassembly logic
incorrectly uses the last extension header offset from the
last received packet instead of from the first packet.</p>
<h1>Impact:</h1>
<p>Malicious IPv6 packets with different IPv6 extensions
could cause a kernel panic or potentially a filtering rule
bypass.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5597</cvename>
<freebsdsa>SA-19:05.pf</freebsdsa>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="1cd89254-b2db-11e9-8001-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.1.0</ge><lt>12.1.2</lt></range>
<range><ge>12.0.0</ge><lt>12.0.4</lt></range>
<range><ge>8.9.0</ge><lt>11.11.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/">
<p>GitHub Integration SSRF</p>
<p>Trigger Token Impersonation</p>
<p>Build Status Disclosure</p>
<p>SSRF Mitigation Bypass</p>
<p>Information Disclosure New Issue ID</p>
<p>IDOR Label Name Enumeration</p>
<p>Persistent XSS Wiki Pages</p>
<p>User Revokation Bypass with Mattermost Integration</p>
<p>Arbitrary File Upload via Import Project Archive</p>
<p>Information Disclosure Vulnerability Feedback</p>
<p>Persistent XSS via Email</p>
<p>Denial Of Service Epic Comments</p>
<p>Email Verification Bypass</p>
<p>Override Merge Request Approval Rules</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/</url>
</references>
<dates>
<discovery>2019-07-29</discovery>
<entry>2019-07-30</entry>
</dates>
</vuln>
<vuln vid="38d2df4d-b143-11e9-87e7-901b0e934d69">
<topic>py-matrix-synapse -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-matrix-synapse</name>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2019/07/26/critical-security-update-synapse-1-2-1-released">
<p>The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation:</p>
<ul>
<li>Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms.</li>
<li>Prevent a denial-of-service attack where cycles of redaction events would make Synapse spin infinitely.</li>
<li>Prevent an attack where users could be joined or parted from public rooms without their consent.</li>
<li>Fix a vulnerability where a federated server could spoof read-receipts from users on other servers. </li>
<li>It was possible for a room moderator to send a redaction for an m.room.create event, which would downgrade the room to version 1.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://matrix.org/blog/2019/07/26/critical-security-update-synapse-1-2-1-released</url>
<url>https://github.com/matrix-org/synapse/releases/tag/v1.2.1</url>
</references>
<dates>
<discovery>2019-07-26</discovery>
<entry>2019-07-28</entry>
</dates>
</vuln>
<vuln vid="3e0da406-aece-11e9-8d41-97657151f8c2">
<topic>Exim -- RCE in ${sort} expansion</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.85</ge><lt>4.92.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim team report:</p>
<blockquote cite="https://www.exim.org/static/doc/security/CVE-2019-13917.txt">
<p>
A local or remote attacker can execute programs with root privileges - if you've an unusual configuration.
</p>
<p>
If your configuration uses the ${sort } expansion for items that can be controlled by an attacker (e.g. $local_part, $domain). The default config, as shipped by the Exim developers, does not contain ${sort }.
</p>
<p>
The vulnerability is exploitable either remotely or locally and could
be used to execute other programs with root privilege. The ${sort }
expansion re-evaluates its items.
</p>
<p>
Exim 4.92.1 is not vulnerable.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-13917</cvename>
<url>https://www.exim.org/static/doc/security/CVE-2019-13917.txt</url>
</references>
<dates>
<discovery>2019-07-18</discovery>
<entry>2019-07-25</entry>
<modified>2019-07-26</modified>
</dates>
</vuln>
<vuln vid="198e6220-ac8b-11e9-a1c7-b499baebfeaf">
<topic>MySQL -- Multiple vulerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.65</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.41</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.26</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.17</lt></range>
</package>
<package>
<name>mariadb104-server</name>
<range><lt>10.4.7</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.45</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.27</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.17</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.65</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.45</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html">
<p>This Critical Patch Update contains 45 new security fixes for
Oracle MySQL. 4 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html</url>
<cvename>CVE-2019-2730</cvename>
<cvename>CVE-2019-2731</cvename>
<cvename>CVE-2019-2737</cvename>
<cvename>CVE-2019-2738</cvename>
<cvename>CVE-2019-2739</cvename>
<cvename>CVE-2019-2740</cvename>
<cvename>CVE-2019-2741</cvename>
<cvename>CVE-2019-2743</cvename>
<cvename>CVE-2019-2746</cvename>
<cvename>CVE-2019-2747</cvename>
<cvename>CVE-2019-2752</cvename>
<cvename>CVE-2019-2755</cvename>
<cvename>CVE-2019-2757</cvename>
<cvename>CVE-2019-2758</cvename>
<cvename>CVE-2019-2774</cvename>
<cvename>CVE-2019-2778</cvename>
<cvename>CVE-2019-2780</cvename>
<cvename>CVE-2019-2784</cvename>
<cvename>CVE-2019-2785</cvename>
<cvename>CVE-2019-2789</cvename>
<cvename>CVE-2019-2791</cvename>
<cvename>CVE-2019-2795</cvename>
<cvename>CVE-2019-2796</cvename>
<cvename>CVE-2019-2797</cvename>
<cvename>CVE-2019-2798</cvename>
<cvename>CVE-2019-2800</cvename>
<cvename>CVE-2019-2801</cvename>
<cvename>CVE-2019-2802</cvename>
<cvename>CVE-2019-2803</cvename>
<cvename>CVE-2019-2805</cvename>
<cvename>CVE-2019-2808</cvename>
<cvename>CVE-2019-2810</cvename>
<cvename>CVE-2019-2811</cvename>
<cvename>CVE-2019-2812</cvename>
<cvename>CVE-2019-2814</cvename>
<cvename>CVE-2019-2815</cvename>
<cvename>CVE-2019-2819</cvename>
<cvename>CVE-2019-2822</cvename>
<cvename>CVE-2019-2826</cvename>
<cvename>CVE-2019-2830</cvename>
<cvename>CVE-2019-2834</cvename>
<cvename>CVE-2019-2879</cvename>
<cvename>CVE-2019-3822</cvename>
</references>
<dates>
<discovery>2019-07-16</discovery>
<entry>2019-07-22</entry>
</dates>
</vuln>
<vuln vid="19d648e0-ab69-11e9-bfef-000ffec0b3e1">
<topic>drupal -- Drupal core - Access bypass</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-008">
<p>In Drupal 8.7.4, when the experimental Workspaces module is enabled,
an access bypass condition is created.</p>
<p>This can be mitigated by disabling the Workspaces module. It does
not affect any release other than Drupal 8.7.4.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2019-008</url>
</references>
<dates>
<discovery>2019-07-17</discovery>
<entry>2019-07-21</entry>
</dates>
</vuln>
<vuln vid="5914705c-ab03-11e9-a4f9-080027ac955c">
<topic>PuTTY 0.72 -- buffer overflow in SSH-1 and integer overflow in SSH client</topic>
<affects>
<package>
<name>putty</name> <range><lt>0.72</lt></range>
</package><package>
<name>putty-gtk2</name> <range><lt>0.72</lt></range>
</package><package>
<name>putty-nogtk</name> <range><lt>0.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Tatham reports:</p>
<blockquote cite="https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html">
<p>Vulnerabilities fixed in this release include:</p>
<ul>
<li>A malicious SSH-1 server could trigger a buffer overrun by sending
extremely short RSA keys, or certain bad packet length fields.
Either of these could happen before host key verification, so even
if you trust the server you *intended* to connect to, you would
still be at risk.
<br/>
(However, the SSH-1 protocol is obsolete, and recent versions of
PuTTY do not try it by default, so you are only at risk if you work
with old servers and have explicitly configured SSH-1.)</li>
<li>If a malicious process found a way to impersonate Pageant, then it
could cause an integer overflow in any of the SSH client tools
(PuTTY, Plink, PSCP, PSFTP) which accessed the malicious Pageant.</li>
</ul>
<p>Other security-related bug fixes include:</p>
<ul>
<li>The 'trust sigil' system introduced in PuTTY 0.71 to protect
against server spoofing attacks had multiple bugs. Trust sigils
were not turned off after login in the SSH-1 and Rlogin protocols,
and not turned back on if you used the Restart Session command.
Both are now fixed.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.tartarus.org/pipermail/putty-announce/2019/000028.html</url>
</references>
<dates>
<discovery>2019-07-14</discovery>
<entry>2019-07-20</entry>
</dates>
</vuln>
<vuln vid="df3db21d-1a4d-4c78-acf7-4639e5a795e0">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.186</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.176.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-07-17/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1424 / CVE-2019-10352</h5>
<p>Arbitrary file write vulnerability using file parameter definitions</p>
<h5>(High) SECURITY-626 / CVE-2019-10353</h5>
<p>CSRF protection tokens did not expire</p>
<h5>(Medium) SECURITY-534 / CVE-2019-10354</h5>
<p>Unauthorized view fragment access</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10352</cvename>
<cvename>CVE-2019-10353</cvename>
<cvename>CVE-2019-10354</cvename>
<url>https://jenkins.io/security/advisory/2019-07-17/</url>
</references>
<dates>
<discovery>2019-07-17</discovery>
<entry>2019-07-17</entry>
</dates>
</vuln>
<vuln vid="93167bef-9752-11e9-b61c-b885849ded8e">
<topic>libxslt -- security framework bypass</topic>
<affects>
<package>
<name>libxslt</name>
<range><lt>1.1.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre report:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068">
<p>libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068</url>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-07-16</entry>
</dates>
</vuln>
<vuln vid="818b2bcb-a46f-11e9-bed9-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability with MESSAGE messages</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.27.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.7.3</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A specially crafted SIP in-dialog MESSAGE message can cause Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-002.html</url>
<cvename>CVE-2019-12827</cvename>
</references>
<dates>
<discovery>2019-06-13</discovery>
<entry>2019-07-12</entry>
</dates>
</vuln>
<vuln vid="e9d2e981-a46d-11e9-bed9-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in chan_sip channel driver</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.27.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.7.3</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When T.38 faxing is done in Asterisk a T.38 reinvite
may be sent to an endpoint to switch it to T.38. If the
endpoint responds with an improperly formatted SDP answer
including both a T.38 UDPTL stream and an audio or video
stream containing only codecs not allowed on the SIP peer
or user a crash will occur. The code incorrectly assumes
that there will be at least one common codec when T.38
is also in the SDP answer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-003.html</url>
<cvename>CVE-2019-13161</cvename>
</references>
<dates>
<discovery>2019-06-28</discovery>
<entry>2019-07-12</entry>
</dates>
</vuln>
<vuln vid="a449c604-a43a-11e9-b422-fcaa147e860e">
<topic>python 3.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python37</name>
<range><lt>3.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python changelog:</p>
<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final">
<p>bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text
after the address and only quad-dotted notation without trailing whitespaces. Some
inet_aton() implementations ignore whitespace and all data after whitespace, e.g.'127.0.0.1
whatever'.</p>
<p>bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and
local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of
urllib.request.</p>
<p>bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().</p>
<p>bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace
or control characters through into the underlying http client request. Such potentially
malicious header injection URLs now cause an http.client.InvalidURL exception to be
raised.</p>
<p>bpo-33529: Prevent fold function used in email header encoding from entering infinite
loop when there are too many non-ASCII characters in a header.</p>
<p>bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH
environment variable is not set. Remove also the current directory from posixpath.defpath.
On Unix, shutil.which() and the subprocess module no longer search the executable in the
current directory if the PATH environment variable is not set.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.7/whatsnew/changelog.html#python-3-7-4-final</url>
<cvename>CVE-2019-9740</cvename>
<cvename>CVE-2019-9948</cvename>
</references>
<dates>
<discovery>2019-03-13</discovery>
<entry>2019-07-12</entry>
</dates>
</vuln>
<vuln vid="0592f49f-b3b8-4260-b648-d1718762656c">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>68.0_4,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.12</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.8.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.8.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/">
<p>CVE-2019-9811: Sandbox escape via installation of malicious language pack</p>
<p>CVE-2019-11711: Script injection within domain through inner window reuse</p>
<p>CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects</p>
<p>CVE-2019-11713: Use-after-free with HTTP/2 cached stream</p>
<p>CVE-2019-11714: NeckoChild can trigger crash when accessed off of main thread</p>
<p>CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault</p>
<p>CVE-2019-11715: HTML parsing error can contribute to content XSS</p>
<p>CVE-2019-11716: globalThis not enumerable until accessed</p>
<p>CVE-2019-11717: Caret character improperly escaped in origins</p>
<p>CVE-2019-11718: Activity Stream writes unsanitized content to innerHTML</p>
<p>CVE-2019-11719: Out-of-bounds read when importing curve25519 private key</p>
<p>CVE-2019-11720: Character encoding XSS vulnerability</p>
<p>CVE-2019-11721: Domain spoofing through unicode latin 'kra' character</p>
<p>CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin</p>
<p>CVE-2019-11723: Cookie leakage during add-on fetching across private browsing boundaries</p>
<p>CVE-2019-11724: Retired site input.mozilla.org has remote troubleshooting permissions</p>
<p>CVE-2019-11725: Websocket resources bypass safebrowsing protections</p>
<p>CVE-2019-11727: PKCS#1 v1.5 signatures can be used for TLS 1.3</p>
<p>CVE-2019-11728: Port scanning through Alt-Svc header</p>
<p>CVE-2019-11710: Memory safety bugs fixed in Firefox 68</p>
<p>CVE-2019-11709: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11709</cvename>
<cvename>CVE-2019-11710</cvename>
<cvename>CVE-2019-11711</cvename>
<cvename>CVE-2019-11712</cvename>
<cvename>CVE-2019-11713</cvename>
<cvename>CVE-2019-11714</cvename>
<cvename>CVE-2019-11715</cvename>
<cvename>CVE-2019-11716</cvename>
<cvename>CVE-2019-11717</cvename>
<cvename>CVE-2019-11718</cvename>
<cvename>CVE-2019-11719</cvename>
<cvename>CVE-2019-11720</cvename>
<cvename>CVE-2019-11721</cvename>
<cvename>CVE-2019-11723</cvename>
<cvename>CVE-2019-11724</cvename>
<cvename>CVE-2019-11725</cvename>
<cvename>CVE-2019-11727</cvename>
<cvename>CVE-2019-11728</cvename>
<cvename>CVE-2019-11729</cvename>
<cvename>CVE-2019-11730</cvename>
<cvename>CVE-2019-9811</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-22/</url>
</references>
<dates>
<discovery>2019-07-09</discovery>
<entry>2019-07-09</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="23f65f58-a261-11e9-b444-002590acae31">
<topic>GnuPG -- denial of service</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>2.2.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>From the GnuPG 2.2.17 changelog:</p>
<blockquote cite="https://dev.gnupg.org/T4606">
<p>gpg: Ignore all key-signatures received from keyservers. This
change is required to mitigate a DoS due to keys flooded with
faked key-signatures.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dev.gnupg.org/T4606</url>
<url>https://dev.gnupg.org/T4607</url>
</references>
<dates>
<discovery>2019-07-03</discovery>
<entry>2019-07-09</entry>
</dates>
</vuln>
<vuln vid="18ed9650-a1d6-11e9-9b17-fcaa147e860e">
<topic>python 3.6 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python36</name>
<range><lt>3.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python changelog:</p>
<blockquote cite="https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-final">
<p>bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file://
and local_file:// URL schemes in URLopener().open() and URLopener().retrieve()
of urllib.request.</p>
<p>bpo-36742: Fixes mishandling of pre-normalization characters in urlsplit().</p>
<p>bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded
whitespace or control characters through into the underlying http client
request. Such potentially malicious header injection URLs now cause an
http.client.InvalidURL exception to be raised.</p>
<p>bpo-36216: Changes urlsplit() to raise ValueError when the URL contains
characters that decompose under IDNA encoding (NFKC-normalization) into
characters that affect how the URL is parsed.</p>
<p>bpo-33529: Prevent fold function used in email header encoding from
entering infinite loop when there are too many non-ASCII characters in
a header.</p>
<p>bpo-35121: Don't send cookies of domain A without Domain attribute to
domain B when domain A is a suffix match of domain B while using a cookiejar
with http.cookiejar.DefaultCookiePolicy policy. Patch by Karthikeyan
Singaravelan.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-9-final</url>
<cvename>CVE-2019-9948</cvename>
<cvename>CVE-2019-9740</cvename>
</references>
<dates>
<discovery>2019-03-13</discovery>
<entry>2019-07-08</entry>
</dates>
</vuln>
<vuln vid="3dd46e05-9fb0-11e9-bf65-00012e582166">
<topic>webkit2-gtk3 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.24.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKitGTK project reports many vulnerabilities,
including several arbitrary code execution vulnerabilities.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0002.html</url>
<cvename>CVE-2019-6201</cvename>
<cvename>CVE-2019-6251</cvename>
<cvename>CVE-2019-7285</cvename>
<cvename>CVE-2019-7292</cvename>
<cvename>CVE-2019-8503</cvename>
<cvename>CVE-2019-8506</cvename>
<cvename>CVE-2019-8515</cvename>
<cvename>CVE-2019-8518</cvename>
<cvename>CVE-2019-8523</cvename>
<cvename>CVE-2019-8524</cvename>
<cvename>CVE-2019-8535</cvename>
<cvename>CVE-2019-8536</cvename>
<cvename>CVE-2019-8544</cvename>
<cvename>CVE-2019-8551</cvename>
<cvename>CVE-2019-8558</cvename>
<cvename>CVE-2019-8559</cvename>
<cvename>CVE-2019-8563</cvename>
<cvename>CVE-2019-11070</cvename>
<url>https://webkitgtk.org/security/WSA-2019-0003.html</url>
<cvename>CVE-2019-6237</cvename>
<cvename>CVE-2019-8571</cvename>
<cvename>CVE-2019-8583</cvename>
<cvename>CVE-2019-8584</cvename>
<cvename>CVE-2019-8586</cvename>
<cvename>CVE-2019-8587</cvename>
<cvename>CVE-2019-8594</cvename>
<cvename>CVE-2019-8595</cvename>
<cvename>CVE-2019-8596</cvename>
<cvename>CVE-2019-8597</cvename>
<cvename>CVE-2019-8601</cvename>
<cvename>CVE-2019-8607</cvename>
<cvename>CVE-2019-8608</cvename>
<cvename>CVE-2019-8609</cvename>
<cvename>CVE-2019-8610</cvename>
<cvename>CVE-2019-8615</cvename>
<cvename>CVE-2019-8611</cvename>
<cvename>CVE-2019-8619</cvename>
<cvename>CVE-2019-8622</cvename>
<cvename>CVE-2019-8623</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-07-06</entry>
</dates>
</vuln>
<vuln vid="3c5a4fe0-9ebb-11e9-9169-fcaa147e860e">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki131</name>
<range><lt>1.31.3</lt></range>
</package>
<package>
<name>mediawiki132</name>
<range><lt>1.32.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000230.html">
<p>Security fixes:
T197279, CVE-2019-12468: Directly POSTing to Special:ChangeEmail would allow
for bypassing reauthentication, allowing for potential account takeover.
T204729, CVE-2019-12473: Passing invalid titles to the API could cause a DoS
by querying the entire `watchlist` table.
T207603, CVE-2019-12471: Loading user JavaScript from a non-existent account
allows anyone to create the account, and XSS the users' loading that script.
T208881: blacklist CSS var().
T199540, CVE-2019-12472: It is possible to bypass the limits on IP range
blocks (`$wgBlockCIDRLimit`) by using the API.
T212118, CVE-2019-12474: Privileged API responses that include whether a
recent change has been patrolled may be cached publicly.
T209794, CVE-2019-12467: A spammer can use Special:ChangeEmail to send out
spam with no rate limiting or ability to block them.
T25227, CVE-2019-12466: An account can be logged out without using a token(CRRF)
T222036, CVE-2019-12469: Exposed suppressed username or log in Special:EditTags.
T222038, CVE-2019-12470: Exposed suppressed log in RevisionDelete page.
T221739, CVE-2019-11358: Fix potential XSS in jQuery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11358</cvename>
<cvename>CVE-2019-12466</cvename>
<cvename>CVE-2019-12467</cvename>
<cvename>CVE-2019-12468</cvename>
<cvename>CVE-2019-12469</cvename>
<cvename>CVE-2019-12470</cvename>
<cvename>CVE-2019-12471</cvename>
<cvename>CVE-2019-12472</cvename>
<cvename>CVE-2019-12473</cvename>
<cvename>CVE-2019-12474</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000230.html</url>
</references>
<dates>
<discovery>2019-04-23</discovery>
<entry>2019-07-05</entry>
</dates>
</vuln>
<vuln vid="b79ec16b-9da7-11e9-a0ea-a92fe7db4867">
<topic>ettercap -- out-of-bound read vulnerability</topic>
<affects>
<package>
<name>ettercap</name>
<range><lt>0.8.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ettercap GitHub issue:</p>
<blockquote cite="https://github.com/Ettercap/ettercap/issues/782">
<p>Etterfilter results in an invalid read of 8 bytes when parsing a crafted file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Ettercap/ettercap/issues/782</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6430</url>
<cvename>CVE-2017-6430</cvename>
</references>
<dates>
<discovery>2019-07-01</discovery>
<entry>2019-07-03</entry>
</dates>
</vuln>
<vuln vid="4ea507d1-9da8-11e9-a759-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>12.0.0</ge><lt>12.0.3</lt></range>
<range><ge>11.11.0</ge><lt>11.11.5</lt></range>
<range><ge>8.3.0</ge><lt>11.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/">
<p>Ability to Write a Note to a Private Snippet</p>
<p>Recent Pipeline Information Disclosed to Unauthorised Users</p>
<p>Resource Exhaustion Attack</p>
<p>Error Caused by Encoded Characters in Comments</p>
<p>Authorization Issues in GraphQL</p>
<p>Number of Merge Requests was Accessible</p>
<p>Enabling One of the Service Templates Could Cause Resource Depletion</p>
<p>Broken Access Control for the Content of Personal Snippets</p>
<p>Decoding Color Codes Caused Resource Depletion</p>
<p>Merge Request Template Name Disclosure</p>
<p>SSRF Vulnerability in Project GitHub Integration</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/07/03/security-release-gitlab-12-dot-0-dot-3-released/</url>
<cvename>CVE-2019-13001</cvename>
<cvename>CVE-2019-13002</cvename>
<cvename>CVE-2019-13003</cvename>
<cvename>CVE-2019-13004</cvename>
<cvename>CVE-2019-13005</cvename>
<cvename>CVE-2019-13006</cvename>
<cvename>CVE-2019-13007</cvename>
<cvename>CVE-2019-13009</cvename>
<cvename>CVE-2019-13010</cvename>
<cvename>CVE-2019-13011</cvename>
<cvename>CVE-2019-13121</cvename>
</references>
<dates>
<discovery>2019-07-03</discovery>
<entry>2019-07-03</entry>
</dates>
</vuln>
<vuln vid="3394bc2b-9da4-11e9-951e-14dae9d5a9d2">
<topic>SDL2_image -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sdl2_image</name>
<range><lt>2.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SDL_image developers report:</p>
<blockquote cite="https://www.libsdl.org/projects/SDL_image/">
<p>Fixed a number of security issues:</p>
<ul>
<li>TALOS-2019-0820</li>
<li>TALOS-2019-0821</li>
<li>TALOS-2019-0841</li>
<li>TALOS-2019-0842</li>
<li>TALOS-2019-0843</li>
<li>TALOS-2019-0844</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0820</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0821</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0841</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0842</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0843</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0844</url>
<cvename>CVE-2019-5051</cvename>
<cvename>CVE-2019-5052</cvename>
<cvename>CVE-2019-5057</cvename>
<cvename>CVE-2019-5058</cvename>
<cvename>CVE-2019-5059</cvename>
<cvename>CVE-2019-5060</cvename>
</references>
<dates>
<discovery>2019-07-02</discovery>
<entry>2019-07-03</entry>
</dates>
</vuln>
<vuln vid="475f952c-9b29-11e9-a8a5-6805ca0b38e8">
<topic>irssi -- Use after free when sending SASL login to the server</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2019_06.txt">
<p>Use after free when sending SASL login to the server found by ilbelkyr. (CWE-416, CWE-825)</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2019_06.txt</url>
<cvename>CVE-2019-13045</cvename>
</references>
<dates>
<discovery>2019-06-29</discovery>
<entry>2019-07-01</entry>
</dates>
</vuln>
<vuln vid="b805d7b4-9c0c-11e9-97f0-000c29e96db4">
<topic>Django -- Incorrect HTTP detection with reverse-proxy connecting via HTTPS</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.22</lt></range>
</package>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.10</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django security releases issued:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/jul/01/security-releases/">
<p>When deployed behind a reverse-proxy connecting to Django via HTTPS,
django.http.HttpRequest.scheme would incorrectly detect client requests
made via HTTP as using HTTPS. This entails incorrect results for is_secure(),
and build_absolute_uri(), and that HTTP requests would not be redirected to
HTTPS in accordance with SECURE_SSL_REDIRECT.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12781</cvename>
<url>https://www.djangoproject.com/weblog/2019/jul/01/security-releases/</url>
</references>
<dates>
<discovery>2019-07-01</discovery>
<entry>2019-07-01</entry>
</dates>
</vuln>
<vuln vid="4b6cb45d-881e-447a-a4e0-c97a954ea758">
<topic>bzip2 -- multiple issues</topic>
<affects>
<package>
<name>bzip2</name>
<range><lt>1.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bzip2 developers reports:</p>
<blockquote cite="https://gitlab.com/federicomenaquintero/bzip2/blob/master/NEWS">
<p>CVE-2016-3189 - Fix use-after-free in bzip2recover (Jakub Martisko)</p>
<p>CVE-2019-12900 - Detect out-of-range nSelectors in corrupted files (Albert Astals Cid). Found through fuzzing karchive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gitlab.com/federicomenaquintero/bzip2/blob/master/NEWS</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1319648</url>
<cvename>CVE-2016-3189</cvename>
<cvename>CVE-2019-12900</cvename>
</references>
<dates>
<discovery>2019-06-23</discovery>
<entry>2019-06-30</entry>
</dates>
</vuln>
<vuln vid="1c21f6a3-9415-11e9-95ec-6805ca2fa271">
<topic>powerdns -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.1.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.10">
<p>CVE-2019-10162: An issue has been found in PowerDNS Authoritative Server allowing an authorized user to
cause the server to exit by inserting a crafted record in a MASTER type zone under their control. The
issue is due to the fact that the Authoritative Server will exit when it runs into a parsing error while
looking up the NS/A/AAAA records it is about to use for an outgoing notify.</p>
<p>CVE-2019-10163: An issue has been found in PowerDNS Authoritative Server allowing a remote, authorized
master server to cause a high CPU load or even prevent any further updates to any slave zone by sending
a large number of NOTIFY messages. Note that only servers configured as slaves are affected by this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/changelog/4.1.html#change-4.1.10</url>
<cvename>CVE-2019-10162</cvename>
<cvename>CVE-2019-10163</cvename>
</references>
<dates>
<discovery>2019-06-21</discovery>
<entry>2019-06-21</entry>
</dates>
</vuln>
<vuln vid="5e35cfba-9994-11e9-b07f-df5abf8b84d6">
<topic>TYPO3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8-php71</name>
<name>typo3-8-php72</name>
<name>typo3-8-php73</name>
<range><lt>8.7.27</lt></range>
</package>
<package>
<name>typo3-9-php71</name>
<name>typo3-9-php72</name>
<name>typo3-9-php73</name>
<range><lt>9.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 news:</p>
<blockquote cite="https://typo3.org/article/typo3-958-and-8727-security-releases-published/">
<p>Please read the corresponding Security Advisories for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-958-and-8727-security-releases-published/</url>
<url>https://get.typo3.org/release-notes/8.7.27</url>
<url>https://get.typo3.org/release-notes/9.5.8</url>
<cvename>CVE-2019-10912</cvename>
<cvename>CVE-2019-12747</cvename>
<cvename>CVE-2019-12748</cvename>
</references>
<dates>
<discovery>2019-06-28</discovery>
<entry>2019-06-28</entry>
</dates>
</vuln>
<vuln vid="245629d4-991e-11e9-82aa-6cc21735f730">
<topic>PostgreSQL -- Stack-based buffer overflow via setting a password</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.4</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1949/">
<p>
An authenticated user could create a stack-based buffer overflow
by changing their own password to a purpose-crafted value. In addition
to the ability to crash the PostgreSQL server, this could be further
exploited to execute arbitrary code as the PostgreSQL operating system account.
</p>
<p>
Additionally, a rogue server could send a specifically crafted
message during the SCRAM authentication process and cause a libpq-enabled client
to either crash or execute arbitrary code as the client's operating system account.
</p>
<p>
This issue is fixed by upgrading and restarting your PostgreSQL
server as well as your libpq installations. All users running
PostgreSQL 10, 11, and 12 beta are encouraged to upgrade as soon as possible.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1949/</url>
<cvename>CVE-2019-10164</cvename>
</references>
<dates>
<discovery>2019-06-20</discovery>
<entry>2019-06-27</entry>
</dates>
</vuln>
<vuln vid="6f15730d-94ea-11e9-a83e-641c67a117d8">
<topic>znc -- privilege escalation</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12816">
<p>Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated
non-admin users to escalate privileges and execute arbitrary
code by loading a module with a crafted name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12816</cvename>
<url>https://wiki.znc.in/ChangeLog/1.7.4</url>
</references>
<dates>
<discovery>2019-06-13</discovery>
<entry>2019-06-22</entry>
</dates>
</vuln>
<vuln vid="49beb00f-a6e1-4a42-93df-9cb14b4c2bee">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>thunderbird-60.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/">
<h1>CVE-2019-11707: Type confusion in Array.pop</h1>
<p>A type confusion vulnerability can occur when manipulating
JavaScript objects due to issues in Array.pop. This can allow
for an exploitable crash. We are aware of targeted attacks in
the wild abusing this flaw.</p>
<h1>CVE-2019-11708: sandbox escape using Prompt:Open</h1>
<p>Insufficient vetting of parameters passed with the
Prompt:Open IPC message between child and parent processes can
result in the non-sandboxed parent process opening web content
chosen by a compromised child process. When combined with
additional vulnerabilities this could result in executing
arbitrary code on the user's computer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-20/</url>
<cvename>CVE-2019-11707</cvename>
<cvename>CVE-2019-11708</cvename>
</references>
<dates>
<discovery>2019-06-20</discovery>
<entry>2019-06-21</entry>
</dates>
</vuln>
<vuln vid="39bc2294-ff32-4972-9ecb-b9f40b4ccb74">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>67.0.4,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.12</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.7.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/">
<h1>CVE-2019-11708: sandbox escape using Prompt:Open</h1>
<p>Insufficient vetting of parameters passed with the
Prompt:Open IPC message between child and parent processes
can result in the non-sandboxed parent process opening web
content chosen by a compromised child process. When combined
with additional vulnerabilities this could result in executing
arbitrary code on the user's computer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/</url>
<cvename>CVE-2019-11708</cvename>
</references>
<dates>
<discovery>2019-06-20</discovery>
<entry>2019-06-21</entry>
<modified>2019-07-09</modified>
</dates>
</vuln>
<vuln vid="98f1241f-8c09-4237-ad0d-67fb4158ea7a">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<range><lt>60.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/">
<h1>CVE-2019-11703: Heap buffer overflow in icalparser.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a heap
buffer overflow in parser_get_next_char when processing certain
email messages, resulting in a potentially exploitable crash.</p>
<h1>CVE-2019-11704: Heap buffer overflow in icalvalue.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a heap
buffer overflow in icalmemory_strdup_and_dequote when processing
certain email messages, resulting in a potentially exploitable
crash.</p>
<h1>CVE-2019-11705: Stack buffer overflow in icalrecur.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a stack
buffer overflow in icalrecur_add_bydayrules when processing
certain email messages, resulting in a potentially exploitable
crash.</p>
<h1>CVE-2019-11706: Type confusion in icalproperty.c</h1>
<p>A flaw in Thunderbird's implementation of iCal causes a type
confusion in icaltimezone_get_vtimezone_properties when
processing certain email messages, resulting in a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/</url>
<cvename>CVE-2019-11703</cvename>
<cvename>CVE-2019-11704</cvename>
<cvename>CVE-2019-11705</cvename>
<cvename>CVE-2019-11706</cvename>
</references>
<dates>
<discovery>2019-06-13</discovery>
<entry>2019-06-21</entry>
</dates>
</vuln>
<vuln vid="5b218581-9372-11e9-8fc4-5404a68ad561">
<topic>vlc -- Double free in Matroska demuxer</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.7.1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102">
<p>mkv: Fix potential double free</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12874</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12874</url>
<url>http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102</url>
</references>
<dates>
<discovery>2019-05-20</discovery>
<entry>2019-06-20</entry>
</dates>
</vuln>
<vuln vid="f2144530-936f-11e9-8fc4-5404a68ad561">
<topic>vlc -- Buffer overflow vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>3.0.7,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zhangyang reports:</p>
<blockquote cite="https://hackerone.com/reports/484398">
<p>The ReadFrame function in the avi.c file uses a variable i_width_bytes,
which is obtained directly from the file. It is a signed integer.
It does not do a strict check before the memory operation(memmove, memcpy),
which may cause a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-5439</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439</url>
<url>https://hackerone.com/reports/484398</url>
</references>
<dates>
<discovery>2019-01-23</discovery>
<entry>2019-06-20</entry>
</dates>
</vuln>
<vuln vid="0cea6e0a-7a39-4dac-b3ec-dbc13d404f76">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>67.0.3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.11</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.7.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/">
<h1>CVE-2019-11707: Type confusion in Array.pop</h1>
<p>A type confusion vulnerability can occur when
manipulating JavaScript objects due to issues in
Array.pop. This can allow for an exploitable crash. We are
aware of targeted attacks in the wild abusing this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11707</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-18/</url>
</references>
<dates>
<discovery>2019-06-18</discovery>
<entry>2019-06-19</entry>
<modified>2019-06-20</modified>
</dates>
</vuln>
<vuln vid="9c9023ff-9057-11e9-b764-00505632d232">
<topic>netatalk3 -- remote code execution vulnerability</topic>
<affects>
<package>
<name>netatalk3</name>
<range><lt>3.1.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1160">
<p>Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-1160</url>
<url>https://medium.com/tenable-techblog/exploiting-an-18-year-old-bug-b47afe54172</url>
</references>
<dates>
<discovery>2018-11-10</discovery>
<entry>2019-06-16</entry>
</dates>
</vuln>
<vuln vid="82c07dfa-9016-11e9-af2f-712c38aa3e4c">
<topic>GraphicsMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.32,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick News:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Read "Security Fixes:" section for details.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
</references>
<dates>
<discovery>2019-06-15</discovery>
<entry>2019-06-16</entry>
</dates>
</vuln>
<vuln vid="d4fc4599-8f75-11e9-8d9f-3065ec8fd3ec">
<topic>chromium -- use after free</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>75.0.3770.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html">
<p>[961413] High CVE-2019-5842: Use-after-free in Blink. Reported by BUGFENSE Anonymous Bug Bounties https://bugfense.io on 2019-05-09</p>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-desktop_13.html</url>
<cvename>CVE-2019-5842</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-06-15</entry>
</dates>
</vuln>
<vuln vid="a5681027-8e03-11e9-85f4-6805ca0b3d42">
<topic>phpMyAdmin -- CSRF vulnerability in login form</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-4/">
<h3>Summary</h3>
<p>CSRF vulnerability in login form</p>
<h3>Description</h3>
<p>A vulnerability was found that allows an attacker to
trigger a CSRF attack against a phpMyAdmin user. The
attacker can trick the user, for instance through a broken
<code><img></code> tag pointing at the victim's
phpMyAdmin database, and the attacker can potentially
deliver a payload (such as a specific INSERT or DELETE
statement) through the victim.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be severe.</p>
<h3>Mitigation factor</h3> <p>Only the 'cookie'
auth_type is affected; users can temporary use
phpMyAdmin's http authentication as a workaround.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2019-4/</url>
<cvename>CVE-2019-12616</cvename>
</references>
<dates>
<discovery>2019-06-04</discovery>
<entry>2019-06-13</entry>
</dates>
</vuln>
<vuln vid="bbdb9713-8e09-11e9-87bc-002590acae31">
<topic>Vim/NeoVim -- Security vulnerability</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-tiny</name>
<range><lt>8.1.1365</lt></range>
</package>
<package>
<name>neovim</name>
<range><lt>0.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Security releases for Vim/NeoVim:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-12735">
<p>Sandbox escape allows for arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-12735</url>
</references>
<dates>
<discovery>2019-05-22</discovery>
<entry>2019-06-13</entry>
</dates>
</vuln>
<vuln vid="13960f55-8d35-11e9-9ba0-4c72b94353b5">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/">
<p>High risk: Theme import stylesheet name RCE</p>
<p>High risk: Nested video MyCode persistent XSS</p>
<p>Medium risk: Find Orphaned Attachments reflected XSS</p>
<p>Medium risk: Post edit reflected XSS</p>
<p>Medium risk: Private Messaging folders SQL injection</p>
<p>Low risk: Potential phar deserialization through Upload Path</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2019/06/10/mybb-1-8-21-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2019-06-10</discovery>
<entry>2019-06-12</entry>
</dates>
</vuln>
<vuln vid="ab099d2c-8c8c-11e9-8ba7-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.207</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-30.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-7845).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7845</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-30.html</url>
</references>
<dates>
<discovery>2019-06-11</discovery>
<entry>2019-06-11</entry>
</dates>
</vuln>
<vuln vid="9b8a52fc-89c1-11e9-9ba0-4c72b94353b5">
<topic>drupal -- Drupal core - Moderately critical</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.67</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-007">
<p>CVE-2019-11831: By-passing protection of Phar Stream Wrapper Interceptor.</p>
<p>In order to intercept file invocations like file_exists or stat on compromised Phar archives
the base name has to be determined and checked before allowing to be handled by PHP
Phar stream handling.
The current implementation is vulnerable to path traversal leading to scenarios where the
Phar archive to be assessed is not the actual (compromised) file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2019-007</url>
</references>
<dates>
<discovery>2019-05-08</discovery>
<entry>2019-06-08</entry>
</dates>
</vuln>
<vuln vid="45bea6b5-8855-11e9-8d41-97657151f8c2">
<topic>Exim -- RCE in deliver_message() function</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.87</ge><lt>4.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim team and Qualys report:</p>
<blockquote cite="https://www.exim.org/static/doc/security/CVE-2019-10149.txt">
<p>
We received a report of a possible remote exploit. Currently there is no evidence of an active use of this exploit.
</p>
<p>
A patch exists already, is being tested, and backported to all
versions we released since (and including) 4.87.
</p>
<p>
The severity depends on your configuration. It depends on how close to
the standard configuration your Exim runtime configuration is. The
closer the better.
</p>
<p>
Exim 4.92 is not vulnerable.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-10149</cvename>
<url>https://www.exim.org/static/doc/security/CVE-2019-10149.txt</url>
</references>
<dates>
<discovery>2019-05-27</discovery>
<entry>2019-06-06</entry>
</dates>
</vuln>
<vuln vid="ffc73e87-87f0-11e9-ad56-fcaa147e860e">
<topic>Django -- AdminURLFieldWidget XSS</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.21</lt></range>
</package>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.9</lt></range>
</package>
<package>
<name>py35-django22</name>
<name>py36-django22</name>
<name>py37-django22</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django security releases issued:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/jun/03/security-releases/">
<p>The clickable "Current URL" link generated by AdminURLFieldWidget displayed the
provided value without validating it as a safe URL. Thus, an unvalidated value stored
in the database, or a value provided as a URL query parameter payload, could result
in an clickable JavaScript link..</p>
<p>jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of Object.prototype
pollution. If an unsanitized source object contained an enumerable __proto__ property,
it could extend the native Object.prototype.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-12308</cvename>
<cvename>CVE-2019-11358</cvename>
<url>https://www.djangoproject.com/weblog/2019/jun/03/security-releases/</url>
</references>
<dates>
<discovery>2019-06-03</discovery>
<entry>2019-06-06</entry>
</dates>
</vuln>
<vuln vid="4091069e-860b-11e9-a05f-001b217b3468">
<topic>Gitlab -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.11.0</ge><lt>11.11.1</lt></range>
<range><ge>11.10.0</ge><lt>11.10.5</lt></range>
<range><ge>6.8.0</ge><lt>11.9.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/">
<p>Remote Command Execution Vulnerability on Repository Download Feature</p>
<p>Confidential Issue Titles Revealed to Restricted Users on Unsubscribe</p>
<p>Disclosure of Milestone Metadata through the Search API</p>
<p>Private Project Discovery via Comment Links</p>
<p>Metadata of Confidential Issues Disclosed to Restricted Users</p>
<p>Mandatory External Authentication Provider Sign-In Restrictions Bypass</p>
<p>Internal Projects Allowed to Be Created on in Private Groups</p>
<p>Server-Side Request Forgery Through DNS Rebinding</p>
<p>Stored Cross-Site Scripting on Wiki Pages</p>
<p>Stored Cross-Site Scripting on Notes</p>
<p>Repository Password Disclosed on Import Error Page</p>
<p>Protected Branches Restriction Rules Bypass</p>
<p>Stored Cross-Site Scripting Vulnerability on Child Epics</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/06/03/security-release-gitlab-11-dot-11-dot-1-released/</url>
<cvename>CVE-2019-12430</cvename>
<cvename>CVE-2019-12432</cvename>
<cvename>CVE-2019-12431</cvename>
<cvename>CVE-2019-12434</cvename>
<cvename>CVE-2019-12429</cvename>
<cvename>CVE-2019-12428</cvename>
<cvename>CVE-2019-12433</cvename>
<cvename>CVE-2019-12443</cvename>
<cvename>CVE-2019-12444</cvename>
<cvename>CVE-2019-12445</cvename>
<cvename>CVE-2019-12446</cvename>
<cvename>CVE-2019-12441</cvename>
<cvename>CVE-2019-12442</cvename>
</references>
<dates>
<discovery>2019-06-03</discovery>
<entry>2019-06-03</entry>
</dates>
</vuln>
<vuln vid="ada8db8a-8471-11e9-8170-0050562a4d7b">
<topic>buildbot -- OAuth Authentication Vulnerability</topic>
<affects>
<package>
<name>py27-buildbot</name>
<name>py35-buildbot</name>
<name>py36-buildbot</name>
<name>py37-buildbot</name>
<range><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication">
<p>Buildbot accepted user-submitted authorization token from OAuth and used
it to authenticate user.</p>
<p>The vulnerability can lead to malicious attackers to authenticate as legitimate users
of a Buildbot instance without knowledge of the victim's login credentials on certain
scenarios.</p>
<p>If an attacker has an application authorized to access data of another user at the
same Identity Provider as the used by the Buildbot instance, then he can acquire a token
to access the data of that user, supply the token to the Buildbot instance and successfully
login as the victim.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication</url>
<url>https://github.com/buildbot/buildbot/pull/4763</url>
<cvename>CVE-2019-12300</cvename>
</references>
<dates>
<discovery>2019-05-07</discovery>
<entry>2019-06-01</entry>
</dates>
</vuln>
<vuln vid="177fa455-48fc-4ded-ba1b-9975caa7f62a">
<topic>bro -- Unsafe integer conversions can cause unintentional code paths to be executed</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jon Siwek of Corelight reports:</p>
<blockquote cite="https://raw.githubusercontent.com/zeek/zeek/bb979702cf9a2fa67b8d1a1c7f88d0b56c6af104/NEWS">
<p>The following Denial of Service vulnerabilities are addressed:</p>
<ul>
<li>Integer type mismatches in BinPAC-generated parser code
and Bro analyzer code may allow for crafted packet data
to cause unintentional code paths in the analysis logic
to be taken due to unsafe integer conversions causing the
parser and analysis logic to each expect different fields
to have been parsed. One such example, reported by Maksim
Shudrak, causes the Kerberos analyzer to dereference a
null pointer. CVE-2019-12175 was assigned for this issue.</li>
<li>The Kerberos parser allows for several fields to be left
uninitialized, but they were not marked with an &optional
attribute and several usages lacked existence checks.
Crafted packet data could potentially cause an attempt
to access such uninitialized fields, generate a runtime
error/exception, and leak memory. Existence checks and
&optional attributes have been added to the relevent
Kerberos fields.</li>
<li>BinPAC-generated protocol parsers commonly contain fields
whose length is derived from other packet input, and for
those that allow for incremental parsing, BinPAC did not
impose a limit on how large such a field could grow,
allowing for remotely-controlled packet data to cause
growth of BinPAC's flowbuffer bounded only by the numeric
limit of an unsigned 64-bit integer, leading to memory
exhaustion. There is now a generalized limit for how
large flowbuffers are allowed to grow, tunable by setting
"BinPAC::flowbuffer_capacity_max".</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12175</cvename>
</references>
<dates>
<discovery>2019-05-29</discovery>
<entry>2019-05-31</entry>
</dates>
</vuln>
<vuln vid="183d700e-ec70-487e-a9c4-632324afa934">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick7</name>
<range><lt>7.0.8.47</lt></range>
</package>
<package>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.8.47</lt></range>
</package>
<package>
<name>ImageMagick6</name>
<range><lt>6.9.10.47,1</lt></range>
</package>
<package>
<name>ImageMagick6-nox11</name>
<range><lt>6.9.10.47,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cvedetails.com reports:</p>
<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html">
<p>CVE-2019-7175: In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.</p>
<p>CVE-2019-7395: In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c.</p>
<p>CVE-2019-7396: In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c.</p>
<p>CVE-2019-7397: In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c.</p>
<p>CVE-2019-7398: In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c.</p>
<p>CVE-2019-9956: In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image file.</p>
<p>CVE-2019-10131: An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.</p>
<p>CVE-2019-10649: In ImageMagick 7.0.8-36 Q16, there is a memory leak in the function SVGKeyValuePairs of coders/svg.c, which allows an attacker to cause a denial of service via a crafted image file.</p>
<p>CVE-2019-10650: In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.</p>
<p>CVE-2019-10714: LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.</p>
<p>CVE-2019-11470: The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.</p>
<p>CVE-2019-11472: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.</p>
<p>CVE-2019-11597: In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.</p>
<p>CVE-2019-11598: In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.cvedetails.com/vulnerability-list/vendor_id-1749/Imagemagick.html</url>
<cvename>CVE-2019-7175</cvename>
<cvename>CVE-2019-7395</cvename>
<cvename>CVE-2019-7396</cvename>
<cvename>CVE-2019-7397</cvename>
<cvename>CVE-2019-7398</cvename>
<cvename>CVE-2019-9956</cvename>
<cvename>CVE-2019-10131</cvename>
<cvename>CVE-2019-10649</cvename>
<cvename>CVE-2019-10650</cvename>
<cvename>CVE-2019-10714</cvename>
<cvename>CVE-2019-11470</cvename>
<cvename>CVE-2019-11472</cvename>
<cvename>CVE-2019-11597</cvename>
<cvename>CVE-2019-11598</cvename>
</references>
<dates>
<discovery>2019-03-07</discovery>
<entry>2019-05-30</entry>
<modified>2019-06-17</modified>
</dates>
</vuln>
<vuln vid="10fd731c-8088-11e9-b6ae-001871ec5271">
<topic>cyrus-imapd -- buffer overrun in httpd</topic>
<affects>
<package>
<name>cyrus-imapd30</name>
<range><ge>3.0.0</ge><lt>3.0.10</lt></range>
</package>
<package>
<name>cyrus-imapd25</name>
<range><ge>2.5.0</ge><lt>2.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.0.10 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.10.html">
<p>Fixed CVE-2019-11356: buffer overrun in httpd</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-11356</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11356</url>
</references>
<dates>
<discovery>2019-04-19</discovery>
<entry>2019-05-27</entry>
</dates>
</vuln>
<vuln vid="3ba87032-7fbd-11e9-8a5f-c85b76ce9b5a">
<topic>serendipity -- XSS</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>2.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11870">
<p>Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.s9y.org/archives/282-Serendipity-2.1.5-released.html</url>
<cvename>CVE-2019-11870</cvename>
</references>
<dates>
<discovery>2019-05-01</discovery>
<entry>2019-05-26</entry>
</dates>
</vuln>
<vuln vid="36b905ad-7fbb-11e9-8a5f-c85b76ce9b5a">
<topic>sqlite3 -- use after free</topic>
<affects>
<package>
<name>sqlite3</name>
<range><eq>3.26.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5018">
<p>An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://talosintelligence.com/vulnerability_reports/TALOS-2019-0777</url>
<cvename>CVE-2019-5018</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-26</entry>
</dates>
</vuln>
<vuln vid="3b903bf3-7f94-11e9-8a5f-c85b76ce9b5a">
<topic>suricata -- buffer over-read</topic>
<affects>
<package>
<name>suricata</name>
<range><lt>4.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10053">
<p>An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs into a heap-based buffer over-read. This occurs because the erroneous search for \r results in an integer underflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/</url>
<cvename>CVE-2019-10053</cvename>
</references>
<dates>
<discovery>2019-03-15</discovery>
<entry>2019-05-26</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="dd343a2b-7ee7-11e9-a290-8ddc52868fa9">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.19.4</ge><lt>7.65.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2019-5435: Integer overflows in curl_url_set()</p>
<p>libcurl contains two integer overflows in the curl_url_set()
function that if triggered, can lead to a too small buffer
allocation and a subsequent heap buffer overflow.</p>
<p>The flaws only exist on 32 bit architectures and require
excessive string input lengths.</p>
<p>CVE-2019-5436: TFTP receive buffer overflow</p>
<p>libcurl contains a heap buffer overflow in the function
(tftp_receive_packet()) that recevives data from a TFTP server. It
calls recvfrom() with the default size for the buffer rather than
with the size that was used to allocate it. Thus, the content that
might overwrite the heap memory is entirely controlled by the server.</p>
<p>The flaw exists if the user selects to use a "blksize" of 504 or
smaller (default is 512). The smaller size that is used, the larger
the possible overflow becomes.</p>
<p>Users chosing a smaller size than default should be rare as the
primary use case for changing the size is to make it larger.</p>
<p>It is rare for users to use TFTP across the Internet. It is most
commonly used within local networks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5435.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-5436.html</url>
<cvename>CVE-2019-5435</cvename>
<cvename>CVE-2019-5436</cvename>
</references>
<dates>
<discovery>2019-05-22</discovery>
<entry>2019-05-25</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="8d2af843-7d8e-11e9-8464-c85b76ce9b5a">
<topic>OCaml -- Multiple Security Vulnerabilities</topic>
<affects>
<package>
<name>ocaml</name>
<range><lt>4.03.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="INSERT URL HERE">
<p>OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2015-8869</url>
<url>https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762</url>
<cvename>CVE-2015-8869</cvename>
</references>
<dates>
<discovery>2016-06-13</discovery>
<entry>2019-05-23</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="44b6dfbf-4ef7-4d52-ad52-2b1b05d81272">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>67.0,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.10</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/">
<p>CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS</p>
<p>CVE-2019-9816: Type confusion with object groups and UnboxedObjects</p>
<p>CVE-2019-9817: Stealing of cross-domain images using canvas</p>
<p>CVE-2019-9818: Use-after-free in crash generation server</p>
<p>CVE-2019-9819: Compartment mismatch with fetch API</p>
<p>CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell</p>
<p>CVE-2019-9821: Use-after-free in AssertWorkerThread</p>
<p>CVE-2019-11691: Use-after-free in XMLHttpRequest</p>
<p>CVE-2019-11692: Use-after-free removing listeners in the event listener manager</p>
<p>CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux</p>
<p>CVE-2019-7317: Use-after-free in png_image_free of libpng library</p>
<p>CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox</p>
<p>CVE-2019-11695: Custom cursor can render over user interface outside of web content</p>
<p>CVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts</p>
<p>CVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions</p>
<p>CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks</p>
<p>CVE-2019-11700: res: protocol can be used to open known local files</p>
<p>CVE-2019-11699: Incorrect domain name highlighting during page navigation</p>
<p>CVE-2019-11701: webcal: protocol default handler loads vulnerable web page</p>
<p>CVE-2019-9814: Memory safety bugs fixed in Firefox 67</p>
<p>CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9815</cvename>
<cvename>CVE-2019-9816</cvename>
<cvename>CVE-2019-9817</cvename>
<cvename>CVE-2019-9818</cvename>
<cvename>CVE-2019-9819</cvename>
<cvename>CVE-2019-9820</cvename>
<cvename>CVE-2019-9821</cvename>
<cvename>CVE-2019-11691</cvename>
<cvename>CVE-2019-11692</cvename>
<cvename>CVE-2019-11693</cvename>
<cvename>CVE-2019-7317</cvename>
<cvename>CVE-2019-11694</cvename>
<cvename>CVE-2019-11695</cvename>
<cvename>CVE-2019-11696</cvename>
<cvename>CVE-2019-11697</cvename>
<cvename>CVE-2019-11698</cvename>
<cvename>CVE-2019-11700</cvename>
<cvename>CVE-2019-11699</cvename>
<cvename>CVE-2019-11701</cvename>
<cvename>CVE-2019-9814</cvename>
<cvename>CVE-2019-9800</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-13/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-14/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-15/</url>
</references>
<dates>
<discovery>2019-05-21</discovery>
<entry>2019-05-22</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="793a0072-7822-11e9-81e2-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><le>4.6.16</le></range>
</package>
<package>
<name>samba47</name>
<range><le>4.7.12</le></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.12</lt></range>
</package>
<package>
<name>samba49</name>
<range><lt>4.9.8</lt></range>
</package>
<package>
<name>samba410</name>
<range><lt>4.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16860.html">
<p>The checksum validation in the S4U2Self handler in the embedded Heimdal KDC
did not first confirm that the checksum was keyed, allowing replacement of the
requested target (client) principal</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2019-3880.html">
<p>Authenticated users with write permission can trigger a symlink traversal to write
or detect files outside the Samba share.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-16860.html</url>
<cvename>CVE-2018-16860</cvename>
<url>https://www.samba.org/samba/security/CVE-2019-3880.html</url>
<cvename>CVE-2019-3880</cvename>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-05-14</entry>
</dates>
</vuln>
<vuln vid="37528379-76a8-11e9-a4fd-00012e582166">
<topic>Rust -- violation of Rust's safety guarantees</topic>
<affects>
<package>
<name>rust</name>
<range><ge>1.34.0</ge><lt>1.34.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sean McArthur reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12083">
<p>
The Rust Programming Language Standard Library 1.34.x
before 1.34.2 contains a stabilized method which, if
overridden, can violate Rust's safety guarantees and
cause memory unsafety. If the Error::type_id method
is overridden then any type can be safely cast to any
other type, causing memory safety vulnerabilities in
safe code (e.g., out-of-bounds write or read). Code
that does not manually implement Error::type_id is
unaffected.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.rust-lang.org/2019/05/13/Security-advisory.html</url>
<cvename>CVE-2019-12083</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-15</entry>
</dates>
</vuln>
<vuln vid="a99923a9-768c-11e9-885a-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.192</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-26.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-7837).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7837</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-26.html</url>
</references>
<dates>
<discovery>2019-05-14</discovery>
<entry>2019-05-14</entry>
</dates>
</vuln>
<vuln vid="c2d1693b-73cb-11e9-a1c7-b499baebfeaf">
<topic>PHP -- Multiple vulnerabilities in EXIF module</topic>
<affects>
<package>
<name>php71-exif</name>
<range><lt>7.1.28</lt></range>
</package>
<package>
<name>php72-exif</name>
<range><lt>7.2.17</lt></range>
</package>
<package>
<name>php73-exif</name>
<range><lt>7.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="https://www.php.net/ChangeLog-7.php">
<p>Heap-buffer-overflow in php_ifd_get32s (CVE-2019-11034)</p>
<p>Heap-buffer-overflow in exif_iif_add_value (CVE-2019-11035)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.php.net/ChangeLog-7.php</url>
<cvename>CVE-2019-11034</cvename>
<cvename>CVE-2019-11035</cvename>
</references>
<dates>
<discovery>2019-04-04</discovery>
<entry>2019-05-11</entry>
</dates>
</vuln>
<vuln vid="065890c3-725e-11e9-b0e1-6cc21735f730">
<topic>PostgreSQL -- Selectivity estimators bypass row security policies</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.3</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><lt>10.8</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.13</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1939/">
<p>
PostgreSQL maintains statistics for tables by sampling
data available in columns; this data is consulted during
the query planning process. Prior to this release, a user
able to execute SQL queries with permissions to read a
given column could craft a leaky operator that could
read whatever data had been sampled from that column.
If this happened to include values from rows that the user
is forbidden to see by a row security policy, the user
could effectively bypass the policy. This is fixed by only
allowing a non-leakproof operator to use this data if
there are no relevant row security policies for the table.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1939/</url>
<cvename>CVE-2019-10130</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-09</entry>
</dates>
</vuln>
<vuln vid="e66a5440-7258-11e9-b0e1-6cc21735f730">
<topic>PostgreSQL -- Memory disclosure in partition routing</topic>
<affects>
<package>
<name>postgresql11-server</name>
<range><lt>11.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1939/">
<p>
Prior to this release, a user running PostgreSQL 11 can read
arbitrary bytes of server memory by executing a purpose-crafted
INSERT statement to a partitioned table.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1939/</url>
<cvename>CVE-2019-10129</cvename>
</references>
<dates>
<discovery>2019-05-09</discovery>
<entry>2019-05-09</entry>
</dates>
</vuln>
<vuln vid="a1de4ae9-6fda-11e9-9ba0-4c72b94353b5">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/04/gitea-1.8.0-is-released">
<p>This release contains two new security fixes which cannot be backported
to the 1.7.0 branch, so it is recommended to update to this version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/04/gitea-1.8.0-is-released/</url>
</references>
<dates>
<discovery>2019-04-21</discovery>
<entry>2019-05-06</entry>
</dates>
</vuln>
<vuln vid="3df5a920-6edc-11e9-a44b-0050562a4d7b">
<topic>comms/hylafax -- Malformed fax sender remote code execution in JPEG support</topic>
<affects>
<package>
<name>hylafax</name>
<range><lt>6.0.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="ftp://ftp.hylafax.org/security/CVE-2018-17141.html">
<p>A malicious sender that sets both JPEG and MH,MR,MMR or JBIG in
the same DCS signal or sends a large JPEG page could lead to remote code execution.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-17141</cvename>
<url>ftp://ftp.hylafax.org/security/CVE-2018-17141.html</url>
<url>https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax/</url>
<url>http://bugs.hylafax.org/show_bug.cgi?id=974</url>
<url>http://git.hylafax.org/HylaFAX?a=commit;h=c6cac8d8cd0dbe313689ba77023e12bc5b3027be</url>
</references>
<dates>
<discovery>2018-08-24</discovery>
<entry>2019-05-05</entry>
</dates>
</vuln>
<vuln vid="4faac805-6be0-11e9-a685-001b217b3468">
<topic>Gitlab -- Information Disclosure</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.10.0</ge><lt>11.10.3</lt></range>
<range><ge>11.9.0</ge><lt>11.9.11</lt></range>
<range><ge>11.8.0</ge><lt>11.8.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/">
<p>Information Disclosure with Limited Scope Token</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/30/security-release-gitlab-11-dot-10-dot-3-released/</url>
<cvename>CVE-2019-11605</cvename>
</references>
<dates>
<discovery>2019-04-30</discovery>
<entry>2019-05-01</entry>
</dates>
</vuln>
<vuln vid="3f98ccb3-6b8a-11e9-9b5c-a4badb296695">
<topic>Dovecot -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/list/dovecot-news/2019-April/000409.html">
<p>Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of-service attack by persistent attacker(s).</p>
</blockquote>
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/list/dovecot-news/2019-April/000410.html">
<p>Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s).</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/list/dovecot-news/2019-April/000409.html</url>
<cvename>CVE-2019-11494</cvename>
<url>https://dovecot.org/list/dovecot-news/2019-April/000410.html</url>
<cvename>CVE-2019-11499</cvename>
</references>
<dates>
<discovery>2019-03-11</discovery>
<entry>2019-04-30</entry>
</dates>
</vuln>
<vuln vid="1138b39e-6abb-11e9-a685-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.10.0</ge><lt>11.10.2</lt></range>
<range><ge>11.9.0</ge><lt>11.9.10</lt></range>
<range><ge>6.0.0</ge><lt>11.8.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/">
<p>Moving an Issue to Private Repo Leaks Project Namespace</p>
<p>Notification Emails Sent to Restricted Users</p>
<p>Unauthorized Comments on Confidential Issues</p>
<p>Merge Request Approval Count Inflation</p>
<p>Unsanitized Branch Names on New Merge Request Notification Emails</p>
<p>Improper Sanitation of Credentials in Gitaly</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/29/security-release-gitlab-11-dot-10-dot-2-released/</url>
<cvename>CVE-2019-11545</cvename>
<cvename>CVE-2019-11544</cvename>
<cvename>CVE-2019-11548</cvename>
<cvename>CVE-2019-11546</cvename>
<cvename>CVE-2019-11547</cvename>
<cvename>CVE-2019-11549</cvename>
</references>
<dates>
<discovery>2019-04-29</discovery>
<entry>2019-04-29</entry>
</dates>
</vuln>
<vuln vid="5536ea5f-6814-11e9-a8f7-0050562a4d7b">
<topic>buildbot -- CRLF injection in Buildbot login and logout redirect code</topic>
<affects>
<package>
<name>py27-buildbot</name>
<name>py35-buildbot</name>
<name>py36-buildbot</name>
<name>py37-buildbot</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code">
<p>A CRLF can be injected in Location header of /auth/login and /auth/logout
This is due to lack of input validation in the buildbot redirection code.
</p>
<p>It was not found a way to impact Buildbot product own security through
this vulnerability, but it could be used to compromise other sites
hosted on the same domain as Buildbot.
- cookie injection a master domain (ie if your buildbot is on
buildbot.buildbot.net, one can inject a cookie on *.buildbot.net,
which could impact another website hosted in your domain)
- HTTP response splitting and cache poisoning (browser or proxy) are
also typical impact of this vulnerability class, but might be impractical
to exploit.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/buildbot/buildbot/wiki/CRLF-injection-in-Buildbot-login-and-logout-redirect-code</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7313</url>
<cvename>CVE-2019-7313</cvename>
</references>
<dates>
<discovery>2019-01-29</discovery>
<entry>2019-04-26</entry>
</dates>
</vuln>
<vuln vid="2bad8b5d-66fb-11e9-9815-78acc0a3b880">
<topic>drupal -- Drupal core - Moderately critical</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.66</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-005">
<p>CVE-2019-10909: Escape validation messages in the PHP templating engine.</p>
<p>CVE-2019-10910: Check service IDs are valid.</p>
<p>CVE-2019-10911: Add a separator in the remember me cookie hash.</p>
</blockquote>
<blockquote cite="https://www.drupal.org/sa-core-2019-006">
<p>jQuery 3.4.0 includes a fix for some unintended behavior when using
jQuery.extend(true, {}, ...). If an unsanitized source object contained
an enumerable __proto__ property, it could extend the native Object.prototype.
This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous
jQuery versions.</p>
<p>It's possible that this vulnerability is exploitable with some Drupal modules.
As a precaution, this Drupal security release backports the fix to jQuery.extend(),
without making any other changes to the jQuery version that is included in
Drupal core (3.2.1 for Drupal 8 and 1.4.4 for Drupal 7) or running on the site
via some other module such as jQuery Update.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2019-005</url>
<url>https://www.drupal.org/SA-CORE-2019-006</url>
</references>
<dates>
<discovery>2019-04-17</discovery>
<entry>2019-04-25</entry>
</dates>
</vuln>
<vuln vid="f6ea18bb-65b9-11e9-8b31-002590045d9c">
<topic>py-yaml -- arbitrary code execution</topic>
<affects>
<package>
<name>py27-yaml</name>
<name>py35-yaml</name>
<name>py36-yaml</name>
<name>py37-yaml</name>
<range><lt>4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>pyyaml reports:</p>
<blockquote cite="https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation">
<p>the PyYAML.load function could be easily exploited to call any Python
function. That means it could call any system command using os.system()</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-18342</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342</url>
<url>https://github.com/yaml/pyyaml/pull/74</url>
</references>
<dates>
<discovery>2018-06-27</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="a207bbd8-6572-11e9-8e67-206a8a720317">
<topic>FreeBSD -- EAP-pwd message reassembly issue with unexpected fragment</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant
(EAP peer) does not to validate fragmentation reassembly state
properly for a case where an unexpected fragment could be received.
This could result in process termination due to NULL pointer
dereference.</p>
<p>See
https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with EAP-pwd support could
suffer a denial of service attack through process termination.</p>
</body>
</description>
<references>
<url>https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt</url>
</references>
<dates>
<discovery>2019-04-18</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="2da3cb25-6571-11e9-8e67-206a8a720317">
<topic>FreeBSD -- EAP-pwd missing commit validation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant
(EAP peer) does not to validate the received scalar and element values
in EAP-pwd-Commit messages properly. This could result in attacks that
would be able to complete EAP-pwd authentication exchange without the
attacker having to know the used password.</p>
<p>See
https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with EAP-pwd support.</p>
</body>
</description>
<references>
<cvename>CVE-2019-9497</cvename>
<cvename>CVE-2019-9498</cvename>
<cvename>CVE-2019-9499</cvename>
<freebsdsa>SA-19:03.wpa</freebsdsa>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
<modified>2019-07-30</modified>
</dates>
</vuln>
<vuln vid="98b71436-656d-11e9-8e67-206a8a720317">
<topic>FreeBSD -- SAE confirm missing state validation</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When hostapd is used to operate an access point with SAE
(Simultaneous Authentication of Equals; also known as WPA3-Personal),
an invalid authentication sequence could result in the hostapd process
terminating due to a NULL pointer dereference when processing SAE
confirm message. This was caused by missing state validation steps
when processing the SAE confirm message in hostapd/AP mode.</p>
<p>See
https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All hostapd versions with SAE support (CONFIG_SAE=y in the build
configuration and SAE being enabled in the runtime configuration).</p>
</body>
</description>
<references>
<cvename>CVE-2019-9496</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="60129efe-656d-11e9-8e67-206a8a720317">
<topic>FreeBSD -- EAP-pwd side-channel attack</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Potential side channel attacks in the SAE implementations used
by both hostapd and wpa_supplicant (see CVE-2019-9494 and VU#871675).
EAP-pwd uses a similar design for deriving PWE from the password and
while a specific attack against EAP-pwd is not yet known to be tested,
there is no reason to believe that the EAP-pwd implementation would
be immune against the type of cache attack that was identified for the
SAE implementation. Since the EAP-pwd implementation in hostapd (EAP
server) and wpa_supplicant (EAP peer) does not support MODP groups,
the timing attack described against SAE is not applicable for the
EAP-pwd implementation.</p>
<p>See
https://w1.fi/security/2019-2/eap-pwd-side-channel-attack.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with EAP-pwd support
(CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled
in the runtime configuration).</p>
</body>
</description>
<references>
<cvename>CVE-2019-9495</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="7e53f9cc-656d-11e9-8e67-206a8a720317">
<topic>FreeBSD -- SAE side-channel attacks</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
<package>
<name>wpa_supplicant</name>
<range><lt>2.8</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Side channel attacks in the SAE implementations used by both
hostapd (AP) and wpa_supplicant (infrastructure BSS station/mesh
station). SAE (Simultaneous Authentication of Equals) is also known
as WPA3-Personal. The discovered side channel attacks may be able to
leak information about the used password based on observable timing
differences and cache access patterns. This might result in full
password recovery when combined with an offline dictionary attack and
if the password is not strong enough to protect against dictionary
attacks.</p>
<p>See
https://w1.fi/security/2019-1/sae-side-channel-attacks.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All wpa_supplicant and hostapd versions with SAE support
(CONFIG_SAE=y in the build configuration and SAE being enabled in
the runtime configuration).</p>
</body>
</description>
<references>
<cvename>CVE-2019-9494</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-23</entry>
</dates>
</vuln>
<vuln vid="484d3f5e-653a-11e9-b0e3-1c39475b9f84">
<topic>Istio -- Security vulnerabilities</topic>
<affects>
<package>
<name>istio</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Istio reports:</p>
<blockquote cite="https://istio.io/blog/2019/announcing-1.1.2/#security-update">
<p>Two security vulnerabilities have recently been identified in the Envoy proxy.
The vulnerabilities are centered on the fact that Envoy did not normalize
HTTP URI paths and did not fully validate HTTP/1.1 header values. These
vulnerabilities impact Istio features that rely on Envoy to enforce any of
authorization, routing, or rate limiting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9900</cvename>
<cvename>CVE-2019-9901</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9900</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9901</url>
<url>https://github.com/envoyproxy/envoy/issues/6434</url>
<url>https://github.com/envoyproxy/envoy/issues/6435</url>
</references>
<dates>
<discovery>2019-03-29</discovery>
<entry>2019-04-22</entry>
</dates>
</vuln>
<vuln vid="5ed7102e-6454-11e9-9a3a-001cc0382b2f">
<topic>Ghostscript -- Security bypass vulnerability</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cedric Buissart (Red Hat) reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835">
<p>It was found that the superexec operator was available in the
internal dictionary in ghostscript before 9.27. A specially crafted
PostScript file could use this flaw in order to, for example, have
access to the file system outside of the constrains imposed by
-dSAFER.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838">
<p>It was found that the forceput operator could be extracted from
the DefineResource method in ghostscript before 9.27. A specially
crafted PostScript file could use this flaw in order to, for
example, have access to the file system outside of the constrains
imposed by -dSAFER.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3835</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3838</url>
<cvename>CVE-2019-3835</cvename>
<cvename>CVE-2019-3838</cvename>
</references>
<dates>
<discovery>2019-03-21</discovery>
<entry>2019-04-21</entry>
</dates>
</vuln>
<vuln vid="fb30db8f-62af-11e9-b0de-001cc0382b2f">
<topic>GnuTLS -- double free, invalid pointer access</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27">
<ul>
<li>Tavis Ormandy from Google Project Zero found a memory
corruption (double free) vulnerability in the certificate
verification API. Any client or server application that verifies
X.509 certificates with GnuTLS 3.5.8 or later is affected.</li>
<li>It was found using the TLS fuzzer tools that decoding a
malformed TLS1.3 asynchronous message can cause a server crash
via an invalid pointer access. The issue affects GnuTLS server
applications since 3.6.4.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27</url>
<cvename>CVE-2019-3829</cvename>
<cvename>CVE-2019-3836</cvename>
</references>
<dates>
<discovery>2019-03-27</discovery>
<entry>2019-04-19</entry>
</dates>
</vuln>
<vuln vid="a64aa22f-61ec-11e9-85b9-a4badb296695">
<topic>dovecot -- json encoder crash</topic>
<affects>
<package>
<name>dovecot</name>
<range><ge>2.3.0</ge><lt>2.3.5.2</lt></range>
</package>
<package>
<name>dovecot2</name>
<range><ge>2.3.0</ge><lt>2.3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html">
<p>* CVE-2019-10691: Trying to login with 8bit username containing
invalid UTF8 input causes auth process to crash if auth policy is
enabled. This could be used rather easily to cause a DoS. Similar
crash also happens during mail delivery when using invalid UTF8 in
From or Subject header when OX push notification driver is used.</p>
</blockquote>
</body>
</description>
<references>
<url>https://dovecot.org/pipermail/dovecot-news/2019-April/000407.html</url>
<cvename>CVE-2019-10691</cvename>
</references>
<dates>
<discovery>2019-04-09</discovery>
<entry>2019-04-18</entry>
<modified>2019-05-26</modified>
</dates>
</vuln>
<vuln vid="6e58e1e9-2636-413e-9f84-4c0e21143628">
<topic>libssh2 -- multiple issues</topic>
<affects>
<package>
<name>libssh2</name>
<range><lt>1.8.1,3</lt></range>
</package>
<package>
<name>linux-c6-libssh2</name>
<range><lt>1.4.2_7</lt></range>
</package>
<package>
<name>linux-c7-libssh2</name>
<range><lt>1.4.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libssh2 developers report:</p>
<blockquote cite="https://github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1">
<ul>
<li>Defend against possible integer overflows in comp_method_zlib_decomp.</li>
<li>Defend against writing beyond the end of the payload in _libssh2_transport_read().</li>
<li>Sanitize padding_length - _libssh2_transport_read().</li>
<li>This prevents an underflow resulting in a potential out-of-bounds read if a server sends a too-large padding_length, possibly with malicious intent.</li>
<li>Prevent zero-byte allocation in sftp_packet_read() which could lead to an out-of-bounds read.</li>
<li>Check the length of data passed to sftp_packet_add() to prevent out-of-bounds reads.</li>
<li>Add a required_size parameter to sftp_packet_require et. al. to require callers of these functions to handle packets that are too short.</li>
<li>Additional length checks to prevent out-of-bounds reads and writes in _libssh2_packet_add().</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libssh2/libssh2/releases/tag/libssh2-1.8.1</url>
<url>https://libssh2.org/CVE-2019-3855.html</url>
<url>https://libssh2.org/CVE-2019-3856.html</url>
<url>https://libssh2.org/CVE-2019-3857.html</url>
<url>https://libssh2.org/CVE-2019-3858.html</url>
<url>https://libssh2.org/CVE-2019-3859.html</url>
<url>https://libssh2.org/CVE-2019-3860.html</url>
<url>https://libssh2.org/CVE-2019-3861.html</url>
<url>https://libssh2.org/CVE-2019-3862.html</url>
<url>https://libssh2.org/CVE-2019-3863.html</url>
<cvename>CVE-2019-3855</cvename>
<cvename>CVE-2019-3856</cvename>
<cvename>CVE-2019-3857</cvename>
<cvename>CVE-2019-3858</cvename>
<cvename>CVE-2019-3859</cvename>
<cvename>CVE-2019-3860</cvename>
<cvename>CVE-2019-3861</cvename>
<cvename>CVE-2019-3862</cvename>
<cvename>CVE-2019-3863</cvename>
</references>
<dates>
<discovery>2019-03-14</discovery>
<entry>2019-04-18</entry>
<modified>2019-07-07</modified>
</dates>
</vuln>
<vuln vid="b747783f-5fb6-11e9-b2ac-08002705f877">
<topic>gitea -- remote code execution</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/04/gitea-1.7.6-is-released/">
<p>Prevent remote code execution vulnerability with mirror repo URL settings.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/04/gitea-1.7.6-is-released/</url>
</references>
<dates>
<discovery>2019-04-13</discovery>
<entry>2019-04-17</entry>
</dates>
</vuln>
<vuln vid="4e1997e8-5de0-11e9-b95c-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.64</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.39</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.23</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.14</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.44</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.26</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.15</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.64</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.44</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html">
<p>Critical Patch Update Oracle MySQL Executive Summary</p>
<p>This Critical Patch Update contains 44 new security fixes for
Oracle MySQL. 3 of these vulnerabilities may be remotely exploitable
without authentication, i.e., may be exploited over a network without
requiring user credentials.</p>
<p>The Oracle MySQL products and versions affected by vulnerabilities
that are fixed in this Critical Patch Update are: MySQL Server, versions
5.6.43 and prior, 5.7.25 and prior, 8.0.15 and prior</p>
<p>Further details will be published by Oracle on 2019-04-16</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html</url>
</references>
<dates>
<discovery>2019-04-13</discovery>
<entry>2019-04-13</entry>
</dates>
</vuln>
<vuln vid="a737eb11-5cfc-11e9-ab87-8cec4bf8fcfb">
<topic>wget -- security flaw in caching credentials passed as a part of the URL</topic>
<affects>
<package>
<name>wget</name>
<range><ge>1.19</ge><lt>1.20.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gynvael Coldwind reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483">
<p>
set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a
file's origin URL in the user.xdg.origin.url metadata attribute
of the extended attributes of the downloaded file, which allows
local users to obtain sensitive information (e.g., credentials
contained in the URL) by reading this attribute, as demonstrated
by getfattr. This also applies to Referer information in the
user.xdg.referrer.url metadata attribute.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483</url>
<cvename>CVE-2018-20483</cvename>
</references>
<dates>
<discovery>2018-12-25</discovery>
<entry>2019-04-12</entry>
</dates>
</vuln>
<vuln vid="a0602fa0-5c1c-11e9-abd6-001b217b3468">
<topic>Gitlab -- Group Runner Registration Token Exposure</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.9.0</ge><lt>11.9.7</lt></range>
<range><ge>11.8.0</ge><lt>11.8.7</lt></range>
<range><ge>10.4.0</ge><lt>11.7.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/">
<p>Group Runner Registration Token Exposure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/10/critical-security-release-gitlab-11-dot-9-dot-7-released/</url>
<cvename>CVE-2019-11000</cvename>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-11</entry>
</dates>
</vuln>
<vuln vid="8e9c3f5a-715b-4336-8d05-19babef55e9e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.172</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.164.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-04-10/">
<h1>Description</h1>
<h5>(Medium) SECURITY-1289</h5>
<p>Jenkins accepted cached legacy CLI authentication</p>
<h5>(Medium) SECURITY-1327</h5>
<p>XSS vulnerability in form validation button</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2019-04-10/</url>
</references>
<dates>
<discovery>2019-04-10</discovery>
<entry>2019-04-10</entry>
</dates>
</vuln>
<vuln vid="45d89773-5b64-11e9-80ed-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.171</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-19.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2019-7096).</li>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2019-7108).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7096</cvename>
<cvename>CVE-2019-7108</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-19.html</url>
</references>
<dates>
<discovery>2019-04-09</discovery>
<entry>2019-04-10</entry>
</dates>
</vuln>
<vuln vid="84ce26c3-5769-11e9-abd6-001b217b3468">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.101.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Clamav reports:</p>
<blockquote cite="https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html">
<p>An out-of-bounds heap read condition may occur when scanning PDF documents</p>
<p>An out-of-bounds heap read condition may occur when scanning PE files</p>
<p>An out-of-bounds heap write condition may occur when scanning OLE2 files</p>
<p>An out-of-bounds heap read condition may occur when scanning malformed PDF documents</p>
<p>A path-traversal write condition may occur as a result of improper input validation when scanning RAR archives</p>
<p>A use-after-free condition may occur as a result of improper error handling when scanning nested RAR archives</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2019/03/clamav-01012-and-01003-patches-have.html</url>
<cvename>CVE-2019-1787</cvename>
<cvename>CVE-2019-1789</cvename>
<cvename>CVE-2019-1788</cvename>
<cvename>CVE-2019-1786</cvename>
<cvename>CVE-2019-1785</cvename>
<cvename>CVE-2019-1798</cvename>
</references>
<dates>
<discovery>2019-03-29</discovery>
<entry>2019-04-05</entry>
</dates>
</vuln>
<vuln vid="da459dbc-5586-11e9-abd6-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.9.0</ge><lt>11.9.4</lt></range>
<range><ge>11.8.0</ge><lt>11.8.6</lt></range>
<range><lt>11.7.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/">
<p>DoS potential for regex in CI/CD refs</p>
<p>Related branches visible in issues for guests</p>
<p>Persistent XSS at merge request resolve conflicts</p>
<p>Improper authorization control "move issue"</p>
<p>Guest users of private projects have access to releases</p>
<p>DoS potential on project languages page</p>
<p>Recurity assessment: information exposure through timing discrepancy</p>
<p>Recurity assessment: loginState HMAC issues</p>
<p>Recurity assessment: open redirect</p>
<p>PDF.js vulnerable to CVE-2018-5158</p>
<p>IDOR labels of private projects/groups</p>
<p>EXIF geolocation data not stripped from uploaded images</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/</url>
<cvename>CVE-2019-10640</cvename>
<cvename>CVE-2019-10116</cvename>
<cvename>CVE-2019-10111</cvename>
<cvename>CVE-2019-10110</cvename>
<cvename>CVE-2019-10115</cvename>
<cvename>CVE-2019-10113</cvename>
<cvename>CVE-2019-10114</cvename>
<cvename>CVE-2019-10112</cvename>
<cvename>CVE-2019-10117</cvename>
<cvename>CVE-2018-5158</cvename>
<cvename>CVE-2019-10108</cvename>
<cvename>CVE-2019-10109</cvename>
</references>
<dates>
<discovery>2019-04-01</discovery>
<entry>2019-04-02</entry>
</dates>
</vuln>
<vuln vid="cf2105c6-551b-11e9-b95c-b499baebfeaf">
<topic>Apache -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd Project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>Apache HTTP Server privilege escalation from modules' scripts
(CVE-2019-0211) (important)</p>
<p>mod_auth_digest access control bypass (CVE-2019-0217)
(important)</p>
<p>mod_ssl access control bypass (CVE-2019-0215) (important)</p>
<p>mod_http2, possible crash on late upgrade (CVE-2019-0197) (low)</p>
<p>mod_http2, read-after-free on a string compare (CVE-2019-0196)
(low)</p>
<p>Apache httpd URL normalization inconsistincy (CVE-2019-0220)
(low)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.apache.org/dist/httpd/CHANGES_2.4.39</url>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2019-0211</cvename>
<cvename>CVE-2019-0217</cvename>
<cvename>CVE-2019-0215</cvename>
<cvename>CVE-2019-0196</cvename>
<cvename>CVE-2019-0220</cvename>
</references>
<dates>
<discovery>2019-04-01</discovery>
<entry>2019-04-02</entry>
</dates>
</vuln>
<vuln vid="6a0129bf-54ad-11e9-987c-1c39475b9f84">
<topic>Kubectl -- Potential directory traversal</topic>
<affects>
<package>
<name>kubectl</name>
<range><lt>1.11.9</lt></range>
<range><ge>1.12.0</ge><lt>1.12.7</lt></range>
<range><ge>1.13.0</ge><lt>1.13.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kubernetes.io reports:</p>
<blockquote cite="https://discuss.kubernetes.io/t/announce-security-release-of-kubernetes-kubectl-potential-directory-traversal-releases-1-11-9-1-12-7-1-13-5-and-1-14-0-cve-2019-1002101/5712">
<p>A security issue was discovered with the Kubernetes kubectl cp
command that could enable a directory traversal replacing or
deleting files on a user’s workstation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-1002101</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-1002101</url>
</references>
<dates>
<discovery>2019-03-28</discovery>
<entry>2019-04-01</entry>
</dates>
</vuln>
<vuln vid="b22d6d4c-53b9-11e9-9310-28d244aee256">
<topic>znc -- Denial of Service</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9917">
<p>ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial
of Service (crash) via invalid encoding.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9917</cvename>
<url>https://wiki.znc.in/ChangeLog/1.7.3</url>
</references>
<dates>
<discovery>2019-03-21</discovery>
<entry>2019-03-31</entry>
</dates>
</vuln>
<vuln vid="fe7e322f-522d-11e9-98b5-216e512dad89">
<topic>Jupyter notebook -- open redirect vulnerability</topic>
<affects>
<package>
<name>py27-notebook</name>
<name>py35-notebook</name>
<name>py36-notebook</name>
<name>py37-notebook</name>
<range><lt>5.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jupyter blog:</p>
<blockquote cite="https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4">
<p>Login pages tend to take a parameter for redirecting back to a page
after successful login, e.g. /login?next=/notebooks/mynotebook.ipynb, so
that you aren't disrupted too much if you try to visit a page, but have
to authenticate first. An Open Redirect Vulnerability is when a
malicious person crafts a link pointing to the login page of a trusted
site, but setting the "redirect after successful login" parameter to
send the user to their own site, instead of a page on the authenticated
site (the notebook or JupyterHub server), e.g.
/login?next=http://badwebsite.biz. This doesn't necessarily compromise
anything immediately, but it enables phishing if users don't notice
that the domain has changed, e.g. by showing a fake "re-enter your
password" page. Servers generally have to validate the redirect URL to
avoid this. Both JupyterHub and Notebook already do this, but the
validation didn't take into account all possible ways to redirect to
other sites, so some malicious URLs could still be crafted to redirect
away from the server (the above example does not work in any recent
version of either package). Only certain browsers (Chrome and Firefox,
not Safari) could be redirected from the JupyterHub login page, but all
browsers could be redirected away from a standalone notebook server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4</url>
<url>https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst</url>
<cvename>CVE-2019-10255</cvename>
</references>
<dates>
<discovery>2019-03-28</discovery>
<entry>2019-03-29</entry>
<modified>2019-04-06</modified>
</dates>
</vuln>
<vuln vid="7862213c-5152-11e9-8b26-a4badb296695">
<topic>dovecot -- Buffer overflow reading extension header</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-7524">
<p>Vulnerability Details:
When reading FTS or POP3-UIDL header from dovecot index, the input
buffer size is not bound, and data is copied to target structure causing
stack overflow.
Risk:
This can be used for local root privilege escalation or executing
arbitrary code in dovecot process context. This requires ability to
directly modify dovecot indexes.
Steps to reproduce:
Produce dovecot.index.log entry that creates an FTS header which has
more than 12 bytes of data.
Trigger dovecot indexer-worker or run doveadm index.
Dovecot will crash.
Mitigations:
Since 2.3.0 dovecot has been compiled with stack smash protection, ASLR,
read-only GOT tables and other techniques that make exploiting this bug
much harder.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-7524</url>
<url>https://dovecot.org/list/dovecot-news/2019-March/000401.html</url>
<cvename>CVE-2019-7524</cvename>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-03-28</entry>
</dates>
</vuln>
<vuln vid="94d63fd7-508b-11e9-9ba0-4c72b94353b5">
<topic>drupal -- Drupal core - Moderately critical - Cross Site Scripting</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.65</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-004">
<p>Under certain circumstances the File module/subsystem allows a malicious
user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/project/drupal/releases/8.6.13</url>
<url>https://www.drupal.org/project/drupal/releases/7.65</url>
<url>https://www.drupal.org/SA-CORE-2019-004</url>
<cvename>CVE-2019-6341</cvename>
</references>
<dates>
<discovery>2019-03-20</discovery>
<entry>2019-03-27</entry>
<modified>2019-03-28</modified>
</dates>
</vuln>
<vuln vid="d74371d2-4fee-11e9-a5cd-1df8a848de3d">
<topic>Python -- NULL pointer dereference vulnerability</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.16</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.7</lt></range>
</package>
<package>
<name>python36</name>
<range><lt>3.6.8_1</lt></range>
</package>
<package>
<name>python37</name>
<range><lt>3.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python Changelog:</p>
<blockquote cite="https://docs.python.org/3.7/whatsnew/changelog.html">
<p>bpo-35746: [CVE-2019-5010] Fix a NULL pointer deref in ssl module. The
cert parser did not handle CRL distribution points with empty DP or URI
correctly. A malicious or buggy certificate can result into segfault.
Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas Edet
of Cisco.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.python.org/3.7/whatsnew/changelog.html</url>
<url>https://bugs.python.org/issue35746</url>
<cvename>CVE-2019-5010</cvename>
</references>
<dates>
<discovery>2019-01-15</discovery>
<entry>2019-03-26</entry>
<modified>2019-03-27</modified>
</dates>
</vuln>
<vuln vid="15ee0e93-4bbb-11e9-9ba0-4c72b94353b5">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.1.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/">
<p>Hosts can now offer a button for their users to update PHP.</p>
<p>The recommended PHP version used by the Update PHP notice can now be filtered.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2019-03-12</discovery>
<entry>2019-03-21</entry>
</dates>
</vuln>
<vuln vid="e0382fde-4bb0-11e9-adcb-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.8.0</ge><lt>11.8.3</lt></range>
<range><lt>11.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/">
<p>Project Runner Token Exposed Through Issues Quick Actions</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/03/20/critical-security-release-gitlab-11-dot-8-dot-3-released/</url>
<cvename>CVE-2019-9866</cvename>
</references>
<dates>
<discovery>2019-03-20</discovery>
<entry>2019-03-21</entry>
</dates>
</vuln>
<vuln vid="1b6a10e9-4b7b-11e9-9e89-54e1ad3d6335">
<topic>libXdmcp -- insufficient entropy generating session keys</topic>
<affects>
<package>
<name>libXdmcp</name>
<range><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop and x.org project reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-2625">
<p>It was discovered that libXdmcp before 1.1.3 used weak
entropy to generate session keys on platforms without
arc4random_buf() but with getentropy(). On a multi-user system using
xdmcp, a local attacker could potentially use information available
from the process list to brute force the key, allowing them to
hijack other users' sessions.</p>
<p>Please note, that since FreeBSD provides arc4random_buf(), it is
unknown if FreeBSD is affected by this vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-2625</url>
<url>https://lists.x.org/archives/xorg-announce/2019-March/002974.html</url>
<cvename>CVE-2017-2625</cvename>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2019-03-21</entry>
<modified>2019-03-22</modified>
</dates>
</vuln>
<vuln vid="7ba5a3d0-4b18-11e9-adcb-001b217b3468">
<topic>Gitlab -- Vulnerability</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><lt>11.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/">
<p>Public project in a private group makes the group page publicly accessible</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/03/14/gitlab-11-8-2-released/</url>
<cvename>CVE-2019-9732</cvename>
</references>
<dates>
<discovery>2019-03-14</discovery>
<entry>2019-03-20</entry>
</dates>
</vuln>
<vuln vid="a8ba7358-4b02-11e9-9ba0-4c72b94353b5">
<topic>gitea -- XSS vulnerability</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://blog.gitea.io/2019/03/gitea-1.7.4-is-released/">
<p>Fix potential XSS vulnerability in repository description.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.gitea.io/2019/03/gitea-1.7.4-is-released/</url>
</references>
<dates>
<discovery>2019-03-12</discovery>
<entry>2019-03-20</entry>
</dates>
</vuln>
<vuln vid="05da6b56-3e66-4306-9ea3-89fafe939726">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>66.0_3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.9</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/">
<p>CVE-2019-9790: Use-after-free when removing in-use DOM elements</p>
<p>CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey</p>
<p>CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script</p>
<p>CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled</p>
<p>CVE-2019-9794: Command line arguments not discarded during execution</p>
<p>CVE-2019-9795: Type-confusion in IonMonkey JIT compiler</p>
<p>CVE-2019-9796: Use-after-free with SMIL animation controller</p>
<p>CVE-2019-9797: Cross-origin theft of images with createImageBitmap</p>
<p>CVE-2019-9798: Library is loaded from world writable APITRACE_LIB location</p>
<p>CVE-2019-9799: Information disclosure via IPC channel messages</p>
<p>CVE-2019-9801: Windows programs that are not 'URL Handlers' are exposed to web content</p>
<p>CVE-2019-9802: Chrome process information leak</p>
<p>CVE-2019-9803: Upgrade-Insecure-Requests incorrectly enforced for same-origin navigation</p>
<p>CVE-2019-9804: Code execution through 'Copy as cURL' in Firefox Developer Tools on macOS</p>
<p>CVE-2019-9805: Potential use of uninitialized memory in Prio</p>
<p>CVE-2019-9806: Denial of service through successive FTP authorization prompts</p>
<p>CVE-2019-9807: Text sent through FTP connection can be incorporated into alert messages</p>
<p>CVE-2019-9809: Denial of service through FTP modal alert error messages</p>
<p>CVE-2019-9808: WebRTC permissions can display incorrect origin with data: and blob: URLs</p>
<p>CVE-2019-9789: Memory safety bugs fixed in Firefox 66</p>
<p>CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-9788</cvename>
<cvename>CVE-2019-9789</cvename>
<cvename>CVE-2019-9790</cvename>
<cvename>CVE-2019-9791</cvename>
<cvename>CVE-2019-9792</cvename>
<cvename>CVE-2019-9793</cvename>
<cvename>CVE-2019-9794</cvename>
<cvename>CVE-2019-9795</cvename>
<cvename>CVE-2019-9796</cvename>
<cvename>CVE-2019-9797</cvename>
<cvename>CVE-2019-9798</cvename>
<cvename>CVE-2019-9799</cvename>
<cvename>CVE-2019-9801</cvename>
<cvename>CVE-2019-9802</cvename>
<cvename>CVE-2019-9803</cvename>
<cvename>CVE-2019-9804</cvename>
<cvename>CVE-2019-9805</cvename>
<cvename>CVE-2019-9806</cvename>
<cvename>CVE-2019-9807</cvename>
<cvename>CVE-2019-9808</cvename>
<cvename>CVE-2019-9809</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2019-07/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2019-08/</url>
</references>
<dates>
<discovery>2019-03-19</discovery>
<entry>2019-03-19</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="6001cfc6-9f0f-4fae-9b4f-9b8fae001425">
<topic>PowerDNS -- Insufficient validation in the HTTP remote backend</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS developers report:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html">
<p>An issue has been found in PowerDNS Authoritative Server when the HTTP remote backend is used in RESTful mode (without post=1 set), allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker-controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-03.html</url>
<cvename>CVE-2019-3871</cvename>
</references>
<dates>
<discovery>2019-03-18</discovery>
<entry>2019-03-19</entry>
</dates>
</vuln>
<vuln vid="1396a74a-4997-11e9-b5f1-83edb3f89ba1">
<topic>Rails -- Action View vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionview4</name>
<range><lt>4.2.11.1</lt></range>
</package>
<package>
<name>rubygem-actionview50</name>
<range><lt>5.0.7.2</lt></range>
</package>
<package>
<name>rubygem-actionview5</name>
<range><lt>5.1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/">
<p>Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released! These contain the following important security fixes. It is recommended that users upgrade as soon as possible:</p>
<p>CVE-2019-5418 File Content Disclosure in Action View</p>
<p>CVE-2019-5419 Denial of Service Vulnerability in Action View</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/</url>
<cvename>CVE-2019-5418</cvename>
<cvename>CVE-2019-5419</cvename>
</references>
<dates>
<discovery>2019-03-13</discovery>
<entry>2019-03-18</entry>
</dates>
</vuln>
<vuln vid="46e1ece5-48bd-11e9-9c40-080027ac955c">
<topic>PuTTY -- security fixes in new release</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.71</lt></range>
</package>
<package>
<name>putty-gtk2</name>
<range><lt>0.71</lt></range>
</package>
<package>
<name>putty-nogtk</name>
<range><lt>0.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PuTTY team reports:</p>
<blockquote cite="https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html">
<p>New in 0.71:</p>
<ul>
<li>Security fixes found by an EU-funded bug bounty programme:</li>
<li>+ a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification</li>
<li>+ potential recycling of random numbers used in cryptography</li>
<li>+ on Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding</li>
<li>+ multiple denial-of-service attacks that can be triggered by writing to the terminal</li>
<li>Other security enhancements: major rewrite of the crypto code to remove cache and timing side channels.</li>
<li>User interface changes to protect against fake authentication prompts from a malicious server.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html</url>
</references>
<dates>
<discovery>2019-03-16</discovery>
<entry>2019-03-17</entry>
</dates>
</vuln>
<vuln vid="72a6e3be-483a-11e9-92d7-f1590402501e">
<topic>Jupyter notebook -- cross-site inclusion (XSSI) vulnerability</topic>
<affects>
<package>
<name>py27-notebook</name>
<name>py35-notebook</name>
<name>py36-notebook</name>
<name>py37-notebook</name>
<range><lt>5.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jupyter notebook Changelog:</p>
<blockquote cite="https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst">
<p>5.7.6 contains a security fix for a cross-site inclusion (XSSI)
vulnerability, where files at a known URL could be included in a page
from an unauthorized website if the user is logged into a Jupyter
server. The fix involves setting the X-Content-Type-Options: nosniff
header, and applying CSRF checks previously on all non-GET API requests
to GET requests to API endpoints and the /files/ endpoint.</p>
<p>The attacking page is able to access some contents of files when using
Internet Explorer through script errors, but this has not been
demonstrated with other browsers. A CVE has been requested for this
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-auth-prompt-spoofing.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-fd-set-overflow.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars-double-width-gtk.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-one-column-cjk.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/pscp-unsanitised-server-output.html</url>
<url>https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/side-channels.html</url>
</references>
<dates>
<discovery>2019-03-10</discovery>
<entry>2019-03-16</entry>
</dates>
</vuln>
<vuln vid="27b12d04-4722-11e9-8b7c-b5e01141761f">
<topic>RubyGems -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<name>ruby25-gems</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RubyGems Security Advisories:</p>
<blockquote cite="https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html">
<p>CVE-2019-8320: Delete directory using symlink when decompressing tar</p>
<p>CVE-2019-8321: Escape sequence injection vulnerability in 'verbose'</p>
<p>CVE-2019-8322: Escape sequence injection vulnerability in 'gem owner'</p>
<p>CVE-2019-8323: Escape sequence injection vulnerability in API response handling</p>
<p>CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution</p>
<p>CVE-2019-8325: Escape sequence injection vulnerability in errors</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html</url>
<url>https://github.com/rubygems/rubygems/blob/master/History.txt</url>
<cvename>CVE-2019-8320</cvename>
<cvename>CVE-2019-8321</cvename>
<cvename>CVE-2019-8322</cvename>
<cvename>CVE-2019-8323</cvename>
<cvename>CVE-2019-8324</cvename>
<cvename>CVE-2019-8325</cvename>
</references>
<dates>
<discovery>2019-03-05</discovery>
<entry>2019-03-15</entry>
</dates>
</vuln>
<vuln vid="e56f2f7c-410e-11e9-b95c-b499baebfeaf">
<topic>OpenSSL -- ChaCha20-Poly1305 nonce vulnerability</topic>
<affects>
<package>
<name>openssl111</name>
<range><lt>1.1.1b_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20190306.txt">
<p>Low: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)</p>
<p>ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce
input for every encryption operation. RFC 7539 specifies that the nonce
value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce
length and front pads the nonce with 0 bytes if it is less than 12 bytes.
However it also incorrectly allows a nonce to be set of up to 16 bytes.
In this case only the last 12 bytes are significant and any additional
leading bytes are ignored.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20190306.txt</url>
<cvename>CVE-2019-1543</cvename>
</references>
<dates>
<discovery>2019-03-06</discovery>
<entry>2019-03-07</entry>
</dates>
</vuln>
<vuln vid="c2576e14-36e2-11e9-9eda-206a8a720317">
<topic>ntp -- Crafted null dereference attack from a trusted source with an authenticated mode 6 packet</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p13</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_2</lt></range>
<range><ge>11.2</ge><lt>11.2_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#March_2019_ntp_4_2_8p13_NTP_Rele">
<p>A crafted malicious authenticated mode 6 (ntpq) packet from a
permitted network address can trigger a NULL pointer dereference,
crashing ntpd.</p>
<p>Note that for this attack to work, the sending
system must be on an address that the target's ntpd accepts mode 6
packets from, and must use a private key that is specifically
listed as being used for mode 6 authorization.</p>
<p>Impact: The ntpd daemon can crash due to the NULL pointer
dereference, causing a denial of service.</p>
<p>Mitigation:</p>
<ul>
<li>Use restrict noquery to limit addresses that can send mode 6
queries.</li>
<li>Limit access to the private controlkey in ntp.keys.</li>
<li>Upgrade to 4.2.8p13, or later.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.ntp.org/3565</url>
<url>http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8936</url>
<url>https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:H/Au:M/C:N/I:N/A:C)</url>
<url>https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H</url>
<cvename>CVE-2019-8936</cvename>
<freebsdsa>SA-19:04.ntp</freebsdsa>
</references>
<dates>
<discovery>2019-01-15</discovery>
<entry>2019-03-07</entry>
<modified>2019-07-30</modified>
</dates>
</vuln>
<vuln vid="d193aa9f-3f8c-11e9-9a24-6805ca0b38e8">
<topic>rssh - multiple vulnerabilities</topic>
<affects>
<package>
<name>rssh</name>
<range><lt>2.3.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4">
<p>rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.</p>
<p>Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4</url>
<cvename>CVE-2019-1000018</cvename>
<cvename>CVE-2019-3463</cvename>
<cvename>CVE-2019-3464</cvename>
</references>
<dates>
<discovery>2019-02-04</discovery>
<entry>2019-03-06</entry>
</dates>
</vuln>
<vuln vid="416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42">
<topic>rt -- XSS via jQuery</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.16</lt></range>
</package>
<package>
<name>rt44</name>
<range><ge>4.4.0</ge><lt>4.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical reports:</p>
<blockquote cite="https://docs.bestpractical.com/release-notes/rt/4.4.4">
<p>The version of jQuery used in RT 4.2 and 4.4 has a
Cross-site Scripting (XSS) vulnerability when using
cross-domain Ajax requests. This vulnerability is assigned
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9251">CVE-2015-9251</a>. RT
does not use this jQuery feature so it is not directly
vulnerable. jQuery version 1.12 no longer receives official
updates, however a fix was posted with recommendations for
applications to patch locally, so RT will follow this
recommendation and ship with a patched version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.bestpractical.com/release-notes/rt/4.4.4</url>
<url>https://docs.bestpractical.com/release-notes/rt/4.2.16</url>
<cvename>CVE-2015-9251</cvename>
</references>
<dates>
<discovery>2019-03-05</discovery>
<entry>2019-03-06</entry>
</dates>
</vuln>
<vuln vid="526d9642-3ae7-11e9-a669-8c164582fbac">
<topic>slixmpp -- improper access control</topic>
<affects>
<package>
<name>py35-slixmpp</name>
<name>py36-slixmpp</name>
<name>py37-slixmpp</name>
<range><lt>1.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2019-1000021">
<p>slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416
contains an incorrect Access Control vulnerability in XEP-0223 plugin
(Persistent Storage of Private Data via PubSub) options profile, used
for the configuration of default access model that can result in
all of the contacts of the victim can see private data having been
published to a PEP node. This attack appears to be exploitable
if the user of this library publishes any private data on PEP,
the node isn't configured to be private. This vulnerability appears
to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416
which is included in slixmpp 1.4.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-1000021</url>
<cvename>CVE-2019-1000021</cvename>
</references>
<dates>
<discovery>2019-02-04</discovery>
<entry>2019-03-05</entry>
</dates>
</vuln>
<vuln vid="11292460-3f2f-11e9-adcb-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.8.0</ge><lt>11.8.1</lt></range>
<range><ge>11.7.0</ge><lt>11.7.6</lt></range>
<range><ge>2.9.0</ge><lt>11.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/">
<p>Arbitrary file read via MergeRequestDiff</p>
<p>CSRF add Kubernetes cluster integration</p>
<p>Blind SSRF in prometheus integration</p>
<p>Merge request information disclosure</p>
<p>IDOR milestone name information disclosure</p>
<p>Burndown chart information disclosure</p>
<p>Private merge request titles in public project information disclosure</p>
<p>Private namespace disclosure in email notification when issue is moved</p>
<p>Milestone name disclosure</p>
<p>Issue board name disclosure</p>
<p>NPM automatic package referencer</p>
<p>Path traversal snippet mover</p>
<p>Information disclosure repo existence</p>
<p>Issue DoS via Mermaid</p>
<p>Privilege escalation impersonate user</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/</url>
<cvename>CVE-2019-9221</cvename>
<cvename>CVE-2019-9176</cvename>
<cvename>CVE-2019-9174</cvename>
<cvename>CVE-2019-9172</cvename>
<cvename>CVE-2019-9170</cvename>
<cvename>CVE-2019-9175</cvename>
<cvename>CVE-2019-9178</cvename>
<cvename>CVE-2019-9179</cvename>
<cvename>CVE-2019-9171</cvename>
<cvename>CVE-2019-9224</cvename>
<cvename>CVE-2019-9225</cvename>
<cvename>CVE-2019-9219</cvename>
<cvename>CVE-2019-9217</cvename>
<cvename>CVE-2019-9222</cvename>
<cvename>CVE-2019-9223</cvename>
<cvename>CVE-2019-9220</cvename>
<cvename>CVE-2019-9485</cvename>
</references>
<dates>
<discovery>2019-03-04</discovery>
<entry>2019-03-05</entry>
</dates>
</vuln>
<vuln vid="a3e24de7-3f0c-11e9-87d1-00012e582166">
<topic>py-gunicorn -- CWE-113 vulnerability</topic>
<affects>
<package>
<name>py27-gunicorn</name>
<name>py35-gunicorn</name>
<name>py36-gunicorn</name>
<name>py37-gunicorn</name>
<range><lt>19.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Everardo reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000164">
<p>gunicorn version 19.4.5 contains a CWE-113: Improper
Neutralization of CRLF Sequences in HTTP Headers vulnerability
in process_headers function in gunicorn/http/wsgi.py
that can result in an attacker causing the server to
return arbitrary HTTP headers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000164</cvename>
<url>https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5</url>
</references>
<dates>
<discovery>2018-04-02</discovery>
<entry>2019-03-05</entry>
</dates>
</vuln>
<vuln vid="b71d7193-3c54-11e9-a3f9-00155d006b02">
<topic>Node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>11.10.1</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.15.2</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.15.1</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.17.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/">
<p>Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.</p>
<p>For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.</p>
<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
<h1>OpenSSL: 0-byte record padding oracle (CVE-2019-1559)</h1>
<p>OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.</p>
<p>Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC. This can be used as the basis of a padding oracle attack to decrypt data.</p>
<p>Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/</url>
<cvename>CVE-2019-5737</cvename>
<cvename>CVE-2019-5739</cvename>
<cvename>CVE-2019-1559</cvename>
</references>
<dates>
<discovery>2019-02-28</discovery>
<entry>2019-03-03</entry>
</dates>
</vuln>
<vuln vid="395ed9d5-3cca-11e9-9ba0-4c72b94353b5">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.20_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/">
<p>Medium risk: Reset Password reflected XSS</p>
<p>Medium risk: ModCP Profile Editor username reflected XSS</p>
<p>Low risk: Predictable CSRF token for guest users</p>
<p>Low risk: ACP Stylesheet Properties XSS</p>
<p>Low risk: Reset Password username enumeration via email</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2019/02/27/mybb-1-8-20-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2019-02-27</discovery>
<entry>2019-03-02</entry>
<modified>2019-03-04</modified>
</dates>
</vuln>
<vuln vid="be0e3817-3bfe-11e9-9cd6-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability with SDP protocol violation</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.7.2</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>When Asterisk makes an outgoing call, a very specific
SDP protocol violation by the remote party can cause
Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2019-001.html</url>
<cvename>CVE-2019-7251</cvename>
</references>
<dates>
<discovery>2019-01-24</discovery>
<entry>2019-03-01</entry>
</dates>
</vuln>
<vuln vid="e3aacd6d-3d01-434c-9330-bc9efd40350f">
<topic>webkit-gtk -- Multiple vulnabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.22.6</lt></range>
</package>
<package>
<name>webkit-gtk2</name>
<name>webkit-gtk3</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Webkitgtk project reports:</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2019-0001.html">
<p>CVE-2019-6212 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6215 - Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.</p>
<p>CVE-2019-6216 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6217 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6226 - Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.</p>
<p>CVE-2019-6227 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</p>
<p>CVE-2019-6229 - Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.</p>
<p>CVE-2019-6233 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</p>
<p>CVE-2019-6234 - Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.</p>
</blockquote>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2019-0001.html</url>
<cvename>CVE-2019-6212</cvename>
<cvename>CVE-2019-6215</cvename>
<cvename>CVE-2019-6216</cvename>
<cvename>CVE-2019-6217</cvename>
<cvename>CVE-2019-6226</cvename>
<cvename>CVE-2019-6227</cvename>
<cvename>CVE-2019-6229</cvename>
<cvename>CVE-2019-6233</cvename>
<cvename>CVE-2019-6234</cvename>
</references>
<dates>
<discovery>2019-02-08</discovery>
<entry>2019-02-24</entry>
</dates>
</vuln>
<vuln vid="3e2c9b63-223c-4575-af5c-816acb14e445">
<topic>rdesktop - critical - Remote Code Execution</topic>
<affects>
<package>
<name>rdesktop</name>
<range><lt>1.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4">
<ul>
<li>Fix memory corruption in process_bitmap_data - CVE-2018-8794
</li>
<li>Fix remote code execution in process_bitmap_data - CVE-2018-8795
</li>
<li>Fix remote code execution in process_plane - CVE-2018-8797
</li>
<li>Fix Denial of Service in mcs_recv_connect_response - CVE-2018-20175
</li>
<li>Fix Denial of Service in mcs_parse_domain_params - CVE-2018-20175
</li>
<li>Fix Denial of Service in sec_parse_crypt_info - CVE-2018-20176
</li>
<li>Fix Denial of Service in sec_recv - CVE-2018-20176
</li>
<li>Fix minor information leak in rdpdr_process - CVE-2018-8791
</li>
<li>Fix Denial of Service in cssp_read_tsrequest - CVE-2018-8792
</li>
<li>Fix remote code execution in cssp_read_tsrequest - CVE-2018-8793
</li>
<li>Fix Denial of Service in process_bitmap_data - CVE-2018-8796
</li>
<li>Fix minor information leak in rdpsnd_process_ping - CVE-2018-8798
</li>
<li>Fix Denial of Service in process_secondary_order - CVE-2018-8799
</li>
<li>Fix remote code execution in in ui_clip_handle_data - CVE-2018-8800
</li>
<li>Fix major information leak in ui_clip_handle_data - CVE-2018-20174
</li>
<li>Fix memory corruption in rdp_in_unistr - CVE-2018-20177
</li>
<li>Fix Denial of Service in process_demand_active - CVE-2018-20178
</li>
<li>Fix remote code execution in lspci_process - CVE-2018-20179
</li>
<li>Fix remote code execution in rdpsnddbg_process - CVE-2018-20180
</li>
<li>Fix remote code execution in seamless_process - CVE-2018-20181
</li>
<li>Fix remote code execution in seamless_process_line - CVE-2018-20182
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rdesktop/rdesktop/releases/tag/v1.8.4</url>
<cvename>CVE-2018-20175</cvename>
<cvename>CVE-2018-20176</cvename>
<cvename>CVE-2018-8791</cvename>
<cvename>CVE-2018-8792</cvename>
<cvename>CVE-2018-8793</cvename>
<cvename>CVE-2018-8794</cvename>
<cvename>CVE-2018-8795</cvename>
<cvename>CVE-2018-8796</cvename>
<cvename>CVE-2018-8797</cvename>
<cvename>CVE-2018-8798</cvename>
<cvename>CVE-2018-8799</cvename>
<cvename>CVE-2018-8800</cvename>
<cvename>CVE-2018-20174</cvename>
<cvename>CVE-2018-20177</cvename>
<cvename>CVE-2018-20178</cvename>
<cvename>CVE-2018-20179</cvename>
<cvename>CVE-2018-20180</cvename>
<cvename>CVE-2018-20181</cvename>
<cvename>CVE-2018-20182</cvename>
</references>
<dates>
<discovery>2019-01-02</discovery>
<entry>2019-02-22</entry>
</dates>
</vuln>
<vuln vid="002b4b05-35dd-11e9-94a8-000ffec0b3e1">
<topic>drupal -- Drupal core - Highly critical - Remote Code Execution</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.6.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2019-003">
<p>Some field types do not properly sanitize data from non-form sources.
This can lead to arbitrary PHP code execution in some cases..</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2019-002</url>
<cvename>CVE-2019-6340</cvename>
</references>
<dates>
<discovery>2019-02-20</discovery>
<entry>2019-02-21</entry>
</dates>
</vuln>
<vuln vid="7700061f-34f7-11e9-b95c-b499baebfeaf">
<topic>OpenSSL -- Padding oracle vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2r,1</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20190226.txt">
<p>0-byte record padding oracle (CVE-2019-1559) (Moderate)<br/>
If an application encounters a fatal protocol error and then calls
SSL_shutdown() twice (once to send a close_notify, and once to receive
one) then OpenSSL can respond differently to the calling application if
a 0 byte record is received with invalid padding compared to if a 0 byte
record is received with an invalid MAC. If the application then behaves
differently based on that in a way that is detectable to the remote peer,
then this amounts to a padding oracle that could be used to decrypt data.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20190226.txt</url>
<cvename>CVE-2019-1559</cvename>
</references>
<dates>
<discovery>2019-02-19</discovery>
<entry>2019-02-20</entry>
<modified>2019-03-07</modified>
</dates>
</vuln>
<vuln vid="f0416fb5-3130-11e9-a5ba-e0d55e883e26">
<topic>msmtp -- certificate-verification issue</topic>
<affects>
<package>
<name>msmtp</name>
<range><gt>1.8.1</gt><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>msmtp developers report:</p>
<blockquote cite="https://marlam.de/msmtp/news/msmtp-1-8-3/">
<p>In msmtp 1.8.2, when tls_trust_file has its default configuration,
certificate-verification results are not properly checked.</p>
</blockquote>
</body>
</description>
<references>
<url>https://marlam.de/msmtp/news/msmtp-1-8-3/</url>
<cvename>CVE-2019-8337</cvename>
</references>
<dates>
<discovery>2019-02-11</discovery>
<entry>2019-02-15</entry>
</dates>
</vuln>
<vuln vid="18211552-f650-4d86-ba4f-e6d5cbfcdbeb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>65.0.1,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.5.1,1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>60.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/">
<p>CVE-2018-18356: Use-after-free in Skia</p>
<p>CVE-2019-5785: Integer overflow in Skia</p>
<p>CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-18511</cvename>
<cvename>CVE-2018-18356</cvename>
<cvename>CVE-2019-5785</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/</url>
</references>
<dates>
<discovery>2019-02-13</discovery>
<entry>2019-02-13</entry>
</dates>
</vuln>
<vuln vid="de11a8fb-2eda-11e9-8fb5-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.142</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb19-06.html">
<ul>
<li>This update resolves an out-of-bounds vulnerability that
could lead to information disclosure (CVE-2019-7090).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-7090</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb19-06.html</url>
</references>
<dates>
<discovery>2019-02-12</discovery>
<entry>2019-02-12</entry>
</dates>
</vuln>
<vuln vid="5efd7a93-2dfb-11e9-9549-e980e869c2e9">
<topic>OpenJPEG -- integer overflow</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.3.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5727">
<p>In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the
opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could
leverage this vulnerability to cause a denial of service via a crafted
bmp file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5727</url>
<url>https://github.com/uclouvain/openjpeg/issues/1053</url>
<cvename>CVE-2018-5727</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2019-02-11</entry>
<modified>2019-03-29</modified>
</dates>
</vuln>
<vuln vid="86c89abf-2d91-11e9-bf3e-a4badb2f4699">
<topic>FreeBSD -- File description reference count leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>FreeBSD 12.0 attempts to handle the case where the
receiving process does not provide a sufficiently large
buffer for an incoming control message containing rights.
In particular, to avoid leaking the corresponding descriptors
into the receiving process' descriptor table, the kernel
handles the truncation case by closing descriptors referenced
by the discarded message.</p>
<p>The code which performs this operation failed to release
a reference obtained on the file corresponding to a received
right. This bug can be used to cause the reference counter
to wrap around and free the file structure.</p>
<h1>Impact:</h1>
<p>A local user can exploit the bug to gain root privileges
or escape from a jail.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5596</cvename>
<freebsdsa>SA-19:02.fd</freebsdsa>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-02-11</entry>
</dates>
</vuln>
<vuln vid="683c714d-2d91-11e9-bf3e-a4badb2f4699">
<topic>FreeBSD -- System call kernel data register leak</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>12.0</ge><lt>12.0_3</lt></range>
<range><ge>11.2</ge><lt>11.2_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The callee-save registers are used by kernel and for
some of them (%r8, %r10, and for non-PTI configurations,
%r9) the content is not sanitized before return from syscalls,
potentially leaking sensitive information.</p>
<h1>Impact:</h1>
<p>Typically an address of some kernel data structure used
in the syscall implementation, is exposed.</p>
</body>
</description>
<references>
<cvename>CVE-2019-5595</cvename>
<freebsdsa>SA-19:01.syscall</freebsdsa>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-02-11</entry>
</dates>
</vuln>
<vuln vid="e8bcac84-2d5c-11e9-9a74-e0d55e2a8bf9">
<topic>kf5-kauth -- Insecure handling of arguments in helpers</topic>
<affects>
<package>
<name>kf5-kauth</name>
<range><lt>5.54.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20190209-1.txt">
<p>KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus.</p>
<p>Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugin</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20190209-1.txt</url>
<cvename>CVE-2019-7443</cvename>
</references>
<dates>
<discovery>2019-02-09</discovery>
<entry>2019-02-10</entry>
</dates>
</vuln>
<vuln vid="c95836a0-2b3b-11e9-9838-8c164567ca3c">
<topic>unit -- heap memory buffer overflow</topic>
<affects>
<package>
<name>unit</name>
<range><ge>0.3.0</ge><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>unit security problems:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/unit/2019-February/000112.html">
<p>CVE-2019-7401: a head memory buffer overflow might have</p>
<p>been caused in the router process by a specially crafted</p>
<p>request, potentially resulting in a segmentation fault</p>
<p>or other unspecified behavior.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/unit/2019-February/000112.html</url>
<cvename>CVE-2019-7401</cvename>
</references>
<dates>
<discovery>2019-02-07</discovery>
<entry>2019-02-08</entry>
</dates>
</vuln>
<vuln vid="714b033a-2b09-11e9-8bc3-610fd6e6cd05">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.64.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-16890: NTLM type-2 out-of-bounds buffer read</p>
<p>libcurl contains a heap buffer out-of-bounds read flaw.</p>
<p>The function handling incoming NTLM type-2 messages
(lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming
data correctly and is subject to an integer overflow vulnerability.</p>
<p>Using that overflow, a malicious or broken NTLM server could trick
libcurl to accept a bad length + offset combination that would lead to a
buffer read out-of-bounds.</p>
<p>CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow</p>
<p>libcurl contains a stack based buffer overflow vulnerability.</p>
<p>The function creating an outgoing NTLM type-3 header
(lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the
request HTTP header contents based on previously received data. The
check that exists to prevent the local buffer from getting overflowed is
implemented wrongly (using unsigned math) and as such it does not
prevent the overflow from happening.</p>
<p>This output data can grow larger than the local buffer if very large
"nt response" data is extracted from a previous NTLMv2 header provided
by the malicious or broken HTTP server.</p>
<p>Such a "large value" needs to be around 1000 bytes or more. The actual
payload data copied to the target buffer comes from the NTLMv2 type-2
response header.</p>
<p>CVE-2019-3823: SMTP end-of-response out-of-bounds read</p>
<p>libcurl contains a heap out-of-bounds read in the code handling the
end-of-response for SMTP.</p>
<p>If the buffer passed to smtp_endofresp() isn't NUL terminated and
contains no character ending the parsed number, and len is set to 5,
then the strtol() call reads beyond the allocated buffer. The read
contents will not be returned to the caller.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16890.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-3822.html</url>
<url>https://curl.haxx.se/docs/CVE-2019-3823.html</url>
<cvename>CVE-2018-16890</cvename>
<cvename>CVE-2019-3822</cvename>
<cvename>CVE-2019-3823</cvename>
</references>
<dates>
<discovery>2019-02-07</discovery>
<entry>2019-02-07</entry>
</dates>
</vuln>
<vuln vid="43ee6c1d-29ee-11e9-82a1-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.7.0</ge><lt>11.7.4</lt></range>
<range><ge>11.6.0</ge><lt>11.6.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/">
<p>Leak of Confidential Issue and Merge Request Titles</p>
<p>Persistent XSS in User Status</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/</url>
<cvename>CVE-2019-7353</cvename>
<cvename>CVE-2019-6796</cvename>
</references>
<dates>
<discovery>2019-02-05</discovery>
<entry>2019-02-06</entry>
</dates>
</vuln>
<vuln vid="1340fcc1-2953-11e9-bc44-a4badb296695">
<topic>mail/dovecot -- Suitable client certificate can be used to login as other user</topic>
<affects>
<package>
<name>dovecot</name>
<range><lt>2.3.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aki Tuomi (Open-Xchange Oy) reports:</p>
<blockquote cite="https://www.mail-archive.com/dovecot@dovecot.org/msg76117.html">
<p>Normally Dovecot is configured to authenticate
imap/pop3/managesieve/submission clients using regular username/password
combination. Some installations have also required clients to present a
trusted SSL certificate on top of that. It's also possible to configure
Dovecot to take the username from the certificate instead of from the
user provided authentication. It's also possible to avoid having a
password at all, only trusting the SSL certificate.
If the provided trusted SSL certificate is missing the username field,
Dovecot should be failing the authentication. However, the earlier
versions will take the username from the user provided authentication
fields (e.g. LOGIN command). If there is no additional password
verification, this allows the attacker to login as anyone else in the
system.
This affects only installations using:
auth_ssl_require_client_cert = yes
auth_ssl_username_from_cert = yes
Attacker must also have access to a valid trusted certificate without
the ssl_cert_username_field in it. The default is commonName, which
almost certainly exists in all certificates. This could happen for
example if ssl_cert_username_field is a field that normally doesn't
exist, and attacker has access to a web server's certificate (and key),
which is signed with the same CA.
Attack can be migitated by having the certificates with proper Extended
Key Usage, such as 'TLS Web Server' and 'TLS Web Server Client'.
Also, ssl_cert_username_field setting was ignored with external SMTP
AUTH, because none of the MTAs (Postfix, Exim) currently send the
cert_username field. This may have allowed users with trusted
certificate to specify any username in the authentication. This does not
apply to Dovecot Submission service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/dovecot@dovecot.org/msg76117.html</url>
<cvename>CVE-2019-3814</cvename>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-02-05</entry>
</dates>
</vuln>
<vuln vid="5d8c0876-2716-11e9-9446-b7f8544ce15c">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8-php71</name>
<name>typo3-8-php72</name>
<name>typo3-8-php73</name>
<range><lt>8.7.24</lt></range>
</package>
<package>
<name>typo3-9-php71</name>
<name>typo3-9-php72</name>
<name>typo3-9-php73</name>
<range><lt>9.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 news:</p>
<blockquote cite="https://typo3.org/article/typo3-954-and-8723-security-releases-published/">
<p>Please read the corresponding Security Advisories for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-954-and-8723-security-releases-published/</url>
<url>https://typo3.org/article/typo3-v8724-lts-released/</url>
</references>
<dates>
<discovery>2019-01-22</discovery>
<entry>2019-02-02</entry>
</dates>
</vuln>
<vuln vid="41c1cd6f-2645-11e9-b5f1-080027fee39c">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.7.0">
<p>Disable redirect for i18n</p>
<p>Only allow local login if password is non-empty</p>
<p>Fix go-get URL generation</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.7.1</url>
</references>
<dates>
<discovery>2019-01-31</discovery>
<entry>2019-02-01</entry>
</dates>
</vuln>
<vuln vid="22b90fe6-258e-11e9-9c8d-6805ca0b3d42">
<topic>p5-Email-Address-List -- DDoS related vulnerability</topic>
<affects>
<package>
<name>p5-Email-Address-List</name>
<range><lt>0.06</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Best PRactical Solutions reports:</p>
<blockquote cite="https://metacpan.org/source/BPS/Email-Address-List-0.06/Changes">
<pre>
0.06 2019-01-02
- Changes to address CVE-2018-18898 which could allow DDoS-type attacks.
Thanks to Lukas Kramer for reporting the issue and Alex Vandiver for
contributing fixes.
- Fix pathological backtracking for unkown regex
- Fix pathological backtracking in obs-phrase(i.e. obs-display-name)
- Fix pathological backtracking in cfws, quoted strings
</pre>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/source/BPS/Email-Address-List-0.06/Changes</url>
<cvename>CVE-2018-18898</cvename>
</references>
<dates>
<discovery>2019-01-02</discovery>
<entry>2019-01-31</entry>
</dates>
</vuln>
<vuln vid="467b7cbe-257d-11e9-8573-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.7.0</ge><lt>11.7.3</lt></range>
<range><ge>11.6.0</ge><lt>11.6.8</lt></range>
<range><ge>0.0.0</ge><lt>11.5.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/">
<p>Remote Command Execution via GitLab Pages</p>
<p>Covert Redirect to Steal GitHub/Bitbucket Tokens</p>
<p>Remote Mirror Branches Leaked by Git Transfer Refs</p>
<p>Denial of Service with Markdown</p>
<p>Guests Can View List of Group Merge Requests</p>
<p>Guest Can View Merge Request Titles via System Notes</p>
<p>Persistent XSS via KaTeX</p>
<p>Emails Sent to Unauthorized Users</p>
<p>Hyperlink Injection in Notification Emails</p>
<p>Unauthorized Access to LFS Objects</p>
<p>Trigger Token Exposure</p>
<p>Upgrade Rails to 5.0.7.1 and 4.2.11</p>
<p>Contributed Project Information Visible in Private Profile</p>
<p>Imported Project Retains Prior Visibility Setting</p>
<p>Error disclosure on Project Import</p>
<p>Persistent XSS in User Status</p>
<p>Last Commit Status Leaked to Guest Users</p>
<p>Mitigations for IDN Homograph and RTLO Attacks</p>
<p>Access to Internal Wiki When External Wiki Enabled</p>
<p>User Can Comment on Locked Project Issues</p>
<p>Unauthorized Reaction Emojis by Guest Users</p>
<p>User Retains Project Role After Removal from Private Group</p>
<p>GitHub Token Leaked to Maintainers</p>
<p>Unauthenticated Blind SSRF in Jira Integration</p>
<p>Unauthorized Access to Group Membership</p>
<p>Validate SAML Response in Group SAML SSO</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/</url>
<cvename>CVE-2019-6783</cvename>
<cvename>CVE-2019-6788</cvename>
<cvename>CVE-2019-6785</cvename>
<cvename>CVE-2019-6790</cvename>
<cvename>CVE-2019-6997</cvename>
<cvename>CVE-2019-6784</cvename>
<cvename>CVE-2019-6789</cvename>
<cvename>CVE-2019-6781</cvename>
<cvename>CVE-2019-6786</cvename>
<cvename>CVE-2019-6787</cvename>
<cvename>CVE-2018-16476</cvename>
<cvename>CVE-2019-6782</cvename>
<cvename>CVE-2019-6791</cvename>
<cvename>CVE-2019-6792</cvename>
<cvename>CVE-2019-6796</cvename>
<cvename>CVE-2019-6794</cvename>
<cvename>CVE-2019-6795</cvename>
<cvename>CVE-2019-6960</cvename>
<cvename>CVE-2019-6995</cvename>
<cvename>CVE-2019-7176</cvename>
<cvename>CVE-2019-7155</cvename>
<cvename>CVE-2019-6797</cvename>
<cvename>CVE-2019-6793</cvename>
<cvename>CVE-2019-6996</cvename>
</references>
<dates>
<discovery>2019-01-31</discovery>
<entry>2019-01-31</entry>
</dates>
</vuln>
<vuln vid="181beef6-2482-11e9-b4a3-00155d006b02">
<topic>turnserver -- multiple vulnerabilities</topic>
<affects>
<package>
<name>turnserver</name>
<range><lt>4.5.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mihály Mészáros reports:</p>
<blockquote cite="https://github.com/coturn/coturn/blob/4.5.1.0/ChangeLog">
<p>We made 4.5.1.0 release public today that fixes many vulnerabilities.</p>
<p>It fix the following vulnerabilities:</p>
<ul>
<li>CVE-2018-4056</li>
<li>CVE-2018-4058</li>
<li>CVE-2018-4059</li>
</ul>
<p>They will be exposed very soon..</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/coturn/coturn/blob/4.5.1.0/ChangeLog</url>
<url>https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/0RuCzcQa0ew/ebZfNEDqBwAJ</url>
<cvename>CVE-2018-4056</cvename>
<cvename>CVE-2018-4058</cvename>
<cvename>CVE-2018-4059</cvename>
</references>
<dates>
<discovery>2019-01-28</discovery>
<entry>2019-01-30</entry>
</dates>
</vuln>
<vuln vid="b1f7d52f-fc42-48e8-8403-87d4c9d26229">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>65.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.7</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.5.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/">
<p>CVE-2018-18500: Use-after-free parsing HTML5 stream</p>
<p>CVE-2018-18503: Memory corruption with Audio Buffer</p>
<p>CVE-2018-18504: Memory corruption and out-of-bounds read of texture client buffer</p>
<p>CVE-2018-18505: Privilege escalation through IPC channel messages</p>
<p>CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied</p>
<p>CVE-2018-18502: Memory safety bugs fixed in Firefox 65</p>
<p>CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-18500</cvename>
<cvename>CVE-2018-18501</cvename>
<cvename>CVE-2018-18502</cvename>
<cvename>CVE-2018-18503</cvename>
<cvename>CVE-2018-18504</cvename>
<cvename>CVE-2018-18505</cvename>
<cvename>CVE-2018-18506</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/</url>
</references>
<dates>
<discovery>2019-01-29</discovery>
<entry>2019-01-29</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="40d92cc5-1e2b-11e9-bef6-6805ca2fa271">
<topic>powerdns-recursor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2019-3806: An issue has been found in PowerDNS Recursor where Lua hooks are
not properly applied to queries received over TCP in some specific combination of
settings, possibly bypassing security policies enforced using Lua.
When the recursor is configured to run with more than one thread (threads=X) and to
do the distribution of incoming queries to the worker threads itself
(pdns-distributes-queries=yes), the Lua script is not properly loaded in the thread
handling incoming TCP queries, causing the Lua hooks to not be properly applied.</p>
<p>CVE-2019-3807: An issue has been found in PowerDNS Recursor where records in the
answer section of responses received from authoritative servers with the AA flag not
set were not properly validated, allowing an attacker to bypass DNSSEC validation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2019-3806</cvename>
<cvename>CVE-2019-3807</cvename>
</references>
<dates>
<discovery>2019-01-21</discovery>
<entry>2019-01-22</entry>
</dates>
</vuln>
<vuln vid="d3d02d3a-2242-11e9-b95c-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.63</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.38</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.38</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.22</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.13</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.63</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.43</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.25</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.14</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.63</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.43</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
<p>Not all listed CVE's are present in all versions/flavors</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#AppendixMSQL</url>
<cvename>CVE-2019-2534</cvename>
<cvename>CVE-2019-2533</cvename>
<cvename>CVE-2019-2529</cvename>
<cvename>CVE-2019-2482</cvename>
<cvename>CVE-2019-2434</cvename>
<cvename>CVE-2019-2455</cvename>
<cvename>CVE-2019-2503</cvename>
<cvename>CVE-2019-2436</cvename>
<cvename>CVE-2019-2536</cvename>
<cvename>CVE-2019-2502</cvename>
<cvename>CVE-2019-2510</cvename>
<cvename>CVE-2019-2539</cvename>
<cvename>CVE-2019-2494</cvename>
<cvename>CVE-2019-2495</cvename>
<cvename>CVE-2019-2537</cvename>
<cvename>CVE-2019-2420</cvename>
<cvename>CVE-2019-2481</cvename>
<cvename>CVE-2019-2507</cvename>
<cvename>CVE-2019-2530</cvename>
<cvename>CVE-2019-2528</cvename>
<cvename>CVE-2019-2531</cvename>
<cvename>CVE-2019-2486</cvename>
<cvename>CVE-2019-2532</cvename>
<cvename>CVE-2019-2535</cvename>
<cvename>CVE-2019-2513</cvename>
</references>
<dates>
<discovery>2019-01-15</discovery>
<entry>2019-01-27</entry>
</dates>
</vuln>
<vuln vid="d8e7e854-17fa-11e9-bef6-6805ca2fa271">
<topic>botan2 -- Side channel during ECC key generation</topic>
<affects>
<package>
<name>botan2</name>
<range><lt>2.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>botan2 developers reports:</p>
<blockquote cite="https://botan.randombit.net/security.html#id1">
<p>A timing side channel during ECC key generation could leak information about the
high bits of the secret scalar. Such information allows an attacker to perform a
brute force attack on the key somewhat more efficiently than they would otherwise.
Found by Ján Jančár using ECTester.</p>
<p>Bug introduced in 1.11.20, fixed in 2.9.0</p>
</blockquote>
</body>
</description>
<references>
<url>https://botan.randombit.net/security.html#id1</url>
<cvename>CVE-2018-20187</cvename>
</references>
<dates>
<discovery>2018-12-17</discovery>
<entry>2019-01-27</entry>
</dates>
</vuln>
<vuln vid="111aefca-2213-11e9-9c8d-6805ca0b3d42">
<topic>phpMyAdmin -- File disclosure and SQL injection</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-1/">
<h3>Summary</h3>
<p>Arbitrary file read vulnerability</p>
<h3>Description</h3>
<p>When <code>AllowArbitraryServer</code> configuration set
to <code>true</code>, with the use of a rogue MySQL server,
an attacker can read any file on the server that the web
server's user can access.</p>
<p>phpMyadmin attempts to block the use of <code>LOAD DATA
INFILE</code>, but due to a <a href="https://bugs.php.net/bug.php?id=77496">bug in PHP</a>,
this check is not honored. Additionally, when using the
'mysql' extension, <a href="http://php.net/manual/en/mysql.configuration.php#ini.mysql.allow-local-infile">mysql.allow_local_infile</a>
is enabled by default. Both of these conditions allow the
attack to occur.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
<h3>Mitigation factor</h3>
<p>This attack can be mitigated by setting the
`AllowArbitraryServer` configuration directive to false
(which is the default value).</p>
<h3>Affected Versions</h3>
<p>phpMyAdmin versions from at least 4.0 through 4.8.4 are
affected</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2019-2/">
<h3>Summary</h3>
<p>SQL injection in Designer feature</p>
<h3>Description</h3>
<p>A vulnerability was reported where a specially crafted
username can be used to trigger an SQL injection attack
through the designer feature.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be serious.</p>
<h3>Affected Versions</h3>
<p>phpMyAdmin versions from 4.5.0 through 4.8.4 are affected</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2019-1/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2019-2/</url>
</references>
<dates>
<discovery>2019-01-21</discovery>
<entry>2019-01-27</entry>
</dates>
</vuln>
<vuln vid="7f6146aa-2157-11e9-9ba0-4c72b94353b5">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea Team reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.7.0">
<p>Do not display the raw OpenID error in the UI</p>
<p>When redirecting clean the path to avoid redirecting to external site</p>
<p>Prevent DeleteFilePost doing arbitrary deletion</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/releases/tag/v1.7.0</url>
</references>
<dates>
<discovery>2019-01-22</discovery>
<entry>2019-01-26</entry>
</dates>
</vuln>
<vuln vid="8e48365a-214d-11e9-9f8a-0050562a4d7b">
<topic>libzmq4 -- Remote Code Execution Vulnerability</topic>
<affects>
<package>
<name>libzmq4</name>
<range><ge>4.2.0</ge><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://github.com/zeromq/libzmq/releases/tag/v4.3.1">
<p>A vulnerability has been found that would allow attackers to direct a peer to
jump to and execute from an address indicated by the attacker.
This issue has been present since v4.2.0. Older releases are not affected.
NOTE: The attacker needs to know in advance valid addresses in the peer's
memory to jump to, so measures like ASLR are effective mitigations.
NOTE: this attack can only take place after authentication, so peers behind
CURVE/GSSAPI are not vulnerable to unauthenticated attackers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-6250</cvename>
<url>https://github.com/zeromq/libzmq/issues/3351</url>
<url>https://github.com/zeromq/libzmq/pull/3353</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2019-6250</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250</url>
</references>
<dates>
<discovery>2019-01-08</discovery>
<entry>2019-01-26</entry>
</dates>
</vuln>
<vuln vid="eb888ce5-1f19-11e9-be05-4c72b94353b5">
<topic>Apache -- vulnerability</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd Project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>SECURITY: CVE-2018-17199
mod_session: mod_session_cookie does not respect expiry time allowing
sessions to be reused.</p>
<p>SECURITY: CVE-2019-0190
mod_ssl: Fix infinite loop triggered by a client-initiated
renegotiation in TLSv1.2 (or earlier) with OpenSSL 1.1.1 and
later. PR 63052.</p>
<p>SECURITY: CVE-2018-17189
mod_http2: fixes a DoS attack vector. By sending slow request bodies
to resources not consuming them, httpd cleanup code occupies a server
thread unnecessarily. This was changed to an immediate stream reset
which discards all stream state and incoming data.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.apache.org/dist/httpd/CHANGES_2.4.38</url>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-17199</cvename>
<cvename>CVE-2018-17189</cvename>
<cvename>CVE-2019-0190</cvename>
</references>
<dates>
<discovery>2019-01-22</discovery>
<entry>2019-01-23</entry>
</dates>
</vuln>
<vuln vid="4af3241d-1f0c-11e9-b4bd-d43d7eed0ce2">
<topic>www/mod_dav_svn -- Malicious SVN clients can crash mod_dav_svn.</topic>
<affects>
<package>
<name>mod_dav_svn</name>
<range><ge>1.10.0</ge><lt>1.10.3</lt></range>
<range><eq>1.11.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2018-11803-advisory.txt">
<p>Malicious SVN clients can trigger a crash in mod_dav_svn by omitting
the root path from a recursive directory listing request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2018-11803-advisory.txt</url>
</references>
<dates>
<discovery>2019-01-23</discovery>
<entry>2019-01-23</entry>
</dates>
</vuln>
<vuln vid="50ad9a9a-1e28-11e9-98d7-0050562a4d7b">
<topic>www/py-requests -- Information disclosure vulnerability</topic>
<affects>
<package>
<name>py27-requests</name>
<name>py35-requests</name>
<name>py36-requests</name>
<name>py37-requests</name>
<range><lt>2.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074">
<p>The Requests package before 2.20.0 for Python sends an HTTP Authorization header
to an http URI upon receiving a same-hostname https-to-http redirect, which makes
it easier for remote attackers to discover credentials by sniffing the network.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-18074</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-18074</url>
<url>https://github.com/requests/requests/issues/4716</url>
<url>https://github.com/requests/requests/pull/4718</url>
<url>https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff</url>
</references>
<dates>
<discovery>2018-06-27</discovery>
<entry>2019-01-22</entry>
<modified>2019-01-27</modified>
</dates>
</vuln>
<vuln vid="6aa398d0-1c4d-11e9-96dd-a4badb296695">
<topic>joomla3 -- vulnerabilitiesw</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports:</p>
<blockquote cite="https://developer.joomla.org/security-centre/760-00190101-core-stored-xss-in-mod-banners.html">
<p>Inadequate escaping in mod_banners leads to a stored XSS vulnerability.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact.html">
<p>Inadequate escaping in com_contact leads to a stored XSS vulnerability</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings.html">
<p>Inadequate checks at the Global Configuration Text Filter settings allowed a stored XSS.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url.html">
<p>Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/760-00190101-core-stored-xss-in-mod-banners.html</url>
<cvename>CVE-2019-6264</cvename>
<url>https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact.html</url>
<cvename>CVE-2019-6261</cvename>
<url>https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings.html</url>
<cvename>CVE-2019-6263</cvename>
<url>https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url.html</url>
<cvename>CVE-2019-6262</cvename>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2019-01-20</entry>
</dates>
</vuln>
<vuln vid="e00ed3d9-1c27-11e9-a257-000ffec0b3e1">
<topic>drupal -- Drupal core - Arbitrary PHP code execution</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.63</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2019-002">
<p>A remote code execution vulnerability exists in PHP's built-in
phar stream wrapper when performing file operations on an untrusted phar:// URI.</p>
<p>Some Drupal code (core, contrib, and custom) may be performing file operations on
insufficiently validated user input, thereby being exposed to this vulnerability.</p>
<p>This vulnerability is mitigated by the fact that such code paths typically require
access to an administrative permission or an atypical configuration.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-006</url>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-01-19</entry>
</dates>
</vuln>
<vuln vid="2a8b79c3-1b6e-11e9-8cf4-1c39475b9f84">
<topic>Helm -- client unpacking chart that contains malicious content</topic>
<affects>
<package>
<name>helm</name>
<range><ge>2.0.0</ge><lt>2.12.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Helm security notice</p>
<blockquote cite="https://helm.sh/blog/helm-security-notice-2019/index.html">
<p>A specially crafted chart may be able to unpack content into locations on
the filesystem outside of the chart's path, potentially
overwriting existing files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://helm.sh/blog/helm-security-notice-2019/index.html</url>
</references>
<dates>
<discovery>2019-01-14</discovery>
<entry>2019-01-18</entry>
</dates>
</vuln>
<vuln vid="ff50192c-19eb-11e9-8573-001b217b3468">
<topic>Gitlab -- Arbitrary repo read in Gitlab project import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.6.0</ge><lt>11.6.4</lt></range>
<range><ge>11.5.0</ge><lt>11.5.7</lt></range>
<range><ge>8.9.0</ge><lt>11.4.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/">
<p>Arbitrary repo read in Gitlab project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2019/01/16/critical-security-release-gitlab-11-dot-6-dot-4-released/</url>
<cvename>CVE-2019-6240</cvename>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-01-17</entry>
</dates>
</vuln>
<vuln vid="debf6353-5753-4e9a-b710-a83ecdd743de">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.160</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.150.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2019-01-16/">
<h1>Description</h1>
<h5>(High) SECURITY-868</h5>
<p>Administrators could persist access to Jenkins using crafted 'Remember me' cookie</p>
<h5>(Medium) SECURITY-901</h5>
<p>Deleting a user in an external security realm did not invalidate their session or 'Remember me' cookie</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2019-01-16/</url>
</references>
<dates>
<discovery>2019-01-16</discovery>
<entry>2019-01-16</entry>
</dates>
</vuln>
<vuln vid="383931ba-1818-11e9-92ea-448a5b29e8a9">
<topic>py-matrix-synapse -- undisclosed vulnerability</topic>
<affects>
<package>
<name>py27-matrix-synapse</name>
<name>py35-matrix-synapse</name>
<name>py36-matrix-synapse</name>
<name>py37-matrix-synapse</name>
<range><lt>0.34.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matrix developers report:</p>
<blockquote cite="https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/">
<p>The matrix team announces the availablility of synapse security releases 0.34.0.1 and 0.34.1.1, fixing CVE-2019-5885.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-5885</cvename>
<url>https://matrix.org/blog/2019/01/10/critical-security-update-synapse-0-34-0-1-synapse-0-34-1-1/</url>
</references>
<dates>
<discovery>2019-01-10</discovery>
<entry>2019-01-15</entry>
</dates>
</vuln>
<vuln vid="d38bbb79-14f3-11e9-9ce2-28d244aee256">
<topic>irssi -- Use after free</topic>
<affects>
<package>
<name>irssi</name>
<range><ge>1.1.0,1</ge><lt>1.1.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2019_01.txt">
<p>Use after free when hidden lines were expired from the scroll
buffer. It may affect the stability of Irssi. (CWE-417, CWE-825)</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2019_01.txt</url>
<cvename>CVE-2019-5882</cvename>
<freebsdpr>ports/234798</freebsdpr>
</references>
<dates>
<discovery>2019-01-09</discovery>
<entry>2019-01-10</entry>
</dates>
</vuln>
<vuln vid="924bd4f8-11e7-11e9-9fe8-5404a68ad561">
<topic>uriparser -- Out-of-bounds read</topic>
<affects>
<package>
<name>uriparser</name>
<range><lt>0.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream project reports:</p>
<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog">
<p>Out-of-bounds read in uriParse*Ex* for incomplete URIs with IPv6
addresses with embedded IPv4 address, e.g. "//[::44.1";
mitigated if passed parameter afterLast points to readable memory
containing a '\0' byte.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog</url>
</references>
<dates>
<discovery>2019-01-02</discovery>
<entry>2019-01-06</entry>
</dates>
</vuln>
<vuln vid="63e36475-119f-11e9-aba7-080027fee39c">
<topic>gitea -- insufficient privilege check</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2019/01/release-of-1.6.3/">
<p>Security</p>
<ul>
<li>Prevent DeleteFilePost doing arbitrary deletion</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/5631</url>
</references>
<dates>
<discovery>2019-01-04</discovery>
<entry>2019-01-06</entry>
</dates>
</vuln>
<vuln vid="720590df-10eb-11e9-b407-080027ef1a23">
<topic>chromium -- Use after free in PDFium</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>71.0.3578.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html">
<p>1 security fix contributed by external researches:</p>
<ul>
<li>High CVE-2018-17481: Use after free in PDFium</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-17481</cvename>
<url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop_12.html</url>
</references>
<dates>
<discovery>2018-12-12</discovery>
<entry>2019-01-05</entry>
</dates>
</vuln>
<vuln vid="546d4dd4-10ea-11e9-b407-080027ef1a23">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>71.0.3578.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html">
<p>43 security fixes in this release, including:</p>
<ul>
<li>High CVE-2018-17480: Out of bounds write in V8</li>
<li>High CVE-2018-17481: Use after free in PDFium</li>
<li>High CVE-2018-18335: Heap buffer overflow in Skia</li>
<li>High CVE-2018-18336: Use after free in PDFium</li>
<li>High CVE-2018-18337: Use after free in Blink</li>
<li>High CVE-2018-18338: Heap buffer overflow in Canvas</li>
<li>High CVE-2018-18339: Use after free in WebAudio</li>
<li>High CVE-2018-18340: Use after free in MediaRecorder</li>
<li>High CVE-2018-18341: Heap buffer overflow in Blink</li>
<li>High CVE-2018-18342: Out of bounds write in V8</li>
<li>High CVE-2018-18343: Use after free in Skia</li>
<li>High CVE-2018-18344: Inappropriate implementation in Extensions</li>
<li>High To be allocated: Multiple issues in SQLite via WebSQL</li>
<li>Medium CVE-2018-18345: Inappropriate implementation in Site Isolation</li>
<li>Medium CVE-2018-18346: Incorrect security UI in Blink</li>
<li>Medium CVE-2018-18347: Inappropriate implementation in Navigation</li>
<li>Medium CVE-2018-18348: Inappropriate implementation in Omnibox</li>
<li>Medium CVE-2018-18349: Insufficient policy enforcement in Blink</li>
<li>Medium CVE-2018-18350: Insufficient policy enforcement in Blink</li>
<li>Medium CVE-2018-18351: Insufficient policy enforcement in Navigation</li>
<li>Medium CVE-2018-18352: Inappropriate implementation in Media</li>
<li>Medium CVE-2018-18353: Inappropriate implementation in Network Authentication</li>
<li>Medium CVE-2018-18354: Insufficient data validation in Shell Integration</li>
<li>Medium CVE-2018-18355: Insufficient policy enforcement in URL Formatter</li>
<li>Medium CVE-2018-18356: Use after free in Skia</li>
<li>Medium CVE-2018-18357: Insufficient policy enforcement in URL Formatter</li>
<li>Medium CVE-2018-18358: Insufficient policy enforcement in Proxy</li>
<li>Medium CVE-2018-18359: Out of bounds read in V8</li>
<li>Low To be allocated: Inappropriate implementation in PDFium</li>
<li>Low To be allocated: Use after free in Extensions</li>
<li>Low To be allocated: Inappropriate implementation in Navigation</li>
<li>Low To be allocated: Inappropriate implementation in Navigation</li>
<li>Low To be allocated: Insufficient policy enforcement in Navigation</li>
<li>Low To be allocated: Insufficient policy enforcement in URL Formatter</li>
<li>Medium To be allocated: Insufficient policy enforcement in Payments</li>
<li>Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-17480</cvename>
<cvename>CVE-2018-17481</cvename>
<cvename>CVE-2018-18335</cvename>
<cvename>CVE-2018-18336</cvename>
<cvename>CVE-2018-18337</cvename>
<cvename>CVE-2018-18338</cvename>
<cvename>CVE-2018-18339</cvename>
<cvename>CVE-2018-18340</cvename>
<cvename>CVE-2018-18341</cvename>
<cvename>CVE-2018-18342</cvename>
<cvename>CVE-2018-18343</cvename>
<cvename>CVE-2018-18344</cvename>
<cvename>CVE-2018-18345</cvename>
<cvename>CVE-2018-18346</cvename>
<cvename>CVE-2018-18347</cvename>
<cvename>CVE-2018-18348</cvename>
<cvename>CVE-2018-18349</cvename>
<cvename>CVE-2018-18350</cvename>
<cvename>CVE-2018-18351</cvename>
<cvename>CVE-2018-18352</cvename>
<cvename>CVE-2018-18353</cvename>
<cvename>CVE-2018-18354</cvename>
<cvename>CVE-2018-18355</cvename>
<cvename>CVE-2018-18356</cvename>
<cvename>CVE-2018-18357</cvename>
<cvename>CVE-2018-18358</cvename>
<cvename>CVE-2018-18359</cvename>
<url>https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-12-04</discovery>
<entry>2019-01-05</entry>
</dates>
</vuln>
<vuln vid="3e41c1a6-10bc-11e9-bd85-fcaa147e860e">
<topic>Django -- Content spoofing possibility in the default 404 page</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<name>py37-django111</name>
<range><lt>1.11.18</lt></range>
</package>
<package>
<name>py35-django20</name>
<name>py36-django20</name>
<name>py37-django20</name>
<range><lt>2.0.10</lt></range>
</package>
<package>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Django security releases issued reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2019/jan/04/security-releases/">
<p>An attacker could craft a malicious URL that could make spoofed content
appear on the default page generated by the django.views.defaults.page_not_found()
view.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2019-3498</cvename>
<url>https://www.djangoproject.com/weblog/2019/jan/04/security-releases/</url>
</references>
<dates>
<discovery>2019-01-03</discovery>
<entry>2019-01-05</entry>
</dates>
</vuln>
<vuln vid="b2f4ab91-0e6b-11e9-8700-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.6.0</ge><lt>11.6.1</lt></range>
<range><ge>11.5.0</ge><lt>11.5.6</lt></range>
<range><ge>8.0.0</ge><lt>11.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/">
<p>Source code disclosure merge request diff</p>
<p>Todos improper access control</p>
<p>URL rel attribute not set</p>
<p>Persistent XSS Autocompletion</p>
<p>SSRF repository mirroring</p>
<p>CI job token LFS error message disclosure</p>
<p>Secret CI variable exposure</p>
<p>Guest user CI job disclosure</p>
<p>Persistent XSS label reference</p>
<p>Persistent XSS wiki in IE browser</p>
<p>SSRF in project imports with LFS</p>
<p>Improper access control CI/CD settings</p>
<p>Missing authorization control merge requests</p>
<p>Improper access control branches and tags</p>
<p>Missing authentication for Prometheus alert endpoint</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/31/security-release-gitlab-11-dot-6-dot-1-released/</url>
<cvename>CVE-2018-20493</cvename>
<cvename>CVE-2018-20492</cvename>
<cvename>CVE-2018-20489</cvename>
<cvename>CVE-2018-20490</cvename>
<cvename>CVE-2018-20497</cvename>
<cvename>CVE-2018-20495</cvename>
<cvename>CVE-2018-20488</cvename>
<cvename>CVE-2018-20494</cvename>
<cvename>CVE-2018-20496</cvename>
<cvename>CVE-2018-20491</cvename>
<cvename>CVE-2018-20499</cvename>
<cvename>CVE-2018-20500</cvename>
<cvename>CVE-2018-20501</cvename>
<cvename>CVE-2018-20498</cvename>
<cvename>CVE-2018-20507</cvename>
</references>
<dates>
<discovery>2018-12-31</discovery>
<entry>2019-01-02</entry>
</dates>
</vuln>
<vuln vid="29d34524-0542-11e9-a444-080027fee39c">
<topic>gitea -- privilege escalation, XSS</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/releases/tag/v1.6.2">
<p>Security</p>
<ul>
<li>Sanitize uploaded file names</li>
<li>HTMLEncode user added text</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/5569</url>
<url>https://github.com/go-gitea/gitea/issues/5565</url>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-21</entry>
</dates>
</vuln>
<vuln vid="f8fe2905-0918-11e9-a550-00262d164c21">
<topic>rpm4 -- regression in -setperms, -setugids and -restore</topic>
<affects>
<package>
<name>rpm4</name>
<range><lt>4.14.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rpm4 reports:</p>
<blockquote cite="http://rpm.org/wiki/Releases/4.14.2.1">
<p>Regression in -setperms, -setugids and -restore</p>
<p>Note that this update can not automatically fix possible damage
done by using -setperms, -setugids or -restore with rpm 4.14.2, it
merely fixes the functionlity itself. Any damage needs to be
investigated and fixed manually, such as using -verify and -restore
or reinstalling packages.</p>
</blockquote>
</body>
</description>
<references>
<url>http://rpm.org/wiki/Releases/4.14.2.1</url>
</references>
<dates>
<discovery>2018-10-22</discovery>
<entry>2018-12-26</entry>
</dates>
</vuln>
<vuln vid="70b774a8-05bc-11e9-87ad-001b217b3468">
<topic>Gitlab -- Arbitrary File read in Gitlab project import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.5</lt></range>
<range><ge>11.4.0</ge><lt>11.4.12</lt></range>
<range><ge>8.9.0</ge><lt>11.3.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released">
<p>Arbitrary File read in Gitlab project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/20/critical-security-release-gitlab-11-dot-5-dot-5-released/</url>
<cvename>CVE-2018-20229</cvename>
</references>
<dates>
<discovery>2018-12-20</discovery>
<entry>2018-12-22</entry>
</dates>
</vuln>
<vuln vid="4f8665d0-0465-11e9-b77a-6cc21735f730">
<topic>shibboleth-sp -- crashes on malformed date/time content</topic>
<affects>
<package>
<name>shibboleth-sp</name>
<range><ge>3.0.0</ge><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Shibboleth Consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20181219a.txt">
<p>SAML messages, assertions, and metadata all commonly contain
date/time information in a standard XML format.</p>
<p>Invalid formatted data in such fields cause an exception of a type
that was not handled properly in the V3 software and causes a crash
(usually to the shibd daemon process, but possibly to Apache in rare
cases). Note that the crash occurs prior to evaluation of a message's
authenticity, so can be exploited by an untrusted attacker.</p>
<p>The problem is believed to be specific to the V3 software and would
not cause a crash in the older, now unsupported, V2 software.</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20181219a.txt</url>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-20</entry>
</dates>
</vuln>
<vuln vid="1999a215-fc6b-11e8-8a95-ac1f6b67e138">
<topic>couchdb -- administrator privilege escalation</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>2.3.0,2</lt></range>
</package>
<package>
<name>couchdb2</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/...">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.couchdb.org/en/stable/cve/2018-17188.html</url>
<cvename>CVE-2018-17188</cvename>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2018-12-13</entry>
</dates>
</vuln>
<vuln vid="b80f039d-579e-4b82-95ad-b534a709f220">
<topic>bro -- "Magellan" remote code execution vulnerability in bundled sqlite</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bro Network security Monitor reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.6.1 updates the embedded SQLite to version 3.26.0
to address the "Magellan" remote code execution vulnerability.
The stock Bro configuration/scripts don't use SQLite by
default, but custom user scripts/packages may.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-12-01</discovery>
<entry>2018-12-20</entry>
</dates>
</vuln>
<vuln vid="fa6a4a69-03d1-11e9-be12-a4badb2f4699">
<topic>FreeBSD -- bootpd buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>12.0</ge><lt>12.0_1</lt></range>
<range><ge>11.2</ge><lt>11.2_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient validation of network-provided data
it may be possible for a malicious attacker to craft a bootp
packet which could cause a stack buffer overflow.</p>
<h1>Impact:</h1>
<p>It is possible that the buffer overflow could lead to a
Denial of Service or remote code execution.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1716</cvename>
<freebsdsa>SA-18:15.bootpd</freebsdsa>
</references>
<dates>
<discovery>2018-12-19</discovery>
<entry>2018-12-19</entry>
</dates>
</vuln>
<vuln vid="4b98613c-0078-11e9-b05b-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>5.0.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/">
<p>WordPress versions 5.0 and earlier are affected by the following bugs, which are
fixed in version 5.0.1. Updated versions of WordPress 4.9 and older releases are
also available, for users who have not yet updated to 5.0.</p>
<p>Karim El Ouerghemmi discovered that authors could alter meta data to delete files
that they weren’t authorized to.</p>
<p>Simon Scannell of RIPS Technologies discovered that authors could create posts of
unauthorized post types with specially crafted input.</p>
<p>Sam Thomas discovered that contributors could craft meta data in a way that resulted
in PHP object injection.</p>
<p>Tim Coen discovered that contributors could edit new comments from higher-privileged
users, potentially leading to a cross-site scripting vulnerability.</p>
<p>Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site
scripting vulnerability in some circumstances. WordPress itself was not affected,
but plugins could be in some situations.</p>
<p>Team Yoast discovered that the user activation screen could be indexed by search
engines in some uncommon configurations, leading to exposure of email addresses,
and in some rare cases, default generated passwords.</p>
<p>Tim Coen and Slavco discovered that authors on Apache-hosted sites could upload
specifically crafted files that bypass MIME verification, leading to a cross-site
scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release/</url>
</references>
<dates>
<discovery>2018-12-13</discovery>
<entry>2018-12-15</entry>
</dates>
</vuln>
<vuln vid="293f40a0-ffa1-11e8-b258-0011d823eebd">
<topic>Mbed TLS -- Local timing attack on RSA decryption</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03">
<p>An attacker who can run code on the same machine that is
performing an RSA decryption can potentially recover the plaintext
through a Bleichenbacher-like oracle.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03</url>
<cvename>CVE-2018-19608</cvename>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="bab29816-ff93-11e8-b05b-00e04c1ea73d">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-8</name>
<range><lt>8.7.21</lt></range>
</package>
<package>
<name>typo3-9</name>
<range><lt>9.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/">
<p>CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr.
The vulnerability stemmed from the fact that it was possible to execute XSS inside
the CKEditor source area after persuading the victim to: (i) switch CKEditor to
source mode, then (ii) paste a specially crafted HTML code, prepared by the attacker,
into the opened CKEditor source area, and (iii) switch back to WYSIWYG mode.
Although this is an unlikely scenario, we recommend to upgrade to the latest editor version.</p>
<p>Failing to properly encode user input, online media asset rendering
(*.youtube and *.vimeo files) is vulnerable to cross-site scripting. A valid backend user
account or write access on the server system (e.g. SFTP) is needed in order to exploit this
vulnerability.</p>
<p>Failing to properly encode user input, notifications shown in modal windows in the TYPO3
backend are vulnerable to cross-site scripting. A valid backend user account is needed in
order to exploit this vulnerability.</p>
<p>Failing to properly encode user input, login status display is vulnerable to cross-site
scripting in the website frontend. A valid user account is needed in order to exploit this
vulnerability - either a backend user or a frontend user having the possibility to modify
their user profile.</p>
<p>Template patterns that are affected are:</p>
<ul>
<li>###FEUSER_[fieldName]### using system extension felogin</li>
<li><!--###USERNAME###--> for regular frontend rendering
(pattern can be defined individually using TypoScript setting
config.USERNAME_substToken)</li>
</ul>
<p>It has been discovered that cookies created in the Install Tool are not hardened to be
submitted only via HTTP. In combination with other vulnerabilities such as cross-site
scripting it can lead to hijacking an active and valid session in the Install Tool.</p>
<p>The Install Tool exposes the current TYPO3 version number to non-authenticated users.</p>
<p>Online Media Asset Handling (*.youtube and *.vimeo files) in the TYPO3 backend is vulnerable
to denial of service. Putting large files with according file extensions results in high
consumption of system resources. This can lead to exceeding limits of the current PHP process
which results in a dysfunctional backend component. A valid backend user account or write
access on the server system (e.g. SFTP) is needed in order to exploit this vulnerability.</p>
<p>TYPO3’s built-in record registration functionality (aka “basic shopping cart”) using recs
URL parameters is vulnerable to denial of service. Failing to properly ensure that anonymous
user sessions are valid, attackers can use this vulnerability in order to create an arbitrary
amount of individual session-data records in the database.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="757e6ee8-ff91-11e8-a148-001b217b3468">
<topic>Gitlab -- Arbitrary File read in GitLab project import with Git LFS</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.4</lt></range>
<range><ge>11.4.0</ge><lt>11.4.11</lt></range>
<range><ge>11.0.0</ge><lt>11.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/">
<p>Arbitrary File read in GitLab project import with Git LFS</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/13/critical-security-release-gitlab-11-dot-5-dot-4-released/</url>
<cvename>CVE-2018-20144</cvename>
</references>
<dates>
<discovery>2018-12-13</discovery>
<entry>2018-12-14</entry>
</dates>
</vuln>
<vuln vid="ed10ed3f-fddc-11e8-94cf-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-6/">
<h3>Summary</h3>
<p>Local file inclusion through transformation feature</p>
<h3>Description</h3>
<p>A flaw has been found where an attacker can exploit
phpMyAdmin to leak the contents of a local file. The
attacker must have access to the phpMyAdmin Configuration
Storage tables, although these can easily be created in any
database to which the attacker has access. An attacker must
have valid credentials to log in to phpMyAdmin; this
vulnerability does not allow an attacker to circumvent the
login system.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be severe.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-7/">
<h3>Summary</h3>
<p>XSRF/CSRF vulnerability in phpMyAdmin</p>
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible to perform harmful SQL operations such as renaming
databases, creating new tables/routines, deleting designer
pages, adding/deleting users, updating user passwords,
killing SQL processes, etc.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-8/">
<h3>Summary</h3>
<p>XSS vulnerability in navigation tree</p>
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
navigation tree, where an attacker can deliver a payload to
a user through a specially-crafted database/table name.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>The stored XSS vulnerabilities can be triggered only by
someone who logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required forms.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-6/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-7/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-8/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-12</entry>
</dates>
</vuln>
<vuln vid="d10b49b2-8d02-49e8-afde-0844626317af">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>64.0_3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.6</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/">
<p>CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module</p>
<p>CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11</p>
<p>CVE-2018-18492: Use-after-free with select element</p>
<p>CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia</p>
<p>CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs</p>
<p>CVE-2018-18495: WebExtension content scripts can be loaded in about: pages</p>
<p>CVE-2018-18496: Embedded feed preview page can be abused for clickjacking</p>
<p>CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators</p>
<p>CVE-2018-18498: Integer overflow when calculating buffer sizes for images</p>
<p>CVE-2018-12406: Memory safety bugs fixed in Firefox 64</p>
<p>CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12405</cvename>
<cvename>CVE-2018-12406</cvename>
<cvename>CVE-2018-12407</cvename>
<cvename>CVE-2018-17466</cvename>
<cvename>CVE-2018-18492</cvename>
<cvename>CVE-2018-18493</cvename>
<cvename>CVE-2018-18494</cvename>
<cvename>CVE-2018-18495</cvename>
<cvename>CVE-2018-18496</cvename>
<cvename>CVE-2018-18497</cvename>
<cvename>CVE-2018-18498</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/</url>
</references>
<dates>
<discovery>2018-12-11</discovery>
<entry>2018-12-11</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="32498c8f-fc84-11e8-be12-a4badb2f4699">
<topic>FreeBSD -- Insufficient bounds checking in bhyve(8) device model</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient bounds checking in one of the device models
provided by bhyve(8) can permit a guest operating system
to overwrite memory in the bhyve(8) processing possibly
permitting arbitary code execution.</p>
<h1>Impact:</h1>
<p>A guest OS using a firmware image can cause the bhyve
process to crash, or possibly execute arbitrary code on the
host as root.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1716</cvename>
<freebsdsa>SA-18:14.bhyve</freebsdsa>
</references>
<dates>
<discovery>2018-12-04</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="268a4289-fc84-11e8-be12-a4badb2f4699">
<topic>FreeBSD -- Multiple vulnerabilities in NFS server code</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient and improper checking in the NFS server
code could cause a denial of service or possibly remote
code execution via a specially crafted network packet.</p>
<h1>Impact:</h1>
<p>A remote attacker could cause the NFS server to crash,
resulting in a denial of service, or possibly execute
arbitrary code on the server.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1715</cvename>
<freebsdsa>SA-18:13.nfs</freebsdsa>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="2a86f45a-fc3c-11e8-a414-00155d006b02">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node6</name>
<range><lt>6.15.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.14.0</lt></range>
</package>
<package>
<name>node10</name>
<range><lt>10.14.0</lt></range>
</package>
<package>
<name>node</name>
<range><lt>11.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/">
<p>Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j.</p>
<p>We recommend that all Node.js users upgrade to a version listed below as soon as possible.</p>
<h1>Debugger port 5858 listens on any interface by default (CVE-2018-12120)</h1>
<p>All versions of Node.js 6 are vulnerable and the severity is HIGH. When the debugger is enabled with <code>node --debug</code> or <code>node debug</code>, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as <code>node --debug=localhost</code>. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.</p>
<h1>Denial of Service with large HTTP headers (CVE-2018-12121)</h1>
<p>All versions of 6 and later are vulnerable and the severity is HIGH. By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
<p>The total size of HTTP headers received by Node.js now must not exceed 8192 bytes.</p>
<h1>"Slowloris" HTTP Denial of Service (CVE-2018-12122)</h1>
<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.</p>
<p>A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with <code>server.headersTimeout</code>. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with <code>server.setTimeout()</code>, this aids in protecting against excessive resource retention and possible Denial of Service.</p>
<h1>Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)</h1>
<p>All versions of Node.js 6 and later are vulnerable and the severity is LOW. If a Node.js application is using <code>url.parse()</code> to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.</p>
<h1>HTTP request splitting (CVE-2018-12116)</h1>
<p>Node.js 6 and 8 are vulnerable and the severity is MEDIUM. If Node.js can be convinced to use unsanitized user-provided Unicode data for the <code>path</code> option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.</p>
<h1>OpenSSL Timing vulnerability in ECDSA signature generation (CVE-2018-0735)</h1>
<p>The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
<h1>OpenSSL Timing vulnerability in DSA signature generation (CVE-2018-0734)</h1>
<p>The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side-channel attack. An attacker could use variations in the signing algorithm to recover the private key.</p>
<h1>OpenSSL Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407)</h1>
<p>OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side-channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/</url>
<cvename>CVE-2018-12120</cvename>
<cvename>CVE-2018-12121</cvename>
<cvename>CVE-2018-12122</cvename>
<cvename>CVE-2018-12123</cvename>
<cvename>CVE-2018-12116</cvename>
<cvename>CVE-2018-0735</cvename>
<cvename>CVE-2018-0734</cvename>
<cvename>CVE-2018-5407</cvename>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-10</entry>
</dates>
</vuln>
<vuln vid="f6d6308a-f2ec-11e8-b005-6805ca2fa271">
<topic>powerdns-recursor -- Crafted query can cause a denial of service</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>powerdns Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2018-16855: An issue has been found in PowerDNS Recursor where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd, a crash will lead to an automatic restart, limiting the impact to a somewhat degraded service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2018-16855</cvename>
</references>
<dates>
<discovery>2018-11-26</discovery>
<entry>2018-12-09</entry>
</dates>
</vuln>
<vuln vid="0e8f496a-b498-11e8-bdcf-74d435e60b7c">
<topic>py-asyncssh -- Allows bypass of authentication</topic>
<affects>
<package>
<name>py-asyncssh</name>
<range><lt>1.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre.org Reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749">
<p>The SSH server implementation of AsyncSSH before 1.12.1 does not properly check
whether authentication is completed before processing other requests
A customized SSH client can simply skip the authentication step.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7749</url>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-12-08</entry>
</dates>
</vuln>
<vuln vid="9d3428d4-f98c-11e8-a148-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.3</lt></range>
<range><ge>11.4.0</ge><lt>11.4.10</lt></range>
<range><ge>8.11.0</ge><lt>11.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released">
<p>Directory Traversal in Templates API</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/12/06/critical-security-release-gitlab-11-dot-5-dot-3-released/</url>
<cvename>CVE-2018-19856</cvename>
</references>
<dates>
<discovery>2018-12-06</discovery>
<entry>2018-12-06</entry>
</dates>
</vuln>
<vuln vid="49cbe200-f92a-11e8-a89d-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>32.0.0.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-42.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to arbitrary code execution (CVE-2018-15982).</li>
<li>This update resolves an insecure library loading vulnerability that
could lead to privilege escalation (CVE-2018-15983).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15982</cvename>
<cvename>CVE-2018-15983</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-42.html</url>
</references>
<dates>
<discovery>2018-12-05</discovery>
<entry>2018-12-06</entry>
</dates>
</vuln>
<vuln vid="3aa27226-f86f-11e8-a085-3497f683cb16">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.154</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.138.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-12-05/">
<h1>Description</h1>
<h5>(Critical) SECURITY-595</h5>
<p>Code execution through crafted URLs</p>
<h5>(Medium) SECURITY-904</h5>
<p>Forced migration of user records</p>
<h5>(Medium) SECURITY-1072</h5>
<p>Workspace browser allowed accessing files outside the workspace</p>
<h5>(Medium) SECURITY-1193</h5>
<p>Potential denial of service through cron expression form validation</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-12-05/</url>
</references>
<dates>
<discovery>2018-12-05</discovery>
<entry>2018-12-05</entry>
</dates>
</vuln>
<vuln vid="889e35f4-f6a0-11e8-82dc-fcaa147e860e">
<topic>moodle -- Login CSRF vulnerability</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.15</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.9</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.6</lt></range>
</package>
<package>
<name>moodle35</name>
<range><lt>3.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=378731">
<p>The login form is not protected by a token to prevent login cross-site
request forgery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-16854</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=378731</url>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-12-03</entry>
</dates>
</vuln>
<vuln vid="f96044a2-7df9-414b-9f6b-6e5b85d06c86">
<topic>Rails -- Active Job vulnerability</topic>
<affects>
<package>
<name>rubygem-activejob4</name>
<range><lt>4.2.11</lt></range>
</package>
<package>
<name>rubygem-activejob5</name>
<range><lt>5.1.6.1</lt></range>
</package>
<package>
<name>rubygem-activejob50</name>
<range><lt>5.0.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/">
<p>Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These
contain the following important security fixes, and it is recommended
that users upgrade as soon as possible</p>
<p>CVE-2018-16476 Broken Access Control vulnerability in Active Job:
Carefully crafted user input can cause Active Job to deserialize it
using GlobalId and allow an attacker to have access to information that
they should not have.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/</url>
<cvename>CVE-2018-16476</cvename>
</references>
<dates>
<discovery>2018-11-27</discovery>
<entry>2018-12-02</entry>
</dates>
</vuln>
<vuln vid="3563fae5-f60c-11e8-b513-5404a68ad561">
<topic>uriparser -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>uriparser</name>
<range><lt>0.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The upstream project reports:</p>
<blockquote cite="https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog">
<p>* Fixed: Out-of-bounds write in uriComposeQuery* and uriComposeQueryEx*
Commit 864f5d4c127def386dd5cc926ad96934b297f04e
Thanks to Google Autofuzz team for the report!</p>
<p>* Fixed: Detect integer overflow in uriComposeQuery* and uriComposeQueryEx*
Commit f76275d4a91b28d687250525d3a0c5509bbd666f
Thanks to Google Autofuzz team for the report!</p>
<p>* Fixed: Protect uriResetUri* against acting on NULL input
Commit f58c25069cf4a986fe17a80c5b38687e31feb539</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19198</cvename>
<cvename>CVE-2018-19199</cvename>
<cvename>CVE-2018-19200</cvename>
<url>https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog</url>
</references>
<dates>
<discovery>2018-10-27</discovery>
<entry>2018-12-02</entry>
</dates>
</vuln>
<vuln vid="c7b1af20-f34f-11e8-9cde-e0d55e2a8bf9">
<topic>messagelib -- HTML email can open browser window automatically</topic>
<affects>
<package>
<name>messagelib</name>
<range><lt>18.08.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20181128-1.txt">
<p>messagelib is the library used by KMail to display emails.</p>
<p>messagelib by default displays emails as plain text, but gives the user
an option to "Prefer HTML to plain text" in the settings and if that option
is not enabled there is way to enable HTML display when an email contains HTML.</p>
<p>Some HTML emails can trick messagelib into opening a new browser window when
displaying said email as HTML.</p>
<p>This happens even if the option to allow the HTML emails to access
remote servers is disabled in KMail settings.</p>
<p>This means that the owners of the servers referred in the email can see
in their access logs your IP address.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19516</cvename>
<url>https://www.kde.org/info/security/advisory-20181128-1.txt</url>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="93f8e0ff-f33d-11e8-be46-0019dbb15b3f">
<topic>payara -- Default typing issue in Jackson Databind</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.181.3</eq></range>
<range><eq>4.1.2.182</eq></range>
<range><eq>5.181.3</eq></range>
<range><eq>5.182</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489">
<p>FasterXML jackson-databind before 2.8.11.1 and 2.9.x before
2.9.5 allows unauthenticated remote code execution because of
an incomplete fix for the CVE-2017-7525 deserialization flaw.
This is exploitable by sending maliciously crafted JSON input
to the readValue method of the ObjectMapper, bypassing a
blacklist that is ineffective if the c3p0 libraries are
available in the classpath.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7489</url>
<cvename>CVE-2018-7489</cvename>
</references>
<dates>
<discovery>2018-02-26</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="22bc5327-f33f-11e8-be46-0019dbb15b3f">
<topic>payara -- Code execution via crafted PUT requests to JSPs</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.174</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615">
<p>When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP
PUTs enabled (e.g. via setting the readonly initialisation
parameter of the Default to false) it was possible to upload a
JSP file to the server via a specially crafted request. This
JSP could then be requested and any code it contained would be
executed by the server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615</url>
<cvename>CVE-2017-12615</cvename>
</references>
<dates>
<discovery>2017-08-07</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="d70c9e18-f340-11e8-be46-0019dbb15b3f">
<topic>payara -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>payara</name>
<range><eq>4.1.2.173</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031">
<p>Apache Commons FileUpload before 1.3.3
DiskFileItem File Manipulation Remote Code Execution.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239">
<p>Vulnerability in the Oracle GlassFish Server component of
Oracle Fusion Middleware (subcomponent: Administration).
Supported versions that are affected are 3.0.1 and 3.1.2.
Easily exploitable vulnerability allows low privileged attacker
with logon to the infrastructure where Oracle GlassFish Server
executes to compromise Oracle GlassFish Server. Successful
attacks of this vulnerability can result in unauthorized read
access to a subset of Oracle GlassFish Server accessible data.
CVSS v3.0 Base Score 3.3 (Confidentiality impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Core). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
vulnerability allows unauthenticated attacker with network access
via SMTP to compromise Oracle GlassFish Server. Successful
attacks require human interaction from a person other than the
attacker. Successful attacks of this vulnerability can result in
unauthorized update, insert or delete access to some of Oracle
GlassFish Server accessible data. CVSS v3.0 Base Score 4.3
(Integrity impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249">
<p>Vulnerability in the Oracle GlassFish Server component of
Oracle Fusion Middleware (subcomponent: Security). Supported
versions that are affected are 2.1.1, 3.0.1 and 3.1.2.
Easily exploitable vulnerability allows unauthenticated attacker
with network access via LDAP to compromise Oracle GlassFish Server.
Successful attacks of this vulnerability can result in unauthorized
update, insert or delete access to some of Oracle GlassFish Server
accessible data as well as unauthorized read access to a subset of
Oracle GlassFish Server accessible data and unauthorized ability
to cause a partial denial of service (partial DOS) of Oracle
GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality,
Integrity and Availability impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Security). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable
vulnerability allows unauthenticated attacker with network access
via HTTP to compromise Oracle GlassFish Server. Successful attacks
of this vulnerability can result in unauthorized update, insert or
delete access to some of Oracle GlassFish Server accessible data as
well as unauthorized read access to a subset of Oracle GlassFish
Server accessible data and unauthorized ability to cause a partial
denial of service (partial DOS) of Oracle GlassFish Server.
CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and
Availability impacts).</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528">
<p>Vulnerability in the Oracle GlassFish Server component of Oracle
Fusion Middleware (subcomponent: Security). Supported versions that
are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit
vulnerability allows unauthenticated attacker with network access
via multiple protocols to compromise Oracle GlassFish Server. While
the vulnerability is in Oracle GlassFish Server, attacks may
significantly impact additional products. Successful attacks of this
vulnerability can result in takeover of Oracle GlassFish Server.
CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and
Availability impacts).</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000031</url>
<cvename>CVE-2016-1000031</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3239</url>
<cvename>CVE-2017-3239</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3247</url>
<cvename>CVE-2017-3247</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3249</url>
<cvename>CVE-2017-3249</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3250</url>
<cvename>CVE-2017-3250</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5528</url>
<cvename>CVE-2016-5528</cvename>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="8a4aba2d-f33e-11e8-9416-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.5.0</ge><lt>11.5.1</lt></range>
<range><ge>11.4.0</ge><lt>11.4.8</lt></range>
<range><ge>0</ge><lt>11.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released">
<p>View Names of Private Groups</p>
<p>Persistent XSS in Environments</p>
<p>SSRF in Prometheus integration</p>
<p>Unauthorized Promotion of Milestones</p>
<p>Exposure of Confidential Issue Title</p>
<p>Persisent XSS in Markdown Fields via Mermaid Script</p>
<p>Persistent XSS in Markdown Fields via Unrecognized HTML Tags</p>
<p>Symlink Race Condition in Pages</p>
<p>Unauthorized Changes by Guest User in Issues</p>
<p>Unauthorized Comments on Locked Issues</p>
<p>Improper Enforcement of Token Scope</p>
<p>CRLF Injection in Project Mirroring</p>
<p>XSS in OAuth Authorization</p>
<p>SSRF in Webhooks</p>
<p>Send Email on Email Address Change</p>
<p>Workhorse Logs Contained Tokens</p>
<p>Unauthorized Publishing of Draft Comments</p>
<p>Guest Can Set Weight of a New Issue</p>
<p>Disclosure of Private Group's Members and Milestones</p>
<p>Persisent XSS in Operations</p>
<p>Reporter Can View Operations Page</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/</url>
<cvename>CVE-2018-19494</cvename>
<cvename>CVE-2018-19493</cvename>
<cvename>CVE-2018-19495</cvename>
<cvename>CVE-2018-19496</cvename>
<cvename>CVE-2018-19577</cvename>
<cvename>CVE-2018-19573</cvename>
<cvename>CVE-2018-19570</cvename>
<cvename>CVE-2018-19572</cvename>
<cvename>CVE-2018-19576</cvename>
<cvename>CVE-2018-19575</cvename>
<cvename>CVE-2018-19569</cvename>
<cvename>CVE-2018-19585</cvename>
<cvename>CVE-2018-19574</cvename>
<cvename>CVE-2018-19571</cvename>
<cvename>CVE-2018-19580</cvename>
<cvename>CVE-2018-19583</cvename>
<cvename>CVE-2018-19582</cvename>
<cvename>CVE-2018-19581</cvename>
<cvename>CVE-2018-19584</cvename>
<cvename>CVE-2018-19579</cvename>
<cvename>CVE-2018-19578</cvename>
</references>
<dates>
<discovery>2018-11-28</discovery>
<entry>2018-11-28</entry>
</dates>
</vuln>
<vuln vid="54976998-f248-11e8-81e2-005056a311d1">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><le>4.6.16</le></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.12</lt></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.7</lt></range>
</package>
<package>
<name>samba49</name>
<range><lt>4.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-14629.html">
<p>All versions of Samba from 4.0.0 onwards are vulnerable to infinite
query recursion caused by CNAME loops. Any dns record can be added via
ldap by an unprivileged user using the ldbadd tool, so this is a
security issue.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16841.html">
<p>When configured to accept smart-card authentication, Samba's KDC will call
talloc_free() twice on the same memory if the principal in a validly signed
certificate does not match the principal in the AS-REQ.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16851.html">
<p>During the processing of an LDAP search before Samba's AD DC returns
the LDAP entries to the client, the entries are cached in a single
memory object with a maximum size of 256MB. When this size is
reached, the Samba process providing the LDAP service will follow the
NULL pointer, terminating the process.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16852.html">
<p>During the processing of an DNS zone in the DNS management DCE/RPC server,
the internal DNS server or the Samba DLZ plugin for BIND9, if the
DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS
property is set, the server will follow a NULL pointer and terminate</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16853.html">
<p>A user in a Samba AD domain can crash the KDC when Samba is built in the
non-default MIT Kerberos configuration.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-16857.html">
<p>AD DC Configurations watching for bad passwords (to restrict brute forcing
of passwords) in a window of more than 3 minutes may not watch for bad
passwords at all.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-14629.html</url>
<cvename>CVE-2018-14629</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16841.html</url>
<cvename>CVE-2018-16841</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16851.html</url>
<cvename>CVE-2018-16851</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16852.html</url>
<cvename>CVE-2018-16852</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16853.html</url>
<cvename>CVE-2018-16853</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-16857.html</url>
<cvename>CVE-2018-16857</cvename>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="ec49f6b5-ee39-11e8-b2f4-74d435b63d51">
<topic>php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter</topic>
<affects>
<package>
<name>php56-imap</name>
<range><lt>5.6.38_1</lt></range>
</package>
<package>
<name>php70-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php71-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php72-imap</name>
<range><lt>*</lt></range>
</package>
<package>
<name>php73-imap</name>
<range><lt>*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP team reports:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=77153">
<p>imap_open allows to run arbitrary shell commands via mailbox parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=77153</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-11-22</entry>
<modified>2018-11-22</modified>
</dates>
</vuln>
<vuln vid="b036faba-edd8-11e8-b3b7-00e04c1ea73d">
<topic>phpmailer -- Multiple vulnerability</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.27</lt></range>
</package>
<package>
<name>phpmailer6</name>
<range><lt>6.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6">
<p>CVE-2018-19296:Fix potential object injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27</url>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6</url>
<cvename>CVE-2018-19296</cvename>
</references>
<dates>
<discovery>2018-11-16</discovery>
<entry>2018-11-21</entry>
<modified>2018-11-23</modified>
</dates>
</vuln>
<vuln vid="8f128c72-ecf9-11e8-aa00-6451062f0f7a">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.153</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-44.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-15981).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15981</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-44.html</url>
</references>
<dates>
<discovery>2018-11-20</discovery>
<entry>2018-11-20</entry>
</dates>
</vuln>
<vuln vid="d889d32c-ecd9-11e8-9416-001b217b3468">
<topic>Gitlab -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.6</lt></range>
<range><ge>8.9.0</ge><lt>11.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/">
<p>Persistent XSS Autocompletion</p>
<p>Unauthorized service template creation</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/</url>
<cvename>CVE-2018-18643</cvename>
<cvename>CVE-2018-19359</cvename>
</references>
<dates>
<discovery>2018-11-19</discovery>
<entry>2018-11-20</entry>
</dates>
</vuln>
<vuln vid="0aee2f13-ec1d-11e8-8c92-6805ca2fa271">
<topic>powerdns -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>4.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Team reports:</p>
<blockquote cite="https://doc.powerdns.com/authoritative/changelog/4.1.html">
<p>CVE-2018-10851: An issue has been found in PowerDNS Authoritative Server allowing
an authorized user to cause a memory leak by inserting a specially crafted record
in a zone under their control, then sending a DNS query for that record. The issue
is due to the fact that some memory is allocated before the parsing and is not
always properly released if the record is malformed. When the PowerDNS
Authoritative Server is run inside the guardian (--guardian), or inside a
supervisor like supervisord or systemd, an out-of-memory crash will lead to an
automatic restart, limiting the impact to a somewhat degraded service.</p>
<p>CVE-2018-14626: An issue has been found in PowerDNS Authoritative Server allowing
a remote user to craft a DNS query that will cause an answer without DNSSEC
records to be inserted into the packet cache and be returned to clients asking for
DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname
and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients
will consider the answer to be bogus until it expires from the packet cache,
leading to a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/authoritative/changelog/4.1.html</url>
<cvename>CVE-2018-10851</cvename>
<cvename>CVE-2018-14626</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-19</entry>
</dates>
</vuln>
<vuln vid="e9aa0e4c-ea8b-11e8-a5b7-00e04c1ea73d">
<topic>powerdns-recursor -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.7</lt></range>
</package>
<package>
<name>powerdns-recursor40</name>
<range><lt>4.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>powerdns Team reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/changelog/4.1.html">
<p>CVE-2018-10851: An issue has been found in PowerDNS Recursor allowing
a malicious authoritative server to cause a memory leak by sending specially
crafted records. The issue is due to the fact that some memory is allocated
before the parsing and is not always properly released if the record is malformed.
When the PowerDNS Recursor is run inside a supervisor like supervisord or systemd,
an out-of-memory crash will lead to an automatic restart, limiting the impact to
a somewhat degraded service.</p>
<p>CVE-2018-14626: An issue has been found in PowerDNS Recursor allowing a remote
user to craft a DNS query that will cause an answer without DNSSEC records to be
inserted into the packet cache and be returned to clients asking for DNSSEC
records, thus hiding the presence of DNSSEC signatures for a specific qname and
qtype. For a DNSSEC-signed domain, this means that clients performing DNSSEC
validation by themselves might consider the answer to be bogus until it expires
from the packet cache, leading to a denial of service.</p>
<p>CVE-2018-14644: An issue has been found in PowerDNS Recursor where a remote attacker
sending a DNS query for a meta-type like OPT can lead to a zone being wrongly cached
as failing DNSSEC validation. It only arises if the parent zone is signed, and all
the authoritative servers for that parent zone answer with FORMERR to a query for at
least one of the meta-types. As a result, subsequent queries from clients requesting
DNSSEC validation will be answered with a ServFail.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/recursor/changelog/4.1.html</url>
<cvename>CVE-2018-10851</cvename>
<cvename>CVE-2018-14626</cvename>
<cvename>CVE-2018-14644</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-17</entry>
<modified>2018-11-19</modified>
</dates>
</vuln>
<vuln vid="c6fb2734-e835-11e8-b14b-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability DNS SRV and NAPTR lookups</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.6.1</lt></range>
</package>
<package>
<name>asterisk16</name>
<range><lt>16.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>There is a buffer overflow vulnerability in dns_srv
and dns_naptr functions of Asterisk that allows an attacker
to crash Asterisk via a specially crafted DNS SRV or NAPTR
response. The attackers request causes Asterisk to segfault
and crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-010.html</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-11-14</entry>
</dates>
</vuln>
<vuln vid="b69292e8-e798-11e8-ae07-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.148</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-39.html">
<ul>
<li>This update resolves a out-of-bounds vulnerability that
could lead to information disclosure (CVE-2018-15978).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15978</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-39.html</url>
</references>
<dates>
<discovery>2018-11-13</discovery>
<entry>2018-11-13</entry>
</dates>
</vuln>
<vuln vid="6f170cf2-e6b7-11e8-a9a8-b499baebfeaf">
<topic>OpenSSL -- timing vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2p_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20181112.txt">
<p>Microarchitecture timing vulnerability in ECC scalar
multiplication. Severity: Low<br/>
OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has
been shown to be vulnerable to a microarchitecture timing side channel
attack. An attacker with sufficient access to mount local timing
attacks during ECDSA signature generation could recover the private
key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20181112.txt</url>
<cvename>CVE-2018-5407</cvename>
</references>
<dates>
<discovery>2018-11-12</discovery>
<entry>2018-11-12</entry>
</dates>
</vuln>
<vuln vid="1460aa25-e6ab-11e8-a733-e0d55e2a8bf9">
<topic>kio-extras -- HTML Thumbnailer automatic remote file access</topic>
<affects>
<package>
<name>kio-extras</name>
<range><lt>18.08.3_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20181012-1.txt">
<p>Various KDE applications share a plugin system to create thumbnails
of various file types for displaying in file managers, file dialogs, etc.
kio-extras contains a thumbnailer plugin for HTML files.
</p>
<p>
The HTML thumbnailer was incorrectly accessing some content of
remote URLs listed in HTML files. This meant that the owners of the servers
referred in HTML files in your system could have seen in their access logs
your IP address every time the thumbnailer tried to create the thumbnail.
</p>
<p>
The HTML thumbnailer has been removed in upcoming KDE Applications 18.12.0
because it was actually not creating thumbnails for files at all.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-19120</cvename>
<url>https://www.kde.org/info/security/advisory-20181012-1.txt</url>
</references>
<dates>
<discovery>2018-11-12</discovery>
<entry>2018-11-12</entry>
</dates>
</vuln>
<vuln vid="791841a3-d484-4878-8909-92ef9ce424f4">
<topic>patch -- multiple vulnerabilities</topic>
<affects>
<package>
<name>patch</name>
<range><lt>2.7.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6951">
<p>An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6952">
<p>A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000156">
<p>GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6951</cvename>
<cvename>CVE-2018-6952</cvename>
<cvename>CVE-2018-1000156</cvename>
<url>https://savannah.gnu.org/bugs/?53132</url>
<url>https://savannah.gnu.org/bugs/?53133</url>
<url>https://savannah.gnu.org/bugs/?53566</url>
</references>
<dates>
<discovery>2018-04-16</discovery>
<entry>2018-11-11</entry>
<modified>2018-11-11</modified>
</dates>
</vuln>
<vuln vid="92a6efd0-e40d-11e8-ada4-408d5cf35399">
<topic>lighttpd - use-after-free vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd Project reports:</p>
<blockquote cite="https://www.lighttpd.net/2018/10/14/1.4.51/">
<p>Security fixes for Lighttpd:</p>
<ul>
<li><p>security: process headers after combining folded headers</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.lighttpd.net/2018/10/14/1.4.51/</url>
<freebsdpr>ports/232278</freebsdpr>
</references>
<dates>
<discovery>2018-08-26</discovery>
<entry>2018-11-09</entry>
</dates>
</vuln>
<vuln vid="1c27a706-e3aa-11e8-b77a-6cc21735f730">
<topic>PostgreSQL -- SQL injection in pg_upgrade and pg_dump</topic>
<affects>
<package>
<name>postgresql10-server</name>
<range><lt>10.6</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.11</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.15</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.20</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><lt>9.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1878/">
<p>CVE-2018-16850: SQL injection in pg_upgrade and pg_dump,
via CREATE TRIGGER ... REFERENCING.</p>
<p>Using a purpose-crafted trigger definition, an attacker can run
arbitrary SQL statements with superuser privileges when a superuser
runs pg_upgrade on the database or during a pg_dump dump/restore
cycle. This attack requires a CREATE privilege on some non-temporary
schema or a TRIGGER privilege on a table. This is exploitable in the
default PostgreSQL configuration, where all users have CREATE
privilege on public schema.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1905/</url>
<cvename>CVE-2018-16850</cvename>
</references>
<dates>
<discovery>2018-11-08</discovery>
<entry>2018-11-08</entry>
</dates>
</vuln>
<vuln vid="84ca56be-e1de-11e8-bcfd-00e04c1ea73d">
<topic>NGINX -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.14.1</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.15.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NGINX Team reports:</p>
<blockquote cite="http://nginx.org/en/security_advisories.html">
<p>Two security issues were identified in nginx HTTP/2 implementation,
which might cause excessive memory consumption (CVE-2018-16843)
and CPU usage (CVE-2018-16844).</p>
<p>The issues affect nginx compiled with the ngx_http_v2_module (not
compiled by default) if the "http2" option of the "listen" directive is
used in a configuration file.</p>
<p>A security issue was identified in the ngx_http_mp4_module, which might
allow an attacker to cause infinite loop in a worker process, cause a
worker process crash, or might result in worker process memory
isclosure by using a specially crafted mp4 file (CVE-2018-16845).</p>
<p>The issue only affects nginx if it is built with the ngx_http_mp4_module
(the module is not built by default) and the "mp4" directive is used in
the configuration file. Further, the attack is only possible if an
attacker is able to trigger processing of a specially crafted mp4 file
with the ngx_http_mp4_module. </p>
</blockquote>
</body>
</description>
<references>
<url>http://nginx.org/en/security_advisories.html</url>
<cvename>CVE-2018-16843</cvename>
<cvename>CVE-2018-16844</cvename>
<cvename>CVE-2018-16845</cvename>
</references>
<dates>
<discovery>2018-11-06</discovery>
<entry>2018-11-06</entry>
</dates>
</vuln>
<vuln vid="deb4f633-de1d-11e8-a9fb-080027f43a02">
<topic>gitea -- remote code exeution</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2018/10/gitea-1.5.3-is-released/">
<p>[This release] contains crit[i]cal security fix for vulnerability
that could potentially allow for authorized users to do remote code
ex[e]cution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/5177</url>
<url>https://github.com/go-gitea/gitea/pull/5196</url>
<url>https://github.com/go-macaron/session/commit/084f1e5c1071f585902a7552b483cee04bc00a14</url>
</references>
<dates>
<discovery>2018-10-25</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="e0ab1773-07c1-46c6-9170-4c5e81c00927">
<topic>curl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.14.1</ge><lt>7.60.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-16839: SASL password overflow via integer overflow</p>
<p>libcurl contains a buffer overrun in the SASL authentication code.</p>
<p>The internal function Curl_auth_create_plain_message fails to
correctly verify that the passed in lengths for name and password
aren't too long, then calculates a buffer size to allocate.</p>
<p>On systems with a 32 bit size_t, the math to calculate the buffer size
triggers an integer overflow when the user name length exceeds 2GB
(2^31 bytes). This integer overflow usually causes a very small buffer
to actually get allocated instead of the intended very huge one, making
the use of that buffer end up in a heap buffer overflow.</p>
<p>This bug is very similar to CVE-2017-14618.</p>
<p>It affects curl 7.33.0 to 7.61.1.</p>
<p>CVE-2018-16840: use-after-free in handle close</p>
<p>libcurl contains a heap use-after-free flaw in code related to closing
an easy handle.</p>
<p>When closing and cleaning up an "easy" handle in the Curl_close()
function, the library code first frees a struct (without nulling the
pointer) and might then subsequently erroneously write to a struct
field within that already freed struct.</p>
<p>It affects curl 7.59.0 to 7.61.1.</p>
<p>CVE-2018-16842: warning message out-of-buffer read</p>
<p>curl contains a heap out of buffer read vulnerability.</p>
<p>The command line tool has a generic function for displaying warning
and informational messages to stderr for various situations. For
example if an unknown command line argument is used, or passed to it in
a "config" file.</p>
<p>This display function formats the output to wrap at 80 columns. The
wrap logic is however flawed, so if a single word in the message is
itself longer than 80 bytes the buffer arithmetic calculates the
remainder wrong and will end up reading behind the end of the buffer.
This could lead to information disclosure or crash.</p>
<p>This vulnerability could lead to a security issue if used in this or
similar situations:</p>
<p>1. a server somewhere uses the curl command line to run something</p>
<p>2. if it fails, it shows stderr to the user</p>
<p>3. the server takes user input for parts of its command line input</p>
<p>4. user provides something overly long that triggers this crash</p>
<p>5. the stderr output may now contain user memory contents that wasn't
meant to be available</p>
<p>It affects curl 7.14.1 to 7.61.1.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16839.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16840.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-16842.html</url>
<cvename>CVE-2018-16839</cvename>
<cvename>CVE-2018-16840</cvename>
<cvename>CVE-2018-16842</cvename>
</references>
<dates>
<discovery>2018-10-31</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="b51d9e83-de08-11e8-9416-001b217b3468">
<topic>Gitlab -- SSRF in Kubernetes integration</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.4</lt></range>
<range><ge>11.3.0</ge><lt>11.3.9</lt></range>
<range><ge>11.0.0</ge><lt>11.2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/">
<p>SSRF in Kubernetes integration</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released/</url>
<cvename>CVE-2018-18843</cvename>
</references>
<dates>
<discovery>2018-11-01</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="36a2a89e-7ee1-4ea4-ae22-7ca38019c8d0">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/154">
<p>This issue has been created for public disclosure of an XSS
vulnerability that was responsibly reported (independently) by Shubham
Pathak and @yasinS (Yasin Soliman).</p>
<p>In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/154</url>
<cvename>CVE-2018-16468</cvename>
</references>
<dates>
<discovery>2018-10-30</discovery>
<entry>2018-11-01</entry>
</dates>
</vuln>
<vuln vid="b9591212-dba7-11e8-9416-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.4.0</ge><lt>11.4.3</lt></range>
<range><ge>11.3.0</ge><lt>11.3.8</lt></range>
<range><ge>5.3.0</ge><lt>11.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/">
<p>RCE in Gitlab Wiki API</p>
<p>SSRF in Hipchat integration</p>
<p>Cleartext storage of personal access tokens</p>
<p>Information exposure through stack trace error message</p>
<p>Persistent XSS autocomplete</p>
<p>Information exposure in stored browser history</p>
<p>Information exposure when replying to issues through email</p>
<p>Persistent XSS in License Management and Security Reports</p>
<p>Metrics information disclosure in Prometheus integration</p>
<p>Unauthorized changes to a protected branch's access levels</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-released/</url>
<cvename>CVE-2018-18649</cvename>
<cvename>CVE-2018-18646</cvename>
<cvename>CVE-2018-18641</cvename>
<cvename>CVE-2018-18648</cvename>
<cvename>CVE-2018-18643</cvename>
<cvename>CVE-2018-18640</cvename>
<cvename>CVE-2018-18645</cvename>
<cvename>CVE-2018-18642</cvename>
<cvename>CVE-2018-18644</cvename>
<cvename>CVE-2018-18647</cvename>
</references>
<dates>
<discovery>2018-10-29</discovery>
<entry>2018-10-29</entry>
</dates>
</vuln>
<vuln vid="238ae7de-dba2-11e8-b713-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities in 1.1 branch</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0i_1</lt></range>
</package>
<package>
<name>openssl111</name>
<range><lt>1.1.1_2</lt></range>
</package>
<package>
<name>libressl</name>
<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><ge>2.8.0</ge><lt>2.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20181029.txt">
<p>Timing vulnerability in ECDSA signature generation
(CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been
shown to be vulnerable to a timing side channel attack. An
attacker could use variations in the signing algorithm to
recover the private key (Low).</p>
<p>Timing vulnerability in DSA signature generation (CVE-2018-0734):
Avoid a timing attack that leaks information via a side channel
that triggers when a BN is resized. Increasing the size of the
BNs prior to doing anything with them suppresses the attack (Low).
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20181029.txt</url>
<url>https://github.com/openssl/openssl/commit/8abfe72e</url>
<cvename>CVE-2018-0735</cvename>
<cvename>CVE-2018-0734</cvename>
</references>
<dates>
<discovery>2018-10-29</discovery>
<entry>2018-10-29</entry>
<modified>2018-11-10</modified>
</dates>
</vuln>
<vuln vid="fa194483-dabd-11e8-bf39-5404a68ad561">
<topic>liveMedia -- potential remote code execution</topic>
<affects>
<package>
<name>liveMedia</name>
<range><lt>2018.10.17,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684">
<p>An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality
of the LIVE555 RTSP server library. A specially crafted packet can cause a stack-based buffer
overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4013</cvename>
<url>https://talosintelligence.com/vulnerability_reports/TALOS-2018-0684</url>
<url>http://lists.live555.com/pipermail/live-devel/2018-October/021071.html</url>
</references>
<dates>
<discovery>2018-10-18</discovery>
<entry>2018-10-28</entry>
</dates>
</vuln>
<vuln vid="33c384f3-5af6-4662-9741-0acb21c7e499">
<topic>mini_httpd -- disclose arbitrary files is some circumstances</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jef Poskanzer reports:</p>
<blockquote cite="http://acme.com/updates/archive/211.html">
<p>Prior versions allowed remote users to read arbitrary files in some circumstances.</p>
</blockquote>
</body>
</description>
<references>
<url>http://acme.com/updates/archive/211.html</url>
</references>
<dates>
<discovery>2018-10-26</discovery>
<entry>2018-10-26</entry>
</dates>
</vuln>
<vuln vid="4f7c6af3-6a2c-4ead-8453-04e509688d45">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<name>py37-salt</name>
<range><lt>2017.7.8</lt></range>
<range><ge>2018.3.0</ge><lt>2018.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html">
<p>Remote command execution and incorrect access control when using
salt-api.</p>
<p>Directory traversal vulnerability when using salt-api. Allows an
attacker to determine what files exist on a server when querying
/run or /events.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15751</cvename>
<cvename>CVE-2018-15750</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2018.3.3.html</url>
<url>https://docs.saltstack.com/en/2017.7/topics/releases/2017.7.8.html</url>
</references>
<dates>
<discovery>2018-10-24</discovery>
<entry>2018-10-27</entry>
</dates>
</vuln>
<vuln vid="7c3a02b9-3273-4426-a0ba-f90fad2ff72e">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>63.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.5</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/">
<p>CVE-2018-12391: HTTP Live Stream audio data is accessible cross-origin</p>
<p>CVE-2018-12392: Crash with nested event loops</p>
<p>CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript</p>
<p>CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting</p>
<p>CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts</p>
<p>CVE-2018-12397:</p>
<p>CVE-2018-12398: CSP bypass through stylesheet injection in resource URIs</p>
<p>CVE-2018-12399: Spoofing of protocol registration notification bar</p>
<p>CVE-2018-12400: Favicons are cached in private browsing mode on Firefox for Android</p>
<p>CVE-2018-12401: DOS attack through special resource URI parsing</p>
<p>CVE-2018-12402: SameSite cookies leak when pages are explicitly saved</p>
<p>CVE-2018-12403: Mixed content warning is not displayed when HTTPS page loads a favicon over HTTP</p>
<p>CVE-2018-12388: Memory safety bugs fixed in Firefox 63</p>
<p>CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12388</cvename>
<cvename>CVE-2018-12390</cvename>
<cvename>CVE-2018-12391</cvename>
<cvename>CVE-2018-12392</cvename>
<cvename>CVE-2018-12393</cvename>
<cvename>CVE-2018-12395</cvename>
<cvename>CVE-2018-12396</cvename>
<cvename>CVE-2018-12397</cvename>
<cvename>CVE-2018-12398</cvename>
<cvename>CVE-2018-12399</cvename>
<cvename>CVE-2018-12400</cvename>
<cvename>CVE-2018-12401</cvename>
<cvename>CVE-2018-12402</cvename>
<cvename>CVE-2018-12403</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/</url>
</references>
<dates>
<discovery>2018-10-23</discovery>
<entry>2018-10-23</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="140a14b5-d615-11e8-b3cb-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.60</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-006">
<p>he path module allows users with the 'administer paths' to create pretty URLs
for content. In certain circumstances the user can enter a particular path that
triggers an open redirect to a malicious url.The issue is mitigated by the fact
that the user needs the administer paths permission to exploit.</p>
<p>When sending email some variables were not being sanitized for shell arguments,
which could lead to remote code execution. </p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-006</url>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2018-10-22</entry>
<modified>2018-11-04</modified>
</dates>
</vuln>
<vuln vid="afc60484-0652-440e-b01a-5ef814747f06">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.3.0,1</ge><lt>2.3.8,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.5,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/">
<p>CVE-2018-16395: OpenSSL::X509::Name equality check does not work
correctly</p>
<p>An instance of OpenSSL::X509::Name contains entities such as CN, C and
so on. Some two instances of OpenSSL::X509::Name are equal only when
all entities are exactly equal. However, there is a bug that the
equality check is not correct if the value of an entity of the
argument (right-hand side) starts with the value of the receiver
(left-hand side). So, if a malicious X.509 certificate is passed to
compare with an existing certificate, there is a possibility to be
judged incorrectly that they are equal.</p>
<p>CVE-2018-16396: Tainted flags are not propagated in Array#pack and
String#unpack with some directives</p>
<p>Array#pack method converts the receiver's contents into a string with
specified format. If the receiver contains some tainted objects, the
returned string also should be tainted. String#unpack method which
converts the receiver into an array also should propagate its tainted
flag to the objects contained in the returned array. But, with B, b, H
and h directives, the tainted flags are not propagated. So, if a script
processes unreliable inputs by Array#pack and/or String#unpack with
these directives and checks the reliability with tainted flags, the
check might be wrong.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/</url>
<url>https://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/</url>
<cvename>CVE-2018-16395</cvename>
<cvename>CVE-2018-16396</cvename>
</references>
<dates>
<discovery>2018-10-17</discovery>
<entry>2018-10-20</entry>
</dates>
</vuln>
<vuln vid="ec5072b0-d43a-11e8-a6d2-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.37</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.37</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.19</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.11</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.42</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.24</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.13</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.62</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.42</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixMSQL</url>
<cvename>CVE-2016-9843</cvename>
<cvename>CVE-2018-3155</cvename>
<cvename>CVE-2018-3143</cvename>
<cvename>CVE-2018-3156</cvename>
<cvename>CVE-2018-3251</cvename>
<cvename>CVE-2018-3182</cvename>
<cvename>CVE-2018-3137</cvename>
<cvename>CVE-2018-3203</cvename>
<cvename>CVE-2018-3133</cvename>
<cvename>CVE-2018-3145</cvename>
<cvename>CVE-2018-3144</cvename>
<cvename>CVE-2018-3185</cvename>
<cvename>CVE-2018-3195</cvename>
<cvename>CVE-2018-3247</cvename>
<cvename>CVE-2018-3187</cvename>
<cvename>CVE-2018-3174</cvename>
<cvename>CVE-2018-3171</cvename>
<cvename>CVE-2018-3277</cvename>
<cvename>CVE-2018-3162</cvename>
<cvename>CVE-2018-3173</cvename>
<cvename>CVE-2018-3200</cvename>
<cvename>CVE-2018-3170</cvename>
<cvename>CVE-2018-3212</cvename>
<cvename>CVE-2018-3280</cvename>
<cvename>CVE-2018-3186</cvename>
<cvename>CVE-2018-3161</cvename>
<cvename>CVE-2018-3278</cvename>
<cvename>CVE-2018-3279</cvename>
<cvename>CVE-2018-3282</cvename>
<cvename>CVE-2018-3284</cvename>
<cvename>CVE-2018-3283</cvename>
<cvename>CVE-2018-3286</cvename>
</references>
<dates>
<discovery>2018-10-16</discovery>
<entry>2018-10-20</entry>
<modified>2018-11-08</modified>
</dates>
</vuln>
<vuln vid="44864c84-d3b8-11e8-b3cb-00e04c1ea73d">
<topic>matomo -- XSS vulnerability</topic>
<affects>
<package>
<name>matomo</name>
<range><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matomo reports:</p>
<blockquote cite="https://matomo.org/changelog/matomo-3-6-1/">
<p>Several XSS issues have been fixed thanks to the great work of security
researchers who responsible disclosed issues to us.</p>
</blockquote>
</body>
</description>
<references>
<url>https://matomo.org/changelog/matomo-3-6-1/</url>
</references>
<dates>
<discovery>2018-10-18</discovery>
<entry>2018-10-19</entry>
</dates>
</vuln>
<vuln vid="2383767c-d224-11e8-9623-a4badb2f4699">
<topic>libssh -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>libssh</name>
<range><ge>0.6</ge><lt>0.7.6</lt></range>
<range><ge>0.8</ge><lt>0.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gladiac reports:</p>
<blockquote cite="https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/">
<p>libssh versions 0.6 and above have an authentication bypass
vulnerability in the server code. By presenting the server an
SSH2_MSG_USERAUTH_SUCCESS message in place of the
SSH2_MSG_USERAUTH_REQUEST message which the server would expect to
initiate authentication, the attacker could successfully authentciate
without any credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/</url>
<cvename>CVE-2018-10933</cvename>
</references>
<dates>
<discovery>2018-10-16</discovery>
<entry>2018-10-17</entry>
</dates>
</vuln>
<vuln vid="8c08ab4c-d06c-11e8-b35c-001b217b3468">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.27.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.5">
<p>Multiple vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.5</url>
<cvename>CVE-2018-17456</cvename>
</references>
<dates>
<discovery>2018-10-05</discovery>
<entry>2018-10-15</entry>
</dates>
</vuln>
<vuln vid="4c11b51e-cd8d-11e8-b0cb-a0f3c100ae18">
<topic>Memory leak bug in Toxcore</topic>
<affects>
<package>
<name>toxcore</name>
<range><lt>0.2.8,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tox project blog reports:</p>
<blockquote cite="https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/">
<p>A memory leak bug was discovered in Toxcore that can be triggered remotely to
exhaust one’s system memory, resulting in a denial of service attack.
The bug is present in the TCP Server module of Toxcore and therefore it
affects mostly bootstrap nodes. Regular Tox clients generally have the
TCP Server functionality disabled by default, leaving them unaffected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/</url>
</references>
<dates>
<discovery>2018-09-29</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="cb539d4e-cd68-11e8-8819-00e04c1ea73d">
<topic>gitea -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/4357">
<p>CSRF Vulnerability on API.</p>
<p>Enforce token on api routes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/4357</url>
<url>ttps://github.com/go-gitea/gitea/pull/4840</url>
</references>
<dates>
<discovery>2018-10-01</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="3350275d-cd5a-11e8-a7be-3497f683cb16">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.146</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.138.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-10-10/">
<h1>Description</h1>
<h5>(Low) SECURITY-867</h5>
<p>Path traversal vulnerability in Stapler allowed accessing internal data</p>
<h5>(Medium) SECURITY-1074</h5>
<p>Arbitrary file write vulnerability using file parameter definitions</p>
<h5>(Medium) SECURITY-1129</h5>
<p>Reflected XSS vulnerability</p>
<h5>(Medium) SECURITY-1162</h5>
<p>Ephemeral user record was created on some invalid authentication attempts</p>
<h5>(Medium) SECURITY-1128</h5>
<p>Ephemeral user record creation</p>
<h5>(Medium) SECURITY-1158</h5>
<p>Session fixation vulnerability on user signup</p>
<h5>(Medium) SECURITY-765</h5>
<p>Failures to process form submission data could result in secrets being displayed or written to logs</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-10-10/</url>
</references>
<dates>
<discovery>2018-10-10</discovery>
<entry>2018-10-11</entry>
</dates>
</vuln>
<vuln vid="a4eb38ea-cc06-11e8-ada4-408d5cf35399">
<topic>tinc -- Buffer overflow</topic>
<affects>
<package>
<name>tinc</name>
<range><lt>1.0.35</lt></range>
</package>
<package>
<name>tinc-devel</name>
<range><lt>1.1pre17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tinc-vpn.org reports:</p>
<blockquote cite="http://www.tinc-vpn.org/news/">
<p>The authentication protocol allows an oracle attack that could
potentially be exploited.</p>
<p>If a man-in-the-middle has intercepted the TCP connection it
might be able to force plaintext UDP packets between two nodes for up to
a PingInterval period.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297fbd3b8c8c8a4661f5bbf89aca5cacba8b5a</url>
<url>https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=e97943b7cc9c851ae36f5a41e2b6102faa74193f</url>
<cvename>CVE-2018-16737</cvename>
<cvename>CVE-2018-16738</cvename>
<cvename>CVE-2018-16758</cvename>
</references>
<dates>
<discovery>2018-10-08</discovery>
<entry>2018-10-09</entry>
</dates>
</vuln>
<vuln vid="23413442-c8ea-11e8-b35c-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.3.0</ge><lt>11.3.4</lt></range>
<range><ge>11.2.0</ge><lt>11.2.5</lt></range>
<range><ge>10.2.0</ge><lt>11.1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/">
<p>Merge request information disclosure</p>
<p>Private project namespace information disclosure</p>
<p>Gitlab Flavored Markdown API information disclosure</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/05/critical-security-release-11-3-4/</url>
<cvename>CVE-2018-17939</cvename>
<cvename>CVE-2018-17976</cvename>
<cvename>CVE-2018-17975</cvename>
</references>
<dates>
<discovery>2018-10-05</discovery>
<entry>2018-10-05</entry>
</dates>
</vuln>
<vuln vid="8b812395-c739-11e8-ab5b-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.100.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Joel Esler reports:</p>
<blockquote cite="https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html">
<ul>
<li>CVE-2018-15378:
<ul>
<li>Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.</li>
<li>Reported by Secunia Research at Flexera.</li>
</ul>
</li>
<li>Fix for a 2-byte buffer over-read bug in ClamAV&s PDF parsing code.
<ul>
<li>Reported by Alex Gaynor.</li>
</ul>
</li>
<li>CVE-2018-14680:
<ul>
<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.</li>
</ul>
</li>
<li>CVE-2018-14681:
<ul>
<li>An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.</li>
</ul>
</li>
<li>CVE-2018-14682:
<ul>
<li>An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.</li>
</ul>
</li>
</ul>
<p>.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html</url>
<cvename>CVE-2018-15378</cvename>
<cvename>CVE-2018-14680</cvename>
<cvename>CVE-2018-14681</cvename>
<cvename>CVE-2018-14682</cvename>
</references>
<dates>
<discovery>2018-10-03</discovery>
<entry>2018-10-03</entry>
</dates>
</vuln>
<vuln vid="004d8c23-c710-11e8-98c7-000c29434208">
<topic>Django -- password hash disclosure</topic>
<affects>
<package>
<name>py34-django21</name>
<name>py35-django21</name>
<name>py36-django21</name>
<name>py37-django21</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/2.1/releases/2.1.2/">
<p>CVE-2018-16984: Password hash disclosure to "view only" admin users</p>
<p>If an admin user has the change permission to the user model, only part
of the password hash is displayed in the change form. Admin users with the
view (but not change) permission to the user model were displayed the entire
hash. While it's typically infeasible to reverse a strong password hash, if
your site uses weaker password hashing algorithms such as MD5 or SHA1, it
could be a problem.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/2.1/releases/2.1.2/</url>
<cvename>CVE-2018-16984</cvename>
</references>
<dates>
<discovery>2018-10-02</discovery>
<entry>2018-10-03</entry>
</dates>
</vuln>
<vuln vid="c4f39920-781f-4aeb-b6af-17ed566c4272">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0.3,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.4</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.53.0</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.2.2,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/">
<h1>CVE-2018-12386: Type confusion in JavaScript</h1>
<p>A vulnerability in register allocation in JavaScript can
lead to type confusion, allowing for an arbitrary read and
write. This leads to remote code execution inside the
sandboxed content process when triggered.</p>
<h1>CVE-2018-12387: </h1>
<p>A vulnerability where the JavaScript JIT compiler inlines
Array.prototype.push with multiple arguments that results
in the stack pointer being off by 8 bytes after a
bailout. This leaks a memory address to the calling
function which can be used as part of an exploit inside
the sandboxed content process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12386</cvename>
<cvename>CVE-2018-12387</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/</url>
</references>
<dates>
<discovery>2018-10-02</discovery>
<entry>2018-10-02</entry>
<modified>2019-07-23</modified>
</dates>
</vuln>
<vuln vid="065b3b72-c5ab-11e8-9ae2-001b217b3468">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.3.0</ge><lt>11.3.1</lt></range>
<range><ge>11.2.0</ge><lt>11.2.4</lt></range>
<range><ge>7.6.0</ge><lt>11.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/">
<p>SSRF GCP access token disclosure</p>
<p>Persistent XSS on issue details</p>
<p>Diff formatter DoS in Sidekiq jobs</p>
<p>Confidential information disclosure in events API endpoint</p>
<p>validate_localhost function in url_blocker.rb could be bypassed</p>
<p>Slack integration CSRF Oauth2</p>
<p>GRPC::Unknown logging token disclosure</p>
<p>IDOR merge request approvals</p>
<p>Persistent XSS package.json</p>
<p>Persistent XSS merge request project import</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/</url>
<cvename>CVE-2018-17450</cvename>
<cvename>CVE-2018-17454</cvename>
<cvename>CVE-2018-15472</cvename>
<cvename>CVE-2018-17449</cvename>
<cvename>CVE-2018-17452</cvename>
<cvename>CVE-2018-17451</cvename>
<cvename>CVE-2018-17453</cvename>
<cvename>CVE-2018-17455</cvename>
<cvename>CVE-2018-17537</cvename>
<cvename>CVE-2018-17536</cvename>
</references>
<dates>
<discovery>2018-10-01</discovery>
<entry>2018-10-01</entry>
</dates>
</vuln>
<vuln vid="5a757a31-f98e-4bd4-8a85-f1c0f3409769">
<topic>pango -- remote DoS vulnerability</topic>
<affects>
<package>
<name>pango</name>
<range><lt>1.42.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120">
<p>libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120</url>
<url>https://www.exploit-db.com/exploits/45263/</url>
<url>https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html</url>
<url>https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f</url>
<cvename>CVE-2018-15120</cvename>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-10-01</entry>
</dates>
</vuln>
<vuln vid="01018916-c47c-11e8-8b07-00e04c1ea73d">
<topic>Serendipity -- multiple vulnerabilities</topic>
<affects>
<package>
<name>serendipity</name>
<range><lt>2.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Serendipity reports:</p>
<blockquote cite="https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html">
<p>Security: Fix XSS for pagination, when multi-category selection is used.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.s9y.org/archives/280-Serendipity-2.1.4-and-2.2.1-alpha1-released.html</url>
</references>
<dates>
<discovery>2018-09-20</discovery>
<entry>2018-09-30</entry>
</dates>
</vuln>
<vuln vid="40a844bf-c430-11e8-96dc-000743165db0">
<topic>bitcoin -- Denial of Service and Possible Mining Inflation</topic>
<affects>
<package>
<name>bitcoin</name>
<name>bitcoin-daemon</name>
<range><lt>0.16.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bitcoin Core reports:</p>
<blockquote cite="https://bitcoincore.org/en/2018/09/20/notice/">
<p>CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bitcoincore.org/en/2018/09/20/notice/</url>
<cvename>CVE-2018-17144</cvename>
</references>
<dates>
<discovery>2018-09-17</discovery>
<entry>2018-09-29</entry>
</dates>
</vuln>
<vuln vid="613193a0-c1b4-11e8-ae2d-54e1ad3d6335">
<topic>spamassassin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>spamassassin</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the Apache Spamassassin project reports:</p>
<blockquote cite="https://seclists.org/oss-sec/2018/q3/242">
<p>In Apache SpamAssassin, using HTML::Parser, we setup an object and
hook into the begin and end tag event handlers In both cases, the
"open" event is immediately followed by a "close" event - even if
the tag *does not* close in the HTML being parsed.</p>
<p>Because of this, we are missing the "text" event to deal with
the object normally. This can cause carefully crafted emails that
might take more scan time than expected leading to a Denial of
Service.</p>
<p>Fix a reliance on "." in @INC in one configuration script. Whether
this can be exploited in any way is uncertain.</p>
<p>Fix a potential Remote Code Execution bug with the PDFInfo plugin.
Thanks to cPanel Security Team for their report of this issue.</p>
<p> Fourth, this release fixes a local user code injection in the
meta rule syntax. Thanks again to cPanel Security Team for their
report of this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/oss-sec/2018/q3/242</url>
<cvename>CVE-2017-15705</cvename>
<cvename>CVE-2016-1238</cvename>
<cvename>CVE-2018-11780</cvename>
<cvename>CVE-2018-11781</cvename>
</references>
<dates>
<discovery>2018-09-16</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="bad59128-c188-11e8-9d40-f0def10dca57">
<topic>wesnoth -- Code Injection vulnerability</topic>
<affects>
<package>
<name>wesnoth</name>
<range><ge>1.7.0</ge><lt>1.14.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>shadowm reports:</p>
<blockquote cite="https://forums.wesnoth.org/viewtopic.php?t=48528">
<p>A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0.
Users of all previous version should upgrade immediately.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1999023</cvename>
<url>https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380</url>
</references>
<dates>
<discovery>2018-07-14</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="e182c076-c189-11e8-a6d2-b499baebfeaf">
<topic>Apache -- Denial of service vulnerability in HTTP/2</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>low: DoS for HTTP/2 connections by continuous SETTINGS</p>
<p>By sending continous SETTINGS frames of maximum size an ongoing
HTTP/2 connection could be kept busy and would never time out. This
can be abused for a DoS on the server. This only affect a server
that has enabled the h2 protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-11763</cvename>
</references>
<dates>
<discovery>2018-09-25</discovery>
<entry>2018-09-26</entry>
</dates>
</vuln>
<vuln vid="6bf71117-c0c9-11e8-b760-6023b685b1ee">
<topic>mantis -- XSS vulnerability</topic>
<affects>
<package>
<name>mantis-php56</name>
<name>mantis-php70</name>
<name>mantis-php71</name>
<name>mantis-php72</name>
<range><lt>2.17.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brian Carpenter reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=24731">
<p>Reflected XSS in view_filters_page.php via core/filter_form_api.php</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-16514</cvename>
</references>
<dates>
<discovery>2018-09-03</discovery>
<entry>2018-09-25</entry>
</dates>
</vuln>
<vuln vid="2d6de6a8-fb78-4149-aeda-77fc8f140f06">
<topic>smart_proxy_dynflow -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>rubygem-smart_proxy_dynflow</name>
<range><lt>0.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643">
<p>An authentication bypass flaw was found in the smart_proxy_dynflow
component used by Foreman. A malicious attacker can use this flaw to
remotely execute arbitrary commands on machines managed by vulnerable
Foreman instances, in a highly privileged context.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-14643</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643</url>
<cvename>CVE-2018-14643</cvename>
</references>
<dates>
<discovery>2018-09-20</discovery>
<entry>2018-09-22</entry>
</dates>
</vuln>
<vuln vid="be1aada2-be6c-11e8-8fc6-000c29434208">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki127</name>
<range><lt>1.27.5</lt></range>
</package>
<package>
<name>mediawiki129</name>
<range><le>1.29.3</le></range>
</package>
<package>
<name>mediawiki130</name>
<range><lt>1.30.1</lt></range>
</package>
<package>
<name>mediawiki131</name>
<range><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html">
<p>Security fixes:</p>
<p>T169545: $wgRateLimits entry for 'user' overrides 'newbie'.</p>
<p>T194605: BotPasswords can bypass CentralAuth's account lock.</p>
<p>T187638: When a log event is (partially) hidden Special:Redirect/logid
can link to the incorrect log and reveal hidden</p>
<p>T193237: Special:BotPasswords should require reauthenticate.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0503</cvename>
<cvename>CVE-2018-0505</cvename>
<cvename>CVE-2018-0504</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2018-September/000223.html</url>
</references>
<dates>
<discovery>2018-08-29</discovery>
<entry>2018-09-22</entry>
</dates>
</vuln>
<vuln vid="3284d948-140c-4a3e-aa76-3b440e2006a8">
<topic>firefox -- Crash in TransportSecurityInfo due to cached data</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0.2,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-22/">
<p>A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12385</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-22/</url>
</references>
<dates>
<discovery>2018-09-21</discovery>
<entry>2018-09-21</entry>
</dates>
</vuln>
<vuln vid="77f67b46-bd75-11e8-81b6-001999f8d30b">
<topic>asterisk -- Remote crash vulnerability in HTTP websocket upgrade</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.23.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>There is a stack overflow vulnerability in the
res_http_websocket.so module of Asterisk that allows an
attacker to crash Asterisk via a specially crafted HTTP
request to upgrade the connection to a websocket. The
attackers request causes Asterisk to run out of stack
space and crash.</p>
<p>As a workaround disable HTTP websocket access by not
loading the res_http_websocket.so module.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-009.html</url>
<cvename>CVE-2018-17281</cvename>
</references>
<dates>
<discovery>2018-08-16</discovery>
<entry>2018-09-21</entry>
</dates>
</vuln>
<vuln vid="074cb225-bb2d-11e8-90e1-fcaa147e860e">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.14</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.8</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>moodle35</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=376023">
<p>Moodle XML import of ddwtos could lead to intentional remote code
execution</p>
<p>QuickForm library remote code vulnerability (upstream)</p>
<p>Boost theme - blog search GET parameter insufficiently filtered</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14630</cvename>
<cvename>CVE-2018-1999022</cvename>
<cvename>CVE-2018-14631</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=376023</url>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-18</entry>
</dates>
</vuln>
<vuln vid="bf2b9c56-b93e-11e8-b2a8-a4badb296695">
<topic>joomla3 -- vulnerabilitiesw</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.8.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports: Multiple low-priority Vulnerabilities</p>
<blockquote cite="https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html">
<p>Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html">
<p>Inadequate output filtering on the user profile page could lead to a stored XSS attack.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html">
<p>Inadequate checks regarding disabled fields can lead to an ACL violation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15860</cvename>
<cvename>CVE-2018-15881</cvename>
<cvename>CVE-2018-15882</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15880</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15881</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15882</url>
<url>https://developer.joomla.org/security-centre/743-20180801-core-hardening-the-inputfilter-for-phar-stubs.html</url>
<url>https://developer.joomla.org/security-centre/744-20180802-core-stored-xss-vulnerability-in-the-frontend-profile.html</url>
<url>https://developer.joomla.org/security-centre/745-20180803-core-acl-violation-in-custom-fields.html</url>
</references>
<dates>
<discovery>2018-08-23</discovery>
<entry>2018-09-15</entry>
</dates>
</vuln>
<vuln vid="ab38d9f8-b787-11e8-8e7a-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/">
<p>High risk: Email field SQL Injection.</p>
<p>Medium risk: Video MyCode Persistent XSS in Visual Editor.</p>
<p>Low risk: Insufficient permission check in User CP’s attachment management.</p>
<p>Low risk: Insufficient email address verification.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/09/11/mybb-1-8-19-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-09-11</discovery>
<entry>2018-09-13</entry>
</dates>
</vuln>
<vuln vid="a67c122a-b693-11e8-ac58-a4badb2f4699">
<topic>FreeBSD -- Improper ELF header parsing</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_3</lt></range>
<range><ge>11.1</ge><lt>11.1_14</lt></range>
<range><ge>10.4</ge><lt>10.4_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation was performed in the ELF header
parser, and malformed or otherwise invalid ELF binaries
were not rejected as they should be.</p>
<h1>Impact:</h1>
<p>Execution of a malicious ELF binary may result in a
kernel crash or may disclose kernel memory.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6924</cvename>
<freebsdsa>SA-18:12.elf</freebsdsa>
</references>
<dates>
<discovery>2018-09-12</discovery>
<entry>2018-09-12</entry>
</dates>
</vuln>
<vuln vid="fe818607-b5ff-11e8-856b-485b3931c969">
<topic>Containous Traefik -- exposes the configuration and secret</topic>
<affects>
<package>
<name>traefik</name>
<range><lt>1.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15598">
<p>Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the
configuration and secret if authentication is missing and the API's port
is publicly reachable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15598</cvename>
<url>https://github.com/containous/traefik/pull/3790</url>
<url>https://github.com/containous/traefik/releases/tag/v1.6.6</url>
</references>
<dates>
<discovery>2018-08-20</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="f9d73a20-b5f0-11e8-b1da-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>31.0.0.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-31.html">
<ul>
<li>This update resolves a privilege escalation vulnerability that
could lead to information disclosure (CVE-2018-15967).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-15967</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-31.html</url>
</references>
<dates>
<discovery>2018-09-11</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="337960ec-b5dc-11e8-ac58-a4badb2f4699">
<topic>Plex Media Server -- Information Disclosure Vulnerability</topic>
<affects>
<package>
<name>plexmediaserver</name>
<name>plexmediaserver-plexpass</name>
<range><lt>1.13.5.5332</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Chris reports:</p>
<blockquote cite="https://seclists.org/fulldisclosure/2018/Aug/1">
<p>The XML parsing engine for Plex Media Server's SSDP/UPNP
functionality is vulnerable to an XML External Entity
Processing (XXE) attack. Unauthenticated attackers on the same LAN can
use this vulnerability to:</p>
<ul>
<li>Access arbitrary files from the filesystem with the same permission as
the user account running Plex.</li>
<li>Initiate SMB connections to capture NetNTLM challenge/response and
crack to clear-text password.</li>
<li>Initiate SMB connections to relay NetNTLM challenge/response and
achieve Remote Command Execution in Windows domains.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://seclists.org/fulldisclosure/2018/Aug/1</url>
<cvename>CVE-2018-13415</cvename>
</references>
<dates>
<discovery>2018-08-01</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="f00acdec-b59f-11e8-805d-001e2a3f778d">
<topic>X11 Session -- SDDM allows unauthorised unlocking</topic>
<affects>
<package>
<name>sddm</name>
<range><lt>0.17.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14345">
<p>An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session.</p>
</blockquote>
<p>The default configuration of SDDM on FreeBSD is not affected, since it has ReuseSession=false.</p>
</body>
</description>
<references>
<url>https://www.suse.com/security/cve/CVE-2018-14345/</url>
<cvename>CVE-2018-14345</cvename>
</references>
<dates>
<discovery>2018-08-13</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="db2acdac-b5a7-11e8-8f6f-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/">
<p>High risk: Image MyCode “alt” attribute persistent XSS.</p>
<p>Medium risk: RSS Atom 1.0 item title persistent XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-08-22</discovery>
<entry>2018-09-11</entry>
</dates>
</vuln>
<vuln vid="7c750960-b129-11e8-9fcd-080027f43a02">
<topic>Information disclosure - Gitea leaks email addresses</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://github.com/go-gitea/gitea/issues/4417">
<p>[Privacy] Gitea leaks hidden email addresses #4417</p>
<p>A fix has been implemented in Gitea 1.5.1.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/issues/4417</url>
<url>https://github.com/go-gitea/gitea/pull/4784</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-09-05</entry>
</dates>
</vuln>
<vuln vid="2a92555f-a6f8-11e8-8acd-10c37b4ac2ea">
<topic>links -- denial of service</topic>
<affects>
<package>
<name>links</name>
<range><lt>2.16,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-11114">
<p>The put_chars function in html_r.c in Twibright Links 2.14 allows
remote attackers to cause a denial of service (buffer over-read)
via a crafted HTML file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11114</url>
<cvename>CVE-2017-11114</cvename>
</references>
<dates>
<discovery>2017-07-31</discovery>
<entry>2018-08-23</entry>
</dates>
</vuln>
<vuln vid="f4d638b9-e6e5-4dbe-8c70-571dbc116174">
<topic>curl -- password overflow vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.15.4</ge><lt>7.61.1</lt></range>
</package>
<package>
<name>linux-c7-curl</name>
<range><lt>7.29.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>curl security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-14618: NTLM password overflow via integer overflow</p>
<p>The internal function Curl_ntlm_core_mk_nt_hash multiplies the length
of the password by two (SUM) to figure out how large temporary storage
area to allocate from the heap.</p>
<p>The length value is then subsequently used to iterate over the
password and generate output into the allocated storage buffer. On
systems with a 32 bit size_t, the math to calculate SUM triggers an
integer overflow when the password length exceeds 2GB (2^31 bytes).
This integer overflow usually causes a very small buffer to actually
get allocated instead of the intended very huge one, making the use of
that buffer end up in a heap buffer overflow.</p>
<p>This bug is almost identical to CVE-2017-8816.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/CVE-2018-14618.html</url>
<cvename>CVE-2018-14618</cvename>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-05</entry>
<modified>2019-08-03</modified>
</dates>
</vuln>
<vuln vid="c96d416a-eae7-4d5d-bc84-40deca9329fb">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>62.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>60.2.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>60.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>60.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/">
<p>CVE-2018-12377: Use-after-free in refresh driver timers</p>
<p>CVE-2018-12378: Use-after-free in IndexedDB</p>
<p>CVE-2018-12379: Out-of-bounds write with malicious MAR file</p>
<p>CVE-2017-16541: Proxy bypass using automount and autofs</p>
<p>CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation</p>
<p>CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android</p>
<p>CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords</p>
<p>CVE-2018-12375: Memory safety bugs fixed in Firefox 62</p>
<p>CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16541</cvename>
<cvename>CVE-2018-12375</cvename>
<cvename>CVE-2018-12376</cvename>
<cvename>CVE-2018-12377</cvename>
<cvename>CVE-2018-12378</cvename>
<cvename>CVE-2018-12379</cvename>
<cvename>CVE-2018-12381</cvename>
<cvename>CVE-2018-12382</cvename>
<cvename>CVE-2018-12383</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/</url>
</references>
<dates>
<discovery>2018-09-05</discovery>
<entry>2018-09-05</entry>
<modified>2018-09-15</modified>
</dates>
</vuln>
<vuln vid="30c0f878-b03e-11e8-be8a-0011d823eebd">
<topic>Ghostscript -- arbitrary code execution</topic>
<affects>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CERT reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/332928">
<p>Ghostscript contains an optional -dSAFER option, which is supposed
to prevent unsafe PostScript operations. Multiple PostScript
operations bypass the protections provided by -dSAFER, which can
allow an attacker to execute arbitrary commands with arbitrary
arguments. This vulnerability can also be exploited in applications
that leverage Ghostscript, such as ImageMagick, GraphicsMagick,
evince, Okular, Nautilus, and others.</p>
<p>Exploit code for this vulnerability is publicly available.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/332928</url>
<cvename>CVE-2018-15908</cvename>
<cvename>CVE-2018-15909</cvename>
<cvename>CVE-2018-15910</cvename>
<cvename>CVE-2018-15911</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-09-04</entry>
</dates>
</vuln>
<vuln vid="1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea">
<topic>grafana -- LDAP and OAuth login vulnerability</topic>
<affects>
<package>
<name>grafana5</name>
<range><ge>5.0.0</ge><lt>5.2.3</lt></range>
</package>
<package>
<name>grafana4</name>
<range><ge>4.0.0</ge><lt>4.6.4</lt></range>
</package>
<package>
<name>grafana3</name>
<range><ge>3.0.0</ge></range>
</package>
<package>
<name>grafana2</name>
<range><ge>2.0.0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Grafana Labs reports:</p>
<blockquote cite="https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050">
<p>On the 20th of August at 1800 CEST we were contacted about a
potential security issue with the “remember me” cookie Grafana
sets upon login. The issue targeted users without a local Grafana
password (LDAP & OAuth users) and enabled a potential attacker
to generate a valid cookie knowing only a username.</p>
<p>All installations which use the Grafana LDAP or OAuth
authentication features must be upgraded as soon as possible. If
you cannot upgrade, you should switch authentication mechanisms
or put additional protections in front of Grafana such as a
reverse proxy.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.grafana.com/t/grafana-5-2-3-and-4-6-4-security-update/10050</url>
<cvename>CVE-2018-558213</cvename>
</references>
<dates>
<discovery>2018-08-20</discovery>
<entry>2018-08-31</entry>
</dates>
</vuln>
<vuln vid="ffeb25d0-ac94-11e8-ab15-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.2.0</ge><lt>11.2.3</lt></range>
<range><ge>11.1.0</ge><lt>11.1.6</lt></range>
<range><ge>2.7.0</ge><lt>11.0.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/">
<p>Persistent XSS in Pipeline Tooltip</p>
<p>GitLab.com GCP Endpoints Exposure</p>
<p>Persistent XSS in Merge Request Changes View</p>
<p>Sensitive Data Disclosure in Sidekiq Logs</p>
<p>Missing CSRF in System Hooks</p>
<p>Orphaned Upload Files Exposure</p>
<p>Missing Authorization Control API Repository Storage</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released/</url>
</references>
<dates>
<discovery>2018-08-28</discovery>
<entry>2018-08-30</entry>
</dates>
</vuln>
<vuln vid="d0be41fe-2a20-4633-b057-4e8b25c41780">
<topic>bro -- array bounds and potential DOS issues</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Corelight reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.5.5 primarily addresses security issues:</p>
<ul>
<li>Fix array bounds checking in BinPAC: for arrays
that are fields within a record, the bounds check
was based on a pointer to the start of the record
rather than the start of the array field, potentially
resulting in a buffer over-read.</li>
<li>Fix SMTP command string comparisons: the number
of bytes compared was based on the user-supplied
string length and can lead to incorrect matches.
e.g. giving a command of "X" incorrectly matched
"X-ANONYMOUSTLS" (and an empty commands match
anything).</li>
</ul>
<p>Address potential vectors for Denial of Service:</p>
<ul>
<li>"Weird" events are now generally suppressed/sampled
by default according to some tunable parameters.</li>
<li>Improved handling of empty lines in several text
protocol analyzers that can cause performance issues
when seen in long sequences.</li>
<li>Add `smtp_excessive_pending_cmds' weird which
serves as a notification for when the "pending
command" queue has reached an upper limit and been
cleared to prevent one from attempting to slowly
exhaust memory.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-08-28</discovery>
<entry>2018-08-29</entry>
</dates>
</vuln>
<vuln vid="0904e81f-a89d-11e8-afbb-bc5ff4f77b71">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>10.9.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.4</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.14.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/">
<h1>OpenSSL: Client DoS due to large DH parameter</h1>
<p>This fixes a potential denial of service (DoS) attack
against client connections by a malicious server. During a TLS
communication handshake, where both client and server agree to
use a cipher-suite using DH or DHE (Diffie-Hellman, in both
ephemeral and non-ephemeral modes), a malicious server can
send a very large prime value to the client. Because this has
been unbounded in OpenSSL, the client can be forced to spend
an unreasonably long period of time to generate a key,
potentially causing a denial of service.</p>
<h1>OpenSSL: ECDSA key extraction via local side-channel</h1>
<p>Attackers with access to observe cache-timing may be able
to extract DSA or ECDSA private keys by causing the victim to
create several signatures and watching responses. This flaw
does not have a CVE due to OpenSSL policy to not assign itself
CVEs for local-only vulnerabilities that are more academic
than practical. This vulnerability was discovered by Keegan
Ryan at NCC Group and impacts many cryptographic libraries
including OpenSSL.</p>
<h1>Unintentional exposure of uninitialized memory</h1>
<p>Only Node.js 10 is impacted by this flaw.</p>
<p>Node.js TSC member Nikita Skovoroda discovered an argument
processing flaw that causes Buffer.alloc() to return
uninitialized memory. This method is intended to be safe and
only return initialized, or cleared, memory. The third
argument specifying encoding can be passed as a number, this
is misinterpreted by Buffer's internal "fill" method as the
start to a fill operation. This flaw may be abused where
Buffer.alloc() arguments are derived from user input to return
uncleared memory blocks that may contain sensitive
information.</p>
<h1>Out of bounds (OOB) write</h1>
<p>Node.js TSC member Nikita Skovoroda discovered an OOB write
in Buffer that can be used to write to memory outside of a
Buffer's memory space. This can corrupt unrelated Buffer
objects or cause the Node.js process to crash.</p>
<p>When used with UCS-2 encoding (recognized by Node.js under
the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'),
Buffer#write() can be abused to write outside of the bounds of
a single Buffer. Writes that start from the second-to-last
position of a buffer cause a miscalculation of the maximum
length of the input bytes to be written.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/</url>
<cvename>CVE-2018-0732</cvename>
<cvename>CVE-2018-7166</cvename>
<cvename>CVE-2018-12115</cvename>
</references>
<dates>
<discovery>2018-08-16</discovery>
<entry>2018-08-25</entry>
</dates>
</vuln>
<vuln vid="45671c0e-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
<range><ge>10.4</ge><lt>10.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When using WPA2, EAPOL-Key frames with the Encrypted
flag and without the MIC flag set, the data field was
decrypted first without verifying the MIC. When the dta
field was encrypted using RC4, for example, when negotiating
TKIP as a pairwise cipher, the unauthenticated but decrypted
data was subsequently processed. This opened wpa_supplicant(8)
to abuse by decryption and recovery of sensitive information
contained in EAPOL-Key messages.</p>
<p>See
https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt
for a detailed description of the bug.</p>
<h1>Impact:</h1>
<p>All users of the WPA2 TKIP pairwise cipher are vulnerable
to information, for example, the group key.</p>
</body>
</description>
<references>
<cvename>CVE-2018-1452</cvename>
<freebsdsa>SA-18:11.hostapd</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="359e1548-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in IP fragment reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A researcher has notified us of a DoS attack applicable
to another operating system. While FreeBSD may not be
vulnerable to that exact attack, we have identified several
places where inadequate DoS protection could allow an
attacker to consume system resources.</p>
<p>It is not necessary that the attacker be able to establish
two-way communication to carry out these attacks. These
attacks impact both IPv4 and IPv6 fragment reassembly.</p>
<h1>Impact:</h1>
<p>In the worst case, an attacker could send a stream of
crafted fragments with a low packet rate which would consume
a substantial amount of CPU.</p>
<p>Other attack vectors allow an attacker to send a stream
of crafted fragments which could consume a large amount of
CPU or all available mbuf clusters on the system.</p>
<p>These attacks could temporarily render a system unreachable
through network interfaces or temporarily render a system
unresponsive. The effects of the attack should clear within
60 seconds after the attack stops.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6923</cvename>
<freebsdsa>SA-18:10.ip</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="2310b814-a652-11e8-805b-a4badb2f4699">
<topic>FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_2</lt></range>
<range><ge>11.1</ge><lt>11.1_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>On certain Intel 64-bit x86 systems there is a period
of time during terminal fault handling where the CPU may
use speculative execution to try to load data. The CPU may
speculatively access the level 1 data cache (L1D). Data
which would otherwise be protected may then be determined
by using side channel methods.</p>
<p>This issue affects bhyve on FreeBSD/amd64 systems.</p>
<h1>Impact:</h1>
<p>An attacker executing user code, or kernel code inside
of a virtual machine, may be able to read secret data from
the kernel or from another virtual machine.</p>
</body>
</description>
<references>
<cvename>CVE-2018-3620</cvename>
<cvename>CVE-2018-3646</cvename>
<freebsdsa>SA-18:09.l1tf</freebsdsa>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="e53a908d-a645-11e8-8acd-10c37b4ac2ea">
<topic>gogs -- open redirect vulnerability</topic>
<affects>
<package>
<name>gogs</name>
<range><lt>0.11.53_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bluecatli (Tencent's Xuanwu Lab) reports:</p>
<blockquote cite="https://github.com/gogs/gogs/issues/5364">
<p>The function isValidRedirect in gogs/routes/user/auth.go is used in login action to validate if url is on the same site.</p>
<p>If the Location header startswith /\, it will be transformed to // by browsers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/gogs/gogs/issues/5364</url>
<url>https://github.com/gogs/gogs/pull/5365</url>
<url>https://github.com/gogs/gogs/commit/1f247cf8139cb483276cd8dd06385a800ce9d4b2</url>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="9e205ef5-a649-11e8-b1f6-6805ca0b3d42">
<topic>phpmyadmin -- XSS in the import dialog</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<name>phpMyAdmin-php56</name>
<name>phpMyAdmin-php70</name>
<name>phpMyAdmin-php71</name>
<name>phpMyAdmin-php72</name>
<range><lt>4.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-5/">
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
file import feature, where an attacker can deliver a payload
to a user through importing a specially-crafted file.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-5/</url>
<cvename>CVE-2018-15605</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="fe99d3ca-a63a-11e8-a7c6-54e1ad3d6335">
<topic>libX11 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2018-August/002915.html">
<p>The functions XGetFontPath, XListExtensions, and XListFonts are
vulnerable to an off-by-one override on malicious server responses.
The server replies consist of chunks consisting of a length byte
followed by actual string, which is not NUL-terminated.
While parsing the response, the length byte is overridden with '\0',
thus the memory area can be used as storage of C strings later on.
To be able to NUL-terminate the last string, the buffer is reserved
with an additional byte of space. For a boundary check, the variable
chend (end of ch) was introduced, pointing at the end of the buffer
which ch initially points to. Unfortunately there is a difference
in handling "the end of ch". While chend points at the first byte
that must not be written to, the for-loop uses chend as the last
byte that can be written to. Therefore, an off-by-one can occur.</p>
<p>The length value is interpreted as signed char on many systems
(depending on default signedness of char), which can lead to an out
of boundary write up to 128 bytes in front of the allocated storage,
but limited to NUL byte(s).</p>
<p>If the server sends a reply in which even the first string would
overflow the transmitted bytes, list[0] (or flist[0]) will be set to
NULL and a count of 0 is returned. If the resulting list is freed
with XFreeExtensionList or XFreeFontPath later on, the first Xfree
call is turned into Xfree (NULL-1) which will most likely trigger a
segmentation fault. Casting the length value to unsigned char fixes
the problem and allows string values with up to 255 characters.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2018-August/002915.html</url>
<cvename>CVE-2018-14598</cvename>
<cvename>CVE-2018-14599</cvename>
<cvename>CVE-2018-14600</cvename>
</references>
<dates>
<discovery>2018-08-21</discovery>
<entry>2018-08-22</entry>
</dates>
</vuln>
<vuln vid="9b19b6df-a4be-11e8-9366-0028f8d09152">
<topic>couchdb -- administrator privilege escalation</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>2.2.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf75@%3Cdev.couchdb.apache.org%3E">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>http://docs.couchdb.org/en/stable/cve/2018-11769.html</url>
<cvename>CVE-2018-11769</cvename>
</references>
<dates>
<discovery>2018-06-05</discovery>
<entry>2018-08-08</entry>
</dates>
</vuln>
<vuln vid="7762d7ad-2e38-41d2-9785-c51f653ba8bd">
<topic>botan2 -- ECDSA side channel</topic>
<affects>
<package>
<name>botan2</name>
<range><ge>2.5.0</ge><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>botan2 developers report:</p>
<blockquote cite="https://botan.randombit.net/security.html#id1">
<p>A side channel in the ECDSA signature operation could allow a local attacker to recover the secret key. Found by Keegan Ryan of NCC Group.</p>
<p>Bug introduced in 2.5.0, fixed in 2.7.0. The 1.10 branch is not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://botan.randombit.net/security.html#id1</url>
<url>https://github.com/randombit/botan/pull/1604</url>
<cvename>CVE-2018-12435</cvename>
</references>
<dates>
<discovery>2018-06-13</discovery>
<entry>2018-08-17</entry>
</dates>
</vuln>
<vuln vid="6905f05f-a0c9-11e8-8335-8c164535ad80">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.138</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.121.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-08-15/">
<h1>Description</h1>
<h5>(Low) SECURITY-637</h5>
<p> Jenkins allowed deserialization of URL objects with host components</p>
<h5>(Medium) SECURITY-672</h5>
<p>Ephemeral user record was created on some invalid authentication attempts</p>
<h5>(Medium) SECURITY-790</h5>
<p>Cron expression form validation could enter infinite loop, potentially resulting in denial of service</p>
<h5>(Low) SECURITY-996</h5>
<p>"Remember me" cookie was evaluated even if that feature is disabled</p>
<h5>(Medium) SECURITY-1071</h5>
<p>Unauthorized users could access agent logs</p>
<h5>(Low) SECURITY-1076</h5>
<p>Unauthorized users could cancel scheduled restarts initiated from the update center</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-08-15/</url>
</references>
<dates>
<discovery>2018-08-15</discovery>
<entry>2018-08-15</entry>
</dates>
</vuln>
<vuln vid="98b603c8-9ff3-11e8-ad63-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.154</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-25.html">
<ul>
<li>This update resolves out-of-bounds read vulnerabilities that
could lead to information disclosure (CVE-2018-12824,
CVE-2018-12826, CVE-2018-12827).</li>
<li>This update resolves a security bypass vulnerability that
could lead to security mitigation bypass (CVE-2018-12825).</li>
<li>This update resolves a component vulnerability that
could lead to privilege escalation (CVE-2018-12828).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12824</cvename>
<cvename>CVE-2018-12825</cvename>
<cvename>CVE-2018-12826</cvename>
<cvename>CVE-2018-12827</cvename>
<cvename>CVE-2018-12828</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-25.html</url>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="c4e9a427-9fc2-11e8-802a-000c29a1e3ec">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba46</name>
<range><lt>4.6.16</lt></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.9</lt></range>
</package>
<package>
<name>samba48</name>
<range><lt>4.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1139.html">
<p>Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which
allows authentication using NTLMv1 over an SMB1 transport (either
directory or via NETLOGON SamLogon calls from a member server), even
when NTLMv1 is explicitly disabled on the server.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1140.html">
<p>Missing input sanitization checks on some of the input parameters to
LDB database layer cause the LDAP server and DNS server to crash when
following a NULL pointer.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10858.html">
<p>Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in
libsmbclient that could allow a malicious server to overwrite
client heap memory by returning an extra long filename in a directory
listing.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10918.html">
<p>Missing database output checks on the returned directory attributes
from the LDB database layer cause the DsCrackNames call in the DRSUAPI
server to crash when following a NULL pointer.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-10919.html">
<p>All versions of the Samba Active Directory LDAP server from 4.0.0
onwards are vulnerable to the disclosure of confidential attribute
values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL
(0x80) searchFlags bit and where an explicit Access Control Entry has
been specified on the ntSecurityDescriptor.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-1139.html</url>
<cvename>CVE-2018-1139</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-1140.html</url>
<cvename>CVE-2018-1140</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10858.html</url>
<cvename>CVE-2018-10858</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10918.html</url>
<cvename>CVE-2018-10918</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-10919.html</url>
<cvename>CVE-2018-10919</cvename>
</references>
<dates>
<discovery>2018-08-14</discovery>
<entry>2018-08-14</entry>
</dates>
</vuln>
<vuln vid="e714b7d2-39f6-4992-9f48-e6b2f5f949df">
<topic>GraphicsMagick -- SVG/Rendering vulnerability</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.30,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick News:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Fix heap write overflow of PrimitiveInfo and PointInfo arrays. This is
another manefestation of CVE-2016-2317, which should finally be fixed
correctly due to active detection/correction of pending overflow rather
than using estimation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
<cvename>CVE-2016-2317</cvename>
</references>
<dates>
<discovery>2018-06-23</discovery>
<entry>2018-08-11</entry>
</dates>
</vuln>
<vuln vid="5a771686-9e33-11e8-8b2d-9cf7a8059466">
<topic>chicken -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.13.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CHICKEN reports:</p>
<blockquote cite="https://code.call-cc.org/releases/4.13.0/NEWS">
<ul>
<li>CVE-2017-6949: Unchecked malloc() call in SRFI-4
constructors when allocating in non-GC memory, resulting
in potential 1-word buffer overrun and/or segfault</li>
<li>CVE-2017-9334: "length" crashes on improper lists</li>
<li>CVE-2017-11343: The randomization factor of the symbol
table was set before the random seed was set, causing it
to have a fixed value on many platforms</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://code.call-cc.org/releases/4.13.0/NEWS</url>
<cvename>CVE-2017-6949</cvename>
<cvename>CVE-2017-9334</cvename>
<cvename>CVE-2017-11343</cvename>
</references>
<dates>
<discovery>2017-03-16</discovery>
<entry>2018-08-12</entry>
</dates>
</vuln>
<vuln vid="bcf56a42-9df8-11e8-afb0-589cfc0f81b0">
<topic>gitea -- TOTP passcode reuse</topic>
<affects>
<package>
<name>gitea</name>
<range><lt>1.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Gitea project reports:</p>
<blockquote cite="https://blog.gitea.io/2018/08/gitea-1.5.0-is-released/">
<p>TOTP passcodes can be reused.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/go-gitea/gitea/pull/3878</url>
</references>
<dates>
<discovery>2018-05-01</discovery>
<entry>2018-08-12</entry>
</dates>
</vuln>
<vuln vid="f4876dd4-9ca8-11e8-aa17-0011d823eebd">
<topic>mbed TLS -- plaintext recovery vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02">
<ul>
<li>When using a CBC based ciphersuite, a remote attacker can
partially recover the plaintext.</li>
<li>When using a CBC based ciphersuite, an attacker with the
ability to execute arbitrary code on the machine under attack
can partially recover the plaintext by use of cache based
side-channels.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02</url>
<cvename>CVE-2018-0497</cvename>
<cvename>CVE-2018-0498</cvename>
</references>
<dates>
<discovery>2018-07-24</discovery>
<entry>2018-08-10</entry>
</dates>
</vuln>
<vuln vid="96eab874-9c79-11e8-b34b-6cc21735f730">
<topic>PostgreSQL -- two vulnerabilities</topic>
<affects>
<package>
<name>postgresql10-server</name>
<range><lt>10.5</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><lt>9.6.10</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><lt>9.5.14</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><lt>9.4.19</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><lt>9.3.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1878/">
<p>CVE-2018-10915: Certain host connection parameters defeat
client-side security defenses</p>
<p>libpq, the client connection API for PostgreSQL that is also used
by other connection libraries, had an internal issue where it did not
reset all of its connection state variables when attempting to
reconnect. In particular, the state variable that determined whether
or not a password is needed for a connection would not be reset, which
could allow users of features requiring libpq, such as the "dblink" or
"postgres_fdw" extensions, to login to servers they should not be able
to access.</p>
<p>CVE-2018-10925: Memory disclosure and missing authorization in
`INSERT ... ON CONFLICT DO UPDATE`</p>
<p>An attacker able to issue CREATE TABLE can read arbitrary bytes of
server memory using an upsert (`INSERT ... ON CONFLICT DO UPDATE`)
query. By default, any user can exploit that. A user that has
specific INSERT privileges and an UPDATE privilege on at least one
column in a given table can also update other columns using a view and
an upsert query.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.postgresql.org/about/news/1878/</url>
<cvename>CVE-2018-10915</cvename>
<cvename>CVE-2018-10925</cvename>
</references>
<dates>
<discovery>2018-08-09</discovery>
<entry>2018-08-10</entry>
</dates>
</vuln>
<vuln vid="909be51b-9b3b-11e8-add2-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.36</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.35</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.17</lt></range>
</package>
<package>
<name>mariadb103-server</name>
<range><lt>10.3.9</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.41</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.23</lt></range>
</package>
<package>
<name>mysql80-server</name>
<range><lt>8.0.12</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.61</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.41</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html">
<p>Multiple vulnerabilities have been disclosed by Oracle without
further detail. CVSS scores 7.1 - 2.7</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html</url>
<cvename>CVE-2018-3064</cvename>
<cvename>CVE-2018-0739</cvename>
<cvename>CVE-2018-3070</cvename>
<cvename>CVE-2018-3060</cvename>
<cvename>CVE-2018-3065</cvename>
<cvename>CVE-2018-3073</cvename>
<cvename>CVE-2018-3074</cvename>
<cvename>CVE-2018-3081</cvename>
<cvename>CVE-2018-3071</cvename>
<cvename>CVE-2018-3079</cvename>
<cvename>CVE-2018-3054</cvename>
<cvename>CVE-2018-3077</cvename>
<cvename>CVE-2018-3078</cvename>
<cvename>CVE-2018-3080</cvename>
<cvename>CVE-2018-3061</cvename>
<cvename>CVE-2018-3067</cvename>
<cvename>CVE-2018-3063</cvename>
<cvename>CVE-2018-3075</cvename>
<cvename>CVE-2018-3058</cvename>
<cvename>CVE-2018-3056</cvename>
<cvename>CVE-2018-3066</cvename>
<cvename>CVE-2018-2767</cvename>
<cvename>CVE-2018-3084</cvename>
<cvename>CVE-2018-3082</cvename>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-08-08</entry>
</dates>
</vuln>
<vuln vid="5786185a-9a43-11e8-b34b-6cc21735f730">
<topic>xml-security-c -- crashes on malformed KeyInfo content</topic>
<affects>
<package>
<name>apache-xml-security-c</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The shibboleth project reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180803.txt">
<p>
SAML messages, assertions, and metadata all commonly make use of the
XML Signature KeyInfo construct, which expresses information about
keys and certificates used in signing or encrypting XML.
</p>
<p>
The Apache Santuario XML Security for C++ library contained code
paths at risk of dereferencing null pointers when processing various
kinds of malformed KeyInfo hints typically found in signed or
encrypted XML. The usual effect is a crash, and in the case of the
Shibboleth SP software, a crash in the shibd daemon, which prevents
access to protected resources until the daemon is restarted.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180803.txt</url>
</references>
<dates>
<discovery>2018-08-03</discovery>
<entry>2018-08-07</entry>
</dates>
</vuln>
<vuln vid="3c2eea8c-99bf-11e8-8bee-a4badb2f4699">
<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.2</ge><lt>11.2_1</lt></range>
<range><ge>11.1</ge><lt>11.1_12</lt></range>
<range><ge>10.4</ge><lt>10.4_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>One of the data structures that holds TCP segments uses
an inefficient algorithm to reassemble the data. This causes
the CPU time spent on segment processing to grow linearly
with the number of segments in the reassembly queue.</p>
<h1>Impact:</h1>
<p>An attacker who has the ability to send TCP traffic to
a victim system can degrade the victim system's network
performance and/or consume excessive CPU by exploiting the
inefficiency of TCP reassembly handling, with relatively
small bandwidth cost.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6922</cvename>
<freebsdsa>SA-18:08.tcp</freebsdsa>
</references>
<dates>
<discovery>2018-08-06</discovery>
<entry>2018-08-06</entry>
</dates>
</vuln>
<vuln vid="9e2d0dcf-9926-11e8-a92d-0050562a4d7b">
<topic>py-cryptography -- tag forgery vulnerability</topic>
<affects>
<package>
<name>py27-cryptography</name>
<name>py34-cryptography</name>
<name>py35-cryptography</name>
<name>py36-cryptography</name>
<name>py37-cryptography</name>
<range><lt>2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Python Cryptographic Authority (PyCA) project reports:</p>
<blockquote cite="https://cryptography.io/en/latest/changelog/#v2-3">
<p>finalize_with_tag() allowed tag truncation by default which can allow tag forgery in some cases. The method now enforces the min_tag_length provided to the GCM constructor</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10903</cvename>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-08-06</entry>
</dates>
</vuln>
<vuln vid="06c4a79b-981d-11e8-b460-9c5c8e75236a">
<topic>cgit -- directory traversal vulnerability</topic>
<affects>
<package>
<name>cgit</name>
<range><lt>1.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jann Horn reports:</p>
<blockquote cite="https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html">
<p>cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html</url>
<cvename>CVE-2018-14912</cvename>
</references>
<dates>
<discovery>2018-08-03</discovery>
<entry>2018-08-04</entry>
</dates>
</vuln>
<vuln vid="e309a2c7-598b-4fa6-a398-bc72fbd1d167">
<topic>rubygem-doorkeeper -- token revocation vulnerability</topic>
<affects>
<package>
<name>rubygem-doorkeeper</name>
<name>rubygem-doorkeeper43</name>
<name>rubygem-doorkeeper-rails5</name>
<name>rubygem-doorkeeper-rails50</name>
<range><lt>4.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-1000211">
<p>Doorkeeper version 4.2.0 and later contains a Incorrect Access Control
vulnerability in Token revocation API's authorized method that can
result in Access tokens are not revoked for public OAuth apps, leaking
access until expiry.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-1000211</url>
<url>https://github.com/doorkeeper-gem/doorkeeper/pull/1120</url>
<cvename>CVE-2018-1000211</cvename>
</references>
<dates>
<discovery>2018-07-13</discovery>
<entry>2018-07-31</entry>
<modified>2018-08-03</modified>
</dates>
</vuln>
<vuln vid="ca05d9da-ac1d-4113-8a05-ffe9cd0d6160">
<topic>sinatra -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-sinatra</name>
<range><ge>2.0.0</ge><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sinatra blog:</p>
<blockquote cite="http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html">
<p>Sinatra had a critical vulnerability since v2.0.0. The purpose of this
release is to fix CVE-2018-11627.</p>
<p>The vulnerability is that XSS can be executed by using illegal parameters.</p>
</blockquote>
</body>
</description>
<references>
<url>http://sinatrarb.com/2018/06/09/sinatra-2.0.2-and-2.0.3.html</url>
<url>https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md</url>
<cvename>CVE-2018-11627</cvename>
</references>
<dates>
<discovery>2018-06-09</discovery>
<entry>2018-07-31</entry>
</dates>
</vuln>
<vuln vid="b4f0ad36-94a5-11e8-9007-080027ac955c">
<topic>mailman -- content spoofing with invalid list names in web UI</topic>
<affects>
<package><name>mailman</name> <range><lt>2.1.28</lt></range></package>
<package><name>mailman-with-htdig</name><range><lt>2.1.28</lt></range></package>
<package><name>ja-mailman</name> <range><lt>2.1.14.j7_6,1</lt></range></package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/1780874">
<p>A URL with a very long text listname such as</p>
<pre>http://www.example.com/mailman/listinfo/This_is_a_long_string_with_some_phishing_text</pre>
<p>will echo the text in the "No such list" error response. This can be used to make a potential victim think the phishing text comes from a trusted site.</p>
<p>This issue was discovered by Hammad Qureshi.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/mailman/+bug/1780874</url>
<url>https://mail.python.org/pipermail/mailman-announce/2018-July/000241.html</url>
<cvename>CVE-2018-13796</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-31</entry>
</dates>
</vuln>
<vuln vid="0822a4cf-9318-11e8-8d88-00e04c1ea73d">
<topic>mantis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>2.15.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mantis reports:</p>
<blockquote cite="https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f">
<p>Teun Beijers reported a cross-site scripting (XSS) vulnerability in
the Edit Filter page which allows execution of arbitrary code
(if CSP settings permit it) when displaying a filter with a crafted
name. Prevent the attack by sanitizing the filter name before display.</p>
<p>Ömer Cıtak, Security Researcher at Netsparker, reported this
vulnerability, allowing remote attackers to inject arbitrary code
(if CSP settings permit it) through a crafted PATH_INFO on
view_filters_page.php. Prevent the attack by sanitizing the output
of $_SERVER['PHP_SELF'] before display.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f</url>
<url>https://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a</url>
<cvename>CVE-2018-14504</cvename>
<cvename>CVE-2018-13066</cvename>
</references>
<dates>
<discovery>2018-07-13</discovery>
<entry>2018-07-29</entry>
<modified>2018-08-24</modified>
</dates>
</vuln>
<vuln vid="e97a8852-32dd-4291-ba4d-92711daff056">
<topic>py-bleach -- unsanitized character entities</topic>
<affects>
<package>
<name>py27-bleach</name>
<name>py36-bleach</name>
<range><ge>2.1.0</ge><lt>2.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>bleach developer reports:</p>
<blockquote cite="https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES">
<p>Attributes that have URI values weren't properly sanitized if the
values contained character entities. Using character entities, it
was possible to construct a URI value with a scheme that was not
allowed that would slide through unsanitized.</p>
<p>This security issue was introduced in Bleach 2.1. Anyone using
Bleach 2.1 is highly encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES</url>
</references>
<dates>
<discovery>2018-03-05</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="07d04eef-d8e2-11e6-a071-001e67f15f5a">
<topic>lshell -- Shell autocomplete reveals forbidden directories</topic>
<affects>
<package>
<name>lshell</name>
<range><lt>0.9.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lshell reports:</p>
<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
<p>The autocomplete feature allows users to list directories, while they do not have access to those paths (issue #109).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ghantoos/lshell/issues/109</url>
</references>
<dates>
<discovery>2015-07-25</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="f353525a-d8b8-11e6-a071-001e67f15f5a">
<topic>lshell -- Multiple security issues</topic>
<affects>
<package>
<name>lshell</name>
<range><le>0.9.18</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>lshell reports:</p>
<blockquote cite="https://github.com/ghantoos/lshell/issues/151">
<p>It is possible to escape lshell if an allowed command can execute an arbitrary non allowed one (issue #122).</p>
<p>Inappropriate parsing of commands can lead to arbitrary command execution (issue #147, #149, #151).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ghantoos/lshell/issues/122</url>
<url>https://github.com/ghantoos/lshell/issues/147</url>
<url>https://github.com/ghantoos/lshell/issues/149</url>
<url>https://github.com/ghantoos/lshell/issues/151</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="11dc3890-0e64-11e8-99b0-d017c2987f9a">
<topic>OpenJPEG -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.3.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenJPEG reports:</p>
<blockquote cite="https://github.com/uclouvain/openjpeg/issues?q=is%3Aissue+CVE-2017-17479+OR+CVE-2017-17480+OR+CVE-2018-5785+OR+CVE-2018-6616">
<p>Multiple vulnerabilities have been found in OpenJPEG, the
opensource JPEG 2000 codec. Please consult the CVE list for further
details.</p>
<p>CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.</p>
<p>CVE-2018-5785 was fixed in r480624.</p>
<p>CVE-2018-6616 was fixed in r489415.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17479</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17480</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5785</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-6616</url>
<cvename>CVE-2017-17479</cvename>
<cvename>CVE-2017-17480</cvename>
<cvename>CVE-2018-5785</cvename>
<cvename>CVE-2018-6616</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2018-07-27</entry>
<modified>2019-02-11</modified>
</dates>
</vuln>
<vuln vid="5ccbb2f8-c798-11e7-a633-009c02a2ab30">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.3.5_1,1</lt></range>
<range><ge>3.4,1</ge><le>3.4.1_4,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://ffmpeg.org/security.html">
<p>Multiple vulnerabilities have been found in FFmpeg. Please refer
to CVE list for details.</p>
<p>Note: CVE-2017-15186 and CVE-2017-15672 affect only the 3.3 branch
before 3.3.5, CVE-2017-16840 and CVE-2017-17081 have been fixed
in 3.4.1. They're listed here for completeness of the record.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15186</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16840</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17081</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6392</url>
<url>http://ffmpeg.org/security.html</url>
<cvename>CVE-2017-15186</cvename>
<cvename>CVE-2017-15672</cvename>
<cvename>CVE-2017-16840</cvename>
<cvename>CVE-2017-17081</cvename>
<cvename>CVE-2018-6392</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="bfda2d80-0858-11e8-ad5c-0021ccb9e74d">
<topic>GIMP - Heap Buffer Overflow Vulnerability</topic>
<affects>
<package>
<name>gimp</name>
<range><lt>2.8.22,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNOME reports:</p>
<blockquote cite="https://www.securityfocus.com/bid/102765/references">
<p>CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=739134</url>
<cvename>CVE-2017-17786</cvename>
</references>
<dates>
<discovery>2017-12-21</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="b9c525d9-9198-11e8-beba-080027ef1a23">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>68.0.3440.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html">
<p>42 security fixes in this release, including:</p>
<ul>
<li>[850350] High CVE-2018-6153: Stack buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS Security Team on 2018-06-07</li>
<li>[848914] High CVE-2018-6154: Heap buffer overflow in WebGL. Reported by Omair on 2018-06-01</li>
<li>[842265] High CVE-2018-6155: Use after free in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-11</li>
<li>[841962] High CVE-2018-6156: Heap buffer overflow in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-10</li>
<li>[840536] High CVE-2018-6157: Type confusion in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-07</li>
<li>[812667] Medium CVE-2018-6150: Cross origin information disclosure in Service Workers. Reported by Rob Wu on 2018-02-15</li>
<li>[805905] Medium CVE-2018-6151: Bad cast in DevTools. Reported by Rob Wu on 2018-01-25</li>
<li>[805445] Medium CVE-2018-6152: Local file write in DevTools. Reported by Rob Wu on 2018-01-24</li>
<li>[841280] Medium CVE-2018-6158: Use after free in Blink. Reported by Zhe Jin, Luyao Liu from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd on 2018-05-09</li>
<li>[837275] Medium CVE-2018-6159: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-04-26</li>
<li>[839822] Medium CVE-2018-6160: URL spoof in Chrome on iOS. Reported by evi1m0 of Bilibili Security Team on 2018-05-04</li>
<li>[826552] Medium CVE-2018-6161: Same origin policy bypass in WebAudio. Reported by Jun Kokatsu (@shhnjk) on 2018-03-27</li>
<li>[804123] Medium CVE-2018-6162: Heap buffer overflow in WebGL. Reported by Omair on 2018-01-21</li>
<li>[849398] Medium CVE-2018-6163: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-06-04</li>
<li>[848786] Medium CVE-2018-6164: Same origin policy bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-06-01</li>
<li>[847718] Medium CVE-2018-6165: URL spoof in Omnibox. Reported by evi1m0 of Bilibili Security Team on 2018-05-30</li>
<li>[835554] Medium CVE-2018-6166: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-21</li>
<li>[833143] Medium CVE-2018-6167: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-04-15</li>
<li>[828265] Medium CVE-2018-6168: CORS bypass in Blink. Reported by Gunes Acar and Danny Y. Huang of Princeton University, Frank Li of UC Berkeley on 2018-04-03</li>
<li>[394518] Medium CVE-2018-6169: Permissions bypass in extension installation. Reported by Sam P on 2014-07-16</li>
<li>[862059] Medium CVE-2018-6170: Type confusion in PDFium. Reported by Anonymous on 2018-07-10</li>
<li>[851799] Medium CVE-2018-6171: Use after free in WebBluetooth. Reported by amazon@mimetics.ca on 2018-06-12</li>
<li>[847242] Medium CVE-2018-6172: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-05-28</li>
<li>[836885] Medium CVE-2018-6173: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-04-25</li>
<li>[835299] Medium CVE-2018-6174: Integer overflow in SwiftShader. Reported by Mark Brand of Google Project Zero on 2018-04-20</li>
<li>[826019] Medium CVE-2018-6175: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-26</li>
<li>[666824] Medium CVE-2018-6176: Local user privilege escalation in Extensions. Reported by Jann Horn of Google Project Zero on 2016-11-18</li>
<li>[826187] Low CVE-2018-6177: Cross origin information leak in Blink. Reported by Ron Masas (Imperva) on 2018-03-27</li>
<li>[823194] Low CVE-2018-6178: UI spoof in Extensions. Reported by Khalil Zhani on 2018-03-19</li>
<li>[816685] Low CVE-2018-6179: Local file information leak in Extensions. Reported by Anonymous on 2018-02-26</li>
<li>[797461] Low CVE-2018-6044: Request privilege escalation in Extensions. Reported by Wob Wu on 2017-12-23</li>
<li>[791324] Low CVE-2018-4117: Cross origin information leak in Blink. Reported by AhsanEjaz - @AhsanEjazA on 2017-12-03</li>
<li>[866821] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4117</cvename>
<cvename>CVE-2018-6044</cvename>
<cvename>CVE-2018-6150</cvename>
<cvename>CVE-2018-6151</cvename>
<cvename>CVE-2018-6152</cvename>
<cvename>CVE-2018-6153</cvename>
<cvename>CVE-2018-6154</cvename>
<cvename>CVE-2018-6155</cvename>
<cvename>CVE-2018-6156</cvename>
<cvename>CVE-2018-6157</cvename>
<cvename>CVE-2018-6158</cvename>
<cvename>CVE-2018-6159</cvename>
<cvename>CVE-2018-6160</cvename>
<cvename>CVE-2018-6161</cvename>
<cvename>CVE-2018-6162</cvename>
<cvename>CVE-2018-6163</cvename>
<cvename>CVE-2018-6164</cvename>
<cvename>CVE-2018-6165</cvename>
<cvename>CVE-2018-6166</cvename>
<cvename>CVE-2018-6167</cvename>
<cvename>CVE-2018-6168</cvename>
<cvename>CVE-2018-6169</cvename>
<cvename>CVE-2018-6170</cvename>
<cvename>CVE-2018-6171</cvename>
<cvename>CVE-2018-6172</cvename>
<cvename>CVE-2018-6173</cvename>
<cvename>CVE-2018-6174</cvename>
<cvename>CVE-2018-6175</cvename>
<cvename>CVE-2018-6176</cvename>
<cvename>CVE-2018-6177</cvename>
<cvename>CVE-2018-6178</cvename>
<cvename>CVE-2018-6179</cvename>
<url>https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-07-24</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="3849e28f-8693-11e8-9610-9c5c8e75236a">
<topic>curl -- SMTP send heap buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.54.1</ge><lt>7.61.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Wu reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_2018-70a2.html">
<p>curl might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_2018-70a2.html</url>
<cvename>CVE-2018-0500</cvename>
</references>
<dates>
<discovery>2018-07-11</discovery>
<entry>2018-07-27</entry>
<modified>2018-07-28</modified>
</dates>
</vuln>
<vuln vid="2da838f9-9168-11e8-8c75-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab-ce</name>
<range><ge>11.1.0</ge><lt>11.1.2</lt></range>
<range><ge>11.0.0</ge><lt>11.0.5</lt></range>
<range><ge>2.7.0</ge><lt>10.8.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/">
<p>Markdown DoS</p>
<p>Information Disclosure Prometheus Metrics</p>
<p>CSRF in System Hooks</p>
<p>Persistent XSS Pipeline Tooltip</p>
<p>Persistent XSS in Branch Name via Web IDE</p>
<p>Persistent XSS in Branch Name via Web IDE</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14601</cvename>
<cvename>CVE-2018-14602</cvename>
<cvename>CVE-2018-14603</cvename>
<cvename>CVE-2018-14604</cvename>
<cvename>CVE-2018-14605</cvename>
<cvename>CVE-2018-14606</cvename>
<url>https://about.gitlab.com/2018/07/26/security-release-gitlab-11-dot-1-dot-2-released/</url>
</references>
<dates>
<discovery>2018-07-26</discovery>
<entry>2018-07-27</entry>
</dates>
</vuln>
<vuln vid="38fec4bd-90f7-11e8-aafb-1c39475b9f84">
<topic>Fix a buffer overflow in the tiff reader</topic>
<affects>
<package>
<name>vips</name>
<range><lt>8.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libvips reports:</p>
<blockquote cite="https://github.com/jcupitt/libvips/releases/tag/v8.6.5">
<p>A buffer overflow was found and fixed in the libvips code</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jcupitt/libvips/releases/tag/v8.6.5</url>
</references>
<dates>
<discovery>2018-07-22</discovery>
<entry>2018-07-26</entry>
</dates>
</vuln>
<vuln vid="efe43d2b-8f35-11e8-b9e8-dcfe074bd614">
<topic>Memory leak in different components</topic>
<affects>
<package>
<name>libsixel</name>
<range><lt>1.8.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-14072">
<p>bsixel 1.8.1 has a memory leak in sixel_decoder_decode in
decoder.c, image_buffer_resize in fromsixel.c, sixel_decode_raw in
fromsixel.c and sixel_allocator_new in allocator.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14072</cvename>
<cvename>CVE-2018-14073</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14072</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14073</url>
</references>
<dates>
<discovery>2018-07-15</discovery>
<entry>2018-07-24</entry>
</dates>
</vuln>
<vuln vid="dc57ad48-ecbb-439b-a4d0-5869be47684e">
<topic>vlc -- Use after free vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><le>2.2.8_6,4</le></range>
</package>
<package>
<name>vlc-qt4</name>
<range><le>2.2.8_6,4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529">
<p>VideoLAN VLC media player 2.2.x is prone to a use after free
vulnerability which an attacker can leverage to execute arbitrary
code via crafted MKV files. Failed exploit attempts will likely
result in denial of service conditions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-11529</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11529</url>
<url>http://seclists.org/fulldisclosure/2018/Jul/28</url>
<url>https://github.com/rapid7/metasploit-framework/pull/10335</url>
<url>https://github.com/videolan/vlc-3.0/commit/c472668ff873cfe29281822b4548715fb7bb0368</url>
<url>https://github.com/videolan/vlc-3.0/commit/d2dadb37e7acc25ae08df71e563855d6e17b5b42</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-07-21</entry>
</dates>
</vuln>
<vuln vid="a2f35081-8a02-11e8-8fa5-4437e6ad11c4">
<topic>mutt -- remote code injection and path traversal vulnerability</topic>
<affects>
<package>
<name>mutt</name>
<range><lt>1.10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kevin J. McCarthy reports:</p>
<blockquote cite="http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html">
<p>Fixes a remote code injection vulnerability when "subscribing"
to an IMAP mailbox, either via $imap_check_subscribed, or via the
<subscribe> function in the browser menu. Mutt was generating a
"mailboxes" command and sending that along to the muttrc parser.
However, it was not escaping "`", which executes code and inserts
the result. This would allow a malicious IMAP server to execute
arbitrary code (for $imap_check_subscribed).</p>
<p>Fixes POP body caching path traversal vulnerability.</p>
<p>Fixes IMAP header caching path traversal vulnerability.</p>
<p>CVE-2018-14349 - NO Response Heap Overflow</p>
<p>CVE-2018-14350 - INTERNALDATE Stack Overflow</p>
<p>CVE-2018-14351 - STATUS Literal Length relative write</p>
<p>CVE-2018-14352 - imap_quote_string off-by-one stack overflow</p>
<p>CVE-2018-14353 - imap_quote_string int underflow</p>
<p>CVE-2018-14354 - imap_subscribe Remote Code Execution</p>
<p>CVE-2018-14355 - STATUS mailbox header cache directory traversal</p>
<p>CVE-2018-14356 - POP empty UID NULL deref</p>
<p>CVE-2018-14357 - LSUB Remote Code Execution</p>
<p>CVE-2018-14358 - RFC822.SIZE Stack Overflow</p>
<p>CVE-2018-14359 - base64 decode Stack Overflow</p>
<p>CVE-2018-14362 - POP Message Cache Directory Traversal</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14349</cvename>
<cvename>CVE-2018-14350</cvename>
<cvename>CVE-2018-14351</cvename>
<cvename>CVE-2018-14352</cvename>
<cvename>CVE-2018-14353</cvename>
<cvename>CVE-2018-14354</cvename>
<cvename>CVE-2018-14355</cvename>
<cvename>CVE-2018-14356</cvename>
<cvename>CVE-2018-14357</cvename>
<cvename>CVE-2018-14358</cvename>
<cvename>CVE-2018-14359</cvename>
<cvename>CVE-2018-14362</cvename>
<url>http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20180716/000004.html</url>
</references>
<dates>
<discovery>2018-07-15</discovery>
<entry>2018-07-17</entry>
</dates>
</vuln>
<vuln vid="fe12ef83-8b47-11e8-96cc-001a4a7ec6be">
<topic>mutt/neomutt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>neomutt</name>
<range><lt>20180716</lt></range>
</package>
<package>
<name>mutt</name>
<range><lt>1.10.1</lt></range>
</package>
<package>
<name>mutt14</name>
<range><lt>*</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NeoMutt report:</p>
<blockquote cite="https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716">
<h1>Description</h1>
<h5>CVE-2018-14349</h5><p>NO Response Heap Overflow</p>
<h5>CVE-2018-14350</h5><p>INTERNALDATE Stack Overflow</p>
<h5>CVE-2018-14351</h5><p>STATUS Literal Length relative write</p>
<h5>CVE-2018-14352</h5><p>imap_quote_string off-by-one stack overflow</p>
<h5>CVE-2018-14353</h5><p>imap_quote_string int underflow</p>
<h5>CVE-2018-14354</h5><p>imap_subscribe Remote Code Execution</p>
<h5>CVE-2018-14355</h5><p>STATUS mailbox header cache directory traversal</p>
<h5>CVE-2018-14356</h5><p>POP empty UID NULL deref</p>
<h5>CVE-2018-14357</h5><p>LSUB Remote Code Execution</p>
<h5>CVE-2018-14358</h5><p>RFC822.SIZE Stack Overflow</p>
<h5>CVE-2018-14359</h5><p>base64 decode Stack Overflow</p>
<h5>CVE-2018-14360</h5><p>NNTP Group Stack Overflow</p>
<h5>CVE-2018-14361</h5><p>NNTP Write 1 where via GROUP response</p>
<h5>CVE-2018-14362</h5><p>POP Message Cache Directory Traversal</p>
<h5>CVE-2018-14363</h5><p>NNTP Header Cache Directory Traversal</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14349</cvename>
<cvename>CVE-2018-14350</cvename>
<cvename>CVE-2018-14351</cvename>
<cvename>CVE-2018-14352</cvename>
<cvename>CVE-2018-14353</cvename>
<cvename>CVE-2018-14354</cvename>
<cvename>CVE-2018-14355</cvename>
<cvename>CVE-2018-14356</cvename>
<cvename>CVE-2018-14357</cvename>
<cvename>CVE-2018-14358</cvename>
<cvename>CVE-2018-14359</cvename>
<cvename>CVE-2018-14360</cvename>
<cvename>CVE-2018-14361</cvename>
<cvename>CVE-2018-14362</cvename>
<cvename>CVE-2018-14363</cvename>
<url>https://github.com/neomutt/neomutt/releases/tag/neomutt-20180716</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-07-19</entry>
</dates>
</vuln>
<vuln vid="20a1881e-8a9e-11e8-bddf-d017c2ca229d">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.133</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.121.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-07-18/">
<h1>Description</h1>
<h5>(High) SECURITY-897 / CVE-2018-1999001</h5>
<p>Users without Overall/Read permission can have Jenkins reset parts of global configuration on the next restart </p>
<h5>(High) SECURITY-914 / CVE-2018-1999002</h5>
<p>Arbitrary file read vulnerability</p>
<h5>(Medium) SECURITY-891 / CVE-2018-1999003</h5>
<p>Unauthorized users could cancel queued builds</p>
<h5>(Medium) SECURITY-892 / CVE-2018-1999004</h5>
<p>Unauthorized users could initiate and abort agent launches</p>
<h5>(Medium) SECURITY-944 / CVE-2018-1999005</h5>
<p>Stored XSS vulnerability</p>
<h5>(Medium) SECURITY-925 / CVE-2018-1999006</h5>
<p>Unauthorized users are able to determine when a plugin was extracted from its JPI package</p>
<h5>(Medium) SECURITY-390 / CVE-2018-1999007</h5>
<p>XSS vulnerability in Stapler debug mode</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1999001</cvename>
<cvename>CVE-2018-1999002</cvename>
<cvename>CVE-2018-1999003</cvename>
<cvename>CVE-2018-1999004</cvename>
<cvename>CVE-2018-1999005</cvename>
<cvename>CVE-2018-1999006</cvename>
<cvename>CVE-2018-1999007</cvename>
<url>https://jenkins.io/security/advisory/2018-07-18/</url>
</references>
<dates>
<discovery>2018-07-18</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="c6d1a8a6-8a91-11e8-be4d-005056925db4">
<topic>znc -- multiple vulnerabilities</topic>
<affects>
<package>
<name>znc</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14055">
<p>ZNC before 1.7.1-rc1 does not properly validate untrusted lines
coming from the network, allowing a non-admin user to escalate his
privilege and inject rogue values into znc.conf.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14056">
<p>ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in
a web skin name to access files outside of the intended skins
directories.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14055</cvename>
<cvename>CVE-2018-14056</cvename>
<url>https://wiki.znc.in/ChangeLog/1.7.1</url>
</references>
<dates>
<discovery>2018-07-14</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="8b1a50ab-8a8e-11e8-add2-b499baebfeaf">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>DoS for HTTP/2 connections by crafted requests
(CVE-2018-1333). By specially crafting HTTP/2 requests, workers
would be allocated 60 seconds longer than necessary, leading to
worker exhaustion and a denial of service. (low)</li>
<li>mod_md, DoS via Coredumps on specially crafted requests
(CVE-2018-8011). By specially crafting HTTP requests, the mod_md
challenge handler would dereference a NULL pointer and cause the
child process to segfault. This could be used to DoS the server.
(moderate)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2018-1333</cvename>
<cvename>CVE-2018-8011</cvename>
</references>
<dates>
<discovery>2018-07-18</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="8fc615cc-8a66-11e8-8c75-d8cb8abf62dd">
<topic>Gitlab -- Remote Code Execution Vulnerability in GitLab Projects Import</topic>
<affects>
<package>
<name>gitlab-ce</name>
<name>gitlab</name>
<range><ge>11.0.0</ge><lt>11.0.4</lt></range>
<range><ge>10.8.0</ge><lt>10.8.6</lt></range>
<range><ge>8.9.0</ge><lt>10.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/">
<p>Remote Code Execution Vulnerability in GitLab Projects Import</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-14364</cvename>
<url>https://about.gitlab.com/2018/07/17/critical-security-release-gitlab-11-dot-0-dot-4-released/</url>
</references>
<dates>
<discovery>2018-07-17</discovery>
<entry>2018-07-18</entry>
</dates>
</vuln>
<vuln vid="ef013039-89cd-11e8-84e9-00e04c1ea73d">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3-7</name>
<range><lt>7.6.30</lt></range>
</package>
<package>
<name>typo3-8</name>
<range><lt>8.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Typo3 core team reports:</p>
<blockquote cite="https://typo3.org/article/typo3-931-8717-and-7630-security-releases-published/">
<p>It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component)
is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance.
In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden
when using MD5 as the default hashing algorithm by just knowing a valid username.
Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.</p>
<p>Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact
that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored
with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way,
Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted
to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by
manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability.
In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit
has been identified so far.</p>
<p>Failing to properly dissociate system related configuration from user generated configuration,
the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation.
Basically instructions can be persisted to a form definition file that were not configured to be modified -
this applies to definitions managed using the form editor module as well as direct file upload using the regular
file list module. A valid backend user account as well as having system extension form activated are needed
in order to exploit this vulnerability.</p>
<p>It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization
when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents
to PHP objects. A valid backend user account as well as having PHP setting "yaml.decode_php" enabled is needed
to exploit this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-001/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-002/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-003/</url>
<url>https://typo3.org/security/advisory/typo3-core-sa-2018-004/</url>
</references>
<dates>
<discovery>2018-07-12</discovery>
<entry>2018-07-17</entry>
</dates>
</vuln>
<vuln vid="fe93803c-883f-11e8-9f0c-001b216d295b">
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><lt>1.60</lt></range>
</package>
<package>
<name>puppetserver</name>
<range><ge>0</ge></range>
</package>
<package>
<name>puppetserver5</name>
<range><lt>5.3.8</lt></range>
</package>
<package>
<name>puppetserver6</name>
<range><lt>6.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/latest_releases.html">
<p>Release 1.60 is now available for download.</p>
<p>CVE-2018-1000180: issue around primality tests for RSA key pair
generation if done using only the low-level API.</p>
<p>CVE-2018-1000613: lack of class checking in deserialization
of XMSS/XMSS^MT private keys with BDS state information.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000180</cvename>
<cvename>CVE-2018-1000613</cvename>
<url>https://www.bouncycastle.org/latest_releases.html</url>
</references>
<dates>
<discovery>2018-06-30</discovery>
<entry>2018-07-15</entry>
</dates>
</vuln>
<vuln vid="bd6cf187-8710-11e8-833d-18a6f7016652">
<topic>qutebrowser -- Remote code execution due to CSRF</topic>
<affects>
<package>
<name>qutebrowser</name>
<range><ge>1.4.0</ge><lt>1.4.1</lt></range>
<range><ge>1.0.0</ge><lt>1.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>qutebrowser team reports:</p>
<blockquote cite="https://blog.qutebrowser.org/cve-2018-10895-remote-code-execution-due-to-csrf-in-qutebrowser.html">
<p>Due to a CSRF vulnerability affecting the qute://settings page,
it was possible for websites to modify qutebrowser settings.
Via settings like editor.command, this possibly allowed websites
to execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2018/q3/29</url>
<cvename>CVE-2018-10895</cvename>
</references>
<dates>
<discovery>2018-07-11</discovery>
<entry>2018-07-14</entry>
</dates>
</vuln>
<vuln vid="e78732b2-8528-11e8-9c42-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.134</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-24.html">
<ul>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-5008).</li>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-5007).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5007</cvename>
<cvename>CVE-2018-5008</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-24.html</url>
</references>
<dates>
<discovery>2018-07-10</discovery>
<entry>2018-07-11</entry>
</dates>
</vuln>
<vuln vid="1e54d140-8493-11e8-a795-0028f8d09152">
<topic>couchdb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>couchdb</name>
<range><lt>1.7.2,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache CouchDB PMC reports:</p>
<blockquote cite="https://blog.couchdb.org/2018/07/10/cve-2018-8007/">
<p>Database Administrator could achieve privilege escalation to
the account that CouchDB runs under, by abusing insufficient validation
in the HTTP API, escaping security controls implemented in previous
releases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.couchdb.org/2018/07/10/cve-2018-8007/</url>
<cvename>CVE-2018-8007</cvename>
<url>https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/</url>
<cvename>CVE-2017-12636</cvename>
<cvename>CVE-2017-12635</cvename>
<url>https://lists.apache.org/thread.html/6fa798e96686b7b0013ec2088140d00aeb7d34487d3f5ad032af6934@%3Cdev.couchdb.apache.org%3E</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2018-07-10</entry>
</dates>
</vuln>
<vuln vid="3c9b7698-84da-11e8-8c75-d8cb8abf62dd">
<topic>Libgit2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libgit2</name>
<range><lt>0.27.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.3">
<p>Out-of-bounds reads when reading objects from a packfile</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.3</url>
<cvename>CVE-2018-10887</cvename>
<cvename>CVE-2018-10888</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-11</entry>
</dates>
</vuln>
<vuln vid="d1e9d8c5-839b-11e8-9610-9c5c8e75236a">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.100.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Joel Esler reports:</p>
<blockquote cite="https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html">
<p>3 security fixes in this release:</p>
<ul>
<li>CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).</li>
<li>CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera.</li>
<li>CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report
ed by aCaB.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html</url>
<cvename>CVE-2017-16932</cvename>
<cvename>CVE-2018-0360</cvename>
<cvename>CVE-2018-0361</cvename>
</references>
<dates>
<discovery>2018-07-09</discovery>
<entry>2018-07-09</entry>
</dates>
</vuln>
<vuln vid="7764b219-8148-11e8-aa4d-000e0cd7b374">
<topic>zziplib - multiple vulnerabilities</topic>
<affects>
<package>
<name>zziplib</name>
<range><lt>0.13.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NIST reports (by search in the range 2017/01/01 - 2018/07/06):</p>
<blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018">
<p>17 security fixes in this release:</p>
<ul>
<li>Heap-based buffer overflow in the __zzip_get32 function in fetch.c.</li>
<li>Heap-based buffer overflow in the __zzip_get64 function in fetch.c.</li>
<li>Heap-based buffer overflow in the zzip_mem_entry_extra_block function
in memdisk.c.</li>
<li>The zzip_mem_entry_new function in memdisk.c allows remote attackers
to cause a denial of service (out-of-bounds read and crash) via a
crafted ZIP file.</li>
<li>The prescan_entry function in fseeko.c allows remote attackers to cause
a denial of service (NULL pointer dereference and crash) via crafted
ZIP file.</li>
<li>The zzip_mem_entry_new function in memdisk.c cause a NULL pointer
dereference and crash via a crafted ZIP file.</li>
<li>seeko.c cause a denial of service (assertion failure and crash) via a
crafted ZIP file.</li>
<li>A segmentation fault caused by invalid memory access in the
zzip_disk_fread function because the size variable is not validated
against the amount of file->stored data.</li>
<li>A memory alignment error and bus error in the __zzip_fetch_disk_trailer
function of zzip/zip.c.</li>
<li>A bus error caused by loading of a misaligned address in the
zzip_disk_findfirst function.</li>
<li>An uncontrolled memory allocation and a crash in the __zzip_parse_root_directory
function.</li>
<li>An invalid memory address dereference was discovered in zzip_disk_fread
in mmapped.c.</li>
<li>A memory leak triggered in the function zzip_mem_disk_new in
memdisk.c.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5974</cvename>
<cvename>CVE-2017-5975</cvename>
<cvename>CVE-2017-5976</cvename>
<cvename>CVE-2017-5977</cvename>
<cvename>CVE-2017-5978</cvename>
<cvename>CVE-2017-5979</cvename>
<cvename>CVE-2017-5980</cvename>
<cvename>CVE-2017-5981</cvename>
<cvename>CVE-2018-6381</cvename>
<cvename>CVE-2018-6484</cvename>
<cvename>CVE-2018-6540</cvename>
<cvename>CVE-2018-6541</cvename>
<cvename>CVE-2018-6542</cvename>
<cvename>CVE-2018-6869</cvename>
<cvename>CVE-2018-7725</cvename>
<cvename>CVE-2018-7726</cvename>
<cvename>CVE-2018-7727</cvename>
<url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&query=zziplib&search_type=all&pub_start_date=01%2F01%2F2017&pub_end_date=07%2F06%2F2018"</url>
</references>
<dates>
<discovery>2017-03-01</discovery>
<entry>2018-07-06</entry>
</dates>
</vuln>
<vuln vid="4740174c-82bb-11e8-a29a-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.7,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<range><lt>4.9.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpressdevelopers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/">
<p>Taxonomy: Improve cache handling for term queries.</p>
<p>Posts, Post Types: Clear post password cookie when logging out.</p>
<p>Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.</p>
<p>Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.</p>
<p>Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-07-05</discovery>
<entry>2018-07-08</entry>
</dates>
</vuln>
<vuln vid="bfd5d004-81d4-11e8-a29a-00e04c1ea73d">
<topic>mybb -- vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/">
<p>High risk: Image and URL MyCode Persistent XSS</p>
<p>Medium risk: Multipage Reflected XSS</p>
<p>Low risk: ACP logs XSS</p>
<p>Low risk: Arbitrary file deletion via ACP’s Settings</p>
<p>Low risk: Login CSRF</p>
<p>Low risk: Non-video content embedding via Video MyCode</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/07/04/mybb-1-8-16-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-07-04</discovery>
<entry>2018-07-07</entry>
</dates>
</vuln>
<vuln vid="e375ff3f-7fec-11e8-8088-28d244aee256">
<topic>expat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.2.1</lt></range>
</package>
<package>
<name>libwww</name>
<range><lt>5.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063">
<p>An integer overflow during the parsing of XML using the Expat library.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233">
<p>XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat
XML Parser Library) allows attackers to put the parser in an infinite
loop using a malformed external entity definition from an external DTD.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233</url>
<url>https://libexpat.github.io/doc/cve-2017-9233/</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2018-07-05</entry>
</dates>
</vuln>
<vuln vid="ce39379f-7eb7-11e8-ab03-00bd7f19ff09">
<topic>h2o -- heap buffer overflow during logging</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marlies Ruck reports:</p>
<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.5">
<p>Fix heap buffer overflow while trying to emit access log
- see references for full details.</p>
<p>CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and
earlier allows remote attackers to execute arbitrary code or
cause a denial of service (DoS) via unspecified vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0608</cvename>
<url>https://github.com/h2o/h2o/issues/1775</url>
<url>https://github.com/h2o/h2o/releases/tag/v2.2.5</url>
</references>
<dates>
<discovery>2018-06-01</discovery>
<entry>2018-07-03</entry>
</dates>
</vuln>
<vuln vid="c1630aa3-7970-11e8-8634-dcfe074bd614">
<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
<affects>
<package>
<name>upp</name>
<range><le>11540</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
statement could cause a NULL pointer dereference, related to build.c
and prepare.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8740</cvename>
<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-07-01</entry>
</dates>
</vuln>
<vuln vid="cd81806c-26e7-4d4a-8425-02724a2f48af">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>61.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.1.19_2</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>60.0,1</ge><lt>60.1.0_1,1</lt></range>
<range><lt>52.9.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/">
<p>CVE-2018-12359: Buffer overflow using computed size of canvas element</p>
<p>CVE-2018-12360: Use-after-free when using focus()</p>
<p>CVE-2018-12361: Integer overflow in SwizzleData</p>
<p>CVE-2018-12358: Same-origin bypass using service worker and redirection</p>
<p>CVE-2018-12362: Integer overflow in SSSE3 scaler</p>
<p>CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture</p>
<p>CVE-2018-12363: Use-after-free when appending DOM nodes</p>
<p>CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins</p>
<p>CVE-2018-12365: Compromised IPC child process can list local filenames</p>
<p>CVE-2018-12371: Integer overflow in Skia library during edge builder allocation</p>
<p>CVE-2018-12366: Invalid data handling during QCMS transformations</p>
<p>CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming</p>
<p>CVE-2018-12368: No warning when opening executable SettingContent-ms files</p>
<p>CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments</p>
<p>CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View</p>
<p>CVE-2018-5186: Memory safety bugs fixed in Firefox 61</p>
<p>CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1</p>
<p>CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5156</cvename>
<cvename>CVE-2018-5186</cvename>
<cvename>CVE-2018-5187</cvename>
<cvename>CVE-2018-5188</cvename>
<cvename>CVE-2018-12358</cvename>
<cvename>CVE-2018-12359</cvename>
<cvename>CVE-2018-12360</cvename>
<cvename>CVE-2018-12361</cvename>
<cvename>CVE-2018-12362</cvename>
<cvename>CVE-2018-12363</cvename>
<cvename>CVE-2018-12364</cvename>
<cvename>CVE-2018-12365</cvename>
<cvename>CVE-2018-12366</cvename>
<cvename>CVE-2018-12367</cvename>
<cvename>CVE-2018-12368</cvename>
<cvename>CVE-2018-12369</cvename>
<cvename>CVE-2018-12370</cvename>
<cvename>CVE-2018-12371</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/</url>
</references>
<dates>
<discovery>2018-06-26</discovery>
<entry>2018-06-26</entry>
<modified>2018-07-07</modified>
</dates>
</vuln>
<vuln vid="739948e3-78bf-11e8-b23c-080027ac955c">
<topic>mailman -- hardening against malicious listowners injecting evil HTML scripts</topic>
<affects>
<package> <name>mailman</name> <range><lt>2.1.27</lt></range> </package>
<package> <name>mailman-with-htdig</name> <range><lt>2.1.27</lt></range> </package>
<package> <name>ja-mailman</name> <range><lt>2.1.14.j7_5,1</lt></range> </package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8">
<p>Existing protections against malicious listowners injecting evil
scripts into listinfo pages have had a few more checks added.
</p>
<p>A few more error messages have had their values HTML escaped.</p>
<p>The hash generated when SUBSCRIBE_FORM_SECRET is set could have been
the same as one generated at the same time for a different list and
IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS#L8</url>
<url>https://www.mail-archive.com/mailman-users@python.org/</url>
<cvename>CVE-2018-0618</cvename>
</references>
<dates>
<discovery>2018-03-09</discovery> <!-- Launchpad rev. 1747 -->
<entry>2018-06-25</entry>
</dates>
</vuln>
<vuln vid="b950a83b-789e-11e8-8545-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>11.0.0</ge><lt>11.0.1</lt></range>
<range><ge>10.8.0</ge><lt>10.8.5</lt></range>
<range><ge>4.1</ge><lt>10.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gitlab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/">
<p>Wiki XSS</p>
<p>Sanitize gem updates</p>
<p>XSS in url_for(params)</p>
<p>Content injection via username</p>
<p>Activity feed publicly displaying internal project names</p>
<p>Persistent XSS in charts</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-12606</cvename>
<cvename>CVE-2018-3740</cvename>
<cvename>CVE-2018-12605</cvename>
<cvename>CVE-2018-12607</cvename>
<url>https://about.gitlab.com/2018/06/25/security-release-gitlab-11-dot-0-dot-1-released/</url>
</references>
<dates>
<discovery>2018-06-25</discovery>
<entry>2018-06-25</entry>
</dates>
</vuln>
<vuln vid="17cb6ff3-7670-11e8-8854-6805ca0b3d42">
<topic>phpmyadmin -- remote code inclusion and XSS scripting</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><lt>4.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-3/">
<h3>Summary</h3>
<p>XSS in Designer feature</p>
<h3>Description</h3>
<p>A Cross-Site Scripting vulnerability was found in the
Designer feature, where an attacker can deliver a
payload to a user through a specially-crafted database
name.</p>
<h3>Severity</h3>
<p>We consider this attack to be of moderate severity.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-4/">
<h3>Summary</h3>
<p>File inclusion and remote code execution attack</p>
<h3>Description</h3>
<p>A flaw has been discovered where an attacker can include
(view and potentially execute) files on the server.</p>
<p>The vulnerability comes from a portion of code where
pages are redirected and loaded within phpMyAdmin, and an
improper test for whitelisted pages.</p>
<p>An attacker must be authenticated, except in these
situations:</p>
<ul>
<li>$cfg['AllowArbitraryServer'] = true: attacker can
specify any host he/she is already in control of, and
execute arbitrary code on phpMyAdmin</li>
<li>$cfg['ServerDefault'] = 0: this bypasses the login and
runs the vulnerable code without any authentication</li>
</ul>
<h3>Severity</h3>
<p>We consider this to be severe.</p> <h3>Mitigation
factor</h3> <p>Configuring PHP with a restrictive
`open_basedir` can greatly restrict an attacker's ability to
view files on the server. Vulnerable systems should not be
run with the phpMyAdmin directives
$cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault']
= 0</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-3/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2018-4/</url>
<cvename>CVE-2018-12581</cvename>
<cvename>CVE-2018-12613</cvename>
</references>
<dates>
<discovery>2018-06-21</discovery>
<entry>2018-06-22</entry>
</dates>
</vuln>
<vuln vid="4e07d94f-75a5-11e8-85d1-a4badb2f4699">
<topic>FreeBSD -- Lazy FPU State Restore Information Disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A subset of Intel processors can allow a local thread
to infer data from another thread through a speculative
execution side channel when Lazy FPU state restore is
used.</p>
<h1>Impact:</h1>
<p>Any local thread can potentially read FPU state information
from other threads running on the host. This could include
cryptographic keys when the AES-NI CPU feature is present.</p>
</body>
</description>
<references>
<cvename>CVE-2018-3665</cvename>
<freebsdsa>SA-18:07.lazyfpu</freebsdsa>
</references>
<dates>
<discovery>2018-06-21</discovery>
<entry>2018-06-21</entry>
</dates>
</vuln>
<vuln vid="25f73c47-68a8-4a30-9cbc-1ca5eea4d6ba">
<topic>GraphicsMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>GraphicsMagick</name>
<range><lt>1.3.26,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GraphicsMagick reports:</p>
<blockquote cite="http://www.graphicsmagick.org/NEWS.html">
<p>Multiple vulnerabilities have been found in GraphicsMagick 1.3.26
or earlier. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.graphicsmagick.org/NEWS.html</url>
<cvename>CVE-2016-7800</cvename>
<cvename>CVE-2016-7996</cvename>
<cvename>CVE-2016-7997</cvename>
<cvename>CVE-2016-9830</cvename>
<cvename>CVE-2017-6335</cvename>
<cvename>CVE-2017-8350</cvename>
<cvename>CVE-2017-10794</cvename>
<cvename>CVE-2017-10799</cvename>
<cvename>CVE-2017-10800</cvename>
</references>
<dates>
<discovery>2017-07-04</discovery>
<entry>2018-06-18</entry>
</dates>
</vuln>
<vuln vid="3a66cb69-716f-11e8-be54-3085a9a47796">
<topic>slurm -- insecure handling of user_name and gid fields</topic>
<affects>
<package>
<name>slurm-wlm</name>
<range><lt>17.02.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SchedMD reports:</p>
<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html">
<h1>Insecure handling of user_name and gid fields (CVE-2018-10995)</h1>
<p>While fixes are only available for the supported 17.02 and 17.11
releases, it is believed that similar vulnerabilities do affect past
versions as well. The only resolution is to upgrade Slurm to a fixed
release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.schedmd.com/pipermail/slurm-announce/2018/000008.html</url>
</references>
<dates>
<discovery>2018-05-30</discovery>
<entry>2018-06-16</entry>
</dates>
</vuln>
<vuln vid="45b8e2eb-7056-11e8-8fab-63ca6e0e13a2">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node6</name>
<range><lt>6.14.3</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.3</lt></range>
</package>
<package>
<name>node</name>
<range><lt>10.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/">
<h1>Denial of Service Vulnerability in HTTP/2 (CVE-2018-7161)</h1>
<p>All versions of 8.x and later are vulnerable and the severity is
HIGH. An attacker can cause a denial of service (DoS) by causing a
node server providing an http2 server to crash. This can be
accomplished by interacting with the http2 server in a manner that
triggers a cleanup bug where objects are used in native code after
they are no longer available. This has been addressed by updating
the http2 implementation. Thanks to Jordan Zebor at F5 Networks for
reporting this issue.</p>
<h1>Denial of Service, nghttp2 dependency (CVE-2018-1000168)</h1>
<p>All versions of 9.x and later are vulnerable and the severity is
HIGH. Under certain conditions, a malicious client can trigger an
uninitialized read (and a subsequent segfault) by sending a
malformed ALTSVC frame. This has been addressed through an by
updating nghttp2.</p>
<h1>Denial of Service Vulnerability in TLS (CVE-2018-7162)</h1>
<p>All versions of 9.x and later are vulnerable and the severity is
HIGH. An attacker can cause a denial of service (DoS) by causing a
node process which provides an http server supporting TLS server to
crash. This can be accomplished by sending duplicate/unexpected
messages during the handshake. This vulnerability has been addressed
by updating the TLS implementation. Thanks to Jordan Zebor at F5
Networks all of his help investigating this issue with the Node.js
team.</p>
<h1>Memory exhaustion DoS on v9.x (CVE-2018-7164)</h1>
<p>Versions 9.7.0 and later are vulnerable and the severity is MEDIUM.
A bug introduced in 9.7.0 increases the memory consumed when reading
from the network into JavaScript using the net.Socket object
directly as a stream. An attacker could use this cause a denial of
service by sending tiny chunks of data in short succession. This
vulnerability was restored by reverting to the prior behaviour.</p>
<h1>Calls to Buffer.fill() and/or Buffer.alloc() may hang (CVE-2018-7167)</h1>
<p>Calling Buffer.fill() or Buffer.alloc() with some parameters can
lead to a hang which could result in a Denial of Service. In order
to address this vulnerability, the implementations of Buffer.alloc()
and Buffer.fill() were updated so that they zero fill instead of
hanging in these cases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/</url>
<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
<cvename>CVE-2018-7161</cvename>
<cvename>CVE-2018-7162</cvename>
<cvename>CVE-2018-7164</cvename>
<cvename>CVE-2018-7167</cvename>
<cvename>CVE-2018-1000168</cvename>
</references>
<dates>
<discovery>2018-06-12</discovery>
<entry>2018-06-15</entry>
</dates>
</vuln>
<vuln vid="53eb9e1e-7014-11e8-8b1f-3065ec8fd3ec">
<topic>password-store -- GPG parsing vulnerabilities</topic>
<affects>
<package>
<name>password-store</name>
<range><lt>1.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason A. Donenfeld reports:</p>
<blockquote cite="https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html">
<p>Markus Brinkmann discovered that [the] parsing of gpg command line
output with regexes isn't anchored to the beginning of the line,
which means an attacker can generate a malicious key that simply has
the verification string as part of its username.</p>
<p>This has a number of nasty consequences:</p>
<ul>
<li>an attacker who manages to write into your ~/.password-store
and also inject a malicious key into your keyring can replace
your .gpg-id key and have your passwords encrypted under
additional keys;</li>
<li>if you have extensions enabled (disabled by default), an
attacker who manages to write into your ~/.password-store and
also inject a malicious key into your keyring can replace your
extensions and hence execute code.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://lists.zx2c4.com/pipermail/password-store/2018-June/003308.html</url>
<cvename>CVE-2018-12356</cvename>
</references>
<dates>
<discovery>2018-06-14</discovery>
<entry>2018-06-14</entry>
</dates>
</vuln>
<vuln vid="9b5162de-6f39-11e8-818e-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495">
<p>Mitigate a local side-channel attack on ECDSA signature as described in the white paper "Return on the Hidden Number Problem".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-0495</cvename>
<url>https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495</url>
<url>https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txt</url>
</references>
<dates>
<discovery>2018-06-13</discovery>
<entry>2018-06-13</entry>
<modified>2018-06-14</modified>
</dates>
</vuln>
<vuln vid="c82ecac5-6e3f-11e8-8777-b499baebfeaf">
<topic>OpenSSL -- Client DoS due to large DH parameter</topic>
<affects>
<package>
<name>libressl</name>
<name>libressl-devel</name>
<range><lt>2.6.5</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2o_4,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180612.txt">
<p>During key agreement in a TLS handshake using a DH(E) based
ciphersuite a malicious server can send a very large prime value
to the client. This will cause the client to spend an unreasonably
long period of time generating a key for this prime resulting in a
hang until the client has finished. This could be exploited in a
Denial Of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180612.txt</url>
<cvename>CVE-2018-0732</cvename>
</references>
<dates>
<discovery>2018-06-12</discovery>
<entry>2018-06-12</entry>
<modified>2018-07-24</modified>
</dates>
</vuln>
<vuln vid="0137167b-6dca-11e8-a671-001999f8d30b">
<topic>asterisk -- PJSIP endpoint presence disclosure when using ACL</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.21.1</lt></range>
</package>
<package>
<name>asterisk15</name>
<range><lt>15.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p> When endpoint specific ACL rules block a SIP request
they respond with a 403 forbidden. However, if an endpoint
is not identified then a 401 unauthorized response is
sent. This vulnerability just discloses which requests
hit a defined endpoint. The ACL rules cannot be bypassed
to gain access to the disclosed endpoints.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-008.html</url>
</references>
<dates>
<discovery>2018-06-11</discovery>
<entry>2018-06-11</entry>
</dates>
</vuln>
<vuln vid="f14ce57f-6dc8-11e8-a671-001999f8d30b">
<topic>asterisk -- Infinite loop when reading iostreams</topic>
<affects>
<package>
<name>asterisk15</name>
<range><lt>15.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>When connected to Asterisk via TCP/TLS if the client
abruptly disconnects, or sends a specially crafted message
then Asterisk gets caught in an infinite loop while trying
to read the data stream. Thus rendering the system as
unusable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-007.html</url>
</references>
<dates>
<discovery>2018-06-11</discovery>
<entry>2018-06-11</entry>
</dates>
</vuln>
<vuln vid="4cb49a23-6c89-11e8-8b33-e8e0b747a45a">
<topic>chromium -- Incorrect handling of CSP header</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>67.0.3396.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html">
<p>1 security fix contributed by external researchers:</p>
<ul>
<li>[845961] High CVE-2018-6148: Incorrect handling of CSP header. Reported by Michal Bentkowski on 2018-05-23</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6148</cvename>
<url>https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-06-10</entry>
</dates>
</vuln>
<vuln vid="7da0417f-6b24-11e8-84cc-002590acae31">
<topic>gnupg -- unsanitized output (CVE-2018-12020)</topic>
<affects>
<package>
<name>gnupg</name>
<range><lt>2.2.8</lt></range>
</package>
<package>
<name>gnupg1</name>
<range><lt>1.4.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html">
<p>GnuPG did not sanitize input file names, which may then be output to
the terminal. This could allow terminal control sequences or fake
status messages to be injected into the output.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12020</url>
<cvename>CVE-2018-12020</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526</url>
<cvename>CVE-2017-7526</cvename>
</references>
<dates>
<discovery>2018-06-07</discovery>
<entry>2018-06-08</entry>
</dates>
</vuln>
<vuln vid="e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7">
<topic>firefox -- Heap buffer overflow rasterizing paths in SVG with Skia</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>60.0.2,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.2.0.13_5</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.8.1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/">
<p>A heap buffer overflow can occur in the Skia library when
rasterizing paths using a maliciously crafted SVG file
with anti-aliasing turned off. This results in a
potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2018-14/</url>
</references>
<dates>
<discovery>2018-06-06</discovery>
<entry>2018-06-08</entry>
</dates>
</vuln>
<vuln vid="2dde5a56-6ab1-11e8-b639-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>30.0.0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-19.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-4945).</li>
<li>This update resolves an integer overflow vulnerability that
could lead to information disclosure (CVE-2018-5000).</li>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-5001).</li>
<li>This update resolves a stack-based buffer overflow vulnerability that
could lead to arbitrary code execution (CVE-2018-5002).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4945</cvename>
<cvename>CVE-2018-5000</cvename>
<cvename>CVE-2018-5001</cvename>
<cvename>CVE-2018-5002</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-19.html</url>
</references>
<dates>
<discovery>2018-06-07</discovery>
<entry>2018-06-07</entry>
<modified>2018-07-11</modified>
</dates>
</vuln>
<vuln vid="2f4fd3aa-32f8-4116-92f2-68f05398348e">
<topic>bro -- multiple memory allocation issues</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Corelight reports:</p>
<blockquote cite="https://www.bro.org/download/NEWS.bro.html">
<p>Bro 2.5.4 primarily fixes security issues</p>
<p>Multiple fixes and improvements to BinPAC generated code related to array parsing, with potential impact to all Bro's BinPAC-generated analyzers in the form of buffer over-reads or other invalid memory accesses depending on whether a particular analyzer incorrectly assumed that the evaulated-array-length expression is actually the number of elements that were parsed out from the input.</p>
<p>The NCP analyzer (not enabled by default and also updated to actually work with newer Bro APIs in the release) performed a memory allocation based directly on a field in the input packet and using signed integer storage. This could result in a signed integer overflow and memory allocations of negative or very large size, leading to a crash or memory exhaustion. The new NCP::max_frame_size tuning option now limits the maximum amount of memory that can be allocated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.bro.org/download/NEWS.bro.html</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-06</entry>
</dates>
</vuln>
<vuln vid="5a1589ad-68f9-11e8-83f5-d8cb8abf62dd">
<topic>Libgit2 -- Fixing insufficient validation of submodule names</topic>
<affects>
<package>
<name>libgit2</name>
<name>py-pygit2</name>
<range><lt>0.27.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://github.com/libgit2/libgit2/releases/tag/v0.27.1">
<p>Insufficient validation of submodule names</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgit2/libgit2/releases/tag/v0.27.1</url>
<cvename>CVE-2018-11235</cvename>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-05</entry>
</dates>
</vuln>
<vuln vid="c7a135f4-66a4-11e8-9e63-3085a9a47796">
<topic>Git -- Fix memory out-of-bounds and remote code execution vulnerabilities (CVE-2018-11233 and CVE-2018-11235)</topic>
<affects>
<package>
<name>git</name>
<name>git-lite</name>
<range><lt>2.13.7</lt></range>
<range><ge>2.14</ge><lt>2.14.4</lt></range>
<range><ge>2.15</ge><lt>2.15.2</lt></range>
<range><ge>2.16</ge><lt>2.16.4</lt></range>
<range><ge>2.17</ge><lt>2.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Git community reports:</p>
<blockquote cite="https://marc.info/?l=git&m=152761328506724&=2">
<ul><li>In affected versions of Git, code to sanity-check pathnames on
NTFS can result in reading out-of-bounds memory.</li>
<li>In affected versions of Git, remote code execution can
occur. With a crafted .gitmodules file, a malicious project can
execute an arbitrary script on a machine that runs "git clone
--recurse-submodules" because submodule "names" are obtained from
this file, and then appended to $GIT_DIR/modules, leading to
directory traversal with "../" in a name. Finally, post-checkout
hooks from a submodule are executed, bypassing the intended design
in which hooks are not obtained from a remote server.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11233</url>
<cvename>CVE-2018-11233</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11235</url>
<cvename>CVE-2018-11235</cvename>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-06-02</entry>
</dates>
</vuln>
<vuln vid="9557dc72-64da-11e8-bc32-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.8.0</ge><lt>10.8.2</lt></range>
<range><ge>10.7.0</ge><lt>10.7.5</lt></range>
<range><ge>1.0</ge><lt>10.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/">
<p>Removing public deploy keys regression</p>
<p>Users can update their password without entering current password</p>
<p>Persistent XSS - Selecting users as allowed merge request approvers</p>
<p>Persistent XSS - Multiple locations of user selection drop downs</p>
<p>include directive in .gitlab-ci.yml allows SSRF requests</p>
<p>Permissions issue in Merge Requests Create Service</p>
<p>Arbitrary assignment of project fields using "Import project"</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/05/29/security-release-gitlab-10-dot-8-dot-2-released/</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-05-31</entry>
</dates>
</vuln>
<vuln vid="7fc3e827-64a5-11e8-aedb-00224d821998">
<topic>strongswan -- Fix Denial-of-Service Vulnerability strongSwan (CVE-2018-10811, CVE-2018-5388)</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2018/05/28/strongswan-5.6.3-released.html">
<ul><li>A denial-of-service vulnerability in the IKEv2 key derivation was fixed
if the openssl plugin is used in FIPS mode and HMAC-MD5 is negotiated as
PRF (which is not FIPS-compliant). So this should only affect very specific setups,
but in such configurations all strongSwan versions since 5.0.1 may be affected.</li>
<li>A denial-of-service vulnerability in the stroke plugin was fixed.
When reading a message from the socket the plugin did not check the received length.
Unless a group is configured, root privileges are required to access that socket,
so in the default configuration this shouldn't be an issue, but all strongSwan versions may be affected.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-10811).html</url>
<cvename>CVE-2018-10811</cvename>
<url>https://www.strongswan.org/blog/2018/05/28/strongswan-vulnerability-(cve-2018-5388).html</url>
<cvename>CVE-2018-5388</cvename>
</references>
<dates>
<discovery>2018-05-16</discovery>
<entry>2018-05-31</entry>
</dates>
</vuln>
<vuln vid="427b0f58-644c-11e8-9e1b-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>67.0.3396.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html">
<p>34 security fixes in this release, including:</p>
<ul>
<li>[835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22</li>
<li>[840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07</li>
<li>[818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05</li>
<li>[844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18</li>
<li>[842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15</li>
<li>[841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09</li>
<li>[838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01</li>
<li>[838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30</li>
<li>[826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27</li>
<li>[839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04</li>
<li>[817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28</li>
<li>[797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23</li>
<li>[823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19</li>
<li>[831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12</li>
<li>[835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21</li>
<li>[810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08</li>
<li>[805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24</li>
<li>[798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01</li>
<li>[796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19</li>
<li>[837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28</li>
<li>[843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15</li>
<li>[828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02</li>
<li>[805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25</li>
<li>[818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02</li>
<li>[847542] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6123</cvename>
<cvename>CVE-2018-6124</cvename>
<cvename>CVE-2018-6125</cvename>
<cvename>CVE-2018-6126</cvename>
<cvename>CVE-2018-6127</cvename>
<cvename>CVE-2018-6128</cvename>
<cvename>CVE-2018-6129</cvename>
<cvename>CVE-2018-6130</cvename>
<cvename>CVE-2018-6131</cvename>
<cvename>CVE-2018-6132</cvename>
<cvename>CVE-2018-6133</cvename>
<cvename>CVE-2018-6134</cvename>
<cvename>CVE-2018-6135</cvename>
<cvename>CVE-2018-6136</cvename>
<cvename>CVE-2018-6137</cvename>
<cvename>CVE-2018-6138</cvename>
<cvename>CVE-2018-6139</cvename>
<cvename>CVE-2018-6140</cvename>
<cvename>CVE-2018-6141</cvename>
<cvename>CVE-2018-6142</cvename>
<cvename>CVE-2018-6143</cvename>
<cvename>CVE-2018-6144</cvename>
<cvename>CVE-2018-6145</cvename>
<cvename>CVE-2018-6147</cvename>
<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop_58.html</url>
</references>
<dates>
<discovery>2018-05-29</discovery>
<entry>2018-05-30</entry>
</dates>
</vuln>
<vuln vid="94599fe0-5ca3-11e8-8be1-d05099c0ae8c">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind912</name>
<range><lt>9.12.1P2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01602">
<p>An error in zone database reference counting can
lead to an assertion failure if a server which is
running an affected version of BIND attempts
several transfers of a slave zone in quick
succession.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01606">
<p>A problem with the implementation of the new
serve-stale feature in BIND 9.12 can lead to
an assertion failure in rbtdb.c, even when
stale-answer-enable is off. Additionally,
problematic interaction between the serve-stale
feature and NSEC aggressive negative caching can
in some cases cause undesirable behavior from named,
such as a recursion loop or excessive logging.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5736</cvename>
<cvename>CVE-2018-5737</cvename>
<url>https://kb.isc.org/article/AA-01602</url>
<url>https://kb.isc.org/article/AA-01606</url>
</references>
<dates>
<discovery>2018-05-18</discovery>
<entry>2018-05-21</entry>
</dates>
</vuln>
<vuln vid="04fe6c8d-2a34-4009-a81e-e7a7e759b5d2">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.60.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security problems:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2018-1000300: FTP shutdown response buffer overflow</p>
<p>curl might overflow a heap based memory buffer when closing down an
FTP connection with very long server command replies.</p>
<p>When doing FTP transfers, curl keeps a spare "closure handle" around
internally that will be used when an FTP connection gets shut down
since the original curl easy handle is then already removed.</p>
<p>FTP server response data that gets cached from the original transfer
might then be larger than the default buffer size (16 KB) allocated in
the "closure handle", which can lead to a buffer overwrite. The
contents and size of that overwrite is controllable by the server.</p>
<p>This situation was detected by an assert() in the code, but that was
of course only preventing bad stuff in debug builds. This bug is very
unlikely to trigger with non-malicious servers.</p>
<p>We are not aware of any exploit of this flaw.</p>
<p>CVE-2018-1000301: RTSP bad headers buffer over-read</p>
<p>curl can be tricked into reading data beyond the end of a heap based
buffer used to store downloaded content.</p>
<p>When servers send RTSP responses back to curl, the data starts out
with a set of headers. curl parses that data to separate it into a
number of headers to deal with those appropriately and to find the end
of the headers that signal the start of the "body" part.</p>
<p>The function that splits up the response into headers is called
Curl_http_readwrite_headers() and in situations where it can't find a
single header in the buffer, it might end up leaving a pointer pointing
into the buffer instead of to the start of the buffer which then later
on may lead to an out of buffer read when code assumes that pointer
points to a full buffer size worth of memory to use.</p>
<p>This could potentially lead to information leakage but most likely a
crash/denial of service for applications if a server triggers this flaw.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<url>https://curl.haxx.se/docs/adv_2018-82c2.html</url>
<url>https://curl.haxx.se/docs/adv_2018-b138.html</url>
<cvename>CVE-2018-1000300</cvename>
<cvename>CVE-2018-1000301</cvename>
</references>
<dates>
<discovery>2018-05-16</discovery>
<entry>2018-05-16</entry>
</dates>
</vuln>
<vuln vid="50210bc1-54ef-11e8-95d9-9c5c8e75236a">
<topic>wavpack -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wavpack</name>
<range><lt>5.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Ramacher reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6767">
<p>A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7253">
<p>The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7254">
<p>The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file.</p>
</blockquote>
<p>Thuan Pham reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10536">
<p>An issue was discovered in WavPack 5.1.0 and earlier. The WAV parser component contains a vulnerability that allows writing to memory because ParseRiffHeaderConfig in riff.c does not reject multiple format chunks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10537">
<p>An issue was discovered in WavPack 5.1.0 and earlier. The W64 parser component contains a vulnerability that allows writing to memory because ParseWave64HeaderConfig in wave64.c does not reject multiple format chunks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10538">
<p>An issue was discovered in WavPack 5.1.0 and earlier for WAV input. Out-of-bounds writes can occur because ParseRiffHeaderConfig in riff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10539">
<p>An issue was discovered in WavPack 5.1.0 and earlier for DSDiff input. Out-of-bounds writes can occur because ParseDsdiffHeaderConfig in dsdiff.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10540">
<p>An issue was discovered in WavPack 5.1.0 and earlier for W64 input. Out-of-bounds writes can occur because ParseWave64HeaderConfig in wave64.c does not validate the sizes of unknown chunks before attempting memory allocation, related to a lack of integer-overflow protection within a bytes_to_copy calculation and subsequent malloc call, leading to insufficient memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6767</cvename>
<cvename>CVE-2018-7253</cvename>
<cvename>CVE-2018-7254</cvename>
<cvename>CVE-2018-10536</cvename>
<cvename>CVE-2018-10537</cvename>
<cvename>CVE-2018-10538</cvename>
<cvename>CVE-2018-10539</cvename>
<cvename>CVE-2018-10540</cvename>
<url>https://www.debian.org/security/2018/dsa-4125</url>
<url>https://www.debian.org/security/2018/dsa-4197</url>
<freebsdpr>228141</freebsdpr>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-11</entry>
</dates>
</vuln>
<vuln vid="e457978b-5484-11e8-9b85-54ee754af08e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.170</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html">
<p>4 security fixes in this release:</p>
<ul>
<li>[835887] Critical: Chain leading to sandbox escape.
Reported by Anonymous on 2018-04-23</li>
<li>[836858] High CVE-2018-6121: Privilege Escalation in extensions</li>
<li>[836141] High CVE-2018-6122: Type confusion in V8</li>
<li>[833721] High CVE-2018-6120: Heap buffer overflow in PDFium.
Reported by Zhou Aiting(@zhouat1) of Qihoo 360 Vulcan Team on 2018-04-17</li>
<li>[841841] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6120</cvename>
<cvename>CVE-2018-6121</cvename>
<cvename>CVE-2018-6122</cvename>
<url>https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2018-04-14</discovery>
<entry>2018-05-11</entry>
</dates>
</vuln>
<vuln vid="06ab7724-0fd7-427e-a5ce-fe436302b10c">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.120</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.107.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-05-09/">
<p>The agent to master security subsystem ensures that the Jenkins
master is protected from maliciously configured agents. A path
traversal vulnerability allowed agents to escape whitelisted
directories to read and write to files they should not be able to
access.</p>
<p>Black Duck Hub Plugin's API endpoint was affected by an XML
External Entity (XXE) processing vulnerability. This allowed an
attacker with Overall/Read access to have Jenkins parse a maliciously
crafted file that uses external entities for extraction of secrets
from the Jenkins master, server-side request forgery, or
denial-of-service attacks.</p>
<p>Several other lower severity issues were reported, see reference
url for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-05-09/</url>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-10</entry>
</dates>
</vuln>
<vuln vid="5aefc41e-d304-4ec8-8c82-824f84f08244">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>60.0,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.1.0_18</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.4</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.8.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.8.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/">
<p>CVE-2018-5183: Backport critical security fixes in Skia</p>
<p>CVE-2018-5154: Use-after-free with SVG animations and clip paths</p>
<p>CVE-2018-5155: Use-after-free with SVG animations and text paths</p>
<p>CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files</p>
<p>CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer</p>
<p>CVE-2018-5159: Integer overflow and out-of-bounds write in Skia</p>
<p>CVE-2018-5160: Uninitialized memory use by WebRTC encoder</p>
<p>CVE-2018-5152: WebExtensions information leak through webRequest API</p>
<p>CVE-2018-5153: Out-of-bounds read in mixed content websocket messages</p>
<p>CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache</p>
<p>CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace</p>
<p>CVE-2018-5166: WebExtension host permission bypass through filterReponseData</p>
<p>CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger</p>
<p>CVE-2018-5168: Lightweight themes can be installed without user interaction</p>
<p>CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages</p>
<p>CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer</p>
<p>CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters</p>
<p>CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update</p>
<p>CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies</p>
<p>CVE-2018-5176: JSON Viewer script injection</p>
<p>CVE-2018-5177: Buffer overflow in XSLT during number formatting</p>
<p>CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox</p>
<p>CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension</p>
<p>CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced</p>
<p>CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink</p>
<p>CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar</p>
<p>CVE-2018-5151: Memory safety bugs fixed in Firefox 60</p>
<p>CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5150</cvename>
<cvename>CVE-2018-5151</cvename>
<cvename>CVE-2018-5152</cvename>
<cvename>CVE-2018-5153</cvename>
<cvename>CVE-2018-5154</cvename>
<cvename>CVE-2018-5155</cvename>
<cvename>CVE-2018-5157</cvename>
<cvename>CVE-2018-5158</cvename>
<cvename>CVE-2018-5159</cvename>
<cvename>CVE-2018-5160</cvename>
<cvename>CVE-2018-5163</cvename>
<cvename>CVE-2018-5164</cvename>
<cvename>CVE-2018-5165</cvename>
<cvename>CVE-2018-5166</cvename>
<cvename>CVE-2018-5167</cvename>
<cvename>CVE-2018-5168</cvename>
<cvename>CVE-2018-5169</cvename>
<cvename>CVE-2018-5172</cvename>
<cvename>CVE-2018-5173</cvename>
<cvename>CVE-2018-5174</cvename>
<cvename>CVE-2018-5175</cvename>
<cvename>CVE-2018-5176</cvename>
<cvename>CVE-2018-5177</cvename>
<cvename>CVE-2018-5178</cvename>
<cvename>CVE-2018-5180</cvename>
<cvename>CVE-2018-5181</cvename>
<cvename>CVE-2018-5182</cvename>
<cvename>CVE-2018-5183</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-11/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-12/</url>
</references>
<dates>
<discovery>2018-05-09</discovery>
<entry>2018-05-09</entry>
</dates>
</vuln>
<vuln vid="5af6378b-bd88-4997-bccc-b9ba2daecdd2">
<topic>kamailio - buffer overflow</topic>
<affects>
<package>
<name>kamailio</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>A specially crafted REGISTER message with a malformed branch or
From tag triggers an off-by-one heap-based buffer overflow in the
tmx_check_pretran function in modules/tmx/tmx_pretran.c</p>
</body>
</description>
<references>
<cvename>CVE-2018-8828</cvename>
<url>https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/</url>
<url>https://github.com/EnableSecurity/advisories/tree/master/ES2018-05-kamailio-heap-overflow</url>
</references>
<dates>
<discovery>2018-02-10</discovery>
<entry>2018-05-06</entry>
</dates>
</vuln>
<vuln vid="7b5a8e3b-52cc-11e8-8c7a-9c5c8e75236a">
<topic>wget -- cookie injection vulnerability</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Harry Sintonen of F-Secure Corporation reports:</p>
<blockquote cite="https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt">
<p>GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt</url>
<cvename>CVE-2018-0494</cvename>
<freebsdpr>ports/228071</freebsdpr>
</references>
<dates>
<discovery>2018-04-26</discovery>
<entry>2018-05-08</entry>
</dates>
</vuln>
<vuln vid="9558d49c-534c-11e8-8177-d43d7ef03aa6">
<topic>Flash Player -- arbitrary code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.171</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-16.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to arbitrary code execution (CVE-2018-4944).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4944</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-16.html</url>
</references>
<dates>
<discovery>2018-05-08</discovery>
<entry>2018-05-09</entry>
</dates>
</vuln>
<vuln vid="521ce804-52fd-11e8-9123-a4badb2f4699">
<topic>FreeBSD -- Mishandling of x86 debug exceptions</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_10</lt></range>
<range><ge>10.4</ge><lt>10.4_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The MOV SS and POP SS instructions inhibit debug exceptions
until the instruction boundary following the next instruction.
If that instruction is a system call or similar instruction
that transfers control to the operating system, the debug
exception will be handled in the kernel context instead of
the user context.</p>
<h1>Impact:</h1>
<p>An authenticated local attacker may be able to read
sensitive data in kernel memory, control low-level operating
system functions, or may panic the system.</p>
</body>
</description>
<references>
<cvename>CVE-2018-8897</cvename>
<freebsdsa>SA-18:06.debugreg</freebsdsa>
</references>
<dates>
<discovery>2018-05-08</discovery>
<entry>2018-05-08</entry>
</dates>
</vuln>
<vuln vid="8719b935-8bae-41ad-92ba-3c826f651219">
<topic>python 2.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>python release notes:</p>
<blockquote cite="https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst">
<p>Multiple vulnerabilities has been fixed in this release. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15rc1.rst</url>
<url>https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.15.rst</url>
<cvename>CVE-2012-0876</cvename>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-4472</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
<cvename>CVE-2018-1060</cvename>
<cvename>CVE-2018-1061</cvename>
</references>
<dates>
<discovery>2018-05-01</discovery>
<entry>2018-05-05</entry>
</dates>
</vuln>
<vuln vid="83a548b5-4fa5-11e8-9a8e-001e2a3f778d">
<topic>KWallet-PAM -- Access to privileged files</topic>
<affects>
<package>
<name>plasma5-kwallet-pam</name>
<range><lt>5.12.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The KDE Community reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20180503-1.txt">
<p>
kwallet-pam was doing file writing and permission changing
as root that with correct timing and use of carefully
crafted symbolic links could allow a non privileged user
to become the owner of any file on the system.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20180503-1.txt</url>
</references>
<dates>
<discovery>2018-05-04</discovery>
<entry>2018-05-04</entry>
</dates>
</vuln>
<vuln vid="89ca6f7d-4f00-11e8-9b1d-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.58</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-004">
<p>A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x.
This potentially allows attackers to exploit multiple attack vectors on a Drupal site,
which could result in the site being compromised. This vulnerability is related to
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002.
Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2018-004</url>
</references>
<dates>
<discovery>2018-04-25</discovery>
<entry>2018-05-03</entry>
</dates>
</vuln>
<vuln vid="9dfe61c8-4d15-11e8-8f2f-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.7.0</ge><lt>10.7.2</lt></range>
<range><ge>10.6.0</ge><lt>10.6.5</lt></range>
<range><ge>9.5.0</ge><lt>10.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released">
<p>Persistent XSS in Move Issue using project namespace</p>
<p>Download Archive allowing unauthorized private repo access</p>
<p>Mattermost Updates</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-10379</cvename>
<url>https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released</url>
</references>
<dates>
<discovery>2018-04-30</discovery>
<entry>2018-05-01</entry>
</dates>
</vuln>
<vuln vid="006bee4e-4c49-11e8-9c32-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.139</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html">
<p>3 security fixes in this release:</p>
<ul>
<li>[831963] Critical CVE-2018-6118: Use after free in Media Cache. Reported by Ned Williamson on 2018-04-12</li>
<li>[837635] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6118</cvename>
<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2018-04-12</discovery>
<entry>2018-04-30</entry>
</dates>
</vuln>
<vuln vid="499f6b41-58db-4f98-b8e7-da8c18985eda">
<topic>quassel -- multiple vulnerabilities</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.5</lt></range>
</package>
<package>
<name>quassel-core</name>
<range><lt>0.12.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo reports:</p>
<blockquote cite="https://bugs.gentoo.org/653834">
<p>quasselcore: corruption of heap metadata caused by qdatastream
leading to preauth remote code execution.</p>
<ul>
<li>Severity: high, by default the server port is publicly open
and the address can be requested using the /WHOIS command of IRC
protocol.</li>
<li>Description: In Qdatastream protocol each object is prepended
with 4 bytes for the object size, this can be used to trigger
allocation errors.</li>
</ul>
<p>quasselcore DDOS</p>
<ul>
<li>Severity: low, only impacts unconfigured quasselcore
instances.</li>
<li>Description: A login attempt causes a NULL pointer dereference
when the database is not initialized.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.gentoo.org/653834</url>
<url>https://github.com/quassel/quassel/commit/08bace4e9ecf08273f094c0c6aa8b3363d38ac3e</url>
<url>https://github.com/quassel/quassel/commit/18389a713a6810f57ab237b945e8ee03df857b8b</url>
</references>
<dates>
<discovery>2018-04-24</discovery>
<entry>2018-04-26</entry>
</dates>
</vuln>
<vuln vid="36ff7a74-47b1-11e8-a7d6-54e1ad544088">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>66.0.3359.117</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html">
<p>62 security fixes in this release:</p>
<ul>
<li>[826626] Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28</li>
<li>[827492] Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30</li>
<li>[813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20</li>
<li>[822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15</li>
<li>[808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04</li>
<li>[820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12</li>
<li>[771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05</li>
<li>[819869] High CVE-2018-6092: Integer overflow in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08</li>
<li>[780435] Medium CVE-2018-6093: Same origin bypass in Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-01</li>
<li>[633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01</li>
<li>[637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11</li>
<li>[776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19</li>
<li>[806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26</li>
<li>[798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03</li>
<li>[808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker. Reported by Jun Kokatsu (@shhnjk) on 2018-02-03</li>
<li>[811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11</li>
<li>[813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19</li>
<li>[813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20</li>
<li>[816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24</li>
<li>[820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08</li>
<li>[803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18</li>
<li>[805729] Medium CVE-2018-6106: Incorrect handling of promises in V8. Reported by lokihardt of Google Project Zero on 2018-01-25</li>
<li>[808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02</li>
<li>[816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27</li>
<li>[710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI. Reported by Dominik Weber (@DoWeb_) on 2017-04-10</li>
<li>[777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24</li>
<li>[780694] Low CVE-2018-6111: Heap-use-after-free in DevTools. Reported by Khalil Zhani on 2017-11-02</li>
<li>[798096] Low CVE-2018-6112: Incorrect URL handling in DevTools. Reported by Rob Wu on 2017-12-29</li>
<li>[805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25</li>
<li>[811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13</li>
<li>[819809] Low CVE-2018-6115: SmartScreen bypass in downloads. Reported by James Feher on 2018-03-07</li>
<li>[822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15</li>
<li>[822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15</li>
<li>[822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html</url>
<cvename>CVE-2018-6085</cvename>
<cvename>CVE-2018-6086</cvename>
<cvename>CVE-2018-6087</cvename>
<cvename>CVE-2018-6088</cvename>
<cvename>CVE-2018-6089</cvename>
<cvename>CVE-2018-6090</cvename>
<cvename>CVE-2018-6091</cvename>
<cvename>CVE-2018-6092</cvename>
<cvename>CVE-2018-6093</cvename>
<cvename>CVE-2018-6094</cvename>
<cvename>CVE-2018-6095</cvename>
<cvename>CVE-2018-6096</cvename>
<cvename>CVE-2018-6097</cvename>
<cvename>CVE-2018-6098</cvename>
<cvename>CVE-2018-6099</cvename>
<cvename>CVE-2018-6100</cvename>
<cvename>CVE-2018-6101</cvename>
<cvename>CVE-2018-6102</cvename>
<cvename>CVE-2018-6103</cvename>
<cvename>CVE-2018-6104</cvename>
<cvename>CVE-2018-6105</cvename>
<cvename>CVE-2018-6106</cvename>
<cvename>CVE-2018-6107</cvename>
<cvename>CVE-2018-6108</cvename>
<cvename>CVE-2018-6109</cvename>
<cvename>CVE-2018-6110</cvename>
<cvename>CVE-2018-6111</cvename>
<cvename>CVE-2018-6112</cvename>
<cvename>CVE-2018-6113</cvename>
<cvename>CVE-2018-6114</cvename>
<cvename>CVE-2018-6115</cvename>
<cvename>CVE-2018-6116</cvename>
<cvename>CVE-2018-6117</cvename>
<cvename>CVE-2018-6084</cvename>
</references>
<dates>
<discovery>2017-04-10</discovery>
<entry>2018-04-24</entry>
</dates>
</vuln>
<vuln vid="d8382a69-4728-11e8-ba83-0011d823eebd">
<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.7.2</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released">
<ul>
<li>Defend against Bellcore glitch attacks by verifying the results
of RSA private key operations.</li>
<li>Fix implementation of the truncated HMAC extension. The
previous implementation allowed an offline 2^80 brute force
attack on the HMAC key of a single, uninterrupted connection
(with no resumption of the session).</li>
<li>Reject CRLs containing unsupported critical extensions. Found
by Falko Strenzke and Evangelos Karatsiolis.</li>
<li>Fix a buffer overread in ssl_parse_server_key_exchange() that
could cause a crash on invalid input.</li>
<li>Fix a buffer overread in ssl_parse_server_psk_hint() that could
cause a crash on invalid input.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.8.0-2.7.2-and-2.1.11-released</url>
</references>
<dates>
<discovery>2018-03-21</discovery>
<entry>2018-04-23</entry>
</dates>
</vuln>
<vuln vid="57aec168-453e-11e8-8777-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.35</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.33</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.15</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.40</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.22</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.60</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.40</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html">
<p>MySQL Multiple Flaws Let Remote Authenticated Users Access and
Modify Data, Remote and Local Users Deny Service, and Local Users
Access Data and Gain Elevated Privileges</p>
<ul>
<li>A local user can exploit a flaw in the Replication component
to gain elevated privileges [CVE-2018-2755].</li>
<li>A remote authenticated user can exploit a flaw in the GIS
Extension component to cause denial of service conditions
[CVE-2018-2805].</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to cause denial of service conditions [CVE-2018-2782,
CVE-2018-2784, CVE-2018-2819].</li>
<li>A remote authenticated user can exploit a flaw in the Security
Privileges component to cause denial of service conditions
[CVE-2018-2758, CVE-2018-2818].</li>
<li>A remote authenticated user can exploit a flaw in the DDL
component to cause denial of service conditions
[CVE-2018-2817].</li>
<li>A remote authenticated user can exploit a flaw in the Optimizer
component to cause denial of service conditions [CVE-2018-2775,
CVE-2018-2778, CVE-2018-2779, CVE-2018-2780, CVE-2018-2781,
CVE-2018-2816].</li>
<li>A remote user can exploit a flaw in the Client programs
component to cause denial of service conditions [CVE-2018-2761,
CVE-2018-2773].</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to partially modify data and cause denial of service
conditions [CVE-2018-2786, CVE-2018-2787].</li>
<li>A remote authenticated user can exploit a flaw in the Optimizer
component to partially modify data and cause denial of service
conditions [CVE-2018-2812].</li>
<li>A local user can exploit a flaw in the Cluster ndbcluster/plugin
component to cause denial of service conditions [CVE-2018-2877].
</li>
<li>A remote authenticated user can exploit a flaw in the InnoDB
component to cause denial of service conditions [CVE-2018-2759,
CVE-2018-2766, CVE-2018-2777, CVE-2018-2810].</li>
<li>A remote authenticated user can exploit a flaw in the DML
component to cause denial of service conditions [CVE-2018-2839].
</li>
<li>A remote authenticated user can exploit a flaw in the
Performance Schema component to cause denial of service conditions
[CVE-2018-2846].</li>
<li>A remote authenticated user can exploit a flaw in the Pluggable
Auth component to cause denial of service conditions
[CVE-2018-2769].</li>
<li>A remote authenticated user can exploit a flaw in the Group
Replication GCS component to cause denial of service conditions
[CVE-2018-2776].</li>
<li>A local user can exploit a flaw in the Connection component to
cause denial of service conditions [CVE-2018-2762].</li>
<li>A remote authenticated user can exploit a flaw in the Locking
component to cause denial of service conditions [CVE-2018-2771].
</li>
<li>A remote authenticated user can exploit a flaw in the DDL
component to partially access data [CVE-2018-2813].</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html</url>
<cvename>CVE-2018-2755</cvename>
<cvename>CVE-2018-2805</cvename>
<cvename>CVE-2018-2782</cvename>
<cvename>CVE-2018-2784</cvename>
<cvename>CVE-2018-2819</cvename>
<cvename>CVE-2018-2758</cvename>
<cvename>CVE-2018-2817</cvename>
<cvename>CVE-2018-2775</cvename>
<cvename>CVE-2018-2780</cvename>
<cvename>CVE-2018-2761</cvename>
<cvename>CVE-2018-2786</cvename>
<cvename>CVE-2018-2787</cvename>
<cvename>CVE-2018-2812</cvename>
<cvename>CVE-2018-2877</cvename>
<cvename>CVE-2018-2759</cvename>
<cvename>CVE-2018-2766</cvename>
<cvename>CVE-2018-2777</cvename>
<cvename>CVE-2018-2810</cvename>
<cvename>CVE-2018-2818</cvename>
<cvename>CVE-2018-2839</cvename>
<cvename>CVE-2018-2778</cvename>
<cvename>CVE-2018-2779</cvename>
<cvename>CVE-2018-2781</cvename>
<cvename>CVE-2018-2816</cvename>
<cvename>CVE-2018-2846</cvename>
<cvename>CVE-2018-2769</cvename>
<cvename>CVE-2018-2776</cvename>
<cvename>CVE-2018-2762</cvename>
<cvename>CVE-2018-2771</cvename>
<cvename>CVE-2018-2813</cvename>
<cvename>CVE-2018-2773</cvename>
</references>
<dates>
<discovery>2018-04-17</discovery>
<entry>2018-04-21</entry>
</dates>
</vuln>
<vuln vid="be38245e-44d9-11e8-a292-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.5,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>zh_CN-wordpress</name>
<name>zh_TW-wordpress</name>
<name>ja-wordpress</name>
<range><lt>4.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/">
<p>Don't treat localhost as same host by default.</p>
<p>Use safe redirects when redirecting the login page if SSL is forced.</p>
<p>Make sure the version string is correctly escaped for use in generator tags.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/04/wordpress-4-9-5-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-04-03</discovery>
<entry>2018-04-20</entry>
</dates>
</vuln>
<vuln vid="ac7da39b-4405-11e8-afbe-6805ca0b3d42">
<topic>phpmyadmin -- CSRF vulnerability allowing arbitrary SQL execution</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.8.0</ge><lt>4.8.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-2/">
<h3>Summary</h3>
<p>CSRF vulnerability allowing arbitrary SQL execution</p>
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible for an attacker to execute arbitrary SQL
commands.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-2/</url>
</references>
<dates>
<discovery>2018-04-17</discovery>
<entry>2018-04-19</entry>
</dates>
</vuln>
<vuln vid="33174280-43fa-11e8-aad5-6cf0497db129">
<topic>drupal -- Drupal core - Moderately critical</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal security team reports:</p>
<blockquote cite="https://www.drupal.org/sa-core-2018-003">
<p>CKEditor, a third-party JavaScript library included in Drupal
core, has fixed a cross-site scripting (XSS) vulnerability. The
vulnerability stemmed from the fact that it was possible to execute
XSS inside CKEditor when using the image2 plugin (which Drupal 8
core also uses).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/sa-core-2018-003</url>
</references>
<dates>
<discovery>2018-04-18</discovery>
<entry>2018-04-19</entry>
</dates>
</vuln>
<vuln vid="8f353420-4197-11e8-8777-b499baebfeaf">
<topic>OpenSSL -- Cache timing vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2o_2,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180416.txt">
<p>The OpenSSL RSA Key generation algorithm has been shown to be
vulnerable to a cache timing side channel attack. An attacker
with sufficient access to mount cache timing attacks during the
RSA key generation process could recover the private key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180416.txt</url>
<cvename>CVE-2018-0737</cvename>
</references>
<dates>
<discovery>2018-04-16</discovery>
<entry>2018-04-16</entry>
</dates>
</vuln>
<vuln vid="a9e466e8-4144-11e8-a292-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.57</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/psa-2018-001">
<p>CVE-2018-7600: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6,
and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because
of an issue affecting multiple subsystems with default or common module configurations.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-7600</cvename>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-04-16</entry>
</dates>
</vuln>
<vuln vid="41c96ffd-29a6-4dcc-9a88-65f5038fa6eb">
<topic>perl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>perl5</name>
<range><ge>5.24.0</ge><lt>5.24.4</lt></range>
<range><ge>5.26.0</ge><lt>5.26.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>perldelta:</p>
<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.2">
<p>CVE-2018-6797: heap-buffer-overflow (WRITE of size 1) in S_regatom
(regcomp.c)</p>
<p>A crafted regular expression could cause a heap buffer write overflow,
with control over the bytes written. [perl #132227]</p>
<p>CVE-2018-6798: Heap-buffer-overflow in Perl__byte_dump_string (utf8.c)</p>
<p>Matching a crafted locale dependent regular expression could cause a
heap buffer read overflow and potentially information disclosure. [perl
#132063]</p>
<p>CVE-2018-6913: heap-buffer-overflow in S_pack_rec</p>
<p>pack() could cause a heap buffer write overflow with a large item
count. [perl #131844]</p>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/changes/release/SHAY/perl-5.26.2</url>
<url>https://metacpan.org/changes/release/SHAY/perl-5.24.4</url>
<cvename>CVE-2018-6797</cvename>
<cvename>CVE-2018-6798</cvename>
<cvename>CVE-2018-6913</cvename>
</references>
<dates>
<discovery>2018-04-14</discovery>
<entry>2018-04-15</entry>
</dates>
</vuln>
<vuln vid="974a6d32-3fda-11e8-aea4-001b216d295b">
<topic>ipsec-tools -- remotely exploitable computational-complexity attack</topic>
<affects>
<package>
<name>ipsec-tools</name>
<range><lt>0.8.2_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Robert Foggia via NetBSD GNATS reports:</p>
<blockquote cite="https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682">
<p>The ipsec-tools racoon daemon contains a remotely exploitable computational
complexity attack when parsing and storing isakmp fragments. The implementation
permits a remote attacker to exhaust computational resources on the remote endpoint
by repeatedly sending isakmp fragment packets in a particular order such that
the worst-case computational complexity is realized in the algorithm utilized
to determine if reassembly of the fragments can take place.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=51682</url>
<cvename>CVE-2016-10396</cvename>
</references>
<dates>
<discovery>2016-12-02</discovery>
<entry>2018-04-14</entry>
</dates>
</vuln>
<vuln vid="1fccb25e-8451-438c-a2b9-6a021e4d7a31">
<topic>nghttp2 -- Denial of service due to NULL pointer dereference</topic>
<affects>
<package>
<name>libnghttp2</name>
<name>nghttp2</name>
<range><ge>1.10.0</ge><lt>1.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 blog:</p>
<blockquote cite="https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/">
<p>If ALTSVC frame is received by libnghttp2 and it is larger than it can
accept, the pointer field which points to ALTSVC frame payload is left
NULL. Later libnghttp2 attempts to access another field through the
pointer, and gets segmentation fault.</p>
<p>ALTSVC frame is defined by RFC 7838.</p>
<p>The largest frame size libnghttp2 accept is by default 16384 bytes.</p>
<p>Receiving ALTSVC frame is disabled by default. Application has to
enable it explicitly by calling
nghttp2_option_set_builtin_recv_extension_type(opt, NGHTTP2_ALTSVC).</p>
<p>Transmission of ALTSVC is always enabled, and it does not cause this
vulnerability.</p>
<p>ALTSVC frame is expected to be sent by server, and received by client
as defined in RFC 7838.</p>
<p>Client and server are both affected by this vulnerability if the
reception of ALTSVC frame is enabled. As written earlier, it is useless
to enable reception of ALTSVC frame on server side. So, server is
generally safe unless application accidentally enabled the reception of
ALTSVC frame.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</url>
<cvename>CVE-2018-1000168</cvename>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-13</entry>
</dates>
</vuln>
<vuln vid="48894ca9-3e6f-11e8-92f0-f0def167eeea">
<topic>roundcube -- IMAP command injection vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><le>1.3.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream reports:</p>
<blockquote cite="https://roundcube.net/news/2018/04/11/security-update-1.3.6">
<p>This update primarily fixes a recently discovered IMAP-cmd-injection
vulnerability caused by insufficient input validation within
the archive plugin.
Details about the vulnerability are published under CVE-2018-9846.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-9846</cvename>
<url>https://roundcube.net/news/2018/04/11/security-update-1.3.6</url>
</references>
<dates>
<discovery>2018-04-11</discovery>
<entry>2018-04-13</entry>
</dates>
</vuln>
<vuln vid="aaba17aa-782e-4843-8a79-7756cfa2bf89">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.115</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.107.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-04-11/">
<p>The Jenkins CLI sent different error responses for commands with
view and agent arguments depending on the existence of the specified
views or agents to unauthorized users. This allowed attackers to
determine whether views or agents with specified names exist.</p>
<p>The Jenkins CLI now returns the same error messages to unauthorized
users independent of the existence of specified view or agent
names</p>
<p>Some JavaScript confirmation dialogs included the item name in an
unsafe manner, resulting in a possible cross-site scripting
vulnerability exploitable by users with permission to create or
configure items.</p>
<p>JavaScript confirmation dialogs that include the item name now
properly escape it, so it can be safely displayed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-04-11/</url>
</references>
<dates>
<discovery>2018-04-11</discovery>
<entry>2018-04-12</entry>
</dates>
</vuln>
<vuln vid="5c6f7482-3ced-11e8-b157-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.140</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-08.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to remote code execution (CVE-2018-4932).</li>
<li>This update resolves out-of-bounds read vulnerabilities that
could lead to information disclosure (CVE-2018-4933,
CVE-2018-4934).</li>
<li>This update resolves out-of-bounds write vulnerabilities that
could lead to remote code execution (CVE-2018-4935,
CVE-2018-4937).</li>
<li>This update resolves a heap overflow vulnerability that
could lead to information disclosure (CVE-2018-4936).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4932</cvename>
<cvename>CVE-2018-4933</cvename>
<cvename>CVE-2018-4934</cvename>
<cvename>CVE-2018-4935</cvename>
<cvename>CVE-2018-4936</cvename>
<cvename>CVE-2018-4937</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-08.html</url>
</references>
<dates>
<discovery>2018-04-10</discovery>
<entry>2018-04-10</entry>
<modified>2018-07-11</modified>
</dates>
</vuln>
<vuln vid="085a087b-3897-11e8-ac53-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.6.0</ge><lt>10.6.3</lt></range>
<range><ge>10.5.0</ge><lt>10.5.7</lt></range>
<range><ge>8.6</ge><lt>10.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/">
<p>Confidential issue comments in Slack, Mattermost, and webhook integrations.</p>
<p>Persistent XSS in milestones data-milestone-id.</p>
<p>Persistent XSS in filename of merge request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/</url>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="c0c5afef-38db-11e8-8b7f-a4badb2f469b">
<topic>FreeBSD -- ipsec crash or denial of service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_9</lt></range>
<range><ge>10.4</ge><lt>10.4_8</lt></range>
<range><ge>10.3</ge><lt>10.3_29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The length field of the option header does not count the
size of the option header itself. This causes a problem
when the length is zero, the count is then incremented by
zero, which causes an infinite loop.</p>
<p>In addition there are pointer/offset mistakes in the
handling of IPv4 options.</p>
<h1>Impact:</h1>
<p>A remote attacker who is able to send an arbitrary packet,
could cause the remote target machine to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6918</cvename>
<freebsdsa>SA-18:05.ipsec</freebsdsa>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="a5cf3ecd-38db-11e8-8b7f-a4badb2f469b">
<topic>FreeBSD -- vt console memory disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_9</lt></range>
<range><ge>10.4</ge><lt>10.4_8</lt></range>
<range><ge>10.3</ge><lt>10.3_29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Insufficient validation of user-provided font parameters
can result in an integer overflow, leading to the use of
arbitrary kernel memory as glyph data. Characters that
reference this data can be displayed on the screen, effectively
disclosing kernel memory.</p>
<h1>Impact:</h1>
<p>Unprivileged users may be able to access privileged
kernel data.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6917</cvename>
<freebsdsa>SA-18:04.vt</freebsdsa>
</references>
<dates>
<discovery>2018-04-04</discovery>
<entry>2018-04-05</entry>
</dates>
</vuln>
<vuln vid="cdb4d962-34f9-11e8-92db-080027907385">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle31</name>
<range><lt>3.1.11</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.8</lt></range>
</package>
<package>
<name>moodle33</name>
<range><lt>3.3.5</lt></range>
</package>
<package>
<name>moodle34</name>
<range><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>moodle reports:</p>
<blockquote cite="https://moodle.org/mod/forum/discuss.php?d=367938">
<p>Unauthenticated users can trigger custom messages to admin via
paypal enrol script.</p>
<p>Suspended users with OAuth 2 authentication method can still log in to
the site.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1081</cvename>
<cvename>CVE-2018-1082</cvename>
<url>https://moodle.org/mod/forum/discuss.php?d=367938</url>
</references>
<dates>
<discovery>2018-03-14</discovery>
<entry>2018-03-31</entry>
</dates>
</vuln>
<vuln vid="eb69bcf2-18ef-4aa2-bb0c-83b263364089">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.3.0,1</ge><lt>2.3.7,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.4,1</lt></range>
<range><ge>2.5.0,1</ge><lt>2.5.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby news:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/">
<p>CVE-2017-17742: HTTP response splitting in WEBrick</p>
<p>If a script accepts an external input and outputs it without
modification as a part of HTTP responses, an attacker can use newline
characters to deceive the clients that the HTTP response header is
stopped at there, and can inject fake HTTP responses after the newline
characters to show malicious contents to the clients.</p>
<p>CVE-2018-6914: Unintentional file and directory creation with
directory traversal in tempfile and tmpdir</p>
<p>Dir.mktmpdir method introduced by tmpdir library accepts the prefix
and the suffix of the directory which is created as the first parameter.
The prefix can contain relative directory specifiers "../", so this
method can be used to target any directory. So, if a script accepts an
external input as the prefix, and the targeted directory has
inappropriate permissions or the ruby process has inappropriate
privileges, the attacker can create a directory or a file at any
directory.</p>
<p>CVE-2018-8777: DoS by large request in WEBrick</p>
<p>If an attacker sends a large request which contains huge HTTP headers,
WEBrick try to process it on memory, so the request causes the
out-of-memory DoS attack.</p>
<p>CVE-2018-8778: Buffer under-read in String#unpack</p>
<p>String#unpack receives format specifiers as its parameter, and can
be specified the position of parsing the data by the specifier @. If a
big number is passed with @, the number is treated as the negative
value, and out-of-buffer read is occurred. So, if a script accepts an
external input as the argument of String#unpack, the attacker can read
data on heaps.</p>
<p>CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in
UNIXServer and UNIXSocket</p>
<p>UNIXServer.open accepts the path of the socket to be created at the
first parameter. If the path contains NUL (\0) bytes, this method
recognize that the path is completed before the NUL bytes. So, if a
script accepts an external input as the argument of this method, the
attacker can make the socket file in the unintentional path. And,
UNIXSocket.open also accepts the path of the socket to be created at
the first parameter without checking NUL bytes like UNIXServer.open.
So, if a script accepts an external input as the argument of this
method, the attacker can accepts the socket file in the unintentional
path.</p>
<p>CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte
in Dir</p>
<p>Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the
target directory as their parameter. If the parameter contains NUL (\0)
bytes, these methods recognize that the path is completed before the
NUL bytes. So, if a script accepts an external input as the argument of
these methods, the attacker can make the unintentional directory
traversal.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-5-1-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-3-7-released/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/http-response-splitting-in-webrick-cve-2017-17742/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/unintentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/large-request-dos-in-webrick-cve-2018-8777/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/buffer-under-read-unpack-cve-2018-8778/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/</url>
<url>https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/</url>
<cvename>CVE-2017-17742</cvename>
<cvename>CVE-2018-6914</cvename>
<cvename>CVE-2018-8777</cvename>
<cvename>CVE-2018-8778</cvename>
<cvename>CVE-2018-8779</cvename>
<cvename>CVE-2018-8780</cvename>
</references>
<dates>
<discovery>2018-03-28</discovery>
<entry>2018-03-29</entry>
</dates>
</vuln>
<vuln vid="5a9bbb6e-32d3-11e8-a769-6daaba161086">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node4</name>
<range><lt>4.9.0</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.14.0</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.11.0</lt></range>
</package>
<package>
<name>node</name>
<range><lt>9.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/">
<h1>Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160)</h1>
<p>Node.js 6.x and later include a debugger protocol (also known as "inspector") that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.</p>
<h1>'path' module regular expression denial of service (CVE-2018-7158)</h1>
<p>The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x.</p>
<h1>Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159)</h1>
<p>The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/</url>
<cvename>CVE-2018-7158</cvename>
<cvename>CVE-2018-7159</cvename>
<cvename>CVE-2018-7160</cvename>
</references>
<dates>
<discovery>2018-03-21</discovery>
<entry>2018-03-28</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="1ce95bc7-3278-11e8-b527-00012e582166">
<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><ge>2.16.6</ge><lt>2.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The WebKit team reports many vulnerabilities.</p>
<p>Please reference the CVE/URL list for details.</p>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2017-0008.html</url>
<url>https://webkitgtk.org/security/WSA-2017-0009.html</url>
<url>https://webkitgtk.org/security/WSA-2017-0010.html</url>
<url>https://webkitgtk.org/security/WSA-2018-0001.html</url>
<url>https://webkitgtk.org/security/WSA-2018-0002.html</url>
<cvename>CVE-2017-7087</cvename>
<cvename>CVE-2017-7089</cvename>
<cvename>CVE-2017-7090</cvename>
<cvename>CVE-2017-7091</cvename>
<cvename>CVE-2017-7092</cvename>
<cvename>CVE-2017-7092</cvename>
<cvename>CVE-2017-7093</cvename>
<cvename>CVE-2017-7095</cvename>
<cvename>CVE-2017-7096</cvename>
<cvename>CVE-2017-7098</cvename>
<cvename>CVE-2017-7100</cvename>
<cvename>CVE-2017-7102</cvename>
<cvename>CVE-2017-7104</cvename>
<cvename>CVE-2017-7107</cvename>
<cvename>CVE-2017-7109</cvename>
<cvename>CVE-2017-7111</cvename>
<cvename>CVE-2017-7117</cvename>
<cvename>CVE-2017-7120</cvename>
<cvename>CVE-2017-13783</cvename>
<cvename>CVE-2017-13784</cvename>
<cvename>CVE-2017-13785</cvename>
<cvename>CVE-2017-13788</cvename>
<cvename>CVE-2017-13791</cvename>
<cvename>CVE-2017-13792</cvename>
<cvename>CVE-2017-13794</cvename>
<cvename>CVE-2017-13795</cvename>
<cvename>CVE-2017-13796</cvename>
<cvename>CVE-2017-13798</cvename>
<cvename>CVE-2017-13802</cvename>
<cvename>CVE-2017-13803</cvename>
<cvename>CVE-2017-7156</cvename>
<cvename>CVE-2017-7157</cvename>
<cvename>CVE-2017-13856</cvename>
<cvename>CVE-2017-13866</cvename>
<cvename>CVE-2017-13870</cvename>
<cvename>CVE-2017-5753</cvename>
<cvename>CVE-2017-5715</cvename>
<cvename>CVE-2018-4088</cvename>
<cvename>CVE-2018-4089</cvename>
<cvename>CVE-2018-4096</cvename>
<cvename>CVE-2017-7153</cvename>
<cvename>CVE-2017-7160</cvename>
<cvename>CVE-2017-7161</cvename>
<cvename>CVE-2017-7165</cvename>
<cvename>CVE-2017-13884</cvename>
<cvename>CVE-2017-13885</cvename>
</references>
<dates>
<discovery>2017-10-18</discovery>
<entry>2018-03-28</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="3ae21918-31e3-11e8-927b-e8e0b747a45a">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>65.0.3325.181</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html">
<p>1 security fix in this release, including:</p>
<ul>
<li>[823553] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop_20.html</url>
</references>
<dates>
<discovery>2018-03-20</discovery>
<entry>2018-03-27</entry>
</dates>
</vuln>
<vuln vid="b7cff5a9-31cc-11e8-8f07-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2o,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20180327.txt">
<ul><li>Constructed ASN.1 types with a recursive definition could
exceed the stack (CVE-2018-0739)<br/>
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious input
with excessive recursion. This could result in a Denial Of Service
attack. There are no such structures used within SSL/TLS that come from
untrusted sources so this is considered safe.</li>
<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. This only
affects processors that support the AVX2 but not ADX extensions
like Intel Haswell (4th generation).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20180327.txt</url>
<cvename>CVE-2018-0739</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2018-03-27</discovery>
<entry>2018-03-27</entry>
</dates>
</vuln>
<vuln vid="dc0c201c-31da-11e8-ac53-d8cb8abf62dd">
<topic>Gitlab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>10.5.0</ge><lt>10.5.6</lt></range>
<range><ge>10.4.0</ge><lt>10.4.6</lt></range>
<range><ge>8.3</ge><lt>10.3.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/">
<h1>SSRF in services and web hooks</h1>
<p>There were multiple server-side request forgery issues in the Services feature.
An attacker could make requests to servers within the same network of the GitLab
instance. This could lead to information disclosure, authentication bypass, or
potentially code execution. This issue has been assigned
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8801">CVE-2018-8801</a>.</p>
<h1>Gitlab Auth0 integration issue</h1>
<p>There was an issue with the GitLab <code>omniauth-auth0</code> configuration
which resulted in the Auth0 integration signing in the wrong users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8801</cvename>
<url>https://about.gitlab.com/2018/03/20/critical-security-release-gitlab-10-dot-5-dot-6-released/</url>
</references>
<dates>
<discovery>2018-03-20</discovery>
<entry>2018-03-27</entry>
<modified>2018-04-07</modified>
</dates>
</vuln>
<vuln vid="23f59689-0152-42d3-9ade-1658d6380567">
<topic>mozilla -- use-after-free in compositor</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>59.0.2,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.3,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>52.7.3</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>52.7.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>52.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/">
<h1>CVE-2018-5148: Use-after-free in compositor</h1>
<p>A use-after-free vulnerability can occur in the
compositor during certain graphics operations when a raw
pointer is used instead of a reference counted one. This
results in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5148</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-10/</url>
</references>
<dates>
<discovery>2018-03-26</discovery>
<entry>2018-03-27</entry>
<modified>2018-03-31</modified>
</dates>
</vuln>
<vuln vid="81946ace-6961-4488-a164-22d58ebc8d66">
<topic>rails-html-sanitizer -- possible XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-rails-html-sanitizer</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OSS-Security list:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2018/03/22/4">
<p>There is a possible XSS vulnerability in rails-html-sanitizer. The gem
allows non-whitelisted attributes to be present in sanitized output
when input with specially-crafted HTML fragments, and these attributes
can lead to an XSS attack on target applications.</p>
<p>This issue is similar to CVE-2018-8048 in Loofah.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2018/03/22/4</url>
<cvename>CVE-2018-3741</cvename>
</references>
<dates>
<discovery>2018-03-22</discovery>
<entry>2018-03-24</entry>
</dates>
</vuln>
<vuln vid="f38187e7-2f6e-11e8-8f07-b499baebfeaf">
<topic>apache -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.30</lt></range>
</package>
<package>
<name>apache22</name>
<range><lt>2.2.34_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd reports:</p>
<blockquote cite="https://www.apache.org/dist/httpd/CHANGES_2.4.33">
<p>Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig
enabled (CVE-2017-15710)</p>
<p>mod_session: CGI-like applications that intend to read from
mod_session's 'SessionEnv ON' could be fooled into reading
user-supplied data instead. (CVE-2018-1283)</p>
<p>mod_cache_socache: Fix request headers parsing to avoid a possible
crash with specially crafted input data. (CVE-2018-1303)</p>
<p>core: Possible crash with excessively long HTTP request headers.
Impractical to exploit with a production build and production
LogLevel. (CVE-2018-1301)</p>
<p>core: Configure the regular expression engine to match '$' to the
end of the input string only, excluding matching the end of any
embedded newline characters. Behavior can be changed with new
directive 'RegexDefaultOptions'. (CVE-2017-15715)</p>
<p>mod_auth_digest: Fix generation of nonce values to prevent replay
attacks across servers using a common Digest domain. This change
may cause problems if used with round robin load balancers.
(CVE-2018-1312)</p>
<p>mod_http2: Potential crash w/ mod_http2. (CVE-2018-1302)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.apache.org/dist/httpd/CHANGES_2.4.33</url>
<cvename>CVE-2017-15710</cvename>
<cvename>CVE-2018-1283</cvename>
<cvename>CVE-2018-1303</cvename>
<cvename>CVE-2018-1301</cvename>
<cvename>CVE-2017-15715</cvename>
<cvename>CVE-2018-1312</cvename>
<cvename>CVE-2018-1302</cvename>
</references>
<dates>
<discovery>2018-03-23</discovery>
<entry>2018-03-24</entry>
<modified>2018-03-27</modified>
</dates>
</vuln>
<vuln vid="d50a50a2-2f3e-11e8-86f8-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/">
<p>Medium risk: Tasks Local File Inclusion</p>
<p>Medium risk: Forum Password Check Bypass</p>
<p>Low risk: Admin Permissions Group Title XSS</p>
<p>Low risk: Attachment types file extension XSS</p>
<p>Low risk: Moderator Tools XSS</p>
<p>Low risk: Security Questions XSS</p>
<p>Low risk: Settings Management XSS</p>
<p>Low risk: Templates Set Name XSS</p>
<p>Low risk: Usergroup Promotions XSS</p>
<p>Low risk: Warning Types XSS</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-24</entry>
</dates>
</vuln>
<vuln vid="6d52bda1-2e54-11e8-a68f-485b3931c969">
<topic>SQLite -- Corrupt DB can cause a NULL pointer dereference</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.22.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-8740">
<p>SQLite databases whose schema is corrupted using a CREATE TABLE AS
statement could cause a NULL pointer dereference, related to build.c
and prepare.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-8740</cvename>
<url>http://openwall.com/lists/oss-security/2018/03/17/1</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-22</entry>
</dates>
</vuln>
<vuln vid="39a30e0a-0c34-431b-9dce-b87cab02412a">
<topic>Sanitize -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-sanitize</name>
<range><lt>2.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sanitize release:</p>
<blockquote cite="https://github.com/rgrove/sanitize/releases">
<p>Fixed an HTML injection vulnerability that could allow XSS.</p>
<p>When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2,
a specially crafted HTML fragment can cause libxml2 to generate
improperly escaped output, allowing non-whitelisted attributes to be
used on whitelisted elements.</p>
<p>Sanitize now performs additional escaping on affected attributes to
prevent this.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rgrove/sanitize/releases</url>
<url>https://github.com/rgrove/sanitize/issues/176</url>
<cvename>CVE-2018-3740</cvename>
</references>
<dates>
<discovery>2018-03-19</discovery>
<entry>2018-03-21</entry>
</dates>
</vuln>
<vuln vid="ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220">
<topic>Loofah -- XSS vulnerability</topic>
<affects>
<package>
<name>rubygem-loofah</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitHub issue:</p>
<blockquote cite="https://github.com/flavorjones/loofah/issues/144">
<p>This issue has been created for public disclosure of an XSS / code
injection vulnerability that was responsibly reported by the Shopify
Application Security Team.</p>
<p>Loofah allows non-whitelisted attributes to be present in sanitized
output when input with specially-crafted HTML fragments.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/flavorjones/loofah/releases</url>
<url>https://github.com/flavorjones/loofah/issues/144</url>
<cvename>CVE-2018-8048</cvename>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-20</entry>
</dates>
</vuln>
<vuln vid="b3edc7d9-9af5-4daf-88f1-61f68f4308c2">
<topic>Jupyter Notebook -- vulnerability</topic>
<affects>
<package>
<name>py27-notebook</name>
<name>py34-notebook</name>
<name>py35-notebook</name>
<name>py36-notebook</name>
<range><lt>5.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768">
<p>In Jupyter Notebook before 5.4.1, a maliciously forged notebook file
can bypass sanitization to execute JavaScript in the notebook context.
Specifically, invalid HTML is 'fixed' by jQuery after sanitization,
making it dangerous.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8768</url>
<cvename>CVE-2018-8768</cvename>
</references>
<dates>
<discovery>2018-03-18</discovery>
<entry>2018-03-19</entry>
</dates>
</vuln>
<vuln vid="928d5c59-2a5a-11e8-a712-0025908740c2">
<topic>SquirrelMail -- post-authentication access privileges</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><le>20170705</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Grunow reports:</p>
<blockquote cite="https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/">
<p> An attacker able to exploit this vulnerability can extract files
of the server the application is running on. This may include
configuration files, log files and additionally all files that are
readable for all users on the system. This issue is
post-authentication. That means an attacker would need valid
credentials for the application to log in or needs to exploit an
additional vulnerability of which we are not aware of at this point
of time.</p>
<p>An attacker would also be able to delete files on the system, if
the user running the application has the rights to do so.</p>
<p>Does this issue affect me?</p>
<p>Likely yes, if you are using Squirrelmail. We checked the latest
development version, which is 1.5.2-svn and the latest version
available for download at this point of time, 1.4.22. Both contain
the vulnerable code.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2018/03/17/2</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-8741</url>
<cvename>CVE-2018-8741</cvename>
</references>
<dates>
<discovery>2017-05-21</discovery>
<entry>2018-03-17</entry>
</dates>
</vuln>
<vuln vid="b3e04661-2a0a-11e8-9e63-3085a9a47796">
<topic>slurm-wlm -- SQL Injection attacks against SlurmDBD</topic>
<affects>
<package>
<name>slurm-wlm</name>
<range><lt>17.02.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SchedMD reports:</p>
<blockquote cite="https://lists.schedmd.com/pipermail/slurm-announce/2018/000006.html">
<p>Several issues were discovered with incomplete sanitization of
user-provided text strings, which could potentially lead to SQL
injection attacks against SlurmDBD itself. Such exploits could lead to a
loss of accounting data, or escalation of user privileges on the cluster.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-7033</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-7033</url>
</references>
<dates>
<discovery>2018-03-15</discovery>
<entry>2018-03-17</entry>
</dates>
</vuln>
<vuln vid="64ee858e-e035-4bb4-9c77-2468963dddb8">
<topic>libvorbis -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.3.6,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14632">
<p>Xiph.Org libvorbis 1.3.5 allows Remote Code Execution
upon freeing uninitialized memory in the function
vorbis_analysis_headerout() in info.c when
vi->channels<=0, a similar issue to Mozilla bug
550184.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-14633">
<p>In Xiph.Org libvorbis 1.3.5, an out-of-bounds array read
vulnerability exists in the function mapping0_forward() in
mapping0.c, which may lead to DoS when operating on a
crafted audio file with vorbis_analysis().</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14632</cvename>
<cvename>CVE-2017-14633</cvename>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-16</entry>
</dates>
</vuln>
<vuln vid="7943794f-707f-4e31-9fea-3bbf1ddcedc1">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libvorbis</name>
<range><lt>1.3.6,3</lt></range>
</package>
<package>
<name>libtremor</name>
<range><lt>1.2.1.s20180316</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>59.0.1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.2,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>52.7.3</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/">
<h1>CVE-2018-5146: Out of bounds memory write in libvorbis</h1>
<p>An out of bounds memory write while processing Vorbis
audio data was reported through the Pwn2Own contest.</p>
<h1>CVE-2018-5147: Out of bounds memory write in libtremor</h1>
<p>The libtremor library has the same flaw as
CVE-2018-5146. This library is used by Firefox in place of
libvorbis on Android and ARM platforms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5146</cvename>
<cvename>CVE-2018-5147</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-08/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-09/</url>
</references>
<dates>
<discovery>2018-03-16</discovery>
<entry>2018-03-16</entry>
<modified>2018-03-31</modified>
</dates>
</vuln>
<vuln vid="2aa9967c-27e0-11e8-9ae1-080027ac955c">
<topic>e2fsprogs -- potential buffer overrun bugs in the blkid library and in the fsck program</topic>
<affects>
<package>
<name>e2fsprogs</name>
<range><lt>1.44.0</lt></range>
</package>
<package>
<name>e2fsprogs-libblkid</name>
<range><lt>1.44.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Theodore Y. Ts'o reports:</p>
<blockquote cite="http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0">
<p>Fixed some potential buffer overrun bugs in the blkid library and in the fsck program.</p>
</blockquote>
</body>
</description>
<references>
<url>http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.44.0</url>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="74daa370-2797-11e8-95ec-a4badb2f4699">
<topic>FreeBSD -- Speculative Execution Vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A number of issues relating to speculative execution
were found last year and publicly announced January 3rd.
Two of these, known as Meltdown and Spectre V2, are addressed
here.</p>
<p>CVE-2017-5754 (Meltdown) - ------------------------</p>
<p>This issue relies on an affected CPU speculatively
executing instructions beyond a faulting instruction. When
this happens, changes to architectural state are not
committed, but observable changes may be left in micro-
architectural state (for example, cache). This may be used
to infer privileged data.</p>
<p>CVE-2017-5715 (Spectre V2) - --------------------------</p>
<p>Spectre V2 uses branch target injection to speculatively
execute kernel code at an address under the control of an
attacker.</p>
<h1>Impact:</h1>
<p>An attacker may be able to read secret data from the
kernel or from a process when executing untrusted code (for
example, in a web browser).</p>
</body>
</description>
<references>
<cvename>CVE-2017-5715</cvename>
<cvename>CVE-2017-5754</cvename>
<freebsdsa>SA-18:03.speculative_execution</freebsdsa>
</references>
<dates>
<discovery>2018-03-14</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="dca7ced0-2796-11e8-95ec-a4badb2f4699">
<topic>FreeBSD -- ipsec validation and use-after-free</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_7</lt></range>
<range><ge>10.4</ge><lt>10.4_7</lt></range>
<range><ge>10.3</ge><lt>10.3_28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a lack of strict checking, an attacker from a
trusted host can send a specially constructed IP packet
that may lead to a system crash.</p>
<p>Additionally, a use-after-free vulnerability in the AH
handling code could cause unpredictable results.</p>
<h1>Impact:</h1>
<p>Access to out of bounds or freed mbuf data can lead to
a kernel panic or other unpredictable results.</p>
</body>
</description>
<references>
<cvename>CVE-2018-6916</cvename>
<freebsdsa>SA-18:01.ipsec</freebsdsa>
</references>
<dates>
<discovery>2018-03-07</discovery>
<entry>2018-03-14</entry>
</dates>
</vuln>
<vuln vid="313078e3-26e2-11e8-9920-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>29.0.0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-05.html">
<ul>
<li>This update resolves a use-after-free vulnerability that
could lead to remote code execution (CVE-2018-4919).</li>
<li>This update resolves a type confusion vulnerability that
could lead to remote code execution (CVE-2018-4920).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4919</cvename>
<cvename>CVE-2018-4920</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-05.html</url>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-03-13</entry>
</dates>
</vuln>
<vuln vid="c71cdc95-3c18-45b7-866a-af28b59aabb5">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>59.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.4.36_3</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.3</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/">
<p>CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList</p>
<p>CVE-2018-5128: Use-after-free manipulating editor selection ranges</p>
<p>CVE-2018-5129: Out-of-bounds write with malformed IPC messages</p>
<p>CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption</p>
<p>CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources</p>
<p>CVE-2018-5132: WebExtension Find API can search privileged pages</p>
<p>CVE-2018-5133: Value of the app.support.baseURL preference is not properly sanitized</p>
<p>CVE-2018-5134: WebExtensions may use view-source: URLs to bypass content restrictions</p>
<p>CVE-2018-5135: WebExtension browserAction can inject scripts into unintended contexts</p>
<p>CVE-2018-5136: Same-origin policy violation with data: URL shared workers</p>
<p>CVE-2018-5137: Script content can access legacy extension non-contentaccessible resources</p>
<p>CVE-2018-5138: Android Custom Tab address spoofing through long domain names</p>
<p>CVE-2018-5140: Moz-icon images accessible to web content through moz-icon: protocol</p>
<p>CVE-2018-5141: DOS attack through notifications Push API</p>
<p>CVE-2018-5142: Media Capture and Streams API permissions display incorrect origin with data: and blob: URLs</p>
<p>CVE-2018-5143: Self-XSS pasting javascript: URL with embedded tab into addressbar</p>
<p>CVE-2018-5126: Memory safety bugs fixed in Firefox 59</p>
<p>CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5125</cvename>
<cvename>CVE-2018-5126</cvename>
<cvename>CVE-2018-5127</cvename>
<cvename>CVE-2018-5128</cvename>
<cvename>CVE-2018-5129</cvename>
<cvename>CVE-2018-5130</cvename>
<cvename>CVE-2018-5131</cvename>
<cvename>CVE-2018-5132</cvename>
<cvename>CVE-2018-5133</cvename>
<cvename>CVE-2018-5134</cvename>
<cvename>CVE-2018-5135</cvename>
<cvename>CVE-2018-5136</cvename>
<cvename>CVE-2018-5137</cvename>
<cvename>CVE-2018-5138</cvename>
<cvename>CVE-2018-5140</cvename>
<cvename>CVE-2018-5141</cvename>
<cvename>CVE-2018-5142</cvename>
<cvename>CVE-2018-5143</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-06/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-07/</url>
</references>
<dates>
<discovery>2018-03-13</discovery>
<entry>2018-03-13</entry>
<modified>2018-03-16</modified>
</dates>
</vuln>
<vuln vid="fb26f78a-26a9-11e8-a1c2-00505689d4ae">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba44</name>
<range><lt>4.4.17</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.16</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.14</lt></range>
</package>
<package>
<name>samba47</name>
<range><lt>4.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1050.html">
<p>Missing null pointer checks may crash the external
print server process.</p>
</blockquote>
<blockquote cite="https://www.samba.org/samba/security/CVE-2018-1057.html">
<p>On a Samba 4 AD DC any authenticated user can change
other user's passwords over LDAP, including the
passwords of administrative users and service accounts.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2018-1050.html</url>
<cvename>CVE-2018-1050</cvename>
<url>https://www.samba.org/samba/security/CVE-2018-1057.html</url>
<cvename>CVE-2018-1057</cvename>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-03-13</entry>
</dates>
</vuln>
<vuln vid="c2f107e1-2493-11e8-b3e8-001cc0382b2f">
<topic>mbed TLS (PolarSSL) -- remote code execution</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.7.0</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><lt>1.3.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Butcher reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01">
<ul>
<li>When the truncated HMAC extension is enabled and CBC is used,
sending a malicious application packet can be used to selectively
corrupt 6 bytes on the peer's heap, potentially leading to a
crash or remote code execution. This can be triggered remotely
from either side in both TLS and DTLS.</li>
<li>When RSASSA-PSS signature verification is enabled, sending a
maliciously constructed certificate chain can be used to cause a
buffer overflow on the peer's stack, potentially leading to crash
or remote code execution. This can be triggered remotely from
either side in both TLS and DTLS.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01</url>
<cvename>CVE-2018-0487</cvename>
<cvename>CVE-2018-0488</cvename>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-03-10</entry>
</dates>
</vuln>
<vuln vid="555af074-22b9-11e8-9799-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>65.0.3325.146</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html">
<p>45 security fixes in this release:</p>
<ul>
<li>[758848] High CVE-2017-11215: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
<li>[758863] High CVE-2017-11225: Use after free in Flash. Reported by JieZeng of Tencent Zhanlu Lab on 2017-08-25</li>
<li>[780919] High CVE-2018-6060: Use after free in Blink. Reported by Omair on 2017-11-02</li>
<li>[794091] High CVE-2018-6061: Race condition in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2017-12-12</li>
<li>[780104] High CVE-2018-6062: Heap buffer overflow in Skia. Reported by Anonymous on 2017-10-31</li>
<li>[789959] High CVE-2018-6057: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-11-30</li>
<li>[792900] High CVE-2018-6063: Incorrect permissions on shared memory. Reported by Gal Beniamini of Google Project Zero on 2017-12-07</li>
<li>[798644] High CVE-2018-6064: Type confusion in V8. Reported by lokihardt of Google Project Zero on 2018-01-03</li>
<li>[808192] High CVE-2018-6065: Integer overflow in V8. Reported by Mark Brand of Google Project Zero on 2018-02-01</li>
<li>[799477] Medium CVE-2018-6066: Same Origin Bypass via canvas. Reported by Masato Kinugawa on 2018-01-05</li>
<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
<li>[779428] Medium CVE-2018-6067: Buffer overflow in Skia. Reported by Ned Williamson on 2017-10-30</li>
<li>[799918] Medium CVE-2018-6069: Stack buffer overflow in Skia. Reported by Wanglu and Yangkang(@dnpushme) of Qihoo360 Qex Team on 2018-01-08</li>
<li>[668645] Medium CVE-2018-6070: CSP bypass through extensions. Reported by Rob Wu on 2016-11-25</li>
<li>[777318] Medium CVE-2018-6071: Heap bufffer overflow in Skia. Reported by Anonymous on 2017-10-23</li>
<li>[791048] Medium CVE-2018-6072: Integer overflow in PDFium. Reported by Atte Kettunen of OUSPG on 2017-12-01</li>
<li>[804118] Medium CVE-2018-6073: Heap bufffer overflow in WebGL. Reported by Omair on 2018-01-20</li>
<li>[809759] Medium CVE-2018-6074: Mark-of-the-Web bypass. Reported by Abdulrahman Alqabandi (@qab) on 2018-02-06</li>
<li>[608669] Medium CVE-2018-6075: Overly permissive cross origin downloads. Reported by Inti De Ceukelaire (intigriti.com) on 2016-05-03</li>
<li>[758523] Medium CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink. Reported by Mateusz Krzeszowiec on 2017-08-24</li>
<li>[778506] Medium CVE-2018-6077: Timing attack using SVG filters. Reported by Khalil Zhani on 2017-10-26</li>
<li>[793628] Medium CVE-2018-6078: URL Spoof in OmniBox. Reported by Khalil Zhani on 2017-12-10</li>
<li>[788448] Medium CVE-2018-6079: Information disclosure via texture data in WebGL. Reported by Ivars Atteka on 2017-11-24</li>
<li>[792028] Medium CVE-2018-6080: Information disclosure in IPC call. Reported by Gal Beniamini of Google Project Zero on 2017-12-05</li>
<li>[797525] Low CVE-2018-6081: XSS in interstitials. Reported by Rob Wu on 2017-12-24</li>
<li>[767354] Low CVE-2018-6082: Circumvention of port blocking. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-09-21</li>
<li>[771709] Low CVE-2018-6083: Incorrect processing of AppManifests. Reported by Jun Kokatsu (@shhnjk) on 2017-10-04</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11215</cvename>
<cvename>CVE-2017-11225</cvename>
<cvename>CVE-2018-6060</cvename>
<cvename>CVE-2018-6061</cvename>
<cvename>CVE-2018-6060</cvename>
<cvename>CVE-2018-6061</cvename>
<cvename>CVE-2018-6062</cvename>
<cvename>CVE-2018-6057</cvename>
<cvename>CVE-2018-6063</cvename>
<cvename>CVE-2018-6064</cvename>
<cvename>CVE-2018-6065</cvename>
<cvename>CVE-2018-6066</cvename>
<cvename>CVE-2018-6067</cvename>
<cvename>CVE-2018-6069</cvename>
<cvename>CVE-2018-6070</cvename>
<cvename>CVE-2018-6071</cvename>
<cvename>CVE-2018-6072</cvename>
<cvename>CVE-2018-6073</cvename>
<cvename>CVE-2018-6074</cvename>
<cvename>CVE-2018-6075</cvename>
<cvename>CVE-2018-6076</cvename>
<cvename>CVE-2018-6077</cvename>
<cvename>CVE-2018-6078</cvename>
<cvename>CVE-2018-6079</cvename>
<cvename>CVE-2018-6080</cvename>
<cvename>CVE-2018-6081</cvename>
<cvename>CVE-2018-6082</cvename>
<cvename>CVE-2018-6083</cvename>
<url>https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2018-03-08</entry>
</dates>
</vuln>
<vuln vid="c5ab620f-4576-4ad5-b51f-93e4fec9cd0e">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>tshark</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>2.2.0</ge><lt>2.2.13</lt></range>
<range><ge>2.4.0</ge><lt>2.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="https://www.wireshark.org/security/">
<p>wnpa-sec-2018-05. IEEE 802.11 dissector crash. (CVE-2018-7335)</p>
<p>wnpa-sec-2018-06. Large or infinite loops in multiple dissectors. (CVE-2018-7321 through CVE-2018-7333)</p>
<p>wnpa-sec-2018-07. UMTS MAC dissector crash. (CVE-2018-7334)</p>
<p>wnpa-sec-2018-08. DOCSIS dissector crash. (CVE-2018-7337)</p>
<p>wnpa-sec-2018-09. FCP dissector crash. (CVE-2018-7336)</p>
<p>wnpa-sec-2018-10. SIGCOMP dissector crash. (CVE-2018-7320)</p>
<p>wnpa-sec-2018-11. Pcapng file parser crash.</p>
<p>wnpa-sec-2018-12. IPMI dissector crash.</p>
<p>wnpa-sec-2018-13. SIGCOMP dissector crash.</p>
<p>wnpa-sec-2018-14. NBAP dissector crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/security/</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-05.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-06.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-07.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-08.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-09.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-10.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-11.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-12.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-13.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2018-14.html</url>
<cvename>CVE-2018-7320</cvename>
<cvename>CVE-2018-7321</cvename>
<cvename>CVE-2018-7322</cvename>
<cvename>CVE-2018-7323</cvename>
<cvename>CVE-2018-7324</cvename>
<cvename>CVE-2018-7325</cvename>
<cvename>CVE-2018-7326</cvename>
<cvename>CVE-2018-7327</cvename>
<cvename>CVE-2018-7328</cvename>
<cvename>CVE-2018-7329</cvename>
<cvename>CVE-2018-7330</cvename>
<cvename>CVE-2018-7331</cvename>
<cvename>CVE-2018-7332</cvename>
<cvename>CVE-2018-7333</cvename>
<cvename>CVE-2018-7334</cvename>
<cvename>CVE-2018-7335</cvename>
<cvename>CVE-2018-7336</cvename>
<cvename>CVE-2018-7337</cvename>
<cvename>CVE-2018-7417</cvename>
</references>
<dates>
<discovery>2018-02-23</discovery>
<entry>2018-03-04</entry>
</dates>
</vuln>
<vuln vid="2040c7f5-1e3a-11e8-8ae9-0050569f0b83">
<topic>isc-dhcp -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>isc-dhcp44-server</name>
<range><lt>4.4.1</lt></range>
</package>
<package>
<name>isc-dhcp44-client</name>
<range><lt>4.4.1</lt></range>
</package>
<package>
<name>isc-dhcp43-server</name>
<range><le>4.3.6</le></range>
</package>
<package>
<name>isc-dhcp43-client</name>
<range><le>4.3.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01565">
<p>Failure to properly bounds check a buffer used for processing
DHCP options allows a malicious server (or an entity
masquerading as a server) to cause a buffer overflow (and
resulting crash) in dhclient by sending a response containing a
specially constructed options section.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01567">
<p>A malicious client which is allowed to send very large amounts
of traffic (billions of packets) to a DHCP server can eventually
overflow a 32-bit reference counter, potentially causing dhcpd
to crash.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5732</cvename>
<cvename>CVE-2018-5733</cvename>
<url>https://kb.isc.org/article/AA-01565</url>
<url>https://kb.isc.org/article/AA-01567</url>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-03-02</entry>
</dates>
</vuln>
<vuln vid="30704aba-1da4-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- out-of-bounds reads</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Xin-Jiang on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/317">
<p>CVE-2017-14245 (Medium): An out of bounds read in the function
d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote
DoS attack or information disclosure, related to mishandling of
the NAN and INFINITY floating-point values.</p>
<p>CVE-2017-14246 (Medium): An out of bounds read in the function
d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote
DoS attack or information disclosure, related to mishandling of the
NAN and INFINITY floating-point values.</p>
</blockquote>
<p>my123px on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/344">
<p>CVE-2017-17456 (Medium): The function d2alaw_array() in alaw.c of
libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
address 0x000000000000), a different vulnerability than CVE-2017-14245.</p>
<p>CVE-2017-17457 (Medium): The function d2ulaw_array() in ulaw.c of
libsndfile 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown
address 0x000000000000), a different vulnerability than CVE-2017-14246.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14245</cvename>
<cvename>CVE-2017-14246</cvename>
<url>https://github.com/erikd/libsndfile/issues/317</url>
<cvename>CVE-2017-17456</cvename>
<cvename>CVE-2017-17457</cvename>
<url>https://github.com/erikd/libsndfile/issues/344</url>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="2b386075-1d9c-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Agostino Sarubbo, Gentoo reports:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8361 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(buffer overflow and application crash) or possibly have unspecified
other impact via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8362 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(invalid read and application crash) via a crafted audio file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/">
<p>CVE-2017-8363 (Medium): The flac_buffer_copy function in flac.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(heap-based buffer over-read and application crash) via a crafted audio
file.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/">
<p>CVE-2017-8365 (Medium): The i2les_array function in pcm.c in libsndfile
1.0.28 allows remote attackers to cause a denial of service (buffer
over-read and application crash) via a crafted audio file.</p>
</blockquote>
<p>manxorist on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/292">
<p>CVE-2017-12562 (High): Heap-based Buffer Overflow in the
psf_binheader_writef function in common.c in libsndfile through
1.0.28 allows remote attackers to cause a denial of service
(application crash) or possibly have unspecified other impact.</p>
</blockquote>
<p>Xin-Jiang on Github reports:</p>
<blockquote cite="https://github.com/erikd/libsndfile/issues/318">
<p>CVE-2017-14634 (Medium): In libsndfile 1.0.28, a divide-by-zero
error exists in the function double64_init() in double64.c, which
may lead to DoS when playing a crafted audio file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8361</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/232</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<cvename>CVE-2017-8362</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/231</url>
<url>https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808</url>
<cvename>CVE-2017-8363</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/</url>
<url>https://github.com/erikd/libsndfile/issues/233</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<url>https://github.com/erikd/libsndfile/commit/cd7da8dbf6ee4310d21d9e44b385d6797160d9e8</url>
<cvename>CVE-2017-8365</cvename>
<url>https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/</url>
<url>https://github.com/erikd/libsndfile/issues/230</url>
<url>https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3</url>
<cvename>CVE-2017-12562</cvename>
<url>https://github.com/erikd/libsndfile/issues/292/</url>
<url>https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8</url>
<cvename>CVE-2017-14634</cvename>
<url>https://github.com/erikd/libsndfile/issues/318</url>
<url>https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="e3eeda2e-1d67-11e8-a2ec-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.22</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.17</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.12</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.8</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1834/">
<ul>
<li>CVE-2018-1058: Uncontrolled search path element in pg_dump and other client applications</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058:_Protect_Your_Search_Path</url>
<cvename>CVE-2018-1058</cvename>
</references>
<dates>
<discovery>2018-03-01</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="6a449a37-1570-11e8-8e00-000c294a5758">
<topic>strongswan - Insufficient input validation in RSASSA-PSS signature parser</topic>
<affects>
<package>
<name>strongswan</name>
<range><eq>5.6.1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
<p>Fixed a DoS vulnerability in the parser for PKCS#1 RSASSA-PSS signatures that
was caused by insufficient input validation. One of the configurable
parameters in algorithm identifier structures for RSASSA-PSS signatures is the
mask generation function (MGF). Only MGF1 is currently specified for this
purpose. However, this in turn takes itself a parameter that specifies the
underlying hash function. strongSwan's parser did not correctly handle the
case of this parameter being absent, causing an undefined data read.
his vulnerability has been registered as CVE-2018-6459.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6459</cvename>
<url>https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f68675eb44806668</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-19</entry>
</dates>
</vuln>
<vuln vid="004debf9-1d16-11e8-b6aa-4ccc6adda413">
<topic>libsndfile -- out-of-bounds read memory access</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Laurent Delosieres, Secunia Research at Flexera Software reports:</p>
<blockquote cite="https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/">
<p>Secunia Research has discovered a vulnerability in libsndfile, which can be
exploited by malicious people to disclose potentially sensitive information.
The vulnerability is caused due to an error in the "aiff_read_chanmap()" function
(src/aiff.c), which can be exploited to cause an out-of-bounds read memory access
via a specially crafted AIFF file. The vulnerability is confirmed in version 1.0.28.
Other versions may also be affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6892</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-6892</url>
<url>https://secuniaresearch.flexerasoftware.com/secunia_research/2017-13/</url>
<url>https://github.com/erikd/libsndfile/commit/f833c53cb596e9e1792949f762e0b33661822748</url>
</references>
<dates>
<discovery>2017-05-23</discovery>
<entry>2018-03-01</entry>
</dates>
</vuln>
<vuln vid="af485ef4-1c58-11e8-8477-d05099c0ae8c">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_7</lt></range>
<range><ge>10.4</ge><lt>10.4_6</lt></range>
<range><ge>10.3</ge><lt>10.3_27</lt></range>
</package>
<package>
<name>ntp</name>
<range><lt>4.2.8p11</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S">
<p>The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.</p>
<p>This release addresses five security issues in ntpd:</p>
<ul>
<li>LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil
vulnerability: ephemeral association attack</li>
<li>INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909:
ctl_getitem(): buffer read overrun leads to undefined
behavior and information leak</li>
<li>LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple
authenticated ephemeral associations</li>
<li>LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved
symmetric mode cannot recover from bad state</li>
<li>LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909:
Unauthenticated packet can reset authenticated interleaved
association</li>
</ul>
<p>one security issue in ntpq:</p>
<ul>
<li>MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909:
ntpq:decodearr() can write beyond its buffer limit</li>
</ul>
<p>and provides over 33 bugfixes and 32 other improvements.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1549</cvename>
<cvename>CVE-2018-7182</cvename>
<cvename>CVE-2018-7170</cvename>
<cvename>CVE-2018-7184</cvename>
<cvename>CVE-2018-7185</cvename>
<cvename>CVE-2018-7183</cvename>
<freebsdsa>SA-18:02.ntp</freebsdsa>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S</url>
</references>
<dates>
<discovery>2018-02-27</discovery>
<entry>2018-02-28</entry>
<modified>2018-03-14</modified>
</dates>
</vuln>
<vuln vid="abfc932e-1ba8-11e8-a944-54ee754af08e">
<topic>chromium -- vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>64.0.3282.167</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html">
<p>1 security fix in this release:</p>
<ul>
<li>[806388] High CVE-2018-6056: Incorrect derived class instantiation in V8. Reported by lokihardt of Google Project Zero on 2018-01-26</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6056</cvename>
<url>https://chromereleases.googleblog.com/2018/02/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2018-01-26</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="8e986b2b-1baa-11e8-a944-54ee754af08e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>64.0.3282.119</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html">
<p>Several security fixes in this release, including:</p>
<ul>
<li>[780450] High CVE-2018-6031: Use after free in PDFium. Reported by Anonymous on 2017-11-01</li>
<li>[787103] High CVE-2018-6032: Same origin bypass in Shared Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-11-20</li>
<li>[793620] High CVE-2018-6033: Race when opening downloaded files. Reported by Juho Nurminen on 2017-12-09</li>
<li>[784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by Tobias Klein (www.trapkit.de) on 2017-11-12</li>
<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[797500] Medium CVE-2018-6035: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[753645] Medium CVE-2018-6037: Insufficient user gesture requirements in autofill. Reported by Paul Stone of Context Information Security on
2017-08-09</li>
<li>[774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported by cloudfuzzer on 2017-10-12</li>
<li>[775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho Nurminen on 2017-10-17</li>
<li>[778658] Medium CVE-2018-6040: Content security policy bypass. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26</li>
<li>[760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan Herrera on 2017-08-29</li>
<li>[773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil Zhani on 2017-10-12</li>
<li>[785809] Medium CVE-2018-6043: Insufficient escaping with external URL handlers. Reported by 0x09AL on 2017-11-16</li>
<li>[797497] Medium CVE-2018-6045: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-23</li>
<li>[798163] Medium CVE-2018-6046: Insufficient isolation of devtools from extensions. Reported by Rob Wu on 2017-12-31</li>
<li>[799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported by Masato Kinugawa on 2018-01-08</li>
<li>[763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-09-08</li>
<li>[771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew Springall (@_aaspring_) on 2017-10-05</li>
<li>[774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-13</li>
<li>[774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan Kew on 2017-10-15</li>
<li>[441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by Antonio Sanso (@asanso) on 2014-12-11</li>
<li>[615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation. Reported by Tanner Emek on 2016-05-28</li>
<li>[758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page. Reported by Asset Kabdenov on 2017-08-23</li>
<li>[797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu on 2017-12-24</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6031</cvename>
<cvename>CVE-2018-6032</cvename>
<cvename>CVE-2018-6033</cvename>
<cvename>CVE-2018-6034</cvename>
<cvename>CVE-2018-6035</cvename>
<cvename>CVE-2018-6036</cvename>
<cvename>CVE-2018-6037</cvename>
<cvename>CVE-2018-6038</cvename>
<cvename>CVE-2018-6039</cvename>
<cvename>CVE-2018-6040</cvename>
<cvename>CVE-2018-6041</cvename>
<cvename>CVE-2018-6042</cvename>
<cvename>CVE-2018-6043</cvename>
<cvename>CVE-2018-6045</cvename>
<cvename>CVE-2018-6046</cvename>
<cvename>CVE-2018-6047</cvename>
<cvename>CVE-2018-6048</cvename>
<cvename>CVE-2017-15420</cvename>
<cvename>CVE-2018-6049</cvename>
<cvename>CVE-2018-6050</cvename>
<cvename>CVE-2018-6051</cvename>
<cvename>CVE-2018-6052</cvename>
<cvename>CVE-2018-6053</cvename>
<cvename>CVE-2018-6054</cvename>
<url>https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html</url>
</references>
<dates>
<discovery>2017-08-09</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="55c4233e-1844-11e8-a712-0025908740c2">
<topic>tomcat -- Security constraints ignored or applied too late</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>7.0.0</ge><le>7.0.84</le></range>
<range><ge>8.0.0</ge><le>8.0.49</le></range>
<range><ge>8.5.0</ge><le>8.5.27</le></range>
<range><ge>9.0.0</ge><le>9.0.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781@%3Cannounce.tomcat.apache.org%3E">
<p>Security constraints defined by annotations of Servlets were only
applied once a Servlet had been loaded. Because security constraints
defined in this way apply to the URL pattern and any URLs below that
point, it was possible - depending on the order Servlets were loaded -
for some security constraints not to be applied. This could have exposed
resources to users who were not authorised to access them.</p>
</blockquote>
<blockquote cite="https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb@%3Cannounce.tomcat.apache.org%3E">
<p>The URL pattern of "" (the empty string) which exactly maps to the
context root was not correctly handled when used as part of a security
constraint definition. This caused the constraint to be ignored. It was,
therefore, possible for unauthorised users to gain access to web
application resources that should have been protected. Only security
constraints with a URL pattern of the empty string were affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://tomcat.apache.org/security-9.html</url>
<url>http://tomcat.apache.org/security-8.html</url>
<url>http://tomcat.apache.org/security-7.html</url>
<cvename>CVE-2018-1304</cvename>
<cvename>CVE-2018-1305</cvename>
</references>
<dates>
<discovery>2018-02-23</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="22438240-1bd0-11e8-a2ec-6cc21735f730">
<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.6.4</lt></range>
</package>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180227.txt">
<p>
Shibboleth SP software vulnerable to additional data forgery flaws
</p>
<p>
The XML processing performed by the Service Provider software has
been found to be vulnerable to new flaws similar in nature to the
one addressed in an advisory last month.
</p>
<p>
These bugs involve the use of other XML constructs rather than
entity references, and therefore required additional mitigation once
discovered. As with the previous issue, this flaw allows for
changes to an XML document that do not break a digital signature but
can alter the user data passed through to applications behind the SP
and result in impersonation attacks and exposure of protected
information.
</p>
<p>
As before, the use of XML Encryption is a significant mitigation,
but we have not dismissed the possibility that attacks on the
Response "envelope" may be possible, in both the original and this
new case. No actual attacks of this nature are known, so deployers
should prioritize patching systems that expect to handle unencrypted
SAML assertions.
</p>
<p>
An updated version of XMLTooling-C (V1.6.4) is available that
protects against these new attacks, and should help prevent similar
vulnerabilities in the future.
</p>
<p>
Unlike the previous case, these bugs are NOT prevented by any
existing Xerces-C parser version on any platform and cannot be
addressed by any means other than the updated XMLTooling-C library.
</p>
<p>
The Service Provider software relies on a generic XML parser to
process SAML responses and there are limitations in older versions
of the parser that make it impossible to fully disable Document Type
Definition (DTD) processing.
</p>
<p>
Through addition/manipulation of a DTD, it's possible to make
changes to an XML document that do not break a digital signature but
are mishandled by the SP and its libraries. These manipulations can
alter the user data passed through to applications behind the SP and
result in impersonation attacks and exposure of protected
information.
</p>
<p>
While newer versions of the xerces-c3 parser are configured by the
SP into disallowing the use of a DTD via an environment variable,
this feature is not present in the xerces-c3 parser before version
3.1.4, so an additional fix is being provided now that an actual DTD
exploit has been identified. Xerces-c3-3.1.4 was committed to the
ports tree already on 2016-07-26.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180227.txt</url>
<cvename>CVE-2018-0489</cvename>
</references>
<dates>
<discovery>2018-02-27</discovery>
<entry>2018-02-27</entry>
</dates>
</vuln>
<vuln vid="57580fcc-1a61-11e8-97e0-00e04c1ea73d">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.56</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2018-001">
<p>CVE-2017-6926: Comment reply form allows access to restricted content</p>
<p>CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete</p>
<p>CVE-2017-6928: Private file access bypass - Moderately Critical</p>
<p>CVE-2017-6929: jQuery vulnerability with untrusted domains - Moderately Critical</p>
<p>CVE-2017-6930: Language fallback can be incorrect on multilingual sites with node access restrictions</p>
<p>CVE-2017-6931: Settings Tray access bypass</p>
<p>CVE-2017-6932: External link injection on 404 pages when linking to the current page</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6926</cvename>
<cvename>CVE-2017-6927</cvename>
<cvename>CVE-2017-6928</cvename>
<cvename>CVE-2017-6929</cvename>
<cvename>CVE-2017-6930</cvename>
<cvename>CVE-2017-6931</cvename>
<cvename>CVE-2017-6932</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-25</entry>
</dates>
</vuln>
<vuln vid="d9fe59ea-1940-11e8-9eb8-5404a68ad561">
<topic>cvs -- Remote code execution via ssh command injection</topic>
<affects>
<package>
<name>cvs</name>
<range><lt>1.20120905_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hank Leininger reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html">
<p>Bugs in Git, Subversion, and Mercurial were just announced and patched
which allowed arbitrary local command execution if a malicious name was
used for the remote server, such as starting with - to pass options to
the ssh client:
git clone ssh://-oProxyCommand=some-command...
CVS has a similar problem with the -d option:</p>
<p>Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871810#10</url>
<cvename>CVE-2017-12836</cvename>
<freebsdpr>ports/226088</freebsdpr>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2018-02-24</entry>
</dates>
</vuln>
<vuln vid="289269f1-0def-11e8-99b0-d017c2987f9a">
<topic>LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>5.4.5</lt></range>
<range><ge>6.0.0</ge><lt>6.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LibreOffice reports:</p>
<blockquote cite="https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/">
<p>LibreOffice Calc supports a WEBSERVICE function to obtain data by URL.
Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file
URL (e.g file://) which can be used to inject local files into the
spreadsheet without warning the user. Subsequent formulas can operate on
that inserted data and construct a remote URL whose path leaks the local
data to a remote attacker.</p>
<p>In later versions of LibreOffice without this flaw, WEBSERVICE has now
been limited to accessing http and https URLs along with bringing
WEBSERVICE URLs under LibreOffice Calc's link management infrastructure.</p>
<p><strong>Note:</strong> This vulnerability has been identified upstream
as CVE-2018-1055, but NVD/Mitre are advising it's a reservation
duplicate of CVE-2018-6871 which should be used instead.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.libreoffice.org/about-us/security/advisories/cve-2018-1055/</url>
<url>https://github.com/jollheef/libreoffice-remote-arbitrary-file-disclosure</url>
<cvename>CVE-2018-6871</cvename>
<freebsdpr>ports/225797</freebsdpr>
</references>
<dates>
<discovery>2018-02-09</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="d5b6d151-1887-11e8-94f7-9c5c8e75236a">
<topic>squid -- Vulnerable to Denial of Service attack</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.27_3</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><lt>4.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Louis Dion-Marcil reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_1.txt">
<p>Due to incorrect pointer handling Squid is vulnerable to denial
of service attack when processing ESI responses.</p>
<p>This problem allows a remote server delivering certain ESI
response syntax to trigger a denial of service for all clients
accessing the Squid service.</p>
<p>Due to unrelated changes Squid-3.5 has become vulnerable to some
regular ESI server responses also triggering this issue.</p>
<p>This problem is limited to the Squid custom ESI parser.
Squid built to use libxml2 or libexpat XML parsers do not have
this problem.</p>
</blockquote>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2018_2.txt">
<p>Due to incorrect pointer handling Squid is vulnerable to denial
of service attack when processing ESI responses or downloading
intermediate CA certificates.</p>
<p>This problem allows a remote client delivering certain HTTP
requests in conjunction with certain trusted server responses to
trigger a denial of service for all clients accessing the Squid
service.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.squid-cache.org/Advisories/SQUID-2018_1.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2018_2.txt</url>
<cvename>CVE-2018-1000024</cvename>
<cvename>CVE-2018-1000027</cvename>
<url>https://www.debian.org/security/2018/dsa-4122</url>
<freebsdpr>ports/226138</freebsdpr>
</references>
<dates>
<discovery>2017-12-13</discovery>
<entry>2018-02-23</entry>
</dates>
</vuln>
<vuln vid="933654ce-17b8-11e8-90b8-001999f8d30b">
<topic>asterisk -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2018-004 - When processing a SUBSCRIBE request the
res_pjsip_pubsub module stores the accepted formats present
in the Accept headers of the request. This code did not
limit the number of headers it processed despite having
a fixed limit of 32. If more than 32 Accept headers were
present the code would write outside of its memory and
cause a crash.</p>
<p>AST-2018-005 - A crash occurs when a number of
authenticated INVITE messages are sent over TCP or TLS
and then the connection is suddenly closed. This issue
leads to a segmentation fault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-004.html</url>
<cvename>CVE-2018-7284</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2018-005.html</url>
<cvename>CVE-2018-7286</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
<modified>2018-06-12</modified>
</dates>
</vuln>
<vuln vid="f9f5c5a2-17b5-11e8-90b8-001999f8d30b">
<topic>asterisk and pjsip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.19.2</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.7.2</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>AST-2018-002 - By crafting an SDP message with an
invalid media format description Asterisk crashes when
using the pjsip channel driver because pjproject's sdp
parsing algorithm fails to catch the invalid media format
description.</p>
<p>AST-2018-003 - By crafting an SDP message body with
an invalid fmtp attribute Asterisk crashes when using the
pjsip channel driver because pjproject's fmtp retrieval
function fails to check if fmtp value is empty (set empty
if previously parsed as invalid).</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2018-002.html</url>
<url>https://downloads.asterisk.org/pub/security/AST-2018-003.html</url>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
</dates>
</vuln>
<vuln vid="261ca31c-179f-11e8-b8b9-6805ca0b3d42">
<topic>phpMyAdmin -- self XSS in central columns feature</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.7.0</ge><lt>4.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2018-1/">
<h3>Summary</h3>
<p>Self XSS in central columns feature</p>
<h3>Description</h3>
<p>A self-cross site scripting (XSS) vulnerability has been
reported relating to the central columns feature.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>A valid token must be used in the attack</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2018-1/</url>
<cvename>CVE-2018-7260</cvename>
</references>
<dates>
<discovery>2018-02-21</discovery>
<entry>2018-02-22</entry>
</dates>
</vuln>
<vuln vid="86291013-16e6-11e8-ae9f-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>6.1.0</ge><le>10.2.7</le></range>
<range><ge>10.3.0</ge><le>10.3.6</le></range>
<range><ge>10.4.0</ge><le>10.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/">
<h1>SnippetFinder information disclosure</h1>
<p>The GitLab SnippetFinder component contained an information disclosure
which allowed access to snippets restricted to Only team members or
configured as disabled. The issue is now resolved in the latest version.</p>
<h1>LDAP API authorization issue</h1>
<p>An LDAP API endpoint contained an authorization vulnerability which
unintentionally disclosed bulk LDAP groups data. This issue is now fixed in
the latest release.</p>
<h1>Persistent XSS mermaid markdown</h1>
<p>The mermaid markdown feature contained a persistent XSS issue that is now
resolved in the latest release.</p>
<h1>Insecure direct object reference Todo API</h1>
<p>The Todo API was vulnerable to an insecure direct object reference issue
which resulted in an information disclosure of confidential data.</p>
<h1>GitHub import access control issue</h1>
<p>An improper access control weakness issue was discovered in the GitHub
import feature. The issue allowed an attacker to create projects under other
accounts which they shouldn't have access to. The issue is now resolved in
the latest version.</p>
<h1>Protected variables information disclosure</h1>
<p>The CI jobs protected tag feature contained a vulnerability which
resulted in an information disclosure of protected variables. The issue is
now resolved in the latest release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/02/07/gitlab-security-10-4-3-plus-10-3-7-plus-10-2-8-blog/</url>
</references>
<dates>
<discovery>2018-02-07</discovery>
<entry>2018-02-21</entry>
</dates>
</vuln>
<vuln vid="7afc5e56-156d-11e8-95f2-005056925db4">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.1.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2018_02.txt">
<p>Use after free when server is disconnected during netsplits.
Found by Joseph Bisch.</p>
<p>Use after free when SASL messages are received in unexpected order.
Found by Joseph Bisch.</p>
<p>Null pointer dereference when an “empty” nick has been observed by
Irssi. Found by Joseph Bisch.</p>
<p>When the number of windows exceed the available space, Irssi would
crash due to Null pointer dereference. Found by Joseph Bisch.</p>
<p>Certain nick names could result in out of bounds access when printing
theme strings. Found by Oss-Fuzz.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2018_02.txt</url>
<cvename>CVE-2018-7054</cvename>
<cvename>CVE-2018-7053</cvename>
<cvename>CVE-2018-7052</cvename>
<cvename>CVE-2018-7051</cvename>
<cvename>CVE-2018-7050</cvename>
<freebsdpr>ports/226001</freebsdpr>
</references>
<dates>
<discovery>2018-02-15</discovery>
<entry>2018-02-19</entry>
<modified>2018-02-22</modified>
</dates>
</vuln>
<vuln vid="a183acb5-1414-11e8-9542-002590acae31">
<topic>p5-Mojolicious -- cookie-handling vulnerability</topic>
<affects>
<package>
<name>p5-Mojolicious</name>
<range><lt>7.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream commit:</p>
<blockquote cite="https://github.com/kraih/mojo/commit/c16a56a9d6575ddc53d15e76d58f0ebcb0eeb149">
<p>Vulnerabilities existed in cookie handling.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/kraih/mojo/issues/1185</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-17</entry>
</dates>
</vuln>
<vuln vid="22283b8c-13c5-11e8-a861-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.13</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.4.12/">
<p>A CSRF vulnerability in report.cgi would allow a third-party site
to extract confidential information from a bug the victim had access to.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5123</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1433400</url>
</references>
<dates>
<discovery>2018-02-16</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="044cff62-ed8b-4e72-b102-18a7d58a669f">
<topic>bro -- integer overflow allows remote DOS</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philippe Antoine of Catena cyber:</p>
<blockquote cite="http://blog.bro.org/2018/02/bro-253-released-security-update.html">
<p>This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro (i.e. a DoS attack). There also is a possibility this can be exploited in other ways. (CVE pending.)</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bro.org/2018/02/bro-253-released-security-update.html</url>
</references>
<dates>
<discovery>2018-02-14</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="ad2eeab6-ca68-4f06-9325-1937b237df60">
<topic>consul -- vulnerability in embedded DNS library</topic>
<affects>
<package>
<name>consul</name>
<range><lt>1.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Consul developers report:</p>
<blockquote cite="https://github.com/hashicorp/consul/issues/3859">
<p>A flaw was found in the embedded DNS library used in consul which
may allow a denial of service attack. Consul was updated to include
the fixed version.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/hashicorp/consul/issues/3859</url>
<url>https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#105-february-7-2018</url>
<url>https://github.com/miekg/dns/pull/631</url>
<url>https://github.com/miekg/dns/issues/627</url>
<cvename>CVE-2017-15133</cvename>
</references>
<dates>
<discovery>2018-01-17</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="746d04dc-507e-4450-911f-4c41e48bb07a">
<topic>bro -- out of bounds write allows remote DOS</topic>
<affects>
<package>
<name>bro</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Meier:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000458">
<p>Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.bro.org/2017/10/bro-252-242-release-security-update.html</url>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2018-02-16</entry>
</dates>
</vuln>
<vuln vid="e15a22ce-f16f-446b-9ca7-6859350c2e75">
<topic>quagga -- several security issues</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>1.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Quagga reports:</p>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-0543.txt">
<p>The Quagga BGP daemon, bgpd, does not properly bounds
check the data sent with a NOTIFY to a peer, if an attribute
length is invalid. Arbitrary data from the bgpd process
may be sent over the network to a peer and/or it may crash.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1114.txt">
<p>The Quagga BGP daemon, bgpd, can double-free memory
when processing certain forms of UPDATE message, containing
cluster-list and/or unknown attributes.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1550.txt">
<p>The Quagga BGP daemon, bgpd, can overrun internal BGP
code-to-string conversion tables used for debug by 1
pointer value, based on input.</p>
</blockquote>
<blockquote cite="https://www.quagga.net/security/Quagga-2018-1975.txt">
<p>The Quagga BGP daemon, bgpd, can enter an infinite
loop if sent an invalid OPEN message by a configured peer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.quagga.net/security/Quagga-2018-0543.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1114.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1550.txt</url>
<url>https://www.quagga.net/security/Quagga-2018-1975.txt</url>
<cvename>CVE-2018-5378</cvename>
<cvename>CVE-2018-5379</cvename>
<cvename>CVE-2018-5380</cvename>
<cvename>CVE-2018-5381</cvename>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="6f0b0cbf-1274-11e8-8b5b-4ccc6adda413">
<topic>libraw -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="https://www.securityfocus.com/archive/1/541732">
<p>CVE-2018-5800: An off-by-one error within the "LibRaw::kodak_ycbcr_load_raw()"
function (internal/dcraw_common.cpp) can be exploited to cause a heap-based
buffer overflow and subsequently cause a crash.</p>
<p>CVE-2017-5801: An error within the "LibRaw::unpack()" function
(src/libraw_cxx.cpp) can be exploited to trigger a NULL pointer dereference.</p>
<p>CVE-2017-5802: An error within the "kodak_radc_load_raw()" function
(internal/dcraw_common.cpp) related to the "buf" variable can be exploited
to cause an out-of-bounds read memory access and subsequently cause a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.securityfocus.com/archive/1/541732</url>
<cvename>CVE-2018-5800</cvename>
<cvename>CVE-2018-5801</cvename>
<cvename>CVE-2018-5802</cvename>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="c60804f1-126f-11e8-8b5b-4ccc6adda413">
<topic>libraw -- multiple DoS vulnerabilities</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Secunia Research reports:</p>
<blockquote cite="https://www.securityfocus.com/archive/1/541583">
<p>CVE-2017-16909: An error related to the "LibRaw::panasonic_load_raw()"
function (dcraw_common.cpp) can be exploited to cause a heap-based buffer
overflow and subsequently cause a crash via a specially crafted TIFF image.</p>
<p>CVE-2017-16910: An error within the "LibRaw::xtrans_interpolate()" function
(internal/dcraw_common.cpp) can be exploited to cause an invalid read
memory access.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.securityfocus.com/archive/1/541583</url>
<cvename>CVE-2017-16909</cvename>
<cvename>CVE-2017-16910</cvename>
</references>
<dates>
<discovery>2017-12-04</discovery>
<entry>2018-02-15</entry>
</dates>
</vuln>
<vuln vid="1a75c84a-11c8-11e8-83e7-485b3931c969">
<topic>bitmessage -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bitmessage</name>
<range><le>0.6.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bitmessage developers report:</p>
<blockquote cite="https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3">
<p>A remote code execution vulnerability has been spotted in use
against some users running PyBitmessage v0.6.2. The cause was
identified and a fix has been added and released as 0.6.3.2. (Will be
updated if/when CVE will be available.)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Bitmessage/PyBitmessage/releases/tag/v0.6.3</url>
<url>https://bitmessage.org/wiki/Main_Page</url>
</references>
<dates>
<discovery>2018-02-13</discovery>
<entry>2018-02-14</entry>
</dates>
</vuln>
<vuln vid="5d374fbb-bae3-45db-afc0-795684ac7353">
<topic>jenkins -- Path traversal vulnerability allows access to files outside plugin resources</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.106</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.89.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2018-02-14/">
<p>Jenkins did not properly prevent specifying relative paths that
escape a base directory for URLs accessing plugin resource files. This
allowed users with Overall/Read permission to download files from the
Jenkins master they should not have access to.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2018-02-14/</url>
<url>https://jenkins.io/blog/2018/02/14/security-updates/</url>
<cvename>CVE-2018-6356</cvename>
</references>
<dates>
<discovery>2018-02-14</discovery>
<entry>2018-02-14</entry>
</dates>
</vuln>
<vuln vid="279f682c-0e9e-11e8-83e7-485b3931c969">
<topic>bchunk -- access violation near NULL on destination operand and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15955">
<p>bchunk 1.2.0 and 1.2.1 is vulnerable to an "Access violation near
NULL on destination operand" and crash when processing a malformed CUE
(.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15955</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15955</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="8ba2819c-0e9d-11e8-83e7-485b3931c969">
<topic>bchunk -- heap-based buffer overflow (with invalid free) and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15954">
<p>bchunk 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer
overflow (with a resultant invalid free) and crash when processing a
malformed CUE (.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15954</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15954</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="1ec1c59b-0e98-11e8-83e7-485b3931c969">
<topic>bchunk -- heap-based buffer overflow and crash</topic>
<affects>
<package>
<name>bchunk</name>
<range><ge>1.2.0</ge><le>1.2.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15953">
<p>bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow
and crash when processing a malformed CUE (.cue) file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15953</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15953</url>
</references>
<dates>
<discovery>2017-10-28</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="a8f25565-109e-11e8-8d41-97657151f8c2">
<topic>uwsgi -- a stack-based buffer overflow</topic>
<affects>
<package>
<name>uwsgi</name>
<range><lt>2.0.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Uwsgi developers report:</p>
<blockquote cite="http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html">
<p>It was discovered that the uwsgi_expand_path function in utils.c in
Unbit uWSGI, an application container server, has a stack-based buffer
overflow via a large directory length that can cause a
denial-of-service (application crash) or stack corruption.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.unbit.it/pipermail/uwsgi/2018-February/008835.html</url>
<url>https://lists.debian.org/debian-lts-announce/2018/02/msg00010.html</url>
<cvename>CVE-2018-6758</cvename>
</references>
<dates>
<discovery>2018-02-06</discovery>
<entry>2018-02-13</entry>
</dates>
</vuln>
<vuln vid="0fe70bcd-2ce3-46c9-a64b-4a7da097db07">
<topic>python -- possible integer overflow vulnerability</topic>
<affects>
<package>
<name>python34</name>
<range><lt>3.4.8</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python issue:</p>
<blockquote cite="https://bugs.python.org/issue30657">
<p>There is a possible integer overflow in PyString_DecodeEscape
function of the file stringobject.c, which can be abused to gain
a heap overflow, possibly leading to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.python.org/issue30657</url>
<url>https://docs.python.org/3.4/whatsnew/changelog.html</url>
<url>https://docs.python.org/3.5/whatsnew/changelog.html</url>
<cvename>CVE-2017-1000158</cvename>
</references>
<dates>
<discovery>2017-06-03</discovery>
<entry>2018-02-11</entry>
</dates>
</vuln>
<vuln vid="aa743ee4-0f16-11e8-8fd2-10bf48e1088e">
<topic>electrum -- JSONRPC vulnerability</topic>
<affects>
<package>
<name>electrum-py36</name>
<range><ge>2.6</ge><lt>3.0.5</lt></range>
</package>
<package>
<name>electrum2</name>
<range><ge>2.6</ge><lt>3.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6353">
<p>JSONRPC vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-6353</cvename>
<url>https://github.com/spesmilo/electrum-docs/blob/master/cve.rst</url>
<url>https://bitcointalk.org/index.php?topic=2702103.0</url>
</references>
<dates>
<discovery>2018-01-27</discovery>
<entry>2018-02-11</entry>
</dates>
</vuln>
<vuln vid="e4dd787e-0ea9-11e8-95f2-005056925db4">
<topic>libtorrent -- remote DoS</topic>
<affects>
<package>
<name>libtorrent</name>
<range><lt>0.13.6_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X-cela reports:</p>
<blockquote cite="https://github.com/rakshasa/libtorrent/pull/99">
<p>Calls into build_benocde that use %zu could crash on 64 bit
machines due to the size change of size_t. Someone can force
READ_ENC_IA to fail allowing an internal_error to be thrown
and bring down the client.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/rakshasa/libtorrent/pull/99</url>
<freebsdpr>ports/224664</freebsdpr>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="316b3c3e-0e98-11e8-8d41-97657151f8c2">
<topic>exim -- a buffer overflow vulnerability, remote code execution</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.90.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers report:</p>
<blockquote cite="https://exim.org/static/doc/security/CVE-2018-6789.txt">
<p>There is a buffer overflow in base64d(), if some pre-conditions are met.
Using a handcrafted message, remote code execution seems to be possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://exim.org/static/doc/security/CVE-2018-6789.txt</url>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="7a2e0063-0e4e-11e8-94c0-5453ed2e2b49">
<topic>p7zip-codec-rar -- insufficient error handling</topic>
<affects>
<package>
<name>p7zip-codec-rar</name>
<range><lt>16.02_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996">
<p>Insufficient exception handling in the method
NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip
can lead to multiple memory corruptions within the PPMd code,
alows remote attackers to cause a denial of service (segmentation
fault) or execute arbitrary code via a crafted RAR archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5996</cvename>
<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5996</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="6d337396-0e4a-11e8-94c0-5453ed2e2b49">
<topic>p7zip -- heap-based buffer overflow</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>16.02_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969">
<p>Heap-based buffer overflow in the
NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before
18.00 and p7zip allows remote attackers to cause a denial of
service (out-of-bounds write) or potentially execute arbitrary
code via a crafted ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-17969</cvename>
<url>https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17969</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-17969</url>
<url>https://marc.info/?l=bugtraq&=151782582216805&=2</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-10</entry>
</dates>
</vuln>
<vuln vid="3ee6e521-0d32-11e8-99b0-d017c2987f9a">
<topic>mpv -- arbitrary code execution via crafted website</topic>
<affects>
<package>
<name>mpv</name>
<range><lt>0.27.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mpv developers report:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-6360">
<p>mpv through 0.28.0 allows remote attackers to execute arbitrary code
via a crafted web site, because it reads HTML documents containing
VIDEO elements, and accepts arbitrary URLs in a src attribute without
a protocol whitelist in player/lua/ytdl_hook.lua. For example, an
av://lavfi:ladspa=file= URL signifies that the product should call
dlopen on a shared object file located at an arbitrary local pathname.
The issue exists because the product does not consider that youtube-dl
can provide a potentially unsafe URL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/mpv-player/mpv/issues/5456</url>
<cvename>CVE-2018-6360</cvename>
</references>
<dates>
<discovery>2018-01-28</discovery>
<entry>2018-02-09</entry>
<modified>2018-02-11</modified>
</dates>
</vuln>
<vuln vid="3d0eeef8-0cf9-11e8-99b0-d017c2987f9a">
<topic>Mailman -- Cross-site scripting (XSS) vulnerability in the web UI</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.26</lt></range>
</package>
<package>
<name>mailman-with-htdig</name>
<range><lt>2.1.26</lt></range>
</package>
<package>
<name>ja-mailman</name>
<range><le>2.1.14.j7_3,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="https://www.mail-archive.com/mailman-users@python.org/msg70478.html">
<p>An XSS vulnerability in the user options CGI could allow a crafted URL
to execute arbitrary javascript in a user's browser. A related issue
could expose information on a user's options page without requiring
login.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mail-archive.com/mailman-users@python.org/msg70478.html</url>
<cvename>CVE-2018-5950</cvename>
</references>
<dates>
<discovery>2018-01-20</discovery>
<entry>2018-02-08</entry>
</dates>
</vuln>
<vuln vid="c602c791-0cf4-11e8-a2ec-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.21</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.16</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.11</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.7</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1829/">
<ul>
<li>CVE-2018-1052: Fix the processing of partition keys containing multiple expressions (only for PostgreSQL-10.x)</li>
<li>CVE-2018-1053: Ensure that all temporary files made with "pg_upgrade" are non-world-readable</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1052</cvename>
<cvename>CVE-2018-1053</cvename>
</references>
<dates>
<discovery>2018-02-05</discovery>
<entry>2018-02-08</entry>
</dates>
</vuln>
<vuln vid="b38e8150-0535-11e8-96ab-0800271d4b9c">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<range><le>4.0.9</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security Advisory reports:</p>
<blockquote cite="https://www.debian.org/security/2018/dsa-4100">
<p>Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9935</cvename>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2704</url>
<cvename>CVE-2017-18013</cvename>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2770</url>
<bid>225544</bid>
</references>
<dates>
<discovery>2017-06-22</discovery>
<entry>2018-01-29</entry>
</dates>
</vuln>
<vuln vid="756a8631-0b84-11e8-a986-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>28.0.0.161</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-03.html">
<ul>
<li>This update resolves use-after-free vulnerabilities that
could lead to remote code execution (CVE-2018-4877,
CVE-2018-4878).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4877</cvename>
<cvename>CVE-2018-4878</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsa18-01.html</url>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-03.html</url>
</references>
<dates>
<discovery>2018-01-31</discovery>
<entry>2018-02-06</entry>
</dates>
</vuln>
<vuln vid="f5524753-67b1-4c88-8114-29c2d258b383">
<topic>mini_httpd,thttpd -- Buffer overflow in htpasswd</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.28</lt></range>
</package>
<package>
<name>thttpd</name>
<range><lt>2.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alessio Santoru reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17663">
<p>Buffer overflow in htpasswd.</p>
</blockquote>
</body>
</description>
<references>
<url>http://acme.com/updates/archive/199.html</url>
</references>
<dates>
<discovery>2017-12-13</discovery>
<entry>2018-02-06</entry>
</dates>
</vuln>
<vuln vid="3746de31-0a1a-11e8-83e7-485b3931c969">
<topic>shadowsocks-libev -- command injection via shell metacharacters</topic>
<affects>
<package>
<name>shadowsocks-libev</name>
<range><ge>3.1.0</ge><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15924">
<p>Improper parsing allows command injection via shell metacharacters in
a JSON configuration request received via 127.0.0.1 UDP traffic.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-15924</url>
</references>
<dates>
<discovery>2017-10-27</discovery>
<entry>2018-02-05</entry>
</dates>
</vuln>
<vuln vid="5044bd23-08cb-11e8-b08f-00012e582166">
<topic>palemoon -- multiple vulnerabilities</topic>
<affects>
<package>
<name>palemoon</name>
<range><lt>27.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pale Moon reports:</p>
<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5102</cvename>
<cvename>CVE-2018-5122</cvename>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-02-03</entry>
</dates>
</vuln>
<vuln vid="d696473f-9f32-42c5-a106-bf4536fb1f74">
<topic>Django -- information leakage</topic>
<affects>
<package>
<name>py27-django111</name>
<name>py34-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<range><lt>1.11.10</lt></range>
</package>
<package>
<name>py27-django20</name>
<name>py34-django20</name>
<name>py35-django20</name>
<name>py36-django20</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django release notes:</p>
<blockquote cite="https://docs.djangoproject.com/en/1.11/releases/1.11.10/">
<p>CVE-2018-6188: Information leakage in AuthenticationForm</p>
<p>A regression in Django 1.11.8 made AuthenticationForm run its
confirm_login_allowed() method even if an incorrect password is entered.
This can leak information about a user, depending on what messages
confirm_login_allowed() raises. If confirm_login_allowed() isn't
overridden, an attacker enter an arbitrary username and see if that user
has been set to is_active=False. If confirm_login_allowed() is
overridden, more sensitive details could be leaked.</p>
<p>This issue is fixed with the caveat that AuthenticationForm can no
longer raise the "This account is inactive." error if the authentication
backend rejects inactive users (the default authentication backend,
ModelBackend, has done that since Django 1.10). This issue will be
revisited for Django 2.1 as a fix to address the caveat will likely be too
invasive for inclusion in older versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.djangoproject.com/en/1.11/releases/1.11.10/</url>
<url>https://docs.djangoproject.com/en/2.0/releases/2.0.2/</url>
<cvename>CVE-2018-6188</cvename>
</references>
<dates>
<discovery>2018-02-01</discovery>
<entry>2018-02-02</entry>
</dates>
</vuln>
<vuln vid="e72d5bf5-07a0-11e8-8248-0021ccb9e74d">
<topic>w3m - multiple vulnerabilities</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.3.20180125</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tatsuya Kinoshita reports:</p>
<blockquote cite="https://github.com/tats/w3m/commit/01d41d49b273a8cc75b27c6ab42291b46004fc0c">
<p>CVE-2018-6196 * table.c: Prevent negative indent value in feed_table_block_tag().</p>
<p>CVE-2018-6197 * form.c: Prevent invalid columnPos() call in formUpdateBuffer().</p>
<p>CVE-2018-6198 * config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when ~/.w3m is unwritable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/tats/w3m/commit/e773a0e089276f82c546447c0fd1e6c0f9156628</url>
<cvename>CVE-2018-6196</cvename>
<cvename>CVE-2018-6197</cvename>
<cvename>CVE-2018-6198</cvename>
</references>
<dates>
<discovery>2018-01-25</discovery>
<entry>2018-02-01</entry>
<modified>2018-02-03</modified>
</dates>
</vuln>
<vuln vid="103bf96a-6211-45ab-b567-1555ebb3a86a">
<topic>firefox -- Arbitrary code execution through unsanitized browser UI</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>58.0.1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.3.65</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/">
<p>Mozilla developer <strong>Johann Hofmann</strong> reported that
unsanitized output in the browser UI can lead to arbitrary
code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1432966</url>
</references>
<dates>
<discovery>2018-01-29</discovery>
<entry>2018-01-29</entry>
<modified>2018-01-31</modified>
</dates>
</vuln>
<vuln vid="2cceb80e-c482-4cfd-81b3-2088d2c0ad53">
<topic>gcab -- stack overflow</topic>
<affects>
<package>
<name>gcab</name>
<range><lt>0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Upstream reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2018-5345">
<p>A stack-based buffer overflow within GNOME gcab through
0.7.4 can be exploited by malicious attackers to cause a
crash or, potentially, execute arbitrary code via a
crafted .cab file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2018-5345</url>
<url>https://mail.gnome.org/archives/ftp-release-list/2018-January/msg00066.html</url>
<cvename>CVE-2018-5345</cvename>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-01-27</entry>
</dates>
</vuln>
<vuln vid="92b8b284-a3a2-41b1-956c-f9cf8b74f500">
<topic>dovecot -- abort of SASL authentication results in a memory leak</topic>
<affects>
<package>
<name>dovecot</name>
<range><gt>2.0</gt><le>2.2.33.2_3</le></range>
<range><ge>2.3</ge><le>2.3.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Pedro Sampaio reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1532768">
<p>A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. A abort of
SASL authentication results in a memory leak in Dovecot auth client
used by login processes. The leak has impact in high performance
configuration where same login processes are reused and can cause the
process to crash due to memory exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15132</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1532768</url>
<url>https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8b060.patch</url>
</references>
<dates>
<discovery>2018-01-09</discovery>
<entry>2018-01-26</entry>
<modified>2018-02-01</modified>
</dates>
</vuln>
<vuln vid="0cbf0fa6-dcb7-469c-b87a-f94cffd94583">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.58.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000007">
<p>libcurl 7.1 through 7.57.0 might accidentally leak authentication
data to third parties. When asked to send custom headers in its HTTP
requests, libcurl will send that set of headers first to the host in
the initial URL but also, if asked to follow redirects and a 30X HTTP
response code is returned, to the host mentioned in URL in the
`Location:` response header value. Sending the same set of headers to
subsequest hosts is in particular a problem for applications that pass
on custom `Authorization:` headers, as this header often contains
privacy sensitive information or data that could allow others to
impersonate the libcurl-using client's request.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_2018-b3bf.html</url>
<cvename>CVE-2018-1000007</cvename>
</references>
<dates>
<discovery>2018-01-24</discovery>
<entry>2018-01-26</entry>
</dates>
</vuln>
<vuln vid="b464f61b-84c7-4e1c-8ad4-6cf9efffd025">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.99.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ClamAV project reports:</p>
<blockquote cite="http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html">
<p>Join us as we welcome ClamAV 0.99.3 to the family!.</p>
<p>This release is a security release and is recommended for
all ClamAV users.</p>
<p>CVE-2017-12374 ClamAV UAF (use-after-free) Vulnerabilities</p>
<p>CVE-2017-12375 ClamAV Buffer Overflow Vulnerability</p>
<p>CVE-2017-12376 ClamAV Buffer Overflow in handle_pdfname
Vulnerability</p>
<p>CVE-2017-12377 ClamAV Mew Packet Heap Overflow Vulnerability</p>
<p>CVE-2017-12378 ClamAV Buffer Over Read Vulnerability</p>
<p>CVE-2017-12379 ClamAV Buffer Overflow in messageAddArgument
Vulnerability</p>
<p>CVE-2017-12380 ClamAV Null Dereference Vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html</url>
<cvename>CVE-2017-12374</cvename>
<cvename>CVE-2017-12375</cvename>
<cvename>CVE-2017-12376</cvename>
<cvename>CVE-2017-12377</cvename>
<cvename>CVE-2017-12378</cvename>
<cvename>CVE-2017-12379</cvename>
<cvename>CVE-2017-12380</cvename>
</references>
<dates>
<discovery>2018-01-25</discovery>
<entry>2018-01-26</entry>
</dates>
</vuln>
<vuln vid="a891c5b4-3d7a-4de9-9c71-eef3fd698c77">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>58.0_1,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.3.63</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.6.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/">
<p>CVE-2018-5091: Use-after-free with DTMF timers</p>
<p>CVE-2018-5092: Use-after-free in Web Workers</p>
<p>CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing</p>
<p>CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory</p>
<p>CVE-2018-5095: Integer overflow in Skia library during edge builder allocation</p>
<p>CVE-2018-5097: Use-after-free when source document is manipulated during XSLT</p>
<p>CVE-2018-5098: Use-after-free while manipulating form input elements</p>
<p>CVE-2018-5099: Use-after-free with widget listener</p>
<p>CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory</p>
<p>CVE-2018-5101: Use-after-free with floating first-letter style elements</p>
<p>CVE-2018-5102: Use-after-free in HTML media elements</p>
<p>CVE-2018-5103: Use-after-free during mouse event handling</p>
<p>CVE-2018-5104: Use-after-free during font face manipulation</p>
<p>CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts</p>
<p>CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker</p>
<p>CVE-2018-5107: Printing process will follow symlinks for local file access</p>
<p>CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs</p>
<p>CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution</p>
<p>CVE-2018-5110: Cursor can be made invisible on OS X</p>
<p>CVE-2018-5111: URL spoofing in addressbar through drag and drop</p>
<p>CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel</p>
<p>CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow</p>
<p>CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts</p>
<p>CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs</p>
<p>CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access</p>
<p>CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right</p>
<p>CVE-2018-5118: Activity Stream images can attempt to load local content through file:</p>
<p>CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers</p>
<p>CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar</p>
<p>CVE-2018-5122: Potential integer overflow in DoCrypt</p>
<p>CVE-2018-5090: Memory safety bugs fixed in Firefox 58</p>
<p>CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-5089</cvename>
<cvename>CVE-2018-5090</cvename>
<cvename>CVE-2018-5091</cvename>
<cvename>CVE-2018-5092</cvename>
<cvename>CVE-2018-5093</cvename>
<cvename>CVE-2018-5094</cvename>
<cvename>CVE-2018-5095</cvename>
<cvename>CVE-2018-5097</cvename>
<cvename>CVE-2018-5098</cvename>
<cvename>CVE-2018-5099</cvename>
<cvename>CVE-2018-5100</cvename>
<cvename>CVE-2018-5101</cvename>
<cvename>CVE-2018-5102</cvename>
<cvename>CVE-2018-5103</cvename>
<cvename>CVE-2018-5104</cvename>
<cvename>CVE-2018-5105</cvename>
<cvename>CVE-2018-5106</cvename>
<cvename>CVE-2018-5107</cvename>
<cvename>CVE-2018-5108</cvename>
<cvename>CVE-2018-5109</cvename>
<cvename>CVE-2018-5110</cvename>
<cvename>CVE-2018-5111</cvename>
<cvename>CVE-2018-5112</cvename>
<cvename>CVE-2018-5113</cvename>
<cvename>CVE-2018-5114</cvename>
<cvename>CVE-2018-5115</cvename>
<cvename>CVE-2018-5116</cvename>
<cvename>CVE-2018-5117</cvename>
<cvename>CVE-2018-5118</cvename>
<cvename>CVE-2018-5119</cvename>
<cvename>CVE-2018-5121</cvename>
<cvename>CVE-2018-5122</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2018-02/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2018-03/</url>
</references>
<dates>
<discovery>2018-01-23</discovery>
<entry>2018-01-23</entry>
<modified>2018-01-29</modified>
</dates>
</vuln>
<vuln vid="24a82876-002e-11e8-9a95-0cc47a02c232">
<topic>powerdns-recursor -- insufficient validation of DNSSEC signatures</topic>
<affects>
<package>
<name>powerdns-recursor</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html">
<p>An issue has been found in the DNSSEC validation component of
PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3
record to be used to wrongfully prove the non-existence of a RR
below the owner name of that record. This would allow an attacker in
position of man-in-the-middle to send a NXDOMAIN answer for a name
that does exist.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-1000003</cvename>
<url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html</url>
</references>
<dates>
<discovery>2018-01-22</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="e264e74e-ffe0-11e7-8b91-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>63.0.3239.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[788453] High CVE-2017-15429: UXSS in V8. Reported by
Anonymous on 2017-11-24</li>
<li>[794792] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15429</cvename>
<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html</url>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="1d951e85-ffdb-11e7-8b91-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>63.0.3239.84</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html">
<p>37 security fixes in this release, including:</p>
<ul>
<li>[778505] Critical CVE-2017-15407: Out of bounds write in QUIC. Reported by
Ned Williamson on 2017-10-26</li>
<li>[762374] High CVE-2017-15408: Heap buffer overflow in PDFium. Reported by
Ke Liu of Tencent's Xuanwu LAB on 2017-09-06</li>
<li>[763972] High CVE-2017-15409: Out of bounds write in Skia. Reported by
Anonymous on 2017-09-11</li>
<li>[765921] High CVE-2017-15410: Use after free in PDFium. Reported by
Luat Nguyen of KeenLab, Tencent on 2017-09-16</li>
<li>[770148] High CVE-2017-15411: Use after free in PDFium. Reported by
Luat Nguyen of KeenLab, Tencent on 2017-09-29</li>
<li>[727039] High CVE-2017-15412: Use after free in libXML. Reported by
Nick Wellnhofer on 2017-05-27</li>
<li>[766666] High CVE-2017-15413: Type confusion in WebAssembly. Reported by
Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-09-19</li>
<li>[765512] Medium CVE-2017-15415: Pointer information disclosure in IPC call.
Reported by Viktor Brange of Microsoft Offensive Security Research Team on 2017-09-15</li>
<li>[779314] Medium CVE-2017-15416: Out of bounds read in Blink. Reported by
Ned Williamson on 2017-10-28</li>
<li>[699028] Medium CVE-2017-15417: Cross origin information disclosure in Skia.
Reported by Max May on 2017-03-07</li>
<li>[765858] Medium CVE-2017-15418: Use of uninitialized value in Skia. Reported by
Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-09-15</li>
<li>[780312] Medium CVE-2017-15419: Cross origin leak of redirect URL in Blink.
Reported by Jun Kokatsu on 2017-10-31</li>
<li>[777419] Medium CVE-2017-15420: URL spoofing in Omnibox. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-10-23</li>
<li>[774382] Medium CVE-2017-15422: Integer overflow in ICU. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-10-13</li>
<li>[780484] Medium CVE-2017-15430: Unsafe navigation in Chromecast Plugin.
Reported by jinmo123 on 2017-01-11</li>
<li>[778101] Low CVE-2017-15423: Issue with SPAKE implementation in BoringSSL.
Reported by Greg Hudson on 2017-10-25</li>
<li>[756226] Low CVE-2017-15424: URL Spoof in Omnibox. Reported by
Khalil Zhani on 2017-08-16</li>
<li>[756456] Low CVE-2017-15425: URL Spoof in Omnibox. Reported by
xisigr of Tencent's Xuanwu Lab on 2017-08-17</li>
<li>[757735] Low CVE-2017-15426: URL Spoof in Omnibox. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-08-18</li>
<li>[768910] Low CVE-2017-15427: Insufficient blocking of Javascript in Omnibox.
Reported by Junaid Farhan on 2017-09-26</li>
<li>[792099] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15407</cvename>
<cvename>CVE-2017-15408</cvename>
<cvename>CVE-2017-15409</cvename>
<cvename>CVE-2017-15410</cvename>
<cvename>CVE-2017-15411</cvename>
<cvename>CVE-2017-15412</cvename>
<cvename>CVE-2017-15413</cvename>
<cvename>CVE-2017-15415</cvename>
<cvename>CVE-2017-15416</cvename>
<cvename>CVE-2017-15417</cvename>
<cvename>CVE-2017-15418</cvename>
<cvename>CVE-2017-15419</cvename>
<cvename>CVE-2017-15420</cvename>
<cvename>CVE-2017-15422</cvename>
<cvename>CVE-2017-15430</cvename>
<cvename>CVE-2017-15423</cvename>
<cvename>CVE-2017-15424</cvename>
<cvename>CVE-2017-15425</cvename>
<cvename>CVE-2017-15426</cvename>
<cvename>CVE-2017-15427</cvename>
<url>https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-12-06</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="82894193-ffd4-11e7-8b91-e8e0b747a45a">
<topic>chromium -- out of bounds read</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html">
<p>1 security fix in this release, including:</p>
<ul>
<li>[782145] High CVE-2017-15428: Out of bounds read in V8. Reported by
Zhao Qixun of Qihoo 360 Vulcan Team on 2017-11-07</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15428</cvename>
<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2017-11-13</discovery>
<entry>2018-01-23</entry>
</dates>
</vuln>
<vuln vid="8d3bae09-fd28-11e7-95f2-005056925db4">
<topic>unbound -- vulnerability in the processing of wildcard synthesized NSEC records</topic>
<affects>
<package>
<name>unbound</name>
<range><lt>1.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unbound reports:</p>
<blockquote cite="https://unbound.net/downloads/CVE-2017-15105.txt">
<p>We discovered a vulnerability in the processing of wildcard synthesized
NSEC records. While synthesis of NSEC records is allowed by RFC4592,
these synthesized owner names should not be used in the NSEC processing.
This does, however, happen in Unbound 1.6.7 and earlier versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://unbound.net/downloads/CVE-2017-15105.txt</url>
<cvename>CVE-2017-15105</cvename>
<freebsdpr>ports/225313</freebsdpr>
</references>
<dates>
<discovery>2017-10-08</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="8e89a89a-fd15-11e7-bdf6-00e04c1ea73d">
<topic>phpbb3 -- multiple issues</topic>
<affects>
<package>
<name>phpbb3</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpbb developers reports:</p>
<blockquote cite="https://wiki.phpbb.com/Release_Highlights/3.2.2">
<p>Password updater working with PostgreSQL - The cron for updating legacy password hashes was running invalid queries on PostgreSQL.</p>
<p>Deleting orphaned attachments w/ large number of orphaned attachments - Orphaned attachment deletion was improved to be able to delete them when a large number of orphaned attachments exist.</p>
<p>Multiple bugfixes for retrieving image size - Multiple issues with retrieving the image size of JPEGs and temporary files were resolved.</p>
<p>Issues with updating from phpBB 3.0.6 - Inconsistencies in the way parent modules were treated caused issues with updating from older phpBB 3.0 versions.</p>
<p>Forum / topic icon blurriness - Fixed issues with forum and topic icons looking blurry on some browsers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.phpbb.com/Release_Highlights/3.2.2</url>
</references>
<dates>
<discovery>2018-01-07</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="e3445736-fd01-11e7-ac58-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.34</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.31</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.13</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.39</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.21</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.59</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.39</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL">
<p>Not all vulnerabilities are relevant for all flavors/versions of the
servers and clients</p>
<ul>
<li>Vulnerability allows low privileged attacker with network access
via multiple protocols to compromise MySQL Server. Successful attacks
of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MySQL Server.
GIS: CVE-2018-2573, DDL CVE-2018-2622, Optimizer: CVE-2018-2640,
CVE-2018-2665, CVE-2018-2668, Security:Privileges: CVE-2018-2703,
Partition: CVE-2018-2562.</li>
<li>Vulnerability allows high privileged attacker with network access
via multiple protocols to compromise MySQL Server. Successful attacks
of this vulnerability can result in unauthorized ability to cause a
hang or frequently repeatable crash (complete DOS) of MySQL Server.
InnoDB: CVE-2018-2565, CVE-2018-2612 DML: CVE-2018-2576,
CVE-2018-2646, Stored Procedure: CVE-2018-2583, Performance Schema:
CVE-2018-2590, Partition: CVE-2018-2591, Optimizer: CVE-2018-2600,
CVE-2018-2667, Security:Privileges: CVE-2018-2696, Replication:
CVE-2018-2647.</li>
<li>Vulnerability allows a low or high privileged attacker with network
access via multiple protocols to compromise MySQL Server with
unauthorized creation, deletion, modification or access to data/
critical data. InnoDB: CVE-2018-2612, Performance Schema:
CVE-2018-2645, Replication: CVE-2018-2647, Partition: CVE-2018-2562.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/library/mariadb-5559-release-notes/</url>
<cvename>CVE-2018-2562</cvename>
<cvename>CVE-2018-2565</cvename>
<cvename>CVE-2018-2573</cvename>
<cvename>CVE-2018-2576</cvename>
<cvename>CVE-2018-2583</cvename>
<cvename>CVE-2018-2586</cvename>
<cvename>CVE-2018-2590</cvename>
<cvename>CVE-2018-2591</cvename>
<cvename>CVE-2018-2600</cvename>
<cvename>CVE-2018-2612</cvename>
<cvename>CVE-2018-2622</cvename>
<cvename>CVE-2018-2640</cvename>
<cvename>CVE-2018-2645</cvename>
<cvename>CVE-2018-2646</cvename>
<cvename>CVE-2018-2647</cvename>
<cvename>CVE-2018-2665</cvename>
<cvename>CVE-2018-2667</cvename>
<cvename>CVE-2018-2668</cvename>
<cvename>CVE-2018-2696</cvename>
<cvename>CVE-2018-2703</cvename>
</references>
<dates>
<discovery>2017-01-18</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="c04dc18f-fcde-11e7-bdf6-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/">
<p>JavaScript errors that prevented saving posts in Firefox have been fixed.</p>
<p>The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.</p>
<p>Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-01-19</entry>
</dates>
</vuln>
<vuln vid="65fab89f-2231-46db-8541-978f4e87f32a">
<topic>gitlab -- Remote code execution on project import</topic>
<affects>
<package>
<name>gitlab</name>
<range><lt>10.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab developers report:</p>
<blockquote cite="https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/">
<p>Today we are releasing versions 10.3.4, 10.2.6, and 10.1.6 for
GitLab Community Edition (CE) and Enterprise Edition (EE).</p>
<p>These versions contain a number of important security fixes,
including two that prevent remote code execution, and we strongly
recommend that all GitLab installations be upgraded to one of these
versions immediately.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/</url>
<cvename>CVE-2017-0915</cvename>
<cvename>CVE-2018-3710</cvename>
</references>
<dates>
<discovery>2018-01-16</discovery>
<entry>2018-01-17</entry>
</dates>
</vuln>
<vuln vid="3e5b8bd3-0c32-452f-a60e-beab7b762351">
<topic>transmission-daemon -- vulnerable to dns rebinding attacks</topic>
<affects>
<package>
<name>transmission-daemon</name>
<range><le>2.92_3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Project Zero reports:</p>
<blockquote cite="https://bugs.chromium.org/p/project-zero/issues/detail?id=1447">
<p>The transmission bittorrent client uses a client/server
architecture, the user interface is the client which communicates
to the worker daemon using JSON RPC requests.</p>
<p>As with all HTTP RPC schemes like this, any website can send
requests to the daemon listening on localhost with XMLHttpRequest(),
but the theory is they will be ignored because clients must prove
they can read and set a specific header, X-Transmission-Session-Id.
Unfortunately, this design doesn't work because of an attack called
"DNS rebinding". Any website can simply create a dns name that they
are authorized to communicate with, and then make it resolve to
localhost.</p>
<p>Exploitation is simple, you could set script-torrent-done-enabled
and run any command, or set download-dir to /home/user/ and then
upload a torrent for .bashrc.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1447</url>
<url>https://github.com/transmission/transmission/pull/468</url>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2018-01-14</entry>
</dates>
</vuln>
<vuln vid="3dbe9492-f7b8-11e7-a12d-6cc21735f730">
<topic>shibboleth-sp -- vulnerable to forged user attribute data</topic>
<affects>
<package>
<name>xmltooling</name>
<range><lt>1.6.3</lt></range>
</package>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Shibboleth consortium reports:</p>
<blockquote cite="https://shibboleth.net/community/advisories/secadv_20180112.txt">
<p>
Shibboleth SP software vulnerable to forged user attribute data
</p>
<p>
The Service Provider software relies on a generic XML parser to
process SAML responses and there are limitations in older versions
of the parser that make it impossible to fully disable Document Type
Definition (DTD) processing.
</p>
<p>
Through addition/manipulation of a DTD, it's possible to make
changes to an XML document that do not break a digital signature but
are mishandled by the SP and its libraries. These manipulations can
alter the user data passed through to applications behind the SP and
result in impersonation attacks and exposure of protected
information.
</p>
<p>
While newer versions of the xerces-c3 parser are configured by the
SP into disallowing the use of a DTD via an environment variable,
this feature is not present in the xerces-c3 parser before version
3.1.4, so an additional fix is being provided now that an actual DTD
exploit has been identified. Xerces-c3-3.1.4 was committed to the
ports tree already on 2016-07-26.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://shibboleth.net/community/advisories/secadv_20180112.txt</url>
<cvename>CVE-2018-0486</cvename>
</references>
<dates>
<discovery>2018-01-12</discovery>
<entry>2018-01-12</entry>
</dates>
</vuln>
<vuln vid="9c016563-f582-11e7-b33c-6451062f0f7a">
<topic>Flash Player -- information disclosure</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>28.0.0.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb18-01.html">
<ul>
<li>This update resolves an out-of-bounds read vulnerability that
could lead to information disclosure (CVE-2018-4871).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2018-4871</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb18-01.html</url>
</references>
<dates>
<discovery>2018-01-09</discovery>
<entry>2018-01-09</entry>
</dates>
</vuln>
<vuln vid="4055aee5-f4c6-11e7-95f2-005056925db4">
<topic>awstats -- remote code execution</topic>
<affects>
<package>
<name>awstats</name>
<range><lt>7.7,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501">
<p>Awstats version 7.6 and earlier is vulnerable to a path traversal
flaw in the handling of the "config" and "migrate" parameters resulting
in unauthenticated remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000501</url>
<cvename>CVE-2017-1000501</cvename>
<freebsdpr>ports/225007</freebsdpr>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-01-08</entry>
</dates>
</vuln>
<vuln vid="a3764767-f31e-11e7-95f2-005056925db4">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.6,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2018_01.txt">
<p>When the channel topic is set without specifying a sender, Irssi
may dereference NULL pointer. Found by Joseph Bisch.</p>
<p>When using incomplete escape codes, Irssi may access data beyond
the end of the string. Found by Joseph Bisch.</p>
<p>A calculation error in the completion code could cause a heap
buffer overflow when completing certain strings.
Found by Joseph Bisch.</p>
<p>When using an incomplete variable argument, Irssi may access data
beyond the end of the string. Found by Joseph Bisch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2018_01.txt</url>
<cvename>CVE-2018-5205</cvename>
<cvename>CVE-2018-5206</cvename>
<cvename>CVE-2018-5207</cvename>
<cvename>CVE-2018-5208</cvename>
<freebsdpr>ports/224954</freebsdpr>
</references>
<dates>
<discovery>2018-01-03</discovery>
<entry>2018-01-06</entry>
</dates>
</vuln>
<vuln vid="8429711b-76ca-474e-94a0-6b980f1e2d47">
<topic>mozilla -- Speculative execution side-channel attack</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>57.0.4,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2018-01/">
<p><strong>Jann Horn</strong> of Google Project Zero
Security reported that speculative execution performed
by modern CPUs could leak information through a timing
side-channel attack. Microsoft Vulnerability Research
extended this attack to browser JavaScript engines and
demonstrated that code on a malicious web page could
read data from other web sites (violating the
same-origin policy) or private data from the browser
itself.</p>
<p>Since this new class of attacks involves measuring
precise time intervals, as a parti al, short-term,
mitigation we are disabling or reducing the precision of
several time sources in Firefox. The precision of
<code>performance.now()</code> has been reduced from 5μs
to 20μs, and the <code>SharedArrayBuffer</code> feature
has been disabled because it can be used to construct a
high-resolution timer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2018-01/</url>
</references>
<dates>
<discovery>2018-01-04</discovery>
<entry>2018-01-05</entry>
</dates>
</vuln>
<vuln vid="cebd05d6-ed7b-11e7-95f2-005056925db4">
<topic>OTRS -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>otrs</name>
<range><lt>5.0.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OTRS reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as an agent can request special URLs
from OTRS which can lead to the execution of shell commands with the
permissions of the web server user.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as a customer can use the ticket search
form to disclose internal article information of their customer tickets.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/">
<p>An attacker who is logged into OTRS as an agent can manipulate form
parameters and execute arbitrary shell commands with the permissions of the
OTRS or web server user.</p>
</blockquote>
<blockquote cite="https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/">
<p>An attacker can send a specially prepared email to an OTRS system. If this
system has cookie support disabled, and a logged in agent clicks a link in this
email, the session information could be leaked to external systems, allowing the
attacker to take over the agent’s session.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16664</cvename>
<cvename>CVE-2017-16854</cvename>
<cvename>CVE-2017-16921</cvename>
<freebsdpr>ports/224729</freebsdpr>
<url>https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/</url>
<url>https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/</url>
</references>
<dates>
<discovery>2017-11-21</discovery>
<entry>2017-12-30</entry>
</dates>
</vuln>
<vuln vid="6a131fbf-ec76-11e7-aa65-001b216d295b">
<topic>The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT")</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><lt>1.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
<p>Release: 1.59</p>
<p>CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS
when RSA key exchange is negotiated. This potentially affected
BCJSSE servers and any other TLS servers configured to use JCE
for the underlying crypto - note the two TLS implementations
using the BC lightweight APIs are not affected by this.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-13098</cvename>
<url>https://www.bouncycastle.org/releasenotes.html</url>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-29</entry>
</dates>
</vuln>
<vuln vid="6a09c80e-6ec7-442a-bc65-d72ce69fd887">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/">
<p>CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9</p>
<p>CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin</p>
<p>CVE-2017-7847: Local path string can be leaked from RSS feed</p>
<p>CVE-2017-7848: RSS Feed vulnerable to new line Injection</p>
<p>CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7829</cvename>
<cvename>CVE-2017-7845</cvename>
<cvename>CVE-2017-7846</cvename>
<cvename>CVE-2017-7847</cvename>
<cvename>CVE-2017-7848</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-30/</url>
</references>
<dates>
<discovery>2017-12-22</discovery>
<entry>2017-12-25</entry>
</dates>
</vuln>
<vuln vid="63eb2b11-e802-11e7-a58c-6805ca0b3d42">
<topic>phpMyAdmin -- XSRF/CSRF vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.7.0</ge><lt>4.7.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-9/">
<h3>Description</h3>
<p>By deceiving a user to click on a crafted URL, it is
possible to perform harmful database operations such as
deleting records, dropping/truncating tables etc.</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-9/</url>
</references>
<dates>
<discovery>2017-12-23</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="2a3bc6ac-e7c6-11e7-a90b-001999f8d30b">
<topic>asterisk -- Crash in PJSIP resource when missing a contact header</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>A select set of SIP messages create a dialog in Asterisk.
Those SIP messages must contain a contact header. For
those messages, if the header was not present and using
the PJSIP channel driver, it would cause Asterisk to
crash. The severity of this vulnerability is somewhat
mitigated if authentication is enabled. If authentication
is enabled a user would have to first be authorized before
reaching the crash point.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-014.html</url>
<cvename>CVE-2017-17850</cvename>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="b7d89082-e7c0-11e7-ac58-b499baebfeaf">
<topic>MariaDB -- unspecified vulnerability</topic>
<affects>
<package>
<name>mariadb101-client</name>
<range><lt>10.1.30</lt></range>
</package>
<package>
<name>mariadb102-client</name>
<range><lt>10.2.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/library/mariadb-10130-release-notes/">
<p>Fixes for the following security vulnerabilities:
CVE-2017-15365</p>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/library/mariadb-10130-release-notes/</url>
<cvename>CVE-2017-15365</cvename>
</references>
<dates>
<discovery>2017-12-23</discovery>
<entry>2017-12-23</entry>
</dates>
</vuln>
<vuln vid="72fff788-e561-11e7-8097-0800271d4b9c">
<topic>rsync -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rsync</name>
<range><ge>3.1.2</ge><le>3.1.2_7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeriko One reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16548">
<p>The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17433">
<p>The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17434">
<p>The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.debian.org/security/2017/dsa-4068</url>
<cvename>CVE-2017-16548</cvename>
<cvename>CVE-2017-17433</cvename>
<cvename>CVE-2017-17434</cvename>
<freebsdpr>ports/224477</freebsdpr>
</references>
<dates>
<discovery>2017-12-17</discovery>
<entry>2017-12-20</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="dd644964-e10e-11e7-8097-0800271d4b9c">
<topic>ruby -- Command injection vulnerability in Net::FTP</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.2.0,1</ge><lt>2.2.9,1</lt></range>
<range><ge>2.3.0,1</ge><lt>2.3.6,1</lt></range>
<range><ge>2.4.0,1</ge><lt>2.4.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Etienne Stalmans from the Heroku product security team reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/">
<p>There is a command injection vulnerability in Net::FTP bundled with Ruby.</p>
<p><code>Net::FTP#get</code>, <code>getbinaryfile</code>, <code>gettextfile</code>, <code>put</code>, <code>putbinaryfile</code>, and <code>puttextfile</code> use <code>Kernel#open</code> to open a local file. If the <code>localfile</code> argument starts with the pipe character <code>"|"</code>, the command following the pipe character is executed. The default value of <code>localfile</code> is <code>File.basename(remotefile)</code>, so malicious FTP servers could cause arbitrary command execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/</url>
<cvename>CVE-2017-17405</cvename>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="8cf25a29-e063-11e7-9b2c-001e672571bc">
<topic>rubygem-passenger -- arbitrary file read vulnerability</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><ge>5.0.10</ge><lt>5.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Phusion reports:</p>
<blockquote cite="https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/">
<p>The cPanel Security Team discovered a vulnerability in Passenger
that allows users to list the contents of arbitrary files on the
system. CVE-2017-16355 has been assigned to this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/</url>
<cvename>CVE-2017-16355</cvename>
</references>
<dates>
<discovery>2017-10-13</discovery>
<entry>2017-12-18</entry>
</dates>
</vuln>
<vuln vid="08a125f3-e35a-11e7-a293-54e1ad3d6335">
<topic>libXfont -- permission bypass when opening files through symlinks</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.4</lt></range>
</package>
<package>
<name>libXfont2</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the freedesktop.org project reports:</p>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8">
<p>A non-privileged X client can instruct X server running under root
to open any file by creating own directory with "fonts.dir",
"fonts.alias" or any font file being a symbolic link to any other
file in the system. X server will then open it. This can be issue
with special files such as /dev/watchdog.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8</url>
<cvename>CVE-2017-16611</cvename>
</references>
<dates>
<discovery>2017-11-25</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="3b9590a1-e358-11e7-a293-54e1ad3d6335">
<topic>libXfont -- multiple memory leaks</topic>
<affects>
<package>
<name>libXfont</name>
<range><lt>1.5.3</lt></range>
</package>
<package>
<name>libXfont2</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608">
<p>If a pattern contains '?' character, any character in the string
is skipped, even if it is '\0'. The rest of the matching then reads
invalid memory.</p>
</blockquote>
<blockquote cite="https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902906bcd">
<p>Without the checks a malformed PCF file can cause the library to
make atom from random heap memory that was behind the `strings`
buffer. This may crash the process or leak information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608</url>
<url>https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd</url>
<cvename>CVE-2017-13720</cvename>
<cvename>CVE-2017-13722</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="ddecde18-e33b-11e7-a293-54e1ad3d6335">
<topic>libXcursor -- integer overflow that can lead to heap buffer overflow</topic>
<affects>
<package>
<name>libXcursor</name>
<range><lt>1.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The freedesktop.org project reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q4/339">
<p>It is possible to trigger heap overflows due to an integer
overflow while parsing images and a signedness issue while
parsing comments.</p>
<p>The integer overflow occurs because the chosen limit 0x10000
for dimensions is too large for 32 bit systems, because each pixel
takes 4 bytes. Properly chosen values allow an overflow which in
turn will lead to less allocated memory than needed for subsequent
reads.</p>
<p>The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows
the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to
allocate less memory than needed for subsequent reads.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q4/339</url>
<url>https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8</url>
<cvename>CVE-2017-16612</cvename>
</references>
<dates>
<discovery>2017-11-28</discovery>
<entry>2017-12-17</entry>
</dates>
</vuln>
<vuln vid="48cca164-e269-11e7-be51-6599c735afc8">
<topic>global -- gozilla vulnerability</topic>
<affects>
<package>
<name>global</name>
<range><ge>4.8.6</ge><lt>6.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531">
<p>gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching
the program specified by the BROWSER environment variable, which might
allow remote attackers to conduct argument-injection attacks via a crafted
URL.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531</url>
<url>http://lists.gnu.org/archive/html/info-global/2017-12/msg00001.html</url>
<cvename>CVE-2017-17531</cvename>
</references>
<dates>
<discovery>2017-12-11</discovery>
<entry>2017-12-16</entry>
</dates>
</vuln>
<vuln vid="7136e6b7-e1b3-11e7-a4d3-000c292ee6b8">
<topic>jenkins -- Two startup race conditions</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.95</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.89.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Jenkins project reports:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-12-14/">
<p>A race condition during Jenkins startup could result in the wrong
order of execution of commands during initialization.</p>
<p>On Jenkins 2.81 and newer, including LTS 2.89.1, this could in
rare cases (we estimate less than 20% of new instances) result in
failure to initialize the setup wizard on the first startup.</p>
<p>There is a very short window of time after startup during which
Jenkins may no longer show the "Please wait while Jenkins is
getting ready to work" message, but Cross-Site Request Forgery
(CSRF) protection may not yet be effective.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-12-14/</url>
</references>
<dates>
<discovery>2017-12-14</discovery>
<entry>2017-12-15</entry>
</dates>
</vuln>
<vuln vid="bea84a7a-e0c9-11e7-b4f3-11baa0c2df21">
<topic>node.js -- Data Confidentiality/Integrity Vulnerability, December 2017</topic>
<affects>
<package>
<name>node4</name>
<range><lt>4.8.7</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.12.2</lt></range>
</package>
<package>
<name>node8</name>
<range><lt>8.9.3</lt></range>
</package>
<package>
<name>node</name>
<range><lt>9.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/">
<h1>Data Confidentiality/Integrity Vulnerability - CVE-2017-15896</h1>
<p>Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.</p>
<h1>Uninitialized buffer vulnerability - CVE-2017-15897</h1>
<p>Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.</p>
<h1>Also included in OpenSSL update - CVE 2017-3738</h1>
<p>Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/</url>
<cvename>CVE-2017-15896</cvename>
<cvename>CVE-2017-15897</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="e72a8864-e0bc-11e7-b627-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>4.2.0</ge><le>10.0.6</le></range>
<range><ge>10.1.0</ge><le>10.1.4</le></range>
<range><ge>10.2.0</ge><le>10.2.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/">
<h1>User without access to private Wiki can see it on the project page</h1>
<p>Matthias Burtscher reported that it was possible for a user to see a
private Wiki on the project page without having the corresponding
permission.</p>
<h1>E-mail address disclosure through member search fields</h1>
<p>Hugo Geoffroy reported via HackerOne that it was possible to find out the
full e-mail address of any user by brute-forcing the member search
field.</p>
<h1>Groups API leaks private projects</h1>
<p>An internal code review discovered that users were able to list private
projects they had no access to by using the Groups API.</p>
<h1>Cross-Site Scripting (XSS) possible by editing a comment</h1>
<p>Sylvain Heiniger reported via HackerOne that it was possible for
arbitrary JavaScript code to be executed when editing a comment.</p>
<h1>Issue API allows any user to create a new issue even when issues are
restricted or disabled</h1>
<p>Mohammad Hasbini reported that any user could create a new issues in a
project even when issues were disabled or restricted to team members in the
project settings.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-12-08</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="36ef8753-d86f-11e7-ad28-0025908740c2">
<topic>tor -- Use-after-free in onion service v2</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.3.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Torproject.org reports:</p>
<blockquote cite="https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516">
<ul>
<li>TROVE-2017-009: Replay-cache ineffective for v2 onion services</li>
<li>TROVE-2017-010: Remote DoS attack against directory authorities</li>
<li>TROVE-2017-011: An attacker can make Tor ask for a password</li>
<li>TROVE-2017-012: Relays can pick themselves in a circuit path</li>
<li>TROVE-2017-013: Use-after-free in onion service v2</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516</url>
<cvename>CVE-2017-8819</cvename>
</references>
<dates>
<discovery>2017-12-01</discovery>
<entry>2017-12-14</entry>
</dates>
</vuln>
<vuln vid="4a67450a-e044-11e7-accc-001999f8d30b">
<topic>asterisk -- Remote Crash Vulnerability in RTCP Stack</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If a compound RTCP packet is received containing more
than one report (for example a Receiver Report and a
Sender Report) the RTCP stack will incorrectly store
report information outside of allocated memory potentially
causing a crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-012.html</url>
</references>
<dates>
<discovery>2017-12-12</discovery>
<entry>2017-12-13</entry>
</dates>
</vuln>
<vuln vid="76e59f55-4f7a-4887-bcb0-11604004163a">
<topic>libxml2 -- Multiple Issues</topic>
<affects>
<package>
<name>libxml2</name>
<range><le>2.9.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libxml2 developers report:</p>
<p>The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.</p>
<p>A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.</p>
<p>libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.</p>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=775200</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98599</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98556</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98601</url>
<url>http://www.openwall.com/lists/oss-security/2017/05/15/1</url>
<url>http://www.securityfocus.com/bid/98568</url>
<cvename>CVE-2017-8872</cvename>
<cvename>CVE-2017-9047</cvename>
<cvename>CVE-2017-9048</cvename>
<cvename>CVE-2017-9049</cvename>
<cvename>CVE-2017-9050</cvename>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-12-13</entry>
</dates>
</vuln>
<vuln vid="9f7a0f39-ddc0-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_6</lt></range>
<range><ge>10.4</ge><lt>10.4_5</lt></range>
<range><ge>10.3</ge><lt>10.3_26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Invoking SSL_read()/SSL_write() while in an error state
causes data to be passed without being decrypted/encrypted
directly from the SSL/TLS record layer.</p>
<p>In order to exploit this issue an application bug would
have to be present that resulted in a call to
SSL_read()/SSL_write() being issued after having already
received a fatal error. [CVE-2017-3737]</p>
<p>There is an overflow bug in the x86_64 Montgomery
multiplication procedure used in exponentiation with 1024-bit
moduli. This only affects processors that support the AVX2
but not ADX extensions like Intel Haswell (4th generation).
[CVE-2017-3738] This bug only affects FreeBSD 11.x.</p>
<h1>Impact:</h1>
<p>Applications with incorrect error handling may inappropriately
pass unencrypted data. [CVE-2017-3737]</p>
<p>Mishandling of carry propagation will produce incorrect
output, and make it easier for a remote attacker to obtain
sensitive private-key information. No EC algorithms are
affected and analysis suggests that attacks against RSA and
DSA as a result of this defect would be very difficult to
perform and are not believed likely.</p>
<p>Attacks against DH1024 are considered just feasible
(although very difficult) because most of the work necessary
to deduce information about a private key may be performed
offline. The amount of resources required for such an attack
would be very significant and likely only accessible to a
limited number of attackers. However, for an attack on TLS
to be meaningful, the server would have to share the DH1024
private key among multiple clients, which is no longer an
option since CVE-2016-0701. [CVE-2017-3738]</p>
</body>
</description>
<references>
<cvename>CVE-2016-0701</cvename>
<cvename>CVE-2017-3737</cvename>
<cvename>CVE-2017-3738</cvename>
<freebsdsa>SA-17:12.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-12-09</discovery>
<entry>2017-12-10</entry>
</dates>
</vuln>
<vuln vid="4b228e69-22e1-4019-afd0-8aa716d0ec0b">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>wireshark-lite</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>tshark</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
<package>
<name>tshark-lite</name>
<range><ge>2.2.0</ge><le>2.2.10</le></range>
<range><ge>2.4.0</ge><le>2.4.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="https://www.wireshark.org/security/">
<p>wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)</p>
<p>wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)</p>
<p>wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/security/</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-47.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-48.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-49.html</url>
<cvename>CVE-2017-17083</cvename>
<cvename>CVE-2017-17084</cvename>
<cvename>CVE-2017-17085</cvename>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2017-12-10</entry>
</dates>
</vuln>
<vuln vid="3bb451fc-db64-11e7-ac58-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><gt>1.0.2</gt><lt>1.0.2n</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20171207.txt">
<ul><li>Read/write after SSL object in error state (CVE-2017-3737)<br/>
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error
state" mechanism. The intent was that if a fatal error occurred
during a handshake then OpenSSL would move into the error state and
would immediately fail if you attempted to continue the handshake.
This works as designed for the explicit handshake functions
(SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to
a bug it does not work correctly if SSL_read() or SSL_write() is
called directly. In that scenario, if the handshake fails then a
fatal error will be returned in the initial function call. If
SSL_read()/SSL_write() is subsequently called by the application for
the same SSL object then it will succeed and the data is passed
without being decrypted/encrypted directly from the SSL/TLS record
layer.</li>
<li>rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)<br/>
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. No EC
algorithms are affected. Analysis suggests that attacks against
RSA and DSA as a result of this defect would be very difficult to
perform and are not believed likely. Attacks against DH1024 are
considered just feasible, because most of the work necessary to
deduce information about a private key may be performed offline.
The amount of resources required for such an attack would be
significant. However, for an attack on TLS to be meaningful, the
server would have to share the DH1024 private key among multiple
clients, which is no longer an option since CVE-2016-0701.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20171207.txt</url>
<cvename>CVE-2017-3737</cvename>
<cvename>CVE-2017-3738</cvename>
</references>
<dates>
<discovery>2017-12-07</discovery>
<entry>2017-12-07</entry>
</dates>
</vuln>
<vuln vid="9442a811-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSL multiple vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_5</lt></range>
<range><ge>11.0</ge><lt>11.0_16</lt></range>
<range><ge>10.4</ge><lt>10.4_4</lt></range>
<range><ge>10.3</ge><lt>10.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If an X.509 certificate has a malformed IPAddressFamily
extension, OpenSSL could do a one-byte buffer overread.
[CVE-2017-3735]</p>
<p>There is a carry propagating bug in the x86_64 Montgomery
squaring procedure. This only affects processors that support
the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th
generation) and later or AMD Ryzen. [CVE-2017-3736] This
bug only affects FreeBSD 11.x.</p>
<h1>Impact:</h1>
<p>Application using OpenSSL may display erroneous certificate
in text format. [CVE-2017-3735]</p>
<p>Mishandling of carry propagation will produce incorrect
output, and make it easier for a remote attacker to obtain
sensitive private-key information. No EC algorithms are
affected, analysis suggests that attacks against RSA and
DSA as a result of this defect would be very difficult to
perform and are not believed likely.</p>
<p>Attacks against DH are considered just feasible (although
very difficult) because most of the work necessary to deduce
information about a private key may be performed offline.
The amount of resources required for such an attack would
be very significant and likely only accessible to a limited
number of attackers. An attacker would additionally need
online access to an unpatched system using the target private
key in a scenario with persistent DH parameters and a private
key that is shared between multiple clients. [CVE-2017-3736]</p>
</body>
</description>
<references>
<cvename>CVE-2017-3735</cvename>
<cvename>CVE-2017-3736</cvename>
<freebsdsa>SA-17:11.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="759059ac-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- Information leak in kldstat(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_4</lt></range>
<range><ge>11.0</ge><lt>11.0_15</lt></range>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel does not properly clear the memory of the
kld_file_stat structure before filling the data. Since the
structure filled by the kernel is allocated on the kernel
stack and copied to userspace, a leak of information from
the kernel stack is possible.</p>
<h1>Impact:</h1>
<p>Some bytes from the kernel stack can be observed in
userspace.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1088</cvename>
<freebsdsa>SA-17:10.kldstat</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="5b1463dd-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- POSIX shm allows jails to access global namespace</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Named paths are globally scoped, meaning a process located
in one jail can read and modify the content of POSIX shared
memory objects created by a process in another jail or the
host system.</p>
<h1>Impact:</h1>
<p>A malicious user that has access to a jailed system is
able to abuse shared memory by injecting malicious content
in the shared memory region. This memory region might be
executed by applications trusting the shared memory, like
Squid.</p>
<p>This issue could lead to a Denial of Service or local
privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1087</cvename>
<freebsdsa>SA-17:09.shm</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="34a3f9b5-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.1</ge><lt>11.1_4</lt></range>
<range><ge>11.0</ge><lt>11.0_15</lt></range>
<range><ge>10.4</ge><lt>10.4_3</lt></range>
<range><ge>10.3</ge><lt>10.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Not all information in the struct ptrace_lwpinfo is
relevant for the state of any thread, and the kernel does
not fill the irrelevant bytes or short strings. Since the
structure filled by the kernel is allocated on the kernel
stack and copied to userspace, a leak of information of the
kernel stack of the thread is possible from the debugger.</p>
<h1>Impact:</h1>
<p>Some bytes from the kernel stack of the thread using
ptrace(PT_LWPINFO) call can be observed in userspace.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1086</cvename>
<freebsdsa>SA-17:08.ptrace</freebsdsa>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="1f8de723-dab3-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- WPA2 protocol vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_2</lt></range>
<range><ge>11.0</ge><lt>11.0_13</lt></range>
<range><ge>10.4</ge><lt>10.4_1</lt></range>
<range><ge>10.3</ge><lt>10.3_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A vulnerability was found in how a number of implementations
can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK,
or IGTK) by replaying a specific frame that is used to
manage the keys.</p>
<h1>Impact:</h1>
<p>Such reinstallation of the encryption key can result in
two different types of vulnerabilities: disabling replay
protection and significantly reducing the security of
encryption to the point of allowing frames to be decrypted
or some parts of the keys to be determined by an attacker
depending on which cipher is used.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1307</cvename>
<cvename>CVE-2017-1308</cvename>
<freebsdsa>SA-17:07.wpa</freebsdsa>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-12-06</entry>
</dates>
</vuln>
<vuln vid="b7e23050-2d5d-4e61-9b48-62e89db222ca">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><ge>57.0,1</ge><lt>57.0.1,1</lt></range>
<range><lt>56.0.2_11,1</lt></range>
</package>
<package>
<name>waterfox</name>
<range><lt>56.0.s20171130</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.5.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.5.1,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-27/">
<p>CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data</p>
<p>CVE-2017-7844: Visited history information leak through SVG image</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7843</cvename>
<cvename>CVE-2017-7844</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-27/</url>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-05</entry>
</dates>
</vuln>
<vuln vid="17133e7e-d764-11e7-b5af-a4badb2f4699">
<topic>varnish -- information disclosure vulnerability</topic>
<affects>
<package>
<name>varnish4</name>
<range><lt>4.1.9</lt></range>
</package>
<package>
<name>varnish5</name>
<range><lt>5.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Varnish reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00002.html">
<p>A wrong if statement in the varnishd source code means that
synthetic objects in stevedores which over-allocate, may leak up to page
size of data from a malloc(3) memory allocation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00002.html</url>
<cvename>CVE-2017-8807</cvename>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-12-02</entry>
</dates>
</vuln>
<vuln vid="addad6de-d752-11e7-99bf-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mybb Team reports:</p>
<blockquote cite="https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/">
<p>High risk: Language file headers RCE</p>
<p>Low risk: Language Pack Properties XSS</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-27</discovery>
<entry>2017-12-02</entry>
</dates>
</vuln>
<vuln vid="a2589511-d6ba-11e7-88dd-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.9.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/">
<p>Use a properly generated hash for the newbloguser key instead of a determinate substring.</p>
<p>Add escaping to the language attributes used on html elements.</p>
<p>Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.</p>
<p>Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-12-01</entry>
</dates>
</vuln>
<vuln vid="e91cf90c-d6dd-11e7-9d10-001999f8d30b">
<topic>asterisk -- DOS Vulnerability in Asterisk chan_skinny</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="https://www.asterisk.org/downloads/security-advisories">
<p>If the chan_skinny (AKA SCCP protocol) channel driver
is flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests
of any kind.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-013.html</url>
<cvename>CVE-2017-17090</cvename>
</references>
<dates>
<discovery>2017-11-30</discovery>
<entry>2017-12-01</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="75dd622c-d5fd-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- remote DoS attack in BDAT processing</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.88</ge><lt>4.89.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim developers team reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
<cvename>CVE-2017-16944</cvename>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-30</entry>
</dates>
</vuln>
<vuln vid="a66f9be2-d519-11e7-9866-c85b763a2f96">
<topic>xrdp -- local user can cause a denial of service</topic>
<affects>
<package>
<name>xrdp-devel</name>
<range><le>0.9.3,1</le></range>
<range><gt>0.9.3_1,1</gt><le>0.9.4,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xrdp reports:</p>
<blockquote cite="https://github.com/neutrinolabs/xrdp/pull/958">
<p>The scp_v0s_accept function in the session manager uses an untrusted integer as a write length,
which allows local users to cause a denial of service (buffer overflow and application crash)
or possibly have unspecified other impact via a crafted input stream.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16927</cvename>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-29</entry>
</dates>
</vuln>
<vuln vid="301a01b7-d50e-11e7-ac58-b499baebfeaf">
<topic>cURL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.21.0</ge><lt>7.57.0</lt></range>
</package>
<package>
<name>linux-c7-curl</name>
<range><ge>7.21.0</ge><lt>7.29.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/changes.html">
<ul><li>NTLM buffer overflow via integer overflow
(CVE-2017-8816)<br/>libcurl contains a buffer overrun flaw
in the NTLM authentication code.
The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up
the lengths of the user name + password (= SUM) and multiplies
the sum by two (= SIZE) to figure out how large storage to
allocate from the heap.</li>
<li>FTP wildcard out of bounds read (CVE-2017-8817)<br/>
libcurl contains a read out of bounds flaw in the FTP wildcard
function.
libcurl's FTP wildcard matching feature, which is enabled with
the CURLOPT_WILDCARDMATCH option can use a built-in wildcard
function or a user provided one. The built-in wildcard function
has a flaw that makes it not detect the end of the pattern
string if it ends with an open bracket ([) but instead it will
continue reading the heap beyond the end of the URL buffer that
holds the wildcard.</li>
<li>SSL out of buffer access (CVE-2017-8818)<br/>
libcurl contains an out boundary access flaw in SSL related code.
When allocating memory for a connection (the internal struct
called connectdata), a certain amount of memory is allocated at
the end of the struct to be used for SSL related structs. Those
structs are used by the particular SSL library libcurl is built
to use. The application can also tell libcurl which specific SSL
library to use if it was built to support more than one.
</li></ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/changes.html</url>
<cvename>CVE-2017-8816</cvename>
<cvename>CVE-2017-8817</cvename>
<cvename>CVE-2017-8818</cvename>
</references>
<dates>
<discovery>2017-11-29</discovery>
<entry>2017-11-29</entry>
<modified>2017-12-11</modified>
</dates>
</vuln>
<vuln vid="0d369972-d4ba-11e7-bfca-005056925db4">
<topic>borgbackup -- remote users can override repository restrictions</topic>
<affects>
<package>
<name>py34-borgbackup</name>
<name>py35-borgbackup</name>
<name>py36-borgbackup</name>
<range><ge>1.1.0</ge><lt>1.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BorgBackup reports:</p>
<blockquote cite="https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27">
<p>Incorrect implementation of access controls allows remote users to
override repository restrictions in Borg servers. A user able to
access a remote Borg SSH server is able to circumvent access controls
post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases
1.0.x are NOT affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15914</cvename>
<url>https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27</url>
</references>
<dates>
<discovery>2017-11-27</discovery>
<entry>2017-11-29</entry>
</dates>
</vuln>
<vuln vid="6056bf68-f570-4e70-b740-b9f606971283">
<topic>palemoon -- multiple vulnerabilities</topic>
<affects>
<package>
<name>palemoon</name>
<range><lt>27.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pale Moon reports:</p>
<blockquote cite="http://www.palemoon.org/releasenotes.shtml">
<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7832</cvename>
<cvename>CVE-2017-7835</cvename>
<cvename>CVE-2017-7840</cvename>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-28</entry>
</dates>
</vuln>
<vuln vid="68b29058-d348-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- remote code execution, deny of service in BDAT</topic>
<affects>
<package>
<name>exim</name>
<range><ge>4.88</ge><lt>4.89_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Exim team reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=2199">
<p>The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=2199</url>
</references>
<dates>
<discovery>2017-11-23</discovery>
<entry>2017-11-27</entry>
</dates>
</vuln>
<vuln vid="7761288c-d148-11e7-87e5-00e04c1ea73d">
<topic>mybb -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mybb</name>
<range><lt>1.8.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>myBB Team reports:</p>
<blockquote cite="https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/">
<p>High risk: Installer RCE on configuration file write</p>
<p>High risk: Language file headers RCE</p>
<p>Medium risk: Installer XSS</p>
<p>Medium risk: Mod CP Edit Profile XSS</p>
<p>Low risk: Insufficient moderator permission check in delayed moderation tools</p>
<p>Low risk: Announcements HTML filter bypass</p>
<p>Low risk: Language Pack Properties XSS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/</url>
</references>
<dates>
<discovery>2017-11-07</discovery>
<entry>2017-11-24</entry>
</dates>
</vuln>
<vuln vid="50127e44-7b88-4ade-8e12-5d57320823f1">
<topic>salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<range><lt>2016.11.8</lt></range>
<range><ge>2017.7.0</ge><lt>2017.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html">
<p>Directory traversal vulnerability in minion id validation in SaltStack.
Allows remote minions with incorrect credentials to authenticate to a
master via a crafted minion ID. Credit for discovering the security flaw
goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists
because of an incomplete fix for CVE-2017-12791.</p>
<p>Remote Denial of Service with a specially crafted authentication request.
Credit for discovering the security flaw goes to: Julian Brost
(julian@0x4a42.net)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14695</cvename>
<cvename>CVE-2017-14696</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html</url>
<url>https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.8.html</url>
<url>https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d</url>
<url>https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b</url>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-11-23</entry>
</dates>
</vuln>
<vuln vid="ef3423e4-d056-11e7-a52c-002590263bf5">
<topic>codeigniter -- input validation bypass</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Security: Fixed a potential object injection in Cache Library 'apc'
driver when save() is used with $raw = TRUE.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-09-25</discovery>
<entry>2017-11-23</entry>
</dates>
</vuln>
<vuln vid="288f7cee-ced6-11e7-8ae9-0050569f0b83">
<topic>procmail -- Heap-based buffer overflow</topic>
<affects>
<package>
<name>procmail</name>
<range><lt>3.22_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://www.debian.org/security/2017/dsa-4041">
<p>A remote attacker could use a flaw to cause formail to crash,
resulting in a denial of service or data loss.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16844</cvename>
<url>https://www.debian.org/security/2017/dsa-4041</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511</url>
</references>
<dates>
<discovery>2017-11-16</discovery>
<entry>2017-11-21</entry>
<modified>2017-12-08</modified>
</dates>
</vuln>
<vuln vid="bf266183-cec7-11e7-af2d-2047478f2f70">
<topic>frr -- BGP Mishandled attribute length on Error</topic>
<affects>
<package>
<name>frr</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FRR reports:</p>
<blockquote cite="https://frrouting.org/community/security/cve-2017-15865.html">
<p>BGP Mishandled attribute length on Error</p>
<p>A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE
packet can leak information from the BGP daemon and cause a denial of
service by crashing the daemon.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15865</cvename>
<url>https://frrouting.org/community/security/cve-2017-15865.html</url>
</references>
<dates>
<discovery>2017-11-08</discovery>
<entry>2017-11-21</entry>
</dates>
</vuln>
<vuln vid="db570002-ce06-11e7-804e-c85b763a2f96">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.1.28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cacti reports:</p>
<blockquote cite="https://www.cacti.net/release_notes.php?version=1.1.28">
<p>Changelog</p>
<p>issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions</p>
<p>issue#1066: CVE-2017-16660 in remote_agent.php logging function</p>
<p>issue#1066: CVE-2017-16661 in view log file</p>
<p>issue#1071: CVE-2017-16785 in global_session.php Reflection XSS</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-16641</cvename>
<cvename>CVE-2017-16660</cvename>
<cvename>CVE-2017-16661</cvename>
<cvename>CVE-2017-16785</cvename>
<url>https://sourceforge.net/p/cacti/mailman/message/36122745/</url>
</references>
<dates>
<discovery>2017-11-01</discovery>
<entry>2017-11-20</entry>
</dates>
</vuln>
<vuln vid="298829e2-ccce-11e7-92e4-000c29649f92">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki127</name>
<range><lt>1.27.3</lt></range>
</package>
<package>
<name>mediawiki128</name>
<range><lt>1.28.2</lt></range>
</package>
<package>
<name>mediawiki129</name>
<range><lt>1.29.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html">
<p>security fixes:</p>
<p>T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.</p>
<p>T165846: BotPasswords doesn't throttle login attempts.</p>
<p>T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.</p>
<p>T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.</p>
<p>T176247: It's possible to mangle HTML via raw message parameter expansion.</p>
<p>T125163: id attribute on headlines allow raw.</p>
<p>T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.</p>
<p>T119158: Language converter: unsafe attribute injection via glossary rules.</p>
<p>T180488: api.log contains passwords in plaintext wasn't correctly fixed.</p>
<p>T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8808</cvename>
<cvename>CVE-2017-8809</cvename>
<cvename>CVE-2017-8810</cvename>
<cvename>CVE-2017-8811</cvename>
<cvename>CVE-2017-8812</cvename>
<cvename>CVE-2017-8814</cvename>
<cvename>CVE-2017-8815</cvename>
<cvename>CVE-2017-0361</cvename>
<cvename>CVE-2017-9841</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-19</entry>
</dates>
</vuln>
<vuln vid="52f10525-caff-11e7-b590-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.187</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-33.html">
<ul>
<li>These updates resolve out-of-bounds read vulnerabilities that
could lead to remote code execution (CVE-2017-3112,
CVE-2017-3114, CVE-2017-11213).</li>
<li>These updates resolve use after free vulnerabilities that
could lead to remote code execution (CVE-2017-11215,
CVE-2017-11225).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3112</cvename>
<cvename>CVE-2017-3114</cvename>
<cvename>CVE-2017-11213</cvename>
<cvename>CVE-2017-11215</cvename>
<cvename>CVE-2017-11225</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-33.html</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-16</entry>
</dates>
</vuln>
<vuln vid="b4b7ec7d-ca27-11e7-a12d-6cc21735f730">
<topic>shibboleth2-sp -- "Dynamic" metadata provider plugin issue</topic>
<affects>
<package>
<name>shibboleth2-sp</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Internet2 community reports:</p>
<blockquote cite="http://shibboleth.internet2.edu/secadv/secadv_20171115.txt">
<p>
The Shibboleth Service Provider software includes a MetadataProvider
plugin with the plugin type "Dynamic" to obtain metadata on demand
from a query server, in place of the more typical mode of
downloading aggregates separately containing all of the metadata to
load.
</p><p>
All the plugin types rely on MetadataFilter plugins to perform
critical security checks such as signature verification, enforcement
of validity periods, and other checks specific to deployments.
</p><p>
Due to a coding error, the "Dynamic" plugin fails to configure
itself with the filters provided to it and thus omits whatever
checks they are intended to perform, which will typically leave
deployments vulnerable to active attacks involving the substitution
of metadata if the network path to the query service is
compromised.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://shibboleth.internet2.edu/secadv/secadv_20171115.txt</url>
</references>
<dates>
<discovery>2017-11-15</discovery>
<entry>2017-11-15</entry>
</dates>
</vuln>
<vuln vid="f78eac48-c3d1-4666-8de5-63ceea25a578">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<!-- 56.0.2_10,1 unlike 57.0,1 has CVE-2017-7827 partially unfixed:
bug 1384615, 1386490, 1393840, 1403716 -->
<range><lt>56.0.2_10,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.2</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/">
<p>CVE-2017-7828: Use-after-free of PressShell while restyling layout</p>
<p>CVE-2017-7830: Cross-origin URL information leak through Resource Timing API</p>
<p>CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects</p>
<p>CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers</p>
<p>CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters</p>
<p>CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections</p>
<p>CVE-2017-7835: Mixed content blocking incorrectly applies with redirects</p>
<p>CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X</p>
<p>CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies</p>
<p>CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN</p>
<p>CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism</p>
<p>CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags</p>
<p>CVE-2017-7842: Referrer Policy is not always respected for <link> elements</p>
<p>CVE-2017-7827: Memory safety bugs fixed in Firefox 57</p>
<p>CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7826</cvename>
<cvename>CVE-2017-7827</cvename>
<cvename>CVE-2017-7828</cvename>
<cvename>CVE-2017-7830</cvename>
<cvename>CVE-2017-7831</cvename>
<cvename>CVE-2017-7832</cvename>
<cvename>CVE-2017-7833</cvename>
<cvename>CVE-2017-7834</cvename>
<cvename>CVE-2017-7835</cvename>
<cvename>CVE-2017-7836</cvename>
<cvename>CVE-2017-7837</cvename>
<cvename>CVE-2017-7838</cvename>
<cvename>CVE-2017-7839</cvename>
<cvename>CVE-2017-7840</cvename>
<cvename>CVE-2017-7842</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-25/</url>
</references>
<dates>
<discovery>2017-11-14</discovery>
<entry>2017-11-14</entry>
</dates>
</vuln>
<vuln vid="27b38d85-c891-11e7-a7bd-cd1209e563f2">
<topic>rubygem-geminabox -- XSS vulnerabilities</topic>
<affects>
<package>
<name>rubygem-geminabox</name>
<range><lt>0.13.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-16792">
<p>Stored cross-site scripting (XSS) vulnerability in "geminabox"
(Gem in a Box) before 0.13.10 allows attackers to inject arbitrary
web script via the "homepage" value of a ".gemspec" file, related
to views/gem.erb and views/index.erb.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-16792</url>
<cvename>CVE-2017-16792</cvename>
</references>
<dates>
<discovery>2017-11-13</discovery>
<entry>2017-11-13</entry>
</dates>
</vuln>
<vuln vid="795ccee1-c7ed-11e7-ad7d-001e2a3f778d">
<topic>konversation -- crash in IRC message parsing</topic>
<affects>
<package>
<name>konversation</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KDE reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20171112-1.txt">
<p>Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15923</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15923</url>
<url>https://www.kde.org/info/security/advisory-20171112-1.txt</url>
</references>
<dates>
<discovery>2017-10-27</discovery>
<entry>2017-11-12</entry>
</dates>
</vuln>
<vuln vid="f622608c-c53c-11e7-a633-009c02a2ab30">
<topic>roundcube -- file disclosure vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.3.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16651">
<p>Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before
1.3.3 allows unauthorized access to arbitrary files on the host's filesystem,
including configuration files, as exploited in the wild in November 2017.
The attacker must be able to authenticate at the target system with a valid
username/password as the attack requires an active session.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/roundcube/roundcubemail/issues/6026</url>
<url>https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10</url>
<cvename>CVE-2017-16651</cvename>
<freebsdpr>ports/223557</freebsdpr>
</references>
<dates>
<discovery>2017-11-06</discovery>
<entry>2017-11-11</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="f8e72cd4-c66a-11e7-bb17-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.89</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC.
Reported by Ned Williamson on 2017-10-24</li>
<li>[776677] High CVE-2017-15399: Use after free in V8. Reported by
Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15398</cvename>
<cvename>CVE-2017-15399</cvename>
<url>https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-11-06</discovery>
<entry>2017-11-10</entry>
</dates>
</vuln>
<vuln vid="1f02af5d-c566-11e7-a12d-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.24</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.20</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.15</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.10</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.6</lt></range>
</package>
<package>
<name>postgresql10-server</name>
<range><ge>10.0</ge><lt>10.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1801/">
<ul>
<li>CVE-2017-15098: Memory disclosure in JSON functions</li>
<li>CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to
enforce SELECT privileges</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15099</cvename>
<cvename>CVE-2017-15098</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-11-09</entry>
</dates>
</vuln>
<vuln vid="1c2a9d76-9d98-43c3-8f5d-8c059b104d99">
<topic>jenkins -- multiple issues</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.89</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.73.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/99574">
<p>Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.</p>
<p>Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-11-08/</url>
</references>
<dates>
<discovery>2017-11-08</discovery>
<entry>2017-11-09</entry>
</dates>
</vuln>
<vuln vid="be261737-c535-11e7-8da5-001999f8d30b">
<topic>asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.5.0</ge><lt>13.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A memory leak occurs when an Asterisk pjsip session
object is created and that call gets rejected before the
session itself is fully established. When this happens
the session object never gets destroyed. This then leads
to file descriptors and RTP ports being leaked as well.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-011.html</url>
<cvename>CVE-2017-16672</cvename>
</references>
<dates>
<discovery>2017-10-15</discovery>
<entry>2017-11-09</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="ab04cb0b-c533-11e7-8da5-001999f8d30b">
<topic>asterisk -- Buffer overflow in CDR's set user</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>No size checking is done when setting the user field
for Party B on a CDR. Thus, it is possible for someone
to use an arbitrarily large string and write past the end
of the user field storage buffer. The earlier AST-2017-001
advisory for the CDR user field overflow was for the Party
A buffer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-010.html</url>
<cvename>CVE-2017-16671</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-11-09</entry>
<modified>2017-12-13</modified>
</dates>
</vuln>
<vuln vid="19b052c9-c533-11e7-8da5-001999f8d30b">
<topic>asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.18.1</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.7.1</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>By carefully crafting invalid values in the Cseq and
the Via header port, pjprojects packet parsing code can
create strings larger than the buffer allocated to hold
them. This will usually cause Asterisk to crash immediately.
The packets do not have to be authenticated.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-009.html</url>
</references>
<dates>
<discovery>2017-10-05</discovery>
<entry>2017-11-09</entry>
<modified>2017-11-15</modified>
</dates>
</vuln>
<vuln vid="f40f07aa-c00f-11e7-ac58-b499baebfeaf">
<topic>OpenSSL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2m,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20171102.txt">
<p>bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)<br/>
Severity: Moderate<br/>
There is a carry propagating bug in the x86_64 Montgomery squaring
procedure. No EC algorithms are affected. Analysis suggests that
attacks against RSA and DSA as a result of this defect would be
very difficult to perform and are not believed likely. Attacks
against DH are considered just feasible (although very difficult)
because most of the work necessary to deduce information about a
private key may be performed offline.</p>
<p>Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)<br/>
Severity: Low<br/>
This issue was previously announced in security advisory
https://www.openssl.org/news/secadv/20170828.txt, but the fix has
not previously been included in a release due to its low severity.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20171102.txt</url>
<cvename>CVE-2017-3735</cvename>
<cvename>CVE-2017-3736</cvename>
</references>
<dates>
<discovery>2017-11-02</discovery>
<entry>2017-11-02</entry>
</dates>
</vuln>
<vuln vid="cee3d12f-bf41-11e7-bced-00e04c1ea73d">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.8.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers reports:</p>
<blockquote cite="https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/">
<p>WordPress versions 4.8.2 and earlier are affected by an issue
where $wpdb->prepare() can create unexpected and unsafe queries
leading to potential SQL injection (SQLi). WordPress core is not
directly vulnerable to this issue, but we've added hardening to
prevent plugins and themes from accidentally causing a vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/</url>
</references>
<dates>
<discovery>2017-10-31</discovery>
<entry>2017-11-01</entry>
</dates>
</vuln>
<vuln vid="4684a426-774d-4390-aa19-b8dd481c4c94">
<topic>wireshark -- multiple security issues</topic>
<affects>
<package>
<name>wireshark</name>
<range><ge>2.2.0</ge><le>2.2.9</le></range>
<range><ge>2.4.0</ge><le>2.4.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wireshark developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/101228">
<p>In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.</p>
<p>In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.</p>
<p>In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.</p>
<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.</p>
<p>In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/101227</url>
<url>http://www.securityfocus.com/bid/101228</url>
<url>http://www.securityfocus.com/bid/101229</url>
<url>http://www.securityfocus.com/bid/101235</url>
<url>http://www.securityfocus.com/bid/101240</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077</url>
<url>https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080</url>
<url>https://code.wireshark.org/review/23470</url>
<url>https://code.wireshark.org/review/23537</url>
<url>https://code.wireshark.org/review/23591</url>
<url>https://code.wireshark.org/review/23635</url>
<url>https://code.wireshark.org/review/23663</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b</url>
<url>https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-42.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-43.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-44.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-45.html</url>
<url>https://www.wireshark.org/security/wnpa-sec-2017-46.html</url>
<cvename>CVE-2017-15189</cvename>
<cvename>CVE-2017-15190</cvename>
<cvename>CVE-2017-15191</cvename>
<cvename>CVE-2017-15192</cvename>
<cvename>CVE-2017-15193</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-30</entry>
</dates>
</vuln>
<vuln vid="de7a2b32-bd7d-11e7-b627-d43d7e971a1b">
<topic>PHP -- denial of service attack</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.32</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.25</lt></range>
</package>
<package>
<name>php71</name>
<range><lt>7.1.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-3">
<p>The PHP development team announces the immediate availability of PHP
5.6.32. This is a security release. Several security bugs were fixed in this
release. All PHP 5.6 users are encouraged to upgrade to this version.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-26-1">
<p>The PHP development team announces the immediate availability of PHP
7.0.25. This is a security release. Several security bugs were fixed in this
release. All PHP 7.0 users are encouraged to upgrade to this version.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-10-27-1">
<p>The PHP development team announces the immediate availability of PHP
7.1.11. This is a bugfix release, with several bug fixes included. All PHP
7.1 users are encouraged to upgrade to this version. </p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2017.php#id2017-10-26-3</url>
<url>http://php.net/archive/2017.php#id2017-10-26-1</url>
<url>http://php.net/archive/2017.php#id2017-10-27-1</url>
<cvename>CVE-2016-1283</cvename>
</references>
<dates>
<discovery>2017-10-26</discovery>
<entry>2017-10-30</entry>
<modified>2017-11-14</modified>
</dates>
</vuln>
<vuln vid="3cd46257-bbc5-11e7-a3bc-e8e0b747a45a">
<topic>chromium -- Stack overflow in V8</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[770452] High CVE-2017-15396: Stack overflow in V8. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
<li>[770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by
Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-15396</cvename>
<cvename>CVE-2017-15406</cvename>
<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html</url>
</references>
<dates>
<discovery>2017-10-26</discovery>
<entry>2017-10-28</entry>
<modified>2018-01-23</modified>
</dates>
</vuln>
<vuln vid="d77ceb8c-bb13-11e7-8357-3065ec6f3643">
<topic>wget -- Heap overflow in HTTP protocol handling</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
<p>Wget contains two vulnerabilities, a stack overflow and a heap
overflow, in the handling of HTTP chunked encoding. By convincing
a user to download a specific link over HTTP, an attacker may be
able to execute arbitrary code with the privileges of the user.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba</url>
<cvename>CVE-2017-13090</cvename>
</references>
<dates>
<discovery>2017-10-20</discovery>
<entry>2017-10-27</entry>
</dates>
</vuln>
<vuln vid="09849e71-bb12-11e7-8357-3065ec6f3643">
<topic>wget -- Stack overflow in HTTP protocol handling</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.19.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Antti Levomäki, Christian Jalio, Joonas Pihlaja:</p>
<blockquote cite="https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html">
<p>Wget contains two vulnerabilities, a stack overflow and a heap
overflow, in the handling of HTTP chunked encoding. By convincing
a user to download a specific link over HTTP, an attacker may be
able to execute arbitrary code with the privileges of the user.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f</url>
<cvename>CVE-2017-13089</cvename>
</references>
<dates>
<discovery>2017-10-20</discovery>
<entry>2017-10-27</entry>
</dates>
</vuln>
<vuln vid="d7d1cc94-b971-11e7-af3a-f1035dd0da62">
<topic>Node.js -- remote DOS security vulnerability</topic>
<affects>
<package>
<name>node</name>
<range><lt>8.8.0</lt></range>
</package>
<package>
<name>node6</name>
<range><ge>6.10.2</ge><lt>6.11.5</lt></range>
</package>
<package>
<name>node4</name>
<range><ge>4.8.2</ge><lt>4.8.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js reports:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/oct-2017-dos/">
<p>Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/oct-2017-dos/</url>
<cvename>CVE-2017-14919</cvename>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-25</entry>
</dates>
</vuln>
<vuln vid="418c172b-b96f-11e7-b627-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>2.8.0</ge><le>9.4.6</le></range>
<range><ge>9.5.0</ge><le>9.5.8</le></range>
<range><ge>10.0.0</ge><le>10.0.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/">
<h1>Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization
filter</h1>
<p>Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS)
vulnerability in the GitLab markdown sanitization filter. The sanitization
filter was not properly stripping invalid characters from URL schemes and
was therefore vulnerable to persistent XSS attacks anywhere Markdown was
supported.</p>
<h1>Cross-Site Scripting (XSS) vulnerability in search bar</h1>
<p>Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the
issue search bar. Usernames were not being properly HTML escaped inside the
author filter would could allow arbitrary script execution.</p>
<h1>Open redirect in repository git redirects</h1>
<p>Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an
open redirect vulnerability when redirecting requests for repository names
that include the git extension. GitLab was not properly removing dangerous
parameters from the params field before redirecting which could allow an
attacker to redirect users to arbitrary hosts.</p>
<h1>Username changes could leave repositories behind</h1>
<p>An internal code review discovered that a bug in the code that moves
repositories during a username change could potentially leave behind
projects, allowing an attacker who knows the previous username to
potentially steal the contents of repositories on instances that are not
configured with hashed namespaces.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-25</entry>
</dates>
</vuln>
<vuln vid="27229c67-b8ff-11e7-9f79-ac9e174be3af">
<topic>Apache OpenOffice -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.4</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1810071_1,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Openofffice project reports:</p>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-3157.html">
<h1>CVE-2017-3157: Arbitrary file disclosure in Calc and Writer</h1>
<p>By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.</p>
<p>The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-9806.html">
<h1>CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor</h1>
<p>A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12607.html">
<h1>CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter</h1>
<p>A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
<blockquote cite="https://www.openoffice.org/security/cves/CVE-2017-12608.html">
<h1>CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles</h1>
<p>A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openoffice.org/security/cves/CVE-2017-3157.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-9806.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-12607.html</url>
<url>https://www.openoffice.org/security/cves/CVE-2017-12608.html</url>
<cvename>CVE-2017-3157</cvename>
<cvename>CVE-2017-9806</cvename>
<cvename>CVE-2017-12607</cvename>
<cvename>CVE-2017-12608</cvename>
</references>
<dates>
<discovery>2016-09-11</discovery>
<entry>2017-10-24</entry>
<modified>2017-10-26</modified>
</dates>
</vuln>
<vuln vid="143ec3d6-b7cf-11e7-ac58-b499baebfeaf">
<topic>cURL -- out of bounds read</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.20</ge><lt>7.56.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20171023.html">
<p>libcurl contains a buffer overrun flaw in the IMAP handler.<br/>
An IMAP FETCH response line indicates the size of the returned data,
in number of bytes. When that response says the data is zero bytes,
libcurl would pass on that (non-existing) data with a pointer and
the size (zero) to the deliver-data function.<br/>
libcurl's deliver-data function treats zero as a magic number and
invokes strlen() on the data to figure out the length. The strlen()
is called on a heap based buffer that might not be zero terminated
so libcurl might read beyond the end of it into whatever memory lies
after (or just crash) and then deliver that to the application as if
it was actually downloaded.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20171023.html</url>
<cvename>CVE-2017-1000257</cvename>
</references>
<dates>
<discovery>2017-10-23</discovery>
<entry>2017-10-23</entry>
</dates>
</vuln>
<vuln vid="10c0fabc-b5da-11e7-816e-00bd5d1fff09">
<topic>h2o -- DoS in workers</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frederik Deweerdt reports:</p>
<blockquote cite="https://github.com/h2o/h2o/releases/tag/v2.2.3">
<p>Multiple Denial-of-Service vulnerabilities exist in h2o workers -
see references for full details.</p>
<p>CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.</p>
<p>CVE-2017-10869: The stack may overflow when proxying huge requests.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-10868</cvename>
<cvename>CVE-2017-10869</cvename>
<url>https://github.com/h2o/h2o/issues/1459</url>
<url>https://github.com/h2o/h2o/issues/1460</url>
<url>https://github.com/h2o/h2o/releases/tag/v2.2.3</url>
</references>
<dates>
<discovery>2017-07-19</discovery>
<entry>2017-10-17</entry>
</dates>
</vuln>
<vuln vid="85e2c7eb-b74b-11e7-8546-5cf3fcfdd1f1">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_10.txt">
<p>When installing themes with unterminated colour formatting
sequences, Irssi may access data beyond the end of the string.</p>
<p>While waiting for the channel synchronisation, Irssi may
incorrectly fail to remove destroyed channels from the query list,
resulting in use after free conditions when updating the state later
on.</p>
<p>Certain incorrectly formatted DCC CTCP messages could cause NULL
pointer dereference.</p>
<p>Overlong nicks or targets may result in a NULL pointer dereference
while splitting the message.</p>
<p>In certain cases Irssi may fail to verify that a Safe channel ID
is long enough, causing reads beyond the end of the string.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_10.txt</url>
<cvename>CVE-2017-15721</cvename>
<cvename>CVE-2017-15722</cvename>
<cvename>CVE-2017-15723</cvename>
<cvename>CVE-2017-15227</cvename>
<cvename>CVE-2017-15228</cvename>
<freebsdpr>ports/223169</freebsdpr>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-22</entry>
<modified>2017-12-31</modified>
</dates>
</vuln>
<vuln vid="a692bffe-b6ad-11e7-a1c2-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>62.0.3202.62</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html">
<p>35 security fixes in this release, including:</p>
<ul>
<li>[762930] High CVE-2017-5124: UXSS with MHTML. Reported by
Anonymous on 2017-09-07</li>
<li>[749147] High CVE-2017-5125: Heap overflow in Skia. Reported by
Anonymous on 2017-07-26</li>
<li>[760455] High CVE-2017-5126: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-08-30</li>
<li>[765384] High CVE-2017-5127: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-09-14</li>
<li>[765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by
Omair on 2017-09-14</li>
<li>[765495] High CVE-2017-5129: Use after free in WebAudio. Reported by
Omair on 2017-09-15</li>
<li>[718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by
Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05</li>
<li>[722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by
Pranjal Jumde on 2017-05-14</li>
<li>[744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by
Anonymous on 2017-07-16</li>
<li>[762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by
Aleksandar Nikolic of Cisco Talos on 2017-09-05</li>
<li>[752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03</li>
<li>[756040] Medium CVE-2017-15387: Content security bypass. Reported by
Jun Kokatsu on 2017-08-16</li>
<li>[756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by
Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17</li>
<li>[739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by
xisigr of Tencent's Xuanwu Lab on 2017-07-06</li>
<li>[750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by
Haosheng Wang on 2017-07-28</li>
<li>[598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by
Joao Lucas Melo Brasio on 2016-03-28</li>
<li>[714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration.
Reported by Xiaoyin Liu on 2017-04-22</li>
<li>[732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by
Svyat Mitin on 2017-06-13</li>
<li>[745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by
Sam on 2017-07-18</li>
<li>[759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by
Johannes Bergman on 2017-08-28</li>
<li>[775550] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5124</cvename>
<cvename>CVE-2017-5125</cvename>
<cvename>CVE-2017-5126</cvename>
<cvename>CVE-2017-5127</cvename>
<cvename>CVE-2017-5128</cvename>
<cvename>CVE-2017-5129</cvename>
<cvename>CVE-2017-5132</cvename>
<cvename>CVE-2017-5130</cvename>
<cvename>CVE-2017-5131</cvename>
<cvename>CVE-2017-5133</cvename>
<cvename>CVE-2017-15386</cvename>
<cvename>CVE-2017-15387</cvename>
<cvename>CVE-2017-15388</cvename>
<cvename>CVE-2017-15389</cvename>
<cvename>CVE-2017-15390</cvename>
<cvename>CVE-2017-15391</cvename>
<cvename>CVE-2017-15392</cvename>
<cvename>CVE-2017-15393</cvename>
<cvename>CVE-2017-15394</cvename>
<cvename>CVE-2017-15395</cvename>
<url>https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-10-17</discovery>
<entry>2017-10-21</entry>
</dates>
</vuln>
<vuln vid="e1cb9dc9-daa9-44db-adde-e94d900e2f7f">
<topic>cacti -- Cross Site Scripting issue</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>1.1.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cacti developers report:</p>
<blockquote cite=" https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd">
<p>The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securitytracker.com/id/1039569</url>
<url>https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd</url>
<url>https://github.com/Cacti/cacti/issues/1010</url>
<cvename>CVE-2017-15194</cvename>
</references>
<dates>
<discovery>2017-10-10</discovery>
<entry>2017-10-19</entry>
</dates>
</vuln>
<vuln vid="b95e5674-b4d6-11e7-b895-0cc47a494882">
<topic>arj -- multiple vulnerabilities</topic>
<affects>
<package>
<name>arj</name>
<range><lt>3.10.22_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Several vulnerabilities: symlink directory traversal, absolute path directory
traversal and buffer overflow were discovered in the arj archiver.</p>
</body>
</description>
<references>
<cvename>CVE-2015-0556</cvename>
<cvename>CVE-2015-0557</cvename>
<cvename>CVE-2015-2782</cvename>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2017-10-19</entry>
</dates>
</vuln>
<vuln vid="3f3837cc-48fb-4414-aa46-5b1c23c9feae">
<topic>krb5 -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>krb5</name>
<range><lt>1.14.6</lt></range>
<range><ge>1.15</ge><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-devel</name>
<range><lt>1.14.6</lt></range>
<range><ge>1.15</ge><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-115</name>
<range><lt>1.15.2</lt></range>
</package>
<package>
<name>krb5-114</name>
<range><lt>1.14.6</lt></range>
</package>
<package>
<name>krb5-113</name>
<range><lt>1.14.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MIT reports:</p>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8599">
<p>CVE-2017-11368:</p>
<p>In MIT krb5 1.7 and later, an authenticated attacker can cause an
assertion failure in krb5kdc by sending an invalid S4U2Self or
S4U2Proxy request.</p>
</blockquote>
<blockquote cite="http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598">
<p>CVE-2017-11462:</p>
<p>RFC 2744 permits a GSS-API implementation to delete an existing
security context on a second or subsequent call to gss_init_sec_context()
or gss_accept_sec_context() if the call results in an error.
This API behavior has been found to be dangerous, leading to the
possibility of memory errors in some callers. For safety, GSS-API
implementations should instead preserve existing security contexts
on error until the caller deletes them.</p>
<p>All versions of MIT krb5 prior to this change may delete acceptor
contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through
1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts
on error.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11368</url>
<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8599</url>
<url>https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970</url>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-11462</url>
<url>https://krbdev.mit.edu/rt/Ticket/Display.html?id=8598</url>
<url>https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf</url>
<cvename>CVE-2017-11368</cvename>
<cvename>CVE-2017-11462</cvename>
</references>
<dates>
<discovery>2017-07-14</discovery>
<entry>2017-10-18</entry>
</dates>
</vuln>
<vuln vid="c41bedfd-b3f9-11e7-ac58-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.33</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.29</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.10</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.38</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.20</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.58</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.38</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL</url>
<cvename>CVE-2017-10155</cvename>
<cvename>CVE-2017-10379</cvename>
<cvename>CVE-2017-10384</cvename>
<cvename>CVE-2017-10276</cvename>
<cvename>CVE-2017-10167</cvename>
<cvename>CVE-2017-10378</cvename>
<cvename>CVE-2017-10277</cvename>
<cvename>CVE-2017-10203</cvename>
<cvename>CVE-2017-10283</cvename>
<cvename>CVE-2017-10313</cvename>
<cvename>CVE-2017-10296</cvename>
<cvename>CVE-2017-10311</cvename>
<cvename>CVE-2017-10320</cvename>
<cvename>CVE-2017-10314</cvename>
<cvename>CVE-2017-10227</cvename>
<cvename>CVE-2017-10279</cvename>
<cvename>CVE-2017-10294</cvename>
<cvename>CVE-2017-10165</cvename>
<cvename>CVE-2017-10284</cvename>
<cvename>CVE-2017-10286</cvename>
<cvename>CVE-2017-10268</cvename>
<cvename>CVE-2017-10365</cvename>
</references>
<dates>
<discovery>2017-10-18</discovery>
<entry>2017-10-18</entry>
<modified>2017-12-23</modified>
</dates>
</vuln>
<vuln vid="ab881a74-c016-4e6d-9f7d-68c8e7cedafb">
<topic>xorg-server -- Multiple Issues</topic>
<affects>
<package>
<name>xorg-server</name>
<range><le>1.18.4_6,1</le></range>
<range><ge>1.19.0,1</ge><le>1.19.3,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>xorg-server developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99546">
<p>In the X.Org X server before 2017-06-19, a user authenticated to
an X Session could crash or execute code in the context of the X
Server by exploiting a stack overflow in the endianness conversion
of X Events.</p>
<p>Uninitialized data in endianness conversion in the XEvent handling
of the X.Org X Server before 2017-06-19 allowed authenticated
malicious users to access potentially privileged data from the X
server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99546</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455</url>
<url>http://www.securityfocus.com/bid/99543</url>
<url>https://bugzilla.suse.com/show_bug.cgi?id=1035283</url>
<url>https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced</url>
<cvename>CVE-2017-10971</cvename>
<cvename>CVE-2017-10972</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-10-17</entry>
<modified>2018-05-20</modified>
</dates>
</vuln>
<vuln vid="a73518da-b2fa-11e7-98ef-d43d7ef03aa6">
<topic>Flash Player -- Remote code execution</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.170</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-32.html">
<ul>
<li>This update resolves a type confusion vulnerability that
could lead to remote code execution (CVE-2017-11292).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11292</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-32.html</url>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-10-17</entry>
</dates>
</vuln>
<vuln vid="d670a953-b2a1-11e7-a633-009c02a2ab30">
<topic>WPA packet number reuse with replayed messages and key reinstallation</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><le>2.6_1</le></range>
</package>
<package>
<name>hostapd</name>
<range><le>2.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wpa_supplicant developers report:</p>
<blockquote cite="http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt">
<p>A vulnerability was found in how a number of implementations can be
triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by
replaying a specific frame that is used to manage the keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt</url>
<url>https://www.kb.cert.org/vuls/id/228519</url>
<cvename>CVE-2017-13077</cvename>
<cvename>CVE-2017-13078</cvename>
<cvename>CVE-2017-13079</cvename>
<cvename>CVE-2017-13080</cvename>
<cvename>CVE-2017-13081</cvename>
<cvename>CVE-2017-13082</cvename>
<cvename>CVE-2017-13084</cvename>
<cvename>CVE-2017-13086</cvename>
<cvename>CVE-2017-13087</cvename>
<cvename>CVE-2017-13088</cvename>
</references>
<dates>
<discovery>2017-10-16</discovery>
<entry>2017-10-16</entry>
</dates>
</vuln>
<vuln vid="b0628e53-092a-4037-938b-29805a7cd31b">
<topic>mercurial -- multiple issues</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mercurial developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100290">
<p>Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository</p>
<p>Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100290</url>
<url>https://security.gentoo.org/glsa/201709-18</url>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<url>http://www.securityfocus.com/bid/100290</url>
<url>https://security.gentoo.org/glsa/201709-18</url>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<cvename>CVE-2017-1000115</cvename>
<cvename>CVE-2017-1000116</cvename>
</references>
<dates>
<discovery>2017-10-05</discovery>
<entry>2017-10-16</entry>
</dates>
</vuln>
<vuln vid="555cd806-b031-11e7-a369-14dae9d59f67">
<topic>Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3</topic>
<affects>
<package>
<name>freexl</name>
<range><lt>1.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco TALOS reports:</p>
<blockquote cite="http://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430">
<p>An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
<blockquote cite="https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431">
<p>An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430</url>
<cvename>CVE-2017-2923</cvename>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431</url>
<cvename>CVE-2017-2924</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="ed73829d-af6d-11e7-a633-009c02a2ab30">
<topic>FFmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.3.4</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-29.x has ffmpeg-3.2 -->
<range><lt>29.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ffmpeg.org/security.html</url>
<cvename>CVE-2017-14054</cvename>
<cvename>CVE-2017-14055</cvename>
<cvename>CVE-2017-14056</cvename>
<cvename>CVE-2017-14057</cvename>
<cvename>CVE-2017-14058</cvename>
<cvename>CVE-2017-14059</cvename>
<cvename>CVE-2017-14169</cvename>
<cvename>CVE-2017-14170</cvename>
<cvename>CVE-2017-14171</cvename>
<cvename>CVE-2017-14222</cvename>
<cvename>CVE-2017-14223</cvename>
<cvename>CVE-2017-14225</cvename>
<cvename>CVE-2017-14767</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-10-12</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="7274e0cc-575f-41bc-8619-14a41b3c2ad0">
<topic>xorg-server -- multiple vulnabilities</topic>
<affects>
<package>
<name>xephyr</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.19.1_2,2</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><lt>1.18.4_5,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.19.1_2,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.19.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Jackson reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002814.html">
<p>One regression fix since 1.19.4 (mea culpa), and fixes for
CVEs 2017-12176 through 2017-12187.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2017-October/002814.html</url>
<cvename>CVE-2017-12176</cvename>
<cvename>CVE-2017-12177</cvename>
<cvename>CVE-2017-12178</cvename>
<cvename>CVE-2017-12179</cvename>
<cvename>CVE-2017-12180</cvename>
<cvename>CVE-2017-12181</cvename>
<cvename>CVE-2017-12182</cvename>
<cvename>CVE-2017-12183</cvename>
<cvename>CVE-2017-12184</cvename>
<cvename>CVE-2017-12185</cvename>
<cvename>CVE-2017-12186</cvename>
<cvename>CVE-2017-12187</cvename>
</references>
<dates>
<discovery>2017-10-12</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="e837390d-0ceb-46b8-9b32-29c1195f5dc7">
<topic>solr -- Code execution via entity expansion</topic>
<affects>
<package>
<name>apache-solr</name>
<range><ge>5.1</ge><le>6.6.1</le></range>
<range><ge>7.0.0</ge><lt>7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Solr developers report:</p>
<blockquote cite="http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html">
<p>Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.</p>
<p>Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html</url>
<url>https://marc.info/?l=apache-announce&m=150786685013286</url>
<cvename>CVE-2017-12629</cvename>
</references>
<dates>
<discovery>2017-10-13</discovery>
<entry>2017-10-13</entry>
<modified>2017-10-16</modified>
</dates>
</vuln>
<vuln vid="6dc3c61c-e866-4c27-93f7-ae50908594fd">
<topic>jenkins -- multiple issues</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.83</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.73.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>jenkins developers report:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-10-11/">
<p>A total of 11 issues are reported, please see reference URL for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://jenkins.io/security/advisory/2017-10-11/</url>
</references>
<dates>
<discovery>2017-10-11</discovery>
<entry>2017-10-13</entry>
</dates>
</vuln>
<vuln vid="da70d472-af59-11e7-ace2-f8b156b439c5">
<topic>xen-kernel -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.2_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen project reports multiple vulnerabilities.</p>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-237.html</url>
<url>http://xenbits.xen.org/xsa/advisory-238.html</url>
<url>http://xenbits.xen.org/xsa/advisory-239.html</url>
<url>http://xenbits.xen.org/xsa/advisory-240.html</url>
<url>http://xenbits.xen.org/xsa/advisory-241.html</url>
<url>http://xenbits.xen.org/xsa/advisory-242.html</url>
<url>http://xenbits.xen.org/xsa/advisory-243.html</url>
<url>http://xenbits.xen.org/xsa/advisory-244.html</url>
</references>
<dates>
<discovery>2017-10-12</discovery>
<entry>2017-10-12</entry>
</dates>
</vuln>
<vuln vid="e71fd9d3-af47-11e7-a633-009c02a2ab30">
<topic>nss -- Use-after-free in TLS 1.2 generating handshake hashes</topic>
<affects>
<package>
<name>nss</name>
<range><ge>3.32</ge><lt>3.32.1</lt></range>
<range><ge>3.28</ge><lt>3.28.6</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
</package>
<package>
<name>linux-c7-nss</name>
<range><ge>3.28</ge><lt>3.28.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805">
<p>During TLS 1.2 exchanges, handshake hashes are generated which
point to a message buffer. This saved data is used for later
messages but in some cases, the handshake transcript can
exceed the space available in the current buffer, causing the
allocation of a new buffer. This leaves a pointer pointing to
the old, freed buffer, resulting in a use-after-free when
handshake hashes are then calculated afterwards. This can
result in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805</url>
<url>https://hg.mozilla.org/projects/nss/rev/2d7b65b72290</url>
<url>https://hg.mozilla.org/projects/nss/rev/d3865e2957d0</url>
<cvename>CVE-2017-7805</cvename>
</references>
<dates>
<discovery>2017-08-04</discovery>
<entry>2017-10-12</entry>
<modified>2018-01-29</modified>
</dates>
</vuln>
<vuln vid="15a62f22-098a-443b-94e2-2d26c375b993">
<topic>osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer</topic>
<affects>
<package>
<name>libosip2</name>
<range><le>5.0.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>osip developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/97644">
<p>In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/97644</url>
<url>https://savannah.gnu.org/support/index.php?109265</url>
<cvename>CVE-2017-7853</cvename>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="b84dbd94-e894-4c91-b8cd-d328537b1b2b">
<topic>ncurses -- multiple issues</topic>
<affects>
<package>
<name>ncurses</name>
<range><le>6.0</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ncurses developers reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1484285">
<p>There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484274</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484276</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484284</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484285</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484287</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484290</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1484291</url>
<cvename>CVE-2017-13728</cvename>
<cvename>CVE-2017-13729</cvename>
<cvename>CVE-2017-13730</cvename>
<cvename>CVE-2017-13731</cvename>
<cvename>CVE-2017-13732</cvename>
<cvename>CVE-2017-13733</cvename>
<cvename>CVE-2017-13734</cvename>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="9164f51e-ae20-11e7-a633-009c02a2ab30">
<topic>Python 2.7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS">
<p>Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.</p>
</blockquote>
</body>
</description>
<references>
<url>https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS</url>
<cvename>CVE-2012-0876</cvename>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-4472</cvename>
<cvename>CVE-2016-5300</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2017-9233</cvename>
</references>
<dates>
<discovery>2017-08-26</discovery>
<entry>2017-10-11</entry>
</dates>
</vuln>
<vuln vid="1257718e-be97-458a-9744-d938b592db42">
<topic>node -- access to unintended files</topic>
<affects>
<package>
<name>node</name>
<range><ge>8.5.0</ge><lt>8.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>node developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/101056">
<p>Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/101056</url>
<cvename>CVE-2017-14849</cvename>
</references>
<dates>
<discovery>2017-09-27</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="af61b271-9e47-4db0-a0f6-29fb032236a3">
<topic>zookeeper -- Denial Of Service</topic>
<affects>
<package>
<name>zookeeper</name>
<range><lt>3.4.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zookeeper developers report:</p>
<blockquote cite="https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E">
<p>Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E</url>
<cvename>CVE-2017-5637</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="9b5a905f-e556-452f-a00c-8f070a086181">
<topic>libtiff -- Improper Input Validation</topic>
<affects>
<package>
<name>libtiff</name>
<range><le>4.0.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtiff developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100524">
<p>There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
<p>There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2727</url>
<url>http://bugzilla.maptools.org/show_bug.cgi?id=2728</url>
<url>http://www.securityfocus.com/bid/100524</url>
<cvename>CVE-2017-13726</cvename>
<cvename>CVE-2017-13727</cvename>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="2c8bd00d-ada2-11e7-82af-8dbff7d75206">
<topic>rubygems -- deserialization vulnerability</topic>
<affects>
<package>
<name>ruby22-gems</name>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<range><lt>2.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oss-security mailing list:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/10/10/2">
<p>There is a possible unsafe object desrialization vulnerability in
RubyGems. It is possible for YAML deserialization of gem specifications
to bypass class white lists. Specially crafted serialized objects can
possibly be used to escalate to remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/10/10/2</url>
<url>http://blog.rubygems.org/2017/10/09/2.6.14-released.html</url>
<cvename>CVE-2017-0903</cvename>
</references>
<dates>
<discovery>2017-10-09</discovery>
<entry>2017-10-10</entry>
</dates>
</vuln>
<vuln vid="4f8ffb9c-f388-4fbd-b90f-b3131559d888">
<topic>xorg-server -- multiple vulnabilities</topic>
<affects>
<package>
<name>xephyr</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-dmx</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-nestserver</name>
<range><lt>1.19.1_1,2</lt></range>
</package>
<package>
<name>xorg-server</name>
<range><lt>1.18.4_4,1</lt></range>
</package>
<package>
<name>xorg-vfbserver</name>
<range><lt>1.19.1_1,1</lt></range>
</package>
<package>
<name>xwayland</name>
<range><lt>1.19.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Coopersmith reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2017-October/002809.html">
<p>X.Org thanks Michal Srb of SuSE for finding these issues
and bringing them to our attention, Julien Cristau of
Debian for getting the fixes integrated, and Adam Jackson
of Red Hat for publishing the release.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2017-October/002809.html</url>
<cvename>CVE-2017-13721</cvename>
<cvename>CVE-2017-13723</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-09</entry>
</dates>
</vuln>
<vuln vid="c0dae634-4820-4505-850d-b1c975d0f67d">
<topic>tomcat -- Remote Code Execution</topic>
<affects>
<package>
<name>tomcat</name>
<range><ge>7.0.0</ge><le>7.0.81</le></range>
<range><ge>8.0.0</ge><le>8.0.46</le></range>
<range><ge>8.5.0</ge><le>8.5.22</le></range>
<range><ge>9.0.0</ge><lt>9.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tomcat developers reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100954">
<p>When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100954</url>
<url>https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E</url>
<cvename>CVE-2017-12617</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-06</entry>
</dates>
</vuln>
<vuln vid="ccace707-a8d8-11e7-ac58-b499baebfeaf">
<topic>cURL -- out of bounds read</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20171004.html">
<p>FTP PWD response parser out of bounds read</p>
<p>libcurl may read outside of a heap allocated buffer when doing FTP.</p>
<p>When libcurl connects to an FTP server and successfully logs in
(anonymous or not), it asks the server for the current directory with
the PWD command. The server then responds with a 257 response containing
the path, inside double quotes. The returned path name is then kept by
libcurl for subsequent uses.</p>
<p>Due to a flaw in the string parser for this directory name, a directory
name passed like this but without a closing double quote would lead to
libcurl not adding a trailing NUL byte to the buffer holding the name.
When libcurl would then later access the string, it could read beyond
the allocated heap buffer and crash or wrongly access data beyond the
buffer, thinking it was part of the path.</p>
<p>A malicious server could abuse this fact and effectively prevent
libcurl-based clients to work with it - the PWD command is always issued
on new FTP connections and the mistake has a high chance of causing a
segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20171004.html</url>
<cvename>CVE-2017-1000254</cvename>
</references>
<dates>
<discovery>2017-10-04</discovery>
<entry>2017-10-04</entry>
</dates>
</vuln>
<vuln vid="6ed5c5e3-a840-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- OpenSSH Denial of Service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.1</ge><lt>11.1_1</lt></range>
<range><ge>11.0</ge><lt>11.0_12</lt></range>
<range><ge>10.3</ge><lt>10.3_21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is no limit on the password length.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause an affected SSH
server to use excessive amount of CPU by sending very long
passwords, when PasswordAuthentication is enabled by the
system administrator.</p>
</body>
</description>
<references>
<cvename>CVE-2016-6515</cvename>
<freebsdsa>SA-17:06.openssh</freebsdsa>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-10-03</entry>
</dates>
</vuln>
<vuln vid="420243e9-a840-11e7-b5af-a4badb2f4699">
<topic>FreeBSD -- heimdal KDC-REP service name validation vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_11</lt></range>
<range><ge>10.3</ge><lt>10.3_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a programming error in the Heimdal implementation
that used an unauthenticated, plain-text version of the
KDC-REP service name found in a ticket.</p>
<h1>Impact:</h1>
<p>An attacker who has control of the network between a
client and the service it talks to will be able to impersonate
the service, allowing a successful man-in-the-middle (MITM)
attack that circumvents the mutual authentication.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1110</cvename>
<freebsdsa>SA-17:05.heimdal</freebsdsa>
</references>
<dates>
<discovery>2017-07-12</discovery>
<entry>2017-10-03</entry>
</dates>
</vuln>
<vuln vid="b77b5646-a778-11e7-ac58-b499baebfeaf">
<topic>dnsmasq -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.78,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Project Zero reports:</p>
<blockquote cite="https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html">
<ul>
<li>CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this
commit overflow was unrestricted.</li>
<li>CVE-2017-14492: Heap based overflow.</li>
<li>CVE-2017-14493: Stack Based overflow.</li>
<li>CVE-2017-14494: Information Leak</li>
<li>CVE-2017-14495: Lack of free()</li>
<li>CVE-2017-14496: Invalid boundary checks. Integer underflow leading
to a huge memcpy.</li>
<li>CVE-2017-13704: Crash on large DNS query</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html</url>
<cvename>CVE-2017-14491</cvename>
<cvename>CVE-2017-14492</cvename>
<cvename>CVE-2017-14493</cvename>
<cvename>CVE-2017-14494</cvename>
<cvename>CVE-2017-14495</cvename>
<cvename>CVE-2017-14496</cvename>
<cvename>CVE-2017-13704</cvename>
</references>
<dates>
<discovery>2017-10-02</discovery>
<entry>2017-10-02</entry>
</dates>
</vuln>
<vuln vid="33888815-631e-4bba-b776-a9b46fe177b5">
<topic>phpmyfaq -- multiple issues</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><le>2.9.8</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phpmyfaq developers report:</p>
<blockquote cite="https://www.exploit-db.com/exploits/42761/">
<p>Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.</p>
<p>Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.exploit-db.com/exploits/42761/</url>
<url>https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86</url>
<cvename>CVE-2017-14618</cvename>
<cvename>CVE-2017-14619</cvename>
</references>
<dates>
<discovery>2017-09-20</discovery>
<entry>2017-09-29</entry>
</dates>
</vuln>
<vuln vid="a48d4478-e23f-4085-8ae4-6b3a7b6f016b">
<topic>wordpress -- multiple issues</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.8.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wordpress developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100912">
<p>Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.</p>
<p>Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.</p>
<p>Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.</p>
<p>Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.</p>
<p>Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.</p>
<p>Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.</p>
<p>Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100912</url>
<url>https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/</url>
<url>https://core.trac.wordpress.org/changeset/41393</url>
<url>https://core.trac.wordpress.org/changeset/41395</url>
<url>https://core.trac.wordpress.org/changeset/41397</url>
<url>https://core.trac.wordpress.org/changeset/41412</url>
<url>https://core.trac.wordpress.org/changeset/41448</url>
<url>https://core.trac.wordpress.org/changeset/41457</url>
<url>https://wpvulndb.com/vulnerabilities/8911</url>
<url>https://wpvulndb.com/vulnerabilities/8912</url>
<url>https://wpvulndb.com/vulnerabilities/8913</url>
<url>https://wpvulndb.com/vulnerabilities/8914</url>
<cvename>CVE-2017-14718</cvename>
<cvename>CVE-2017-14719</cvename>
<cvename>CVE-2017-14720</cvename>
<cvename>CVE-2017-14721</cvename>
<cvename>CVE-2017-14722</cvename>
<cvename>CVE-2017-14724</cvename>
<cvename>CVE-2017-14726</cvename>
</references>
<dates>
<discovery>2017-09-23</discovery>
<entry>2017-09-29</entry>
</dates>
</vuln>
<vuln vid="1098a15b-b0f6-42b7-b5c7-8a8646e8be07">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>56.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
<p>CVE-2017-7793: Use-after-free with Fetch API</p>
<p>CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode</p>
<p>CVE-2017-7818: Use-after-free during ARIA array manipulation</p>
<p>CVE-2017-7819: Use-after-free while resizing images in design mode</p>
<p>CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE</p>
<p>CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes</p>
<p>CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files</p>
<p>CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings</p>
<p>CVE-2017-7813: Integer truncation in the JavaScript parser</p>
<p>CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces</p>
<p>CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations</p>
<p>CVE-2017-7816: WebExtensions can load about: URLs in extension UI</p>
<p>CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction</p>
<p>CVE-2017-7823: CSP sandbox directive did not create a unique origin</p>
<p>CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV</p>
<p>CVE-2017-7820: Xray wrapper bypass with new tab and web console</p>
<p>CVE-2017-7811: Memory safety bugs fixed in Firefox 56</p>
<p>CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7793</cvename>
<cvename>CVE-2017-7805</cvename>
<cvename>CVE-2017-7810</cvename>
<cvename>CVE-2017-7811</cvename>
<cvename>CVE-2017-7812</cvename>
<cvename>CVE-2017-7813</cvename>
<cvename>CVE-2017-7814</cvename>
<cvename>CVE-2017-7815</cvename>
<cvename>CVE-2017-7816</cvename>
<cvename>CVE-2017-7817</cvename>
<cvename>CVE-2017-7818</cvename>
<cvename>CVE-2017-7819</cvename>
<cvename>CVE-2017-7820</cvename>
<cvename>CVE-2017-7821</cvename>
<cvename>CVE-2017-7822</cvename>
<cvename>CVE-2017-7823</cvename>
<cvename>CVE-2017-7824</cvename>
<cvename>CVE-2017-7825</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/</url>
</references>
<dates>
<discovery>2017-09-28</discovery>
<entry>2017-09-29</entry>
<modified>2017-10-03</modified>
</dates>
</vuln>
<vuln vid="43a1b8f9-3451-4f3c-b4fc-730c0f5876c1">
<topic>sam2p -- multiple issues</topic>
<affects>
<package>
<name>sam2p</name>
<range><lt>0.49.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sam2p developers report:</p>
<blockquote cite="https://github.com/pts/sam2p/issues/14">
<p>In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.</p>
<p>In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.</p>
<p>In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.</p>
<p>In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.</p>
<p>Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.</p>
<p>In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/pts/sam2p/issues/14</url>
<cvename>CVE-2017-14628</cvename>
<cvename>CVE-2017-14629</cvename>
<cvename>CVE-2017-14630</cvename>
<cvename>CVE-2017-14631</cvename>
<cvename>CVE-2017-14636</cvename>
<cvename>CVE-2017-14637</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-28</entry>
</dates>
</vuln>
<vuln vid="02bee9ae-c5d1-409b-8a79-983a88861509">
<topic>libraw -- Out-of-bounds Read</topic>
<affects>
<package>
<name>libraw</name>
<range><le>0.18.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21">
<p>In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21</url>
<url>https://github.com/LibRaw/LibRaw/issues/101</url>
<cvename>CVE-2017-14608</cvename>
</references>
<dates>
<discovery>2017-09-20</discovery>
<entry>2017-09-28</entry>
</dates>
</vuln>
<vuln vid="3dd6ccf4-a3c6-11e7-a52e-0800279f2ff8">
<topic>OpenVPN -- out-of-bounds write in legacy key-method 1</topic>
<affects>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.18</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
</package>
<package>
<name>openvpn</name>
<range><ge>2.4.0</ge><lt>2.4.4</lt></range>
<range><lt>2.3.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Steffan Karger reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/CVE-2017-12166">
<p>The bounds check in read_key() was performed after using the value,
instead of before. If 'key-method 1' is used, this allowed an
attacker to send a malformed packet to trigger a stack buffer
overflow. [...]</p>
<p>Note that 'key-method 1' has been replaced by 'key method 2' as the
default in OpenVPN 2.0 (released on 2005-04-17), and explicitly
deprecated in 2.4 and marked for removal in 2.5. This should limit
the amount of users impacted by this issue.</p>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/CVE-2017-12166</url>
<url>https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html</url>
<cvename>CVE-2017-12166</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="16fb4f83-a2ab-11e7-9c14-009c02a2ab30">
<topic>ImageMagick -- denial of service via a crafted font file</topic>
<affects>
<package>
<name>ImageMagick7</name>
<range><lt>7.0.7.4</lt></range>
</package>
<package>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.7.4</lt></range>
</package>
<package>
<name>ImageMagick</name>
<range><le>6.9.8.9_1</le></range>
</package>
<package>
<name>ImageMagick-nox11</name>
<range><le>6.9.8.9_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741">
<p>The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741</url>
<url>https://github.com/ImageMagick/ImageMagick/issues/771</url>
<url>https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f</url>
<url>https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d</url>
<cvename>CVE-2017-14741</cvename>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="58fafead-cd13-472f-a9bd-d0173ba1b04c">
<topic>libofx -- exploitable buffer overflow</topic>
<affects>
<package>
<name>libofx</name>
<range><le>0.9.11_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100828">
<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100828</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317</url>
<cvename>CVE-2017-2816</cvename>
</references>
<dates>
<discovery>2017-09-13</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="3b776502-f601-44e0-87cd-b63f1b9ae42a">
<topic>sugarcrm -- multiple vulnerabilities</topic>
<affects>
<package>
<name>sugarcrm</name>
<range><le>6.5.26</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>sugarcrm developers report:</p>
<blockquote cite="https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/">
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.</p>
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.</p>
<p>An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/</url>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/</url>
<url>https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/</url>
<url>https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/</url>
<cvename>CVE-2017-14508</cvename>
<cvename>CVE-2017-14509</cvename>
<cvename>CVE-2017-14510</cvename>
</references>
<dates>
<discovery>2017-09-17</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="b2952517-07e5-4d19-8850-21c5b7e0623f">
<topic>libzip -- denial of service</topic>
<affects>
<package>
<name>libzip</name>
<range><lt>1.1.13_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libzip developers report:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/">
<p>The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/</url>
<url>https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5</url>
<cvename>CVE-2017-14107</cvename>
</references>
<dates>
<discovery>2017-09-01</discovery>
<entry>2017-09-27</entry>
</dates>
</vuln>
<vuln vid="10214bda-0902-4e3b-a2f9-9a68ef206a73">
<topic>libbson -- Denial of Service</topic>
<affects>
<package>
<name>libbson</name>
<range><lt>1.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mongodb developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100825">
<p>In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100825</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489355</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489356</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1489362</url>
<cvename>CVE-2017-14227</cvename>
</references>
<dates>
<discovery>2017-09-09</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="eb03d642-6724-472d-b038-f2bf074e1fc8">
<topic>tcpdump -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tcpdump</name>
<range><lt>4.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>tcpdump developers report:</p>
<blockquote cite="http://www.tcpdump.org/tcpdump-changes.txt">
<p>Too many issues to detail, see CVE references for details.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11541</cvename>
<cvename>CVE-2017-11542</cvename>
<cvename>CVE-2017-11543</cvename>
<cvename>CVE-2017-12893</cvename>
<cvename>CVE-2017-12894</cvename>
<cvename>CVE-2017-12895</cvename>
<cvename>CVE-2017-12896</cvename>
<cvename>CVE-2017-12897</cvename>
<cvename>CVE-2017-12898</cvename>
<cvename>CVE-2017-12899</cvename>
<cvename>CVE-2017-12900</cvename>
<cvename>CVE-2017-12901</cvename>
<cvename>CVE-2017-12902</cvename>
<cvename>CVE-2017-12985</cvename>
<cvename>CVE-2017-12986</cvename>
<cvename>CVE-2017-12987</cvename>
<cvename>CVE-2017-12988</cvename>
<cvename>CVE-2017-12989</cvename>
<cvename>CVE-2017-12990</cvename>
<cvename>CVE-2017-12991</cvename>
<cvename>CVE-2017-12992</cvename>
<cvename>CVE-2017-12993</cvename>
<cvename>CVE-2017-12994</cvename>
<cvename>CVE-2017-12995</cvename>
<cvename>CVE-2017-12996</cvename>
<cvename>CVE-2017-12997</cvename>
<cvename>CVE-2017-12998</cvename>
<cvename>CVE-2017-12999</cvename>
<cvename>CVE-2017-13000</cvename>
<cvename>CVE-2017-13001</cvename>
<cvename>CVE-2017-13002</cvename>
<cvename>CVE-2017-13003</cvename>
<cvename>CVE-2017-13004</cvename>
<cvename>CVE-2017-13005</cvename>
<cvename>CVE-2017-13006</cvename>
<cvename>CVE-2017-13007</cvename>
<cvename>CVE-2017-13008</cvename>
<cvename>CVE-2017-13009</cvename>
<cvename>CVE-2017-13010</cvename>
<cvename>CVE-2017-13011</cvename>
<cvename>CVE-2017-13012</cvename>
<cvename>CVE-2017-13013</cvename>
<cvename>CVE-2017-13014</cvename>
<cvename>CVE-2017-13015</cvename>
<cvename>CVE-2017-13016</cvename>
<cvename>CVE-2017-13017</cvename>
<cvename>CVE-2017-13018</cvename>
<cvename>CVE-2017-13019</cvename>
<cvename>CVE-2017-13020</cvename>
<cvename>CVE-2017-13021</cvename>
<cvename>CVE-2017-13022</cvename>
<cvename>CVE-2017-13023</cvename>
<cvename>CVE-2017-13024</cvename>
<cvename>CVE-2017-13025</cvename>
<cvename>CVE-2017-13026</cvename>
<cvename>CVE-2017-13027</cvename>
<cvename>CVE-2017-13028</cvename>
<cvename>CVE-2017-13029</cvename>
<cvename>CVE-2017-13030</cvename>
<cvename>CVE-2017-13031</cvename>
<cvename>CVE-2017-13032</cvename>
<cvename>CVE-2017-13033</cvename>
<cvename>CVE-2017-13034</cvename>
<cvename>CVE-2017-13035</cvename>
<cvename>CVE-2017-13036</cvename>
<cvename>CVE-2017-13037</cvename>
<cvename>CVE-2017-13038</cvename>
<cvename>CVE-2017-13039</cvename>
<cvename>CVE-2017-13040</cvename>
<cvename>CVE-2017-13041</cvename>
<cvename>CVE-2017-13042</cvename>
<cvename>CVE-2017-13043</cvename>
<cvename>CVE-2017-13044</cvename>
<cvename>CVE-2017-13045</cvename>
<cvename>CVE-2017-13046</cvename>
<cvename>CVE-2017-13047</cvename>
<cvename>CVE-2017-13048</cvename>
<cvename>CVE-2017-13049</cvename>
<cvename>CVE-2017-13050</cvename>
<cvename>CVE-2017-13051</cvename>
<cvename>CVE-2017-13052</cvename>
<cvename>CVE-2017-13053</cvename>
<cvename>CVE-2017-13054</cvename>
<cvename>CVE-2017-13055</cvename>
<cvename>CVE-2017-13687</cvename>
<cvename>CVE-2017-13688</cvename>
<cvename>CVE-2017-13689</cvename>
<cvename>CVE-2017-13690</cvename>
<cvename>CVE-2017-13725</cvename>
</references>
<dates>
<discovery>2017-07-22</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="d9f96741-47bd-4426-9aba-8736c0971b24">
<topic>libraw -- buffer overflow</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/100866">
<p>LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100866</url>
<url>https://github.com/LibRaw/LibRaw/issues/100</url>
<cvename>CVE-2017-14348</cvename>
</references>
<dates>
<discovery>2017-09-12</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="4cd857d9-26d2-4417-b765-69701938f9e0">
<topic>libraw -- denial of service and remote code execution</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libraw developers report:</p>
<blockquote cite="https://github.com/LibRaw/LibRaw/issues/99">
<p>A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibRaw/LibRaw/issues/99</url>
<cvename>CVE-2017-14265</cvename>
</references>
<dates>
<discovery>2017-09-11</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="a60a2e95-acba-4b11-bc32-ffb47364e07d">
<topic>libgd -- Denial of servica via double free</topic>
<affects>
<package>
<name>libgd</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libgd developers report:</p>
<blockquote cite="http://www.debian.org/security/2017/dsa-3961">
<p>Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.debian.org/security/2017/dsa-3961</url>
<url>https://github.com/libgd/libgd/issues/381</url>
<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.5</url>
<url>https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP/</url>
<cvename>CVE-2017-6362</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="5033e2fc-98ec-4ef5-8e0b-87cfbbc73081">
<topic>php-gd and gd -- Buffer over-read into uninitialized memory</topic>
<affects>
<package>
<name>libgd</name>
<range><lt>2.2.5</lt></range>
</package>
<package>
<name>php70-gd</name>
<range><lt>7.0.21</lt></range>
</package>
<package>
<name>php71-gd</name>
<range><lt>7.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP developers report:</p>
<blockquote cite="https://bugs.php.net/bug.php?id=74435">
<p>The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.php.net/bug.php?id=74435</url>
<cvename>CVE-2017-7890</cvename>
</references>
<dates>
<discovery>2017-08-02</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="d843a984-7f22-484f-ba81-483ddbe30dc3">
<topic>ledger -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ledger</name>
<range><le>3.1.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/100543">
<p>An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.</p>
<p>An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/100543</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303</url>
<url>http://www.securityfocus.com/bid/100546</url>
<url>https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304</url>
<cvename>CVE-2017-2808</cvename>
<cvename>CVE-2017-2807</cvename>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-26</entry>
</dates>
</vuln>
<vuln vid="7801b1e1-99b4-42ac-ab22-7646235e7c16">
<topic>aacplusenc -- denial of service</topic>
<affects>
<package>
<name>aacplusenc</name>
<range><le>0.17.5_2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gentoo developers report:</p>
<blockquote cite="https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/">
<p>DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/</url>
<url>https://github.com/teknoraver/aacplusenc/issues/1</url>
<cvename>CVE-2017-14181</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="478d4102-2319-4026-b3b2-a57c48f159ac">
<topic>ansible -- information disclosure flaw</topic>
<affects>
<package>
<name>ansible</name>
<range><le>2.2.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible/issues/22505">
<p>Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ansible/ansible/issues/22505</url>
<cvename>CVE-2017-7473</cvename>
</references>
<dates>
<discovery>2017-07-21</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="b63421b6-a1e0-11e7-ac58-b499baebfeaf">
<topic>weechat -- crash in logger plugin</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>1.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>WeeChat reports:</p>
<blockquote cite="https://weechat.org/news/98/20170923-Version-1.9.1-security-release/">
<p>security problem: a crash can happen in logger plugin when
converting date/time specifiers in file mask.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/news/98/20170923-Version-1.9.1-security-release/</url>
<cvename>CVE-2017-14727</cvename>
</references>
<dates>
<discovery>2017-09-23</discovery>
<entry>2017-09-25</entry>
</dates>
</vuln>
<vuln vid="d9e82328-a129-11e7-987e-4f174049b30a">
<topic>perl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>perl5</name>
<range><ge>5.24.0</ge><lt>5.24.3</lt></range>
<range><ge>5.26.0</ge><lt>5.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SO-AND-SO reports:</p>
<blockquote cite="https://metacpan.org/changes/release/SHAY/perl-5.26.1#Security">
<p>CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows</p>
<p>A possible stack buffer overflow in the %ENV code on Windows has been
fixed by removing the buffer completely since it was superfluous anyway.</p>
<p>CVE-2017-12837: Heap buffer overflow in regular expression compiler</p>
<p>Compiling certain regular expression patterns with the case-insensitive
modifier could cause a heap buffer overflow and crash perl. This has now
been fixed.</p>
<p>CVE-2017-12883: Buffer over-read in regular expression parser</p>
<p>For certain types of syntax error in a regular expression pattern, the
error message could either contain the contents of a random, possibly
large, chunk of memory, or could crash perl. This has now been fixed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://metacpan.org/changes/release/SHAY/perl-5.24.3</url>
<url>https://metacpan.org/changes/release/SHAY/perl-5.26.1</url>
<cvename>CVE-2017-12814</cvename>
<cvename>CVE-2017-12837</cvename>
<cvename>CVE-2017-12883</cvename>
</references>
<dates>
<discovery>2017-09-19</discovery>
<entry>2017-09-24</entry>
</dates>
</vuln>
<vuln vid="917e5519-9fdd-11e7-8b58-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>61.0.3163.100</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by
Jordan Rabet, Microsoft Offensive Security Research and Microsoft
ChakraCore team on 2017-09-14</li>
<li>[752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by
Choongwoo Han of Naver Corporation on 2017-08-04</li>
<li>[767508] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5121</cvename>
<cvename>CVE-2017-5122</cvename>
<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html</url>
</references>
<dates>
<discovery>2017-09-21</discovery>
<entry>2017-09-22</entry>
</dates>
</vuln>
<vuln vid="c2ea3b31-9d75-11e7-bb13-001999f8d30b">
<topic>asterisk -- RTP/RTCP information leak</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.3</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.17.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>This is a follow up advisory to AST-2017-005.</p>
<p>Insufficient RTCP packet validation could allow reading
stale buffer contents and when combined with the "nat"
and "symmetric_rtp" options allow redirecting where
Asterisk sends the next RTCP report.</p>
<p>The RTP stream qualification to learn the source address
of media always accepted the first RTP packet as the new
source and allowed what AST-2017-005 was mitigating. The
intent was to qualify a series of packets before accepting
the new source address.</p>
<p>The RTP/RTCP stack will now validate RTCP packets before processing them.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-008.html</url>
<cvename>CVE-2017-14099</cvename>
</references>
<dates>
<discovery>2017-09-01</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="95b01379-9d52-11e7-a25c-471bafc3262f">
<topic>ruby -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.2.0</ge><lt>2.2.8</lt></range>
<range><ge>2.3.0</ge><lt>2.3.5</lt></range>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby blog:</p>
<blockquote cite="https://www.ruby-lang.org/en/security/">
<p>CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf</p>
<p>If a malicious format string which contains a precious specifier (*)
is passed and a huge minus value is also passed to the specifier,
buffer underrun may be caused. In such situation, the result may
contains heap, or the Ruby interpreter may crash.</p>
<p>CVE-2017-10784: Escape sequence injection vulnerability in the Basic
authentication of WEBrick</p>
<p>When using the Basic authentication of WEBrick, clients can pass an
arbitrary string as the user name. WEBrick outputs the passed user name
intact to its log, then an attacker can inject malicious escape
sequences to the log and dangerous control characters may be executed
on a victim’s terminal emulator.</p>
<p>This vulnerability is similar to a vulnerability already fixed, but
it had not been fixed in the Basic authentication.</p>
<p>CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode</p>
<p>If a malicious string is passed to the decode method of OpenSSL::ASN1,
buffer underrun may be caused and the Ruby interpreter may crash.</p>
<p>CVE-2017-14064: Heap exposure vulnerability in generating JSON</p>
<p>The generate method of JSON module optionally accepts an instance of
JSON::Ext::Generator::State class. If a malicious instance is passed,
the result may include contents of heap.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/security/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/</url>
<url>https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/</url>
<cvename>CVE-2017-0898</cvename>
<cvename>CVE-2017-10784</cvename>
<cvename>CVE-2017-14033</cvename>
<cvename>CVE-2017-14064</cvename>
</references>
<dates>
<discovery>2017-09-14</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="2bffdf2f-9d45-11e7-a25c-471bafc3262f">
<topic>rubygem-geminabox -- XSS & CSRF vulnerabilities</topic>
<affects>
<package>
<name>rubygem-geminabox</name>
<range><lt>0.13.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gem in a box XSS vulenrability - CVE-2017-14506:</p>
<blockquote cite="https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html">
<p>Malicious attacker create GEM file with crafted homepage value
(gem.homepage in .gemspec file) includes XSS payload.</p>
<p>The attacker access geminabox system and uploads the gem file
(or uses CSRF/SSRF attack to do so).</p>
<p>From now on, any user access Geminabox web server, executes the
malicious XSS payload, that will delete any gems on the server,
and won't let users use the geminabox anymore. (make victim's
browser crash or redirect them to other hosts).</p>
</blockquote>
</body>
</description>
<references>
<url>https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html</url>
<cvename>CVE-2017-14506</cvename>
<cvename>CVE-2017-14683</cvename>
</references>
<dates>
<discovery>2017-09-18</discovery>
<entry>2017-09-19</entry>
<modified>2017-09-27</modified>
</dates>
</vuln>
<vuln vid="76b085e2-9d33-11e7-9260-000c292ee6b8">
<topic>Apache -- HTTP OPTIONS method can leak server memory</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.27_1</lt></range>
</package>
<package>
<name>apache22</name>
<range><lt>2.2.34_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Fuzzing Project reports:</p>
<blockquote cite="https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html">
<p>Apache httpd allows remote attackers to read secret data from
process memory if the Limit directive can be set in a user's
.htaccess file, or if httpd.conf has certain misconfigurations,
aka Optionsbleed. This affects the Apache HTTP Server through
2.2.34 and 2.4.x through 2.4.27. The attacker sends an
unauthenticated OPTIONS HTTP request when attempting to read
secret data. This is a use-after-free issue and thus secret data
is not always sent, and the specific data depends on many factors
including configuration. Exploitation with .htaccess can be
blocked with a patch to the ap_limit_section function in
server/core.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/detail/CVE-2017-9798</url>
<cvename>CVE-2017-9798</cvename>
</references>
<dates>
<discovery>2017-09-18</discovery>
<entry>2017-09-19</entry>
</dates>
</vuln>
<vuln vid="6a177c87-9933-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>1.0.0</ge><le>9.3.10</le></range>
<range><ge>9.4.0</ge><le>9.4.5</le></range>
<range><ge>9.5.0</ge><le>9.5.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/</url>
<cvename>CVE-2017-5029</cvename>
<cvename>CVE-2016-4738</cvename>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-14</entry>
</dates>
</vuln>
<vuln vid="531aae08-97f0-11e7-aadd-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>27.0.0.130</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-28.html">
<ul>
<li>These updates resolve memory corruption vulnerabilities that
could lead to remote code execution (CVE-2017-11281,
CVE-2017-11282).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-11281</cvename>
<cvename>CVE-2017-11282</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-28.html</url>
</references>
<dates>
<discovery>2017-09-12</discovery>
<entry>2017-09-12</entry>
</dates>
</vuln>
<vuln vid="47e2e52c-975c-11e7-942d-5404a68a61a2">
<topic>emacs -- enriched text remote code execution vulnerability</topic>
<affects>
<package>
<name>emacs25</name>
<name>emacs-nox11</name>
<range><lt>25.3,3</lt></range>
</package>
<package>
<name>emacs-devel</name>
<range><lt>26.0.50.20170912,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paul Eggert reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q3/422">
<p>Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.</p>
<p>When Emacs renders MIME text/enriched data (Internet RFC 1896), it
is vulnerable to arbitrary code execution. Since Emacs-based mail
clients decode "Content-Type: text/enriched", this code is exploitable
remotely. This bug affects GNU Emacs versions 19.29 through 25.2.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q3/422</url>
<url>https://bugs.gnu.org/28350</url>
</references>
<dates>
<discovery>2017-09-04</discovery>
<entry>2017-09-12</entry>
<modified>2017-09-13</modified>
</dates>
</vuln>
<vuln vid="f9f76a50-9642-11e7-ab09-080027b00c2e">
<topic>cyrus-imapd -- broken "other users" behaviour</topic>
<affects>
<package>
<name>cyrus-imapd30</name>
<range><ge>3.0.0</ge><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 3.0.4 Release Notes states:</p>
<blockquote cite="https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.4.html">
<p>Fixed Issue #2132: Broken "Other Users" behaviour</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-14230</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14230</url>
</references>
<dates>
<discovery>2017-09-07</discovery>
<entry>2017-09-10</entry>
</dates>
</vuln>
<vuln vid="aaab03be-932d-11e7-92d8-4b26fc968492">
<topic>Django -- possible XSS in traceback section of technical 500 debug page</topic>
<affects>
<package>
<name>py27-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<name>py36-django110</name>
<range><lt>1.10.8</lt></range>
</package>
<package>
<name>py27-django111</name>
<name>py34-django111</name>
<name>py35-django111</name>
<name>py36-django111</name>
<range><lt>1.11.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django blog:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2017/sep/05/security-releases/">
<p>In older versions, HTML autoescaping was disabled in a portion of the template
for the technical 500 debug page. Given the right circumstances, this allowed a
cross-site scripting attack. This vulnerability shouldn't affect most production
sites since you shouldn't run with DEBUG = True (which makes this page accessible)
in your production settings.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12794</cvename>
<url>https://www.djangoproject.com/weblog/2017/sep/05/security-releases/</url>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-06</entry>
</dates>
</vuln>
<vuln vid="e1100e63-92f7-11e7-bd95-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>61.0.3163.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html">
<p>22 security fixes in this release, including:</p>
<ul>
<li>[737023] High CVE-2017-5111: Use after free in PDFium. Reported by
Luat Nguyen on KeenLab, Tencent on 2017-06-27</li>
<li>[740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by
Tobias Klein on 2017-07-10</li>
<li>[747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by
Anonymous on 2017-07-20</li>
<li>[752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by
Ke Liu of Tencent's Xuanwu LAB on 2017-08-07</li>
<li>[744584] High CVE-2017-5115: Type confusion in V8. Reported by
Marco Giovannini on 2017-07-17</li>
<li>[759624] High CVE-2017-5116: Type confusion in V8. Reported by
Anonymous on 2017-08-28</li>
<li>[739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by
Tobias Klein on 2017-07-04</li>
<li>[747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by
WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24</li>
<li>[725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by
Anonymous on 2017-05-22</li>
<li>[718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by
Xiaoyin Liu on 2017-05-05</li>
<li>[762099] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5111</cvename>
<cvename>CVE-2017-5112</cvename>
<cvename>CVE-2017-5113</cvename>
<cvename>CVE-2017-5114</cvename>
<cvename>CVE-2017-5115</cvename>
<cvename>CVE-2017-5116</cvename>
<cvename>CVE-2017-5117</cvename>
<cvename>CVE-2017-5118</cvename>
<cvename>CVE-2017-5119</cvename>
<cvename>CVE-2017-5120</cvename>
<url>https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-09-05</discovery>
<entry>2017-09-06</entry>
</dates>
</vuln>
<vuln vid="44101b31-8ffd-11e7-b5af-a4badb2f4699">
<cancelled/>
</vuln>
<vuln vid="5a1f1a86-8f4c-11e7-b5af-a4badb2f4699">
<topic>gdk-pixbuf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gtk-pixbuf2</name>
<range><lt>2.36.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TALOS reports:</p>
<blockquote cite="http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html">
<ul>
<li><p>An exploitable integer overflow vulnerability exists in
the tiff_image_parse functionality.</p></li>
<li><p>An exploitable heap-overflow vulnerability exists in
the gdk_pixbuf__jpeg_image_load_increment functionality.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html</url>
<cvename>CVE-2017-2862</cvename>
<cvename>CVE-2017-2870</cvename>
</references>
<dates>
<discovery>2017-08-30</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="ec1df2a1-8ee6-11e7-8be8-001999f8d30b">
<topic>asterisk -- Remote Crash Vulerability in res_pjsip</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-007.html</url>
<cvename>CVE-2017-14098</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="c599f95c-8ee5-11e7-8be8-001999f8d30b">
<topic>asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.2</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2017-005 - A change was made to the strict RTP
support in the RTP stack to better tolerate late media
when a reinvite occurs. When combined with the symmetric
RTP support this introduced an avenue where media could
be hijacked. Instead of only learning a new address when
expected the new code allowed a new source address to be
learned at all times.</p>
<p>AST-2017-006 - The app_minivm module has an "externnotify"
program configuration option that is executed by the
MinivmNotify dialplan application. The application uses
the caller-id name and number as part of a built string
passed to the OS shell for interpretation and execution.
Since the caller-id name and number can come from an
untrusted source, a crafted caller-id name or number
allows an arbitrary shell command injection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://downloads.asterisk.org/pub/security/AST-2017-005.html</url>
<cvename>CVE-2017-14099</cvename>
<url>https://downloads.asterisk.org/pub/security/AST-2017-006.html</url>
<cvename>CVE-2017-14100</cvename>
</references>
<dates>
<discovery>2017-08-31</discovery>
<entry>2017-09-01</entry>
</dates>
</vuln>
<vuln vid="22f28bb3-8d98-11e7-8c37-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack vulnerability</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379">
<p>Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0379</cvename>
<url>https://eprint.iacr.org/2017/806</url>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379</url>
</references>
<dates>
<discovery>2017-08-27</discovery>
<entry>2017-08-30</entry>
</dates>
</vuln>
<vuln vid="3f6de636-8cdb-11e7-9c71-f0def1fd7ea2">
<topic>rubygems -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ruby22-gems</name>
<name>ruby23-gems</name>
<name>ruby24-gems</name>
<range><lt>2.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Official blog of RubyGems reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/">
<p>The following vulnerabilities have been reported: a DNS request
hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS
vulnerability in the query command, and a vulnerability in the gem
installer that allowed a malicious gem to overwrite arbitrary
files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/</url>
</references>
<dates>
<discovery>2017-08-29</discovery>
<entry>2017-08-29</entry>
</dates>
</vuln>
<vuln vid="7d7e05fb-64da-435a-84fb-4061493b89b9">
<topic>kanboard -- multiple privilege escalation vulnerabilities</topic>
<affects>
<package>
<name>kanboard</name>
<range><lt>1.0.46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>chbi reports:</p>
<blockquote cite="https://kanboard.net/news/version-1.0.46">
<p>an authenticated standard user could reset the password of another
user (including admin) by altering form data.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kanboard.net/news/version-1.0.46</url>
<cvename>CVE-2017-12850</cvename>
<cvename>CVE-2017-12851</cvename>
</references>
<dates>
<discovery>2017-08-15</discovery>
<entry>2017-08-26</entry>
</dates>
</vuln>
<vuln vid="eca2d861-76f4-42ed-89d2-23a2cb396c87">
<topic>poppler -- multiple denial of service issues</topic>
<affects>
<package>
<name>poppler</name>
<range><lt>0.56.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Poppler developers report:</p>
<blockquote cite="http://www.securityfocus.com/bid/99241/discuss">
<p>Poppler is prone to a stack-based buffer-overflow
vulnerability.</p>
<p>Successful exploits may allow attackers to crash the affected
application, resulting in denial-of-service condition. Due to the
nature of this issue, arbitrary code execution may be possible but
this has not been confirmed.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99241/discuss</url>
<cvename>CVE-2017-9865</cvename>
<cvename>CVE-2017-9775</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-08-24</entry>
</dates>
</vuln>
<vuln vid="c5d79773-8801-11e7-93f7-d43d7e971a1b">
<topic>phpmailer -- XSS in code example and default exeception handler</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHPMailer reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24">
<p>Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The
code_generator.phps example did not filter user input prior to output. This
file is distributed with a .phps extension, so it it not normally executable
unless it is explicitly renamed, so it is safe by default. There was also an
undisclosed potential XSS vulnerability in the default exception handler
(unused by default). Patches for both issues kindly provided by Patrick
Monnerat of the Fedora Project.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24</url>
<cvename>CVE-2017-11503</cvename>
</references>
<dates>
<discovery>2017-07-27</discovery>
<entry>2017-08-23</entry>
</dates>
</vuln>
<vuln vid="3531141d-a708-477c-954a-2a0549e49ca9">
<topic>salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<name>py36-salt</name>
<range><lt>2016.11.7</lt></range>
<range><ge>2017.7.0</ge><lt>2017.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html">
<p>Correct a flaw in minion id validation which could allow certain
minions to authenticate to a master despite not having the correct
credentials. To exploit the vulnerability, an attacker must create a
salt-minion with an ID containing characters that will cause a
directory traversal.
Credit for discovering the security flaw goes to: Vernhk@qq.com</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-12791</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html</url>
<url>https://docs.saltstack.com/en/latest/topics/releases/2016.11.7.html</url>
</references>
<dates>
<discovery>2017-08-16</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="198d82f3-8777-11e7-950a-e8e0b747a45a">
<topic>dnsdist -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dnsdist</name>
<range><lt>1.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS Security Advisory reports:</p>
<blockquote cite="https://dnsdist.org/security-advisories/index.html">
<p>The first issue can lead to a denial of service on 32-bit if a backend
sends crafted answers, and the second to an alteration of dnsdist's ACL
if the API is enabled, writable and an authenticated user is tricked
into visiting a crafted website.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7069</cvename>
<cvename>CVE-2017-7557</cvename>
<url>https://dnsdist.org/security-advisories/index.html</url>
</references>
<dates>
<discovery>2017-08-21</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="01a197ca-67f1-11e7-a266-28924a333806">
<topic>evince and atril -- command injection vulnerability in CBT handler</topic>
<affects>
<package>
<name>evince</name>
<range><le>3.24.0</le></range>
</package>
<package>
<name>evince-lite</name>
<range><le>3.24.0</le></range>
</package>
<package>
<name>atril</name>
<range><lt>1.18.1</lt></range>
<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
</package>
<package>
<name>atril-lite</name>
<range><lt>1.18.1</lt></range>
<range><ge>1.19.0</ge><lt>1.19.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNOME reports:</p>
<blockquote cite="https://bugzilla.gnome.org/show_bug.cgi?id=784630">
<p>The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.</p>
<p>The same vulnerability affects atril, the Evince fork.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=784630</url>
<url>https://github.com/mate-desktop/atril/issues/257</url>
<cvename>CVE-2017-1000083</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="e1de77e8-c45e-48d7-8866-5a6f943046de">
<topic>SquirrelMail -- post-authentication remote code execution</topic>
<affects>
<package>
<name>squirrelmail</name>
<range><lt>20170705</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SquirrelMail developers report:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2017/Apr/81">
<p>SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN)
allows post-authentication remote code execution via a sendmail.cf
file that is mishandled in a popen call. It's possible to exploit this
vulnerability to execute arbitrary shell commands on the remote
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-08-22</entry>
</dates>
</vuln>
<vuln vid="6876b163-8708-11e7-8568-e8e0b747a45a">
<topic>pspp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>pspp</name>
<range><lt>1.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE Details reports:</p>
<blockquote cite="https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html">
<ul>
<li>There is an Integer overflow in the hash_int function of the libpspp library
in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).</li>
<li>There is a NULL Pointer Dereference in the function ll_insert() of the libpspp
library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).</li>
<li>There is an illegal address access in the function output_hex() in data/data-out.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).</li>
<li>There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).</li>
<li>There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).</li>
<li>There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c
of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-10791</cvename>
<cvename>CVE-2017-10792</cvename>
<cvename>CVE-2017-12958</cvename>
<cvename>CVE-2017-12959</cvename>
<cvename>CVE-2017-12960</cvename>
<cvename>CVE-2017-12961</cvename>
<url>https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html</url>
</references>
<dates>
<discovery>2017-08-18</discovery>
<entry>2017-08-22</entry>
<modified>2017-08-30</modified>
</dates>
</vuln>
<vuln vid="473b6a9e-8493-11e7-b24b-6cf0497db129">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-004">
<p>CVE-2017-6923: Views - Access Bypass - Moderately Critical</p>
<p>CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica</p>
<p>CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6923</cvename>
<cvename>CVE-2017-6924</cvename>
<cvename>CVE-2017-6925</cvename>
</references>
<dates>
<discovery>2017-08-16</discovery>
<entry>2017-08-19</entry>
</dates>
</vuln>
<vuln vid="8e7bbddd-8338-11e7-867f-b499baebfeaf">
<topic>libsoup -- stack based buffer overflow</topic>
<affects>
<package>
<name>libsoup</name>
<range><lt>2.52.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Mueller reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q3/304">
<p>libsoup is susceptible to a stack based buffer overflow
attack when using chunked encoding. Regardless of libsoup
being used as a server or client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q3/304</url>
<cvename>CVE-2017-2885</cvename>
</references>
<dates>
<discovery>2017-08-17</discovery>
<entry>2017-08-17</entry>
<modified>2017-08-20</modified>
</dates>
</vuln>
<vuln vid="5df8bd95-8290-11e7-93af-005056925db4">
<topic>Zabbix -- Remote code execution</topic>
<affects>
<package>
<name>zabbix2-server</name>
<name>zabbix2-proxy</name>
<range><le>2.0.20</le></range>
</package>
<package>
<name>zabbix22-server</name>
<name>zabbix22-proxy</name>
<range><lt>2.2.19</lt></range>
</package>
<package>
<name>zabbix3-server</name>
<name>zabbix3-proxy</name>
<range><lt>3.0.10</lt></range>
</package>
<package>
<name>zabbix32-server</name>
<name>zabbix32-proxy</name>
<range><lt>3.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824">
<p>An exploitable code execution vulnerability exists in the trapper command
functionality of Zabbix Server 2.4.X. A specially crafted set of packets
can cause a command injection resulting in remote code execution. An attacker
can make requests from an active Zabbix Proxy to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2824</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824</url>
<url>https://support.zabbix.com/browse/ZBX-12349</url>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-08-16</entry>
</dates>
</vuln>
<vuln vid="c9460380-81e3-11e7-93af-005056925db4">
<topic>Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests</topic>
<affects>
<package>
<name>py27-supervisor</name>
<range><lt>3.3.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mnaberez reports:</p>
<blockquote cite="https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606">
<p>supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket.
The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been
enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been
found where an authenticated client can send a malicious XML-RPC request to supervisord that
will run arbitrary shell commands on the server. The commands will be run as the same user as
supervisord. Depending on how supervisord has been configured, this may be root.</p>
<p>This vulnerability can only be exploited by an authenticated client or if supervisord has been
configured to run an HTTP server without authentication. If authentication has not been enabled,
supervisord will log a message at the critical level every time it starts.</p>
</blockquote>
</body>
</description>
<references>
<url>http://supervisord.org/changes.html</url>
<url>https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606</url>
<cvename>CVE-2017-11610</cvename>
</references>
<dates>
<discovery>2017-07-24</discovery>
<entry>2017-08-15</entry>
</dates>
</vuln>
<vuln vid="79bbec7e-8141-11e7-b5af-a4badb2f4699">
<topic>FreeRadius -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>freeradius3</name>
<range><lt>3.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guido Vranken reports:</p>
<blockquote cite="http://freeradius.org/security/fuzzer-2017.html">
<p>Multiple vulnerabilities found via fuzzing:
FR-GV-201 (v2,v3) Read / write overflow in make_secret()
FR-GV-202 (v2) Write overflow in rad_coalesce()
FR-GV-203 (v2) DHCP - Memory leak in decode_tlv()
FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode()
FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options()
FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
FR-GV-207 (v2) Zero-length malloc in data2vp()
FR-GV-301 (v3) Write overflow in data2vp_wimax()
FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
FR-GV-305 (v3) Decode 'signed' attributes correctly
FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data
FR-AD-002 (v3) String lifetime issues in rlm_python
FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</p>
</blockquote>
</body>
</description>
<references>
<url>http://freeradius.org/security/fuzzer-2017.html</url>
</references>
<dates>
<discovery>2017-06-17</discovery>
<entry>2017-08-14</entry>
</dates>
</vuln>
<vuln vid="1d33cdee-7f6b-11e7-a9b5-3debb10a6871">
<topic>Mercurial -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial Release Notes:</p>
<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29">
<p>CVE-2017-1000115</p>
<p>Mercurial's symlink auditing was incomplete prior to 4.3, and could be
abused to write to files outside the repository.</p>
<p>CVE-2017-1000116</p>
<p>Mercurial was not sanitizing hostnames passed to ssh, allowing shell
injection attacks on clients by specifying a hostname starting with
-oProxyCommand. This is also present in Git (CVE-2017-1000117) and
Subversion (CVE-2017-9800), so please patch those tools as well if you
have them installed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29</url>
<cvename>CVE-2017-1000115</cvename>
<cvename>CVE-2017-1000116</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-12</entry>
</dates>
</vuln>
<vuln vid="6e80bd9b-7e9b-11e7-abfe-90e2baa3bafc">
<topic>subversion -- Arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><le>1.9.6</le></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.0.0</ge><le>1.8.18</le></range>
</package>
<package>
<name>subversion-static</name>
<range><ge>1.0.0</ge><le>1.8.18</le></range>
<range><ge>1.9.0</ge><le>1.9.6</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>subversion team reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2017-9800-advisory.txt">
<p>A Subversion client sometimes connects to URLs provided by the repository.
This happens in two primary cases: during 'checkout', 'export', 'update', and
'switch', when the tree being downloaded contains svn:externals properties;
and when using 'svnsync sync' with one URL argument.</p>
<p>A maliciously constructed svn+ssh:// URL would cause Subversion clients to
run an arbitrary shell command. Such a URL could be generated by a malicious
server, by a malicious user committing to a honest server (to attack another
user of that server's repositories), or by a proxy server.</p>
<p>The vulnerability affects all clients, including those that use file://,
http://, and plain (untunneled) svn://.</p>
<p>An exploit has been tested.</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2017-9800-advisory.txt</url>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-11</entry>
</dates>
</vuln>
<vuln vid="abcc5ad3-7e6a-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- two vulnerabilities</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>7.9.0</ge><le>8.17.8</le></range>
<range><ge>9.0.0</ge><le>9.0.12</le></range>
<range><ge>9.1.0</ge><le>9.1.9</le></range>
<range><ge>9.2.0</ge><le>9.2.9</le></range>
<range><ge>9.3.0</ge><le>9.3.9</le></range>
<range><ge>9.4.0</ge><le>9.4.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/">
<h1>Remote Command Execution in git client</h1>
<p>An external code review performed by Recurity-Labs identified a remote
command execution vulnerability in git that could be exploited via the "Repo
by URL" import option in GitLab. The command line git client was not
properly escaping command line arguments in URLs using the SSH protocol
before invoking the SSH client. A specially crafted URL could be used to
execute arbitrary shell commands on the GitLab server.<br/>
To fully patch this vulnerability two fixes were needed. The Omnibus
versions of GitLab contain a patched git client. For source users who may
still be running an older version of git, GitLab now also blocks import URLs
containing invalid host and usernames.<br/>
This issue has been assigned CVE-2017-12426.</p>
<h1>Improper sanitization of GitLab export files on import</h1>
<p>GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a
patch for a critical directory traversal vulnerability in the GitLab export
feature that could be exploited by including symlinks in the export file and
then re-importing it to a GitLab instance. This vulnerability was patched by
checking for and removing symlinks in these files on import.<br/>
Recurity-Labs also determined that this fix did not properly remove symlinks for
hidden files. Though not as dangerous as the original vulnerability hidden file
symlinks could still be used to steal copies of git repositories belonging to
other users if the path to the git repository was known by the attacker. An
updated fix has been included in these releases that properly removes all
symlinks.<br/>
This import option was not made available to non-admin users until GitLab
8.13.0.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/</url>
<cvename>CVE-2017-12426</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-11</entry>
</dates>
</vuln>
<vuln vid="982872f1-7dd3-11e7-9736-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.22</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.18</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.13</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.8</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="https://www.postgresql.org/about/news/1772/">
<ul>
<li>CVE-2017-7546: Empty password accepted in some authentication
methods</li>
<li>CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords
to users lacking server privileges</li>
<li>CVE-2017-7548: lo_put() function ignores ACLs</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7546</cvename>
<cvename>CVE-2017-7547</cvename>
<cvename>CVE-2017-7548</cvename>
</references>
<dates>
<discovery>2017-08-10</discovery>
<entry>2017-08-10</entry>
</dates>
</vuln>
<vuln vid="7e3d3e9a-7d8f-11e7-a02b-d43d7ef03aa6">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.151</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-23.html">
<ul>
<li>These updates resolve security bypass vulnerability that
could lead to information disclosure (CVE-2017-3085).</li>
<li>These updates resolve type confusion vulnerability that
could lead to remote code execution (CVE-2017-3106).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3085</cvename>
<cvename>CVE-2017-3106</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-23.html</url>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-10</entry>
</dates>
</vuln>
<vuln vid="69cfa386-7cd0-11e7-867f-b499baebfeaf">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><lt>7.55.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<ul>
<li>FILE buffer read out of bounds</li>
<li>TFTP sends more than buffer size</li>
<li>URL globbing out of bounds read</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<cvename>CVE-2017-1000099</cvename>
<cvename>CVE-2017-1000100</cvename>
<cvename>CVE-2017-1000101</cvename>
</references>
<dates>
<discovery>2017-08-09</discovery>
<entry>2017-08-09</entry>
</dates>
</vuln>
<vuln vid="c1265e85-7c95-11e7-93af-005056925db4">
<topic>Axis2 -- Security vulnerability on dependency Apache Commons FileUpload</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html">
<p>The commons-fileupload dependency has been updated to a version that fixes
CVE-2016-1000031 (AXIS2-5853).</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5853</url>
<url>https://issues.apache.org/jira/browse/FILEUPLOAD-279</url>
<cvename>CVE-2016-1000031</cvename>
</references>
<dates>
<discovery>2016-11-14</discovery>
<entry>2017-08-09</entry>
</dates>
</vuln>
<vuln vid="555b244e-6b20-4546-851f-d8eb7d6c1ffa">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>55.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7753</cvename>
<cvename>CVE-2017-7779</cvename>
<cvename>CVE-2017-7780</cvename>
<cvename>CVE-2017-7781</cvename>
<cvename>CVE-2017-7782</cvename>
<cvename>CVE-2017-7783</cvename>
<cvename>CVE-2017-7784</cvename>
<cvename>CVE-2017-7785</cvename>
<cvename>CVE-2017-7786</cvename>
<cvename>CVE-2017-7787</cvename>
<cvename>CVE-2017-7788</cvename>
<cvename>CVE-2017-7789</cvename>
<cvename>CVE-2017-7790</cvename>
<cvename>CVE-2017-7791</cvename>
<cvename>CVE-2017-7792</cvename>
<cvename>CVE-2017-7794</cvename>
<cvename>CVE-2017-7796</cvename>
<cvename>CVE-2017-7797</cvename>
<cvename>CVE-2017-7798</cvename>
<cvename>CVE-2017-7799</cvename>
<cvename>CVE-2017-7800</cvename>
<cvename>CVE-2017-7801</cvename>
<cvename>CVE-2017-7802</cvename>
<cvename>CVE-2017-7803</cvename>
<cvename>CVE-2017-7804</cvename>
<cvename>CVE-2017-7806</cvename>
<cvename>CVE-2017-7807</cvename>
<cvename>CVE-2017-7808</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/</url>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-08</entry>
</dates>
</vuln>
<vuln vid="9245681c-7c3c-11e7-b5af-a4badb2f4699">
<topic>sqlite3 -- heap-buffer overflow</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google reports:</p>
<blockquote cite="https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937">
<p>A heap-buffer overflow (sometimes a crash) can arise when
running a SQL request on malformed sqlite3 databases.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937</url>
<cvename>CVE-2017-10989</cvename>
</references>
<dates>
<discovery>2017-08-08</discovery>
<entry>2017-08-08</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="88a77ad8-77b1-11e7-b5af-a4badb2f4699">
<topic>Varnish -- Denial of service vulnerability</topic>
<affects>
<package>
<name>varnish4</name>
<range><ge>4.0.1</ge><lt>4.0.5</lt></range>
<range><ge>4.1.0</ge><lt>4.1.8</lt></range>
</package>
<package>
<name>varnish5</name>
<range><lt>5.0.1</lt></range>
<range><ge>5.1.0</ge><lt>5.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>phk reports:</p>
<blockquote cite="https://varnish-cache.org/security/VSV00001.html">
<p>A wrong if statement in the varnishd source code means that
particular invalid requests from the client can trigger an assert.</p>
</blockquote>
</body>
</description>
<references>
<url>https://varnish-cache.org/security/VSV00001.html</url>
</references>
<dates>
<discovery>2017-08-02</discovery>
<entry>2017-08-02</entry>
</dates>
</vuln>
<vuln vid="7d138476-7710-11e7-88a1-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>60.0.3112.78</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html">
<p>40 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5091</cvename>
<cvename>CVE-2017-5092</cvename>
<cvename>CVE-2017-5093</cvename>
<cvename>CVE-2017-5094</cvename>
<cvename>CVE-2017-5095</cvename>
<cvename>CVE-2017-5096</cvename>
<cvename>CVE-2017-5097</cvename>
<cvename>CVE-2017-5098</cvename>
<cvename>CVE-2017-5099</cvename>
<cvename>CVE-2017-5100</cvename>
<cvename>CVE-2017-5101</cvename>
<cvename>CVE-2017-5102</cvename>
<cvename>CVE-2017-5103</cvename>
<cvename>CVE-2017-5104</cvename>
<cvename>CVE-2017-7000</cvename>
<cvename>CVE-2017-5105</cvename>
<cvename>CVE-2017-5106</cvename>
<cvename>CVE-2017-5107</cvename>
<cvename>CVE-2017-5108</cvename>
<cvename>CVE-2017-5109</cvename>
<cvename>CVE-2017-5110</cvename>
<url>https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-07-25</discovery>
<entry>2017-08-01</entry>
</dates>
</vuln>
<vuln vid="f86d0e5d-7467-11e7-93af-005056925db4">
<topic>Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php</topic>
<affects>
<package>
<name>cacti</name>
<range><eq>1.1.13</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kimiizhang reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/issues/867">
<p>Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti
1.1.13 allows remote authenticated users to inject arbitrary web script
or HTML via specially crafted HTTP Referer headers.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/issues/867</url>
<url>https://www.cacti.net/release_notes.php?version=1.1.14</url>
<cvename>CVE-2017-11691</cvename>
</references>
<dates>
<discovery>2017-07-20</discovery>
<entry>2017-07-29</entry>
</dates>
</vuln>
<vuln vid="770d7e91-72af-11e7-998a-08606e47f965">
<topic>proftpd -- user chroot escape vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7418">
<p>ProFTPD ... controls whether the home directory of a user could
contain a symbolic link through the AllowChrootSymlinks
configuration option, but checks only the last path component when
enforcing AllowChrootSymlinks. Attackers with local access could
bypass the AllowChrootSymlinks control by replacing a path
component (other than the last one) with a symbolic link.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.proftpd.org/show_bug.cgi?id=4295</url>
<cvename>CVE-2017-7418</cvename>
</references>
<dates>
<discovery>2017-03-06</discovery>
<entry>2017-07-27</entry>
</dates>
</vuln>
<vuln vid="76d80b33-7211-11e7-998a-08606e47f965">
<topic>jabberd -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>jabberd</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99511/discuss">
<p>JabberD is prone to an authentication-bypass vulnerability.
An attacker can exploit this issue to bypass the authentication
mechanism and perform unauthorized actions. This may lead to
further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867032</url>
<url>http://www.securityfocus.com/bid/99511</url>
<cvename>CVE-2017-10807</cvename>
</references>
<dates>
<discovery>2017-07-03</discovery>
<entry>2017-07-26</entry>
</dates>
</vuln>
<vuln vid="0f66b901-715c-11e7-ad1f-bcaec565249c">
<topic>webkit2-gtk3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>webkit2-gtk3</name>
<range><lt>2.16.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Webkit gtk team reports:</p>
<blockquote cite="https://webkitgtk.org/security/WSA-2017-0006.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://webkitgtk.org/security/WSA-2017-0006.html</url>
<cvename>CVE-2017-7006</cvename>
<cvename>CVE-2017-7011</cvename>
<cvename>CVE-2017-7012</cvename>
<cvename>CVE-2017-7018</cvename>
<cvename>CVE-2017-7019</cvename>
<cvename>CVE-2017-7020</cvename>
<cvename>CVE-2017-7030</cvename>
<cvename>CVE-2017-7034</cvename>
<cvename>CVE-2017-7037</cvename>
<cvename>CVE-2017-7038</cvename>
<cvename>CVE-2017-7039</cvename>
<cvename>CVE-2017-7040</cvename>
<cvename>CVE-2017-7041</cvename>
<cvename>CVE-2017-7042</cvename>
<cvename>CVE-2017-7043</cvename>
<cvename>CVE-2017-7046</cvename>
<cvename>CVE-2017-7048</cvename>
<cvename>CVE-2017-7049</cvename>
<cvename>CVE-2017-7052</cvename>
<cvename>CVE-2017-7055</cvename>
<cvename>CVE-2017-7056</cvename>
<cvename>CVE-2017-7059</cvename>
<cvename>CVE-2017-7061</cvename>
<cvename>CVE-2017-7064</cvename>
</references>
<dates>
<discovery>2017-07-24</discovery>
<entry>2017-07-25</entry>
<modified>2018-03-28</modified>
</dates>
</vuln>
<vuln vid="8745c67e-7dd1-4165-96e2-fcf9da2dc5b5">
<topic>gsoap -- remote code execution via via overflow</topic>
<affects>
<package>
<name>gsoap</name>
<range><lt>2.8.47</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Senrio reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/99868/discuss">
<p>Genivia gSOAP is prone to a stack-based buffer-overflow
vulnerability because it fails to properly bounds check user-supplied
data before copying it into an insufficiently sized buffer.</p>
<p>A remote attacker may exploit this issue to execute arbitrary code
in the context of the affected device. Failed attempts will likely
cause a denial-of-service condition.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/99868/discuss</url>
<url>http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions</url>
<url>http://blog.senr.io/devilsivy.html</url>
<url>https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29</url>
<url>https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29</url>
<cvename>CVE-2017-9765</cvename>
</references>
<dates>
<discovery>2017-07-18</discovery>
<entry>2017-07-25</entry>
</dates>
</vuln>
<vuln vid="92f4191a-6d25-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.0.0</ge><le>8.17.6</le></range>
<range><ge>9.0.0</ge><le>9.0.10</le></range>
<range><ge>9.1.0</ge><le>9.1.7</le></range>
<range><ge>9.2.0</ge><le>9.2.7</le></range>
<range><ge>9.3.0</ge><le>9.3.7</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/</url>
<cvename>CVE-2017-11438</cvename>
</references>
<dates>
<discovery>2017-07-20</discovery>
<entry>2017-07-20</entry>
<modified>2017-08-15</modified>
</dates>
</vuln>
<vuln vid="cda2f3c2-6c8b-11e7-867f-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.32</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.26</lt></range>
</package>
<package>
<name>mariadb102-server</name>
<range><lt>10.2.6</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.37</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.19</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.57</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.37</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL</url>
<cvename>CVE-2017-3529</cvename>
<cvename>CVE-2017-3633</cvename>
<cvename>CVE-2017-3634</cvename>
<cvename>CVE-2017-3635</cvename>
<cvename>CVE-2017-3636</cvename>
<cvename>CVE-2017-3637</cvename>
<cvename>CVE-2017-3638</cvename>
<cvename>CVE-2017-3639</cvename>
<cvename>CVE-2017-3640</cvename>
<cvename>CVE-2017-3641</cvename>
<cvename>CVE-2017-3642</cvename>
<cvename>CVE-2017-3643</cvename>
<cvename>CVE-2017-3644</cvename>
<cvename>CVE-2017-3645</cvename>
<cvename>CVE-2017-3646</cvename>
<cvename>CVE-2017-3647</cvename>
<cvename>CVE-2017-3648</cvename>
<cvename>CVE-2017-3649</cvename>
<cvename>CVE-2017-3650</cvename>
<cvename>CVE-2017-3651</cvename>
<cvename>CVE-2017-3652</cvename>
<cvename>CVE-2017-3653</cvename>
</references>
<dates>
<discovery>2017-07-19</discovery>
<entry>2017-07-19</entry>
<modified>2017-08-12</modified>
</dates>
</vuln>
<vuln vid="08a2df48-6c6a-11e7-9b01-2047478f2f70">
<topic>collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures</topic>
<affects>
<package>
<name>collectd5</name>
<range><lt>5.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>marcinguy reports:</p>
<blockquote cite="https://github.com/collectd/collectd/issues/2174">
<p>After sending this payload, collectd seems to be entering endless while()
loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/collectd/collectd/issues/2174</url>
<cvename>CVE-2017-7401</cvename>
</references>
<dates>
<discovery>2017-02-13</discovery>
<entry>2017-07-19</entry>
</dates>
</vuln>
<vuln vid="e6ccaf8a-6c63-11e7-9b01-2047478f2f70">
<topic>strongswan -- multiple vulnerabilities</topic>
<affects>
<package>
<name>strongswan</name>
<range><ge>4.4.0</ge><le>5.5.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>strongSwan security team reports:</p>
<blockquote cite="https://www.strongswan.org/blog/2017/05/30/strongswan-5.5.3-released.html">
<ul>
<li>RSA public keys passed to the gmp plugin aren't validated sufficiently
before attempting signature verification, so that invalid input might
lead to a floating point exception. [CVE-2017-9022]</li>
<li>ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when
parsing X.509 certificates with extensions that use such types. This
could lead to infinite looping of the thread parsing a specifically crafted certificate.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html</url>
<cvename>CVE-2017-9022</cvename>
<url>https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html</url>
<cvename>CVE-2017-9023</cvename>
</references>
<dates>
<discovery>2017-05-30</discovery>
<entry>2017-07-19</entry>
</dates>
</vuln>
<vuln vid="c7e8e955-6c61-11e7-9b01-2047478f2f70">
<cancelled superseded="e6ccaf8a-6c63-11e7-9b01-2047478f2f70"/>
</vuln>
<vuln vid="dc3c66e8-6a18-11e7-93af-005056925db4">
<topic>Cacti -- Cross-site scripting (XSS) vulnerability in link.php</topic>
<affects>
<package>
<name>cacti</name>
<range><ge>1.0.0</ge><lt>1.1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>kimiizhang reports:</p>
<blockquote cite="https://github.com/Cacti/cacti/issues/838">
<p>Cross-site scripting (XSS) vulnerability in link.php in Cacti<br/>
1.1.12 allows remote anonymous users to inject arbitrary web<br/>
script or HTML via the id parameter.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/Cacti/cacti/issues/838</url>
<url>https://www.cacti.net/release_notes.php?version=1.1.13</url>
<cvename>CVE-2017-10970</cvename>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-07-17</entry>
</dates>
</vuln>
<vuln vid="457ce015-67fa-11e7-867f-b499baebfeaf">
<topic>Apache httpd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="https://httpd.apache.org/security/vulnerabilities_24.html">
<p>important: Read after free in mod_http2 (CVE-2017-9789)<br/>
When under stress, closing many connections, the HTTP/2 handling
code would sometimes access memory after it has been freed,
resulting in potentially erratic behaviour.</p>
<p>important: Uninitialized memory reflection in mod_auth_digest
(CVE-2017-9788)<br/>The value placeholder in [Proxy-]Authorization
headers of type 'Digest' was not initialized or reset before or
between successive key=value assignments. by mod_auth_digest.<br/>
Providing an initial key with no '=' assignment could reflect
the stale value of uninitialized pool memory used by the prior
request, leading to leakage of potentially confidential
information, and a segfault.</p>
</blockquote>
</body>
</description>
<references>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2017-9789</cvename>
<cvename>CVE-2017-9788</cvename>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="a03e043a-67f1-11e7-beff-6451062f0f7a">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.137</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-21.html">
<ul>
<li>These updates resolve security bypass vulnerability that
could lead to information disclosure (CVE-2017-3080).</li>
<li>These updates resolve memory corruption vulnerability that
could lead to remote code execution (CVE-2017-3099).</li>
<li>These updates resolve memory corruption vulnerability that
could lead to memory address disclosure (CVE-2017-3100).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3080</cvename>
<cvename>CVE-2017-3099</cvename>
<cvename>CVE-2017-3100</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-21.html</url>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-13</entry>
</dates>
</vuln>
<vuln vid="85851e4f-67d9-11e7-bc37-00505689d4ae">
<topic>samba -- Orpheus Lyre mutual authentication validation bypass</topic>
<affects>
<package>
<name>samba42</name>
<range><lt>4.2.15</lt></range>
</package>
<package>
<name>samba43</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>samba44</name>
<range><lt>4.4.15</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.12</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-11103.html">
<p>A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by
returning malicious replication or authorization data.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-11103.html</url>
<cvename>CVE-2017-11103</cvename>
</references>
<dates>
<discovery>2017-07-12</discovery>
<entry>2017-07-12</entry>
</dates>
</vuln>
<vuln vid="3eff66c5-66c9-11e7-aa1d-3d2e663cef42">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>8.1.4</lt></range>
</package>
<package>
<name>node4</name>
<range><lt>4.8.4</lt></range>
</package>
<package>
<name>node6</name>
<range><lt>6.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Updates are now available for all active Node.js release lines as
well as the 7.x line. These include the fix for the high severity
vulnerability identified in the initial announcement, one additional
lower priority Node.js vulnerability in the 4.x release line, as well
as some lower priority fixes for Node.js dependencies across the
current release lines.</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/">
<h2>Constant Hashtable Seeds (CVE pending)</h2>
<p>Node.js was susceptible to hash flooding remote DoS attacks as the
HashTable seed was constant across a given released version of
Node.js. This was a result of building with V8 snapshots enabled by
default which caused the initially randomized seed to be overwritten
on startup. Thanks to Jann Horn of Google Project Zero for reporting
this vulnerability.</p>
<p>This is a high severity vulnerability and applies to all active
release lines (4.x, 6.x, 8.x) as well as the 7.x line.</p>
<h2>http.get with numeric authorization options creates uninitialized
buffers</h2>
<p>Application code that allows the auth field of the options object
used with http.get() to be set to a number can result in an
uninitialized buffer being created/used as the authentication
string.</p>
<p>This is a low severity defect and only applies to the 4.x release
line.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/</url>
</references>
<dates>
<discovery>2017-06-27</discovery>
<entry>2017-07-12</entry>
</dates>
</vuln>
<vuln vid="b28adc5b-6693-11e7-ad43-f0def16c5c1b">
<topic>nginx -- a specially crafted request might result in an integer overflow</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>0.5.6</ge><lt>1.12.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>0.5.6</ge><lt>1.13.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html">
<p>A security issue was identified in nginx range filter. A specially
crafted request might result in an integer overflow and incorrect
processing of ranges, potentially resulting in sensitive information
leak (CVE-2017-7529).</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html</url>
<cvename>CVE-2017-7529</cvename>
</references>
<dates>
<discovery>2017-07-11</discovery>
<entry>2017-07-11</entry>
</dates>
</vuln>
<vuln vid="aaedf196-6436-11e7-8b49-002590263bf5">
<topic>codeigniter -- input validation bypass</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Form Validation Library rule valid_email could be bypassed if
idn_to_ascii() is available.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-06-19</discovery>
<entry>2017-07-08</entry>
</dates>
</vuln>
<vuln vid="31001c6b-63e7-11e7-85aa-a4badb2f4699">
<topic>irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_07.txt">
<p>When receiving messages with invalid time stamps, Irssi
would try to dereference a NULL pointer.</p>
<p>While updating the internal nick list, Irssi may
incorrectly use the GHashTable interface and free the nick while
updating it. This will then result in use-after-free conditions on each
access of the hash table.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_07.txt</url>
<cvename>CVE-2017-10965</cvename>
<cvename>CVE-2017-10966</cvename>
<freebsdpr>ports/220544</freebsdpr>
</references>
<dates>
<discovery>2017-07-05</discovery>
<entry>2017-07-08</entry>
</dates>
</vuln>
<vuln vid="b396cf6c-62e6-11e7-9def-b499baebfeaf">
<topic>oniguruma -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libevhtp</name>
<range><lt>1.2.14</lt></range>
</package>
<package>
<name>oniguruma4</name>
<range><lt>4.7.2</lt></range>
</package>
<package>
<name>oniguruma5</name>
<range><lt>5.9.7</lt></range>
</package>
<package>
<name>oniguruma6</name>
<range><lt>6.4.0</lt></range>
</package>
<package>
<name>php56-mbstring</name>
<range><lt>5.6.31</lt></range>
</package>
<package>
<name>php70-mbstring</name>
<range><lt>7.0.21</lt></range>
</package>
<package>
<name>php71-mbstring</name>
<range><lt>7.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>the PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php">
<ul>
<li>A stack out-of-bounds read occurs in match_at() during regular
expression searching. A logical error involving order of validation
and access in match_at() could result in an out-of-bounds read from
a stack buffer (CVE-2017-9224).</li>
<li>A heap out-of-bounds write or read occurs in next_state_val()
during regular expression compilation. Octal numbers larger than 0xff
are not handled correctly in fetch_token() and fetch_token_in_cc().
A malformed regular expression containing an octal number in the form
of '\700' would produce an invalid code point value larger than 0xff
in next_state_val(), resulting in an out-of-bounds write memory
corruption (CVE-2017-9226).</li>
<li>A stack out-of-bounds read occurs in mbc_enc_len() during regular
expression searching. Invalid handling of reg->dmin in
forward_search_range() could result in an invalid pointer dereference,
as an out-of-bounds read from a stack buffer (CVE-2017-9227).</li>
<li>A heap out-of-bounds write occurs in bitset_set_range() during
regular expression compilation due to an uninitialized variable from
an incorrect state transition. An incorrect state transition in
parse_char_class() could create an execution path that leaves a
critical local variable uninitialized until it's used as an index,
resulting in an out-of-bounds write memory corruption (CVE-2017-9228).</li>
<li>A SIGSEGV occurs in left_adjust_char_head() during regular expression
compilation. Invalid handling of reg->dmax in forward_search_range() could
result in an invalid pointer dereference, normally as an immediate
denial-of-service condition (CVE-2017-9228).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php</url>
<cvename>CVE-2017-9224</cvename>
<cvename>CVE-2017-9226</cvename>
<cvename>CVE-2017-9227</cvename>
<cvename>CVE-2017-9228</cvename>
<cvename>CVE-2017-9228</cvename>
</references>
<dates>
<discovery>2017-07-06</discovery>
<entry>2017-07-07</entry>
<modified>2018-01-04</modified>
</dates>
</vuln>
<vuln vid="4fc2df49-6279-11e7-be0f-6cf0497db129">
<topic>drupal -- Drupal Core - Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.56</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team Reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-003">
<p>CVE-2017-6920: PECL YAML parser unsafe object handling.</p>
<p>CVE-2017-6921: File REST resource does not properly validate</p>
<p>CVE-2017-6922: Files uploaded by anonymous users into a private
file system can be accessed by other anonymous users.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6920</cvename>
<cvename>CVE-2017-6921</cvename>
<cvename>CVE-2017-6922</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-07-06</entry>
</dates>
</vuln>
<vuln vid="60931f98-55a7-11e7-8514-589cfc0654e1">
<topic>Dropbear -- two vulnerabilities</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2017.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnston reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Fix double-free in server TCP listener cleanup A double-free in
the server could be triggered by an authenticated user if dropbear
is running with -a (Allow connections to forwarded ports from any
host) This could potentially allow arbitrary code execution as root
by an authenticated user.</p>
<p>Fix information disclosure with ~/.ssh/authorized_keys symlink.
Dropbear parsed authorized_keys as root, even if it were a symlink.
The fix is to switch to user permissions when opening authorized_keys.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2017-9078</cvename>
<cvename>CVE-2017-9079</cvename>
</references>
<dates>
<discovery>2017-05-18</discovery>
<entry>2017-07-03</entry>
</dates>
</vuln>
<vuln vid="6e4e35c3-5fd1-11e7-9def-b499baebfeaf">
<topic>smarty3 -- shell injection in math</topic>
<affects>
<package>
<name>smarty3</name>
<range><lt>3.1.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The smarty project reports:</p>
<blockquote cite="https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt">
<p>bugfix {math} shell injection vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt</url>
</references>
<dates>
<discovery>2016-07-19</discovery>
<entry>2017-07-03</entry>
</dates>
</vuln>
<vuln vid="ed3bf433-5d92-11e7-aa14-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack on RSA secret keys</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.7.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html">
<p>Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7526</cvename>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html</url>
</references>
<dates>
<discovery>2017-06-29</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="85ebfa0c-5d8d-11e7-93f7-d43d7e971a1b">
<topic>GitLab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>4.0.0</ge><le>9.0.9</le></range>
<range><ge>9.1.0</ge><le>9.1.6</le></range>
<range><ge>9.2.0</ge><le>9.2.4</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/</url>
</references>
<dates>
<discovery>2017-06-07</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="0b9f4b5e-5d82-11e7-85df-14dae9d5a9d2">
<topic>tor -- security regression</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.3.0.9</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.3.1.4.a</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Project reports:</p>
<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html">
<p>Tor 0.3.0.9 fixes a path selection bug that would allow a client
to use a guard that was in the same network family as a chosen exit
relay. This is a security regression; all clients running earlier
versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or
0.3.1.4-alpha.</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/blog/tor-0309-released-security-update-clients</url>
<url>https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients</url>
<url>https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html</url>
<cvename>CVE-2017-0377</cvename>
</references>
<dates>
<discovery>2017-06-29</discovery>
<entry>2017-06-30</entry>
</dates>
</vuln>
<vuln vid="8c1a271d-56cf-11e7-b9fe-c13eb7bcbf4f">
<topic>exim -- Privilege escalation via multiple memory leaks</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.89_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualsys reports:</p>
<blockquote cite="https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt">
<p>
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369</url>
</references>
<dates>
<discovery>2017-06-19</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="00e4050b-56c1-11e7-8e66-08606e46faad">
<topic>pear-Horde_Image -- DoS vulnerability</topic>
<affects>
<package>
<name>pear-Horde_Image</name>
<range><gt>2.3.0</gt><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael J Rubinsky reports:</p>
<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
<p>The second vulnerability (CVE-2017-9773) is a DOS vulnerability.
This only affects Horde installations that do not have a configured image
handling backend, and thus use the "Null" image driver. It is exploitable by
a logged in user clicking on a maliciously crafted URL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
<cvename>CVE-2017-9773</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="a7003121-56bf-11e7-8e66-08606e46faad">
<topic>pear-Horde_Image -- remote code execution vulnerability</topic>
<affects>
<package>
<name>pear-Horde_Image</name>
<range><ge>2.0.0</ge><lt>2.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael J Rubinsky reports:</p>
<blockquote cite="https://lists.horde.org/archives/announce/2017/001234.html">
<p>The fist vulnerability (CVE-2017-9774) is a Remote Code Execution
vulnerability and is exploitable by a logged in user sending a
maliciously crafted GET request to the Horde server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.horde.org/archives/announce/2017/001234.html</url>
<cvename>CVE-2017-9774</cvename>
</references>
<dates>
<discovery>2017-06-21</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="9f65d382-56a4-11e7-83e3-080027ef73ec">
<topic>OpenVPN -- several vulnerabilities</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.17</lt></range>
<range><ge>2.4.0</ge><lt>2.4.3</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243">
<p>In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In
the process he found several vulnerabilities and reported them to
the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.</p>
<p>This is a list of fixed important vulnerabilities:</p>
<ul>
<li>Remotely-triggerable ASSERT() on malformed IPv6 packet</li>
<li>Pre-authentication remote crash/information disclosure for clients</li>
<li>Potential double-free in --x509-alt-username</li>
<li>Remote-triggerable memory leaks</li>
<li>Post-authentication remote DoS when using the --x509-track option</li>
<li>Null-pointer dereference in establish_http_proxy_passthru()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243</url>
<cvename>CVE-2017-7508</cvename>
<cvename>CVE-2017-7512</cvename>
<cvename>CVE-2017-7520</cvename>
<cvename>CVE-2017-7521</cvename>
<cvename>CVE-2017-7522</cvename>
</references>
<dates>
<discovery>2017-05-19</discovery>
<entry>2017-06-21</entry>
</dates>
</vuln>
<vuln vid="0c2db2aa-5584-11e7-9a7d-b499baebfeaf">
<topic>Apache httpd -- several vulnerabilities</topic>
<affects>
<package>
<name>apache22</name>
<range><lt>2.2.33</lt></range>
</package>
<package>
<name>apache24</name>
<range><lt>2.4.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache httpd project reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):<br/>
Use of the ap_get_basic_auth_pw() by third-party modules outside
of the authentication phase may lead to authentication requirements
being bypassed.</li>
<li>mod_ssl Null Pointer Dereference (CVE-2017-3169):<br/>mod_ssl may
dereference a NULL pointer when third-party modules
call ap_hook_process_connection() during an HTTP request to an HTTPS
port.</li>
<li>mod_http2 Null Pointer Dereference (CVE-2017-7659):<br/> A maliciously
constructed HTTP/2 request could cause mod_http2 to dereference a NULL
pointer and crash the server process.</li>
<li>ap_find_token() Buffer Overread (CVE-2017-7668):<br/>The HTTP strict
parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token
list parsing, which allows ap_find_token() to search past the end of its
input string. By maliciously crafting a sequence of request headers, an
attacker may be able to cause a segmentation fault, or to force
ap_find_token() to return an incorrect value.</li>
<li>mod_mime Buffer Overread (CVE-2017-7679):<br/>mod_mime can read one
byte past the end of a buffer when sending a malicious Content-Type
response header.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://httpd.apache.org/security/vulnerabilities_24.html</url>
<url>https://httpd.apache.org/security/vulnerabilities_22.html</url>
<cvename>CVE-2017-3167</cvename>
<cvename>CVE-2017-3169</cvename>
<cvename>CVE-2017-7659</cvename>
<cvename>CVE-2017-7668</cvename>
<cvename>CVE-2017-7679</cvename>
</references>
<dates>
<discovery>2017-06-20</discovery>
<entry>2017-06-20</entry>
</dates>
</vuln>
<vuln vid="f53dd5cc-527f-11e7-a772-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>59.0.3071.104</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by
Ned Williamson on 2017-05-22</li>
<li>[729991] High CVE-2017-5088: Out of bounds read in V8. Reported by
Xiling Gong of Tencent Security Platform Department on 2017-06-06</li>
<li>[714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by
Michal Bentkowski on 2017-04-21</li>
<li>[732498] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5087</cvename>
<cvename>CVE-2017-5088</cvename>
<cvename>CVE-2017-5089</cvename>
<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html</url>
</references>
<dates>
<discovery>2017-06-15</discovery>
<entry>2017-06-16</entry>
</dates>
</vuln>
<vuln vid="9314058e-5204-11e7-b712-b1a44a034d72">
<topic>cURL -- URL file scheme drive letter buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.53.0</ge><lt>7.54.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170614.html">
<p>When libcurl is given either</p>
<p>1. a file: URL that doesn't use two slashes following the colon, or</p>
<p>2. is told that file is the default scheme to use for URLs without scheme</p>
<p>... and the given path starts with a drive letter and libcurl is built for
Windows or DOS, then libcurl would copy the path with a wrong offset, so that
the end of the given path would write beyond the malloc buffer. Up to seven
bytes too much.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9502</cvename>
<url>https://curl.haxx.se/docs/adv_20170614.html</url>
</references>
<dates>
<discovery>2017-06-14</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="7a92e958-5207-11e7-8d7c-6805ca0b3d42">
<topic>rt and dependent modules -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>rt42</name>
<range><ge>4.2.0</ge><lt>4.2.13_1</lt></range>
</package>
<package>
<name>rt44</name>
<range><ge>4.4.0</ge><lt>4.4.1_1</lt></range>
</package>
<package>
<name>p5-RT-Authen-ExternalAuth</name>
<range><ge>0.9</ge><lt>0.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>BestPractical reports:</p>
<blockquote cite="http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html</url>
<cvename>CVE-2015-7686</cvename>
<cvename>CVE-2016-6127</cvename>
<cvename>CVE-2017-5361</cvename>
<cvename>CVE-2017-5943</cvename>
<cvename>CVE-2017-5944</cvename>
</references>
<dates>
<discovery>2017-06-15</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="cd944b3f-51f6-11e7-b7b2-001c25e46b1d">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>26.0.0.126</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-17.html">
<ul>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2017-3075, CVE-2017-3081,
CVE-2017-3083, CVE-2017-3084).</li>
<li>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2017-3076, CVE-2017-3077,
CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3075</cvename>
<cvename>CVE-2017-3076</cvename>
<cvename>CVE-2017-3077</cvename>
<cvename>CVE-2017-3078</cvename>
<cvename>CVE-2017-3079</cvename>
<cvename>CVE-2017-3081</cvename>
<cvename>CVE-2017-3082</cvename>
<cvename>CVE-2017-3083</cvename>
<cvename>CVE-2017-3084</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-17.html</url>
</references>
<dates>
<discovery>2017-06-13</discovery>
<entry>2017-06-15</entry>
</dates>
</vuln>
<vuln vid="6cec1b0a-da15-467d-8691-1dea392d4c8d">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>54.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>52.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>52.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>52.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5470</cvename>
<cvename>CVE-2017-5471</cvename>
<cvename>CVE-2017-5472</cvename>
<cvename>CVE-2017-7749</cvename>
<cvename>CVE-2017-7750</cvename>
<cvename>CVE-2017-7751</cvename>
<cvename>CVE-2017-7752</cvename>
<cvename>CVE-2017-7754</cvename>
<cvename>CVE-2017-7755</cvename>
<cvename>CVE-2017-7756</cvename>
<cvename>CVE-2017-7757</cvename>
<cvename>CVE-2017-7758</cvename>
<cvename>CVE-2017-7759</cvename>
<cvename>CVE-2017-7760</cvename>
<cvename>CVE-2017-7761</cvename>
<cvename>CVE-2017-7762</cvename>
<cvename>CVE-2017-7763</cvename>
<cvename>CVE-2017-7764</cvename>
<cvename>CVE-2017-7765</cvename>
<cvename>CVE-2017-7766</cvename>
<cvename>CVE-2017-7767</cvename>
<cvename>CVE-2017-7768</cvename>
<cvename>CVE-2017-7778</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/</url>
</references>
<dates>
<discovery>2017-06-13</discovery>
<entry>2017-06-13</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="bce47c89-4d3f-11e7-8080-a4badb2f4699">
<topic>roundcube -- arbitrary password resets</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.2.5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11">
<p>Roundcube Webmail allows arbitrary password resets by
authenticated users. The problem is caused by an improperly restricted
exec call in the virtualmin and sasl drivers of the password plugin.</p>
</blockquote>
</body>
</description>
<references>
<url>https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11</url>
<cvename>CVE-2017-8114</cvename>
</references>
<dates>
<discovery>2017-04-28</discovery>
<entry>2017-06-09</entry>
</dates>
</vuln>
<vuln vid="b33fb1e0-4c37-11e7-afeb-0011d823eebd">
<topic>GnuTLS -- Denial of service vulnerability</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.5.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2017-4">
<p>It was found using the TLS fuzzer tools that decoding a status
response TLS extension with valid contents could lead to a crash
due to a null pointer dereference. The issue affects GnuTLS server
applications.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2017-4</url>
</references>
<dates>
<discovery>2017-06-07</discovery>
<entry>2017-06-08</entry>
</dates>
</vuln>
<vuln vid="165e8951-4be0-11e7-a539-0050569f7e80">
<topic>irssi -- remote DoS</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>1.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joseph Bisch reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_06.txt">
<p>When receiving a DCC message without source nick/host, Irssi would
attempt to dereference a NULL pointer.</p>
<p>When receiving certain incorrectly quoted DCC files, Irssi would
try to find the terminating quote one byte before the allocated
memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9468</cvename>
<cvename>CVE-2017-9469</cvename>
<url>https://irssi.org/security/irssi_sa_2017_06.txt</url>
</references>
<dates>
<discovery>2017-06-06</discovery>
<entry>2017-06-08</entry>
</dates>
</vuln>
<vuln vid="52f4b48b-4ac3-11e7-99aa-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>59.0.3071.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html">
<p>30 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5070</cvename>
<cvename>CVE-2017-5071</cvename>
<cvename>CVE-2017-5072</cvename>
<cvename>CVE-2017-5073</cvename>
<cvename>CVE-2017-5074</cvename>
<cvename>CVE-2017-5075</cvename>
<cvename>CVE-2017-5086</cvename>
<cvename>CVE-2017-5076</cvename>
<cvename>CVE-2017-5077</cvename>
<cvename>CVE-2017-5078</cvename>
<cvename>CVE-2017-5079</cvename>
<cvename>CVE-2017-5080</cvename>
<cvename>CVE-2017-5081</cvename>
<cvename>CVE-2017-5082</cvename>
<cvename>CVE-2017-5083</cvename>
<cvename>CVE-2017-5085</cvename>
<url>https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-06-05</discovery>
<entry>2017-06-06</entry>
</dates>
</vuln>
<vuln vid="15a04b9f-47cb-11e7-a853-001fbc0f280f">
<topic>ansible -- Input validation flaw in jinja2 templating system</topic>
<affects>
<package>
<name>ansible</name>
<range><lt>2.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat security team reports:</p>
<blockquote cite="https://access.redhat.com/security/cve/cve-2017-7481">
<p>An input validation flaw was found in Ansible, where it fails to
properly mark lookup-plugin results as unsafe. If an attacker could
control the results of lookup() calls, they could inject Unicode
strings to be parsed by the jinja2 templating system, result in
code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://access.redhat.com/security/cve/cve-2017-7481</url>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481</url>
</references>
<dates>
<discovery>2017-05-09</discovery>
<entry>2017-06-02</entry>
</dates>
</vuln>
<vuln vid="738e8ae1-46dd-11e7-a539-0050569f7e80">
<topic>duo -- Two-factor authentication bypass</topic>
<affects>
<package>
<name>duo</name>
<range><lt>1.9.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The duo security team reports:</p>
<blockquote cite="https://duo.com/labs/psa/duo-psa-2017-002">
<p>An untrusted user may be able to set the http_proxy variable to
an invalid address. If this happens, this will trigger the
configured 'failmode' behavior, which defaults to safe. Safe
mode causes the authentication to report a success.</p>
</blockquote>
</body>
</description>
<references>
<url>https://duo.com/labs/psa/duo-psa-2017-002</url>
</references>
<dates>
<discovery>2017-05-19</discovery>
<entry>2017-06-01</entry>
</dates>
</vuln>
<vuln vid="673dce46-46d0-11e7-a539-0050569f7e80">
<topic>FreeRADIUS -- TLS resumption authentication bypass</topic>
<affects>
<package>
<name>freeradius</name>
<name>freeradius2</name>
<name>freeradius3</name>
<range><lt>3.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stefan Winter reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q2/342">
<p>The TLS session cache in FreeRADIUS before 3.0.14 fails to
reliably prevent resumption of an unauthenticated session, which
allows remote attackers (such as malicious 802.1X supplicants) to
bypass authentication via PEAP or TTLS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-9148</cvename>
<url>http://freeradius.org/security.html</url>
<url>http://seclists.org/oss-sec/2017/q2/342</url>
<url>http://www.securityfocus.com/bid/98734</url>
</references>
<dates>
<discovery>2017-02-03</discovery>
<entry>2017-06-01</entry>
</dates>
</vuln>
<vuln vid="40a8d798-4615-11e7-8080-a4badb2f4699">
<topic>heimdal -- bypass of capath policy</topic>
<affects>
<package>
<name>heimdal</name>
<range><lt>7.1.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Viktor Dukhovni reports:</p>
<blockquote cite="https://www.h5l.org/advisories.html?show=2017-04-13">
<p>Commit f469fc6 (2010-10-02) inadvertently caused the
previous hop realm to not be added to the transit path of issued
tickets. This may, in some cases, enable bypass of capath policy in
Heimdal versions 1.5 through 7.2. Note, this may break sites that rely
on the bug. With the bug some incomplete [capaths] worked, that should
not have. These may now break authentication in some cross-realm
configurations. (CVE-2017-6594)</p>
</blockquote>
</body>
</description>
<references>
<url>CVE-2017-6594</url>
<freebsdpr>ports/219657</freebsdpr>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-05-31</entry>
</dates>
</vuln>
<vuln vid="51d1282d-420e-11e7-82c5-14dae9d210b8">
<topic>FreeBSD -- ipfilter(4) fragment handling panic</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_10</lt></range>
<range><ge>10.3</ge><lt>10.3_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>ipfilter(4), capable of stateful packet inspection, using
the "keep state" or "keep frags" rule options, will not
only maintain the state of connections, such as TCP streams
or UDP communication, it also maintains the state of
fragmented packets. When a packet fragments are received
they are cached in a hash table (and linked list). When a
fragment is received it is compared with fragments already
cached in the hash table for a match. If it does not match
the new entry is used to create a new entry in the hash
table. If on the other hand it does match, unfortunately
the wrong entry is freed, the entry in the hash table. This
results in use after free panic (and for a brief moment
prior to the panic a memory leak due to the wrong entry
being freed).</p>
<h1>Impact:</h1>
<p>Carefully feeding fragments that are allowed to pass by
an ipfilter(4) firewall can be used to cause a panic followed
by reboot loop denial of service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2017-1081</cvename>
<freebsdsa>SA-17:04.ipfilter</freebsdsa>
</references>
<dates>
<discovery>2017-04-27</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="3c0237f5-420e-11e7-82c5-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_9</lt></range>
<range><ge>10.3</ge><lt>10.3_18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A vulnerability was discovered in the NTP server's parsing
of configuration directives. [CVE-2017-6464]</p>
<p>A vulnerability was found in NTP, in the parsing of
packets from the DPTS Clock. [CVE-2017-6462]</p>
<p>A vulnerability was discovered in the NTP server's parsing
of configuration directives. [CVE-2017-6463]</p>
<p>A vulnerability was found in NTP, affecting the origin
timestamp check function. [CVE-2016-9042]</p>
<h1>Impact:</h1>
<p>A remote, authenticated attacker could cause ntpd to
crash by sending a crafted message. [CVE-2017-6463,
CVE-2017-6464]</p>
<p>A malicious device could send crafted messages, causing
ntpd to crash. [CVE-2017-6462]</p>
<p>An attacker able to spoof messages from all of the
configured peers could send crafted packets to ntpd, causing
later replies from those peers to be discarded, resulting
in denial of service. [CVE-2016-9042]</p>
</body>
</description>
<references>
<cvename>CVE-2016-9042</cvename>
<cvename>CVE-2017-6462</cvename>
<cvename>CVE-2017-6463</cvename>
<cvename>CVE-2017-6464</cvename>
<freebsdsa>SA-17:03.ntp</freebsdsa>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="ec6aeb8e-41e4-11e7-aa00-5404a68ad561">
<topic>vlc -- remote code execution via crafted subtitles</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.6,4</lt></range>
</package>
<package>
<name>vlc-qt4</name>
<range><lt>2.2.6,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Check Point research team reports:</p>
<blockquote cite="http://blog.checkpoint.com/2017/05/23/hacked-in-translation/">
<p>Remote code execution via crafted subtitles</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.checkpoint.com/2017/05/23/hacked-in-translation/</url>
</references>
<dates>
<discovery>2017-05-23</discovery>
<entry>2017-05-26</entry>
</dates>
</vuln>
<vuln vid="803879e9-4195-11e7-9b08-080027ef73ec">
<topic>OpenEXR -- multiple remote code execution and denial of service vulnerabilities</topic>
<affects>
<package>
<name>OpenEXR</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brandon Perry reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/05/12/5">
<p>[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).</p>
<ul>
<li>CVE-2017-9110
In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9111
In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9112
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9113
In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9114
In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.</li>
<li>CVE-2017-9115
In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.</li>
<li>CVE-2017-9116
In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/05/12/5</url>
<cvename>CVE-2017-9110</cvename>
<cvename>CVE-2017-9111</cvename>
<cvename>CVE-2017-9112</cvename>
<cvename>CVE-2017-9113</cvename>
<cvename>CVE-2017-9114</cvename>
<cvename>CVE-2017-9115</cvename>
<cvename>CVE-2017-9116</cvename>
<url>https://github.com/openexr/openexr/issues/232</url>
</references>
<dates>
<discovery>2017-01-12</discovery>
<entry>2017-05-25</entry>
</dates>
</vuln>
<vuln vid="50776801-4183-11e7-b291-b499baebfeaf">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.6.4_2,1</lt></range>
<range><ge>6.9.7.0,1</ge><lt>6.9.8.8,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://nvd.nist.gov/vuln/search/results?query=ImageMagick">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://nvd.nist.gov/vuln/search/results?query=ImageMagick</url>
<cvename>CVE-2017-5506</cvename>
<cvename>CVE-2017-5507</cvename>
<cvename>CVE-2017-5508</cvename>
<cvename>CVE-2017-5509</cvename>
<cvename>CVE-2017-5510</cvename>
<cvename>CVE-2017-5511</cvename>
<cvename>CVE-2017-6497</cvename>
<cvename>CVE-2017-6498</cvename>
<cvename>CVE-2017-6499</cvename>
<cvename>CVE-2017-6500</cvename>
<cvename>CVE-2017-6501</cvename>
<cvename>CVE-2017-6502</cvename>
<cvename>CVE-2017-7275</cvename>
<cvename>CVE-2017-7606</cvename>
<cvename>CVE-2017-7619</cvename>
<cvename>CVE-2017-7941</cvename>
<cvename>CVE-2017-7942</cvename>
<cvename>CVE-2017-7943</cvename>
<cvename>CVE-2017-8343</cvename>
<cvename>CVE-2017-8344</cvename>
<cvename>CVE-2017-8345</cvename>
<cvename>CVE-2017-8346</cvename>
<cvename>CVE-2017-8347</cvename>
<cvename>CVE-2017-8348</cvename>
<cvename>CVE-2017-8349</cvename>
<cvename>CVE-2017-8350</cvename>
<cvename>CVE-2017-8351</cvename>
<cvename>CVE-2017-8352</cvename>
<cvename>CVE-2017-8353</cvename>
<cvename>CVE-2017-8354</cvename>
<cvename>CVE-2017-8355</cvename>
<cvename>CVE-2017-8356</cvename>
<cvename>CVE-2017-8357</cvename>
<cvename>CVE-2017-8765</cvename>
<cvename>CVE-2017-8830</cvename>
<cvename>CVE-2017-9141</cvename>
<cvename>CVE-2017-9142</cvename>
<cvename>CVE-2017-9143</cvename>
<cvename>CVE-2017-9144</cvename>
</references>
<dates>
<discovery>2017-03-05</discovery>
<entry>2017-05-25</entry>
<modified>2017-05-29</modified>
</dates>
</vuln>
<vuln vid="6f4d96c0-4062-11e7-b291-b499baebfeaf">
<topic>samba -- remote code execution vulnerability</topic>
<affects>
<package>
<name>samba42</name>
<range><lt>4.2.15</lt></range>
</package>
<package>
<name>samba43</name>
<range><lt>4.3.14</lt></range>
</package>
<package>
<name>samba44</name>
<range><lt>4.4.14</lt></range>
</package>
<package>
<name>samba45</name>
<range><lt>4.5.10</lt></range>
</package>
<package>
<name>samba46</name>
<range><lt>4.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The samba project reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-7494.html">
<p>Remote code execution from a writable share.</p>
<p>All versions of Samba from 3.5.0 onwards are vulnerable to a remote
code execution vulnerability, allowing a malicious client to upload
a shared library to a writable share, and then cause the server to
load and execute it.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-7494.html</url>
<cvename>CVE-2017-7494</cvename>
</references>
<dates>
<discovery>2017-05-24</discovery>
<entry>2017-05-24</entry>
</dates>
</vuln>
<vuln vid="f52e3a8d-3f7e-11e7-97a9-a0d3c19bfa21">
<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>375.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4462">
<p>NVIDIA GPU Display Driver contains vulnerabilities in the
kernel mode layer handler where not correctly validated user
input, NULL pointer dereference, and incorrect access control
may lead to denial of service or potential escalation of
privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0350</cvename>
<cvename>CVE-2017-0351</cvename>
<cvename>CVE-2017-0352</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4462</url>
</references>
<dates>
<discovery>2017-05-15</discovery>
<entry>2017-05-23</entry>
</dates>
</vuln>
<vuln vid="da1d5d2e-3eca-11e7-8861-0018fe623f2b">
<topic>miniupnpc -- integer signedness error</topic>
<affects>
<package>
<name>miniupnpc</name>
<range><lt>2.0.20170509</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tintinweb reports:</p>
<blockquote cite="https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798">
<p>An integer signedness error was found in miniupnp's miniwget
allowing an unauthenticated remote entity typically located on the
local network segment to trigger a heap corruption or an access
violation in miniupnp's http response parser when processing a
specially crafted chunked-encoded response to a request for the
xml root description url.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8798</cvename>
<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798</url>
</references>
<dates>
<discovery>2017-05-09</discovery>
<entry>2017-05-22</entry>
</dates>
</vuln>
<vuln vid="a5bb7ea0-3e58-11e7-94a2-00e04c1ea73d">
<topic>Wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<name>fr-wordpress</name>
<range><lt>4.7.5,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://wordpress.org/news/2017/05/wordpress-4-7-5/">
<p>WordPress versions 4.7.4 and earlier are affected by six security issues</p>
<ul>
<li>Insufficient redirect validation in the HTTP class.</li>
<li>Improper handling of post meta data values in the XML-RPC API.</li>
<li>Lack of capability checks for post meta data in the XML-RPC API.</li>
<li>A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.</li>
<li>A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2017/05/wordpress-4-7-5/</url>
</references>
<dates>
<discovery>2017-05-16</discovery>
<entry>2017-05-21</entry>
</dates>
</vuln>
<vuln vid="fab87bff-3ce5-11e7-bf9d-001999f8d30b">
<topic>asterisk -- Memory exhaustion on short SCCP packets</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.15.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A remote memory exhaustion can be triggered by sending
an SCCP packet to Asterisk system with "chan_skinny"
enabled that is larger than the length of the SCCP header
but smaller than the packet length specified in the header.
The loop that reads the rest of the packet doesn't detect
that the call to read() returned end-of-file before the
expected number of bytes and continues infinitely. The
"partial data" message logging in that tight loop causes
Asterisk to exhaust all available memory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-004.html</url>
</references>
<dates>
<discovery>2017-04-13</discovery>
<entry>2017-05-19</entry>
</dates>
</vuln>
<vuln vid="0537afa3-3ce0-11e7-bf9d-001999f8d30b">
<topic>asterisk -- Buffer Overrun in PJSIP transaction layer</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.15.1</lt></range>
</package>
<package>
<name>pjsip</name>
<range><lt>2.6_1</lt></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><lt>2.6_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>A remote crash can be triggered by sending a SIP packet
to Asterisk with a specially crafted CSeq header and a
Via header with no branch parameter. The issue is that
the PJSIP RFC 2543 transaction key generation algorithm
does not allocate a large enough buffer. By overrunning
the buffer, the memory allocation table becomes corrupted,
leading to an eventual crash.</p>
<p>The multi-part body parser in PJSIP contains a logical
error that can make certain multi-part body parts attempt
to read memory from outside the allowed boundaries. A
specially-crafted packet can trigger these invalid reads
and potentially induce a crash.</p>
<p>This issues is in PJSIP, and so the issue can be fixed
without performing an upgrade of Asterisk at all. However,
we are releasing a new version of Asterisk with the bundled
PJProject updated to include the fix.</p>
<p>If you are running Asterisk with chan_sip, this issue
does not affect you.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-002.html</url>
<url>http://downloads.asterisk.org/pub/security/AST-2017-003.html</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-05-19</entry>
</dates>
</vuln>
<vuln vid="3c2549b3-3bed-11e7-a9f0-a4badb296695">
<topic>Joomla3 -- SQL Injection</topic>
<affects>
<package>
<name>joomla3</name>
<range><eq>3.7.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>JSST reports:</p>
<blockquote cite="https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html">
<p>Inadequate filtering of request data leads to a SQL Injection vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8917</cvename>
<url>https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html</url>
</references>
<dates>
<discovery>2017-05-11</discovery>
<entry>2017-05-18</entry>
</dates>
</vuln>
<vuln vid="9704930c-3bb7-11e7-93f7-d43d7e971a1b">
<topic>gitlab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>6.6.0</ge><le>8.17.5</le></range>
<range><ge>9.0.0</ge><le>9.0.6</le></range>
<range><ge>9.1.0</ge><le>9.1.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/</url>
</references>
<dates>
<discovery>2017-05-08</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>
<vuln vid="5d62950f-3bb5-11e7-93f7-d43d7e971a1b">
<topic>gitlab -- Various security issues</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.7.0</ge><le>8.15.7</le></range>
<range><ge>8.16.0</ge><le>8.16.7</le></range>
<range><ge>8.17.0</ge><le>8.17.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/">
<h1>Information Disclosure in Issue and Merge Request Trackers</h1>
<p>During an internal code review a critical vulnerability in the GitLab
Issue and Merge Request trackers was discovered. This vulnerability could
allow a user with access to assign ownership of an issue or merge request to
another user to disclose that user's private token, email token, email
address, and encrypted OTP secret. Reporter-level access to a GitLab project
is required to exploit this flaw.</p>
<h1>SSRF when importing a project from a Repo by URL</h1>
<p>GitLab instances that have enabled project imports using "Repo by URL"
were vulnerable to Server-Side Request Forgery attacks. By specifying a
project import URL of localhost an attacker could target services that are
bound to the local interface of the server. These services often do not
require authentication. Depending on the service an attacker might be able
craft an attack using the project import request URL.</p>
<h1>Links in Environments tab vulnerable to tabnabbing</h1>
<p>edio via HackerOne reported that user-configured Environment links
include target=_blank but do not also include rel: noopener
noreferrer. Anyone clicking on these links may therefore be subjected to
tabnabbing attacks where a link back to the requesting page is maintained
and can be manipulated by the target server.</p>
<h1>Accounts with email set to "Do not show on profile" have addresses
exposed in public atom feed</h1>
<p>Several GitLab users reported that even with "Do not show on profile"
configured for their email addresses those addresses were still being leaked
in Atom feeds if they commented on a public project.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0882</cvename>
<url>https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/</url>
</references>
<dates>
<discovery>2017-03-20</discovery>
<entry>2017-05-18</entry>
<modified>2017-05-30</modified>
</dates>
</vuln>
<vuln vid="4a088d67-3af2-11e7-9d75-c86000169601">
<topic>freetype2 -- buffer overflows</topic>
<affects>
<package>
<name>freetype2</name>
<range><lt>2.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Lemberg reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html">
<p>CVE-2017-8105, CVE-2017-8287: Older FreeType versions have
out-of-bounds writes caused by heap-based buffer overflows
related to Type 1 fonts.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html</url>
<cvename>CVE-2017-8105</cvename>
<cvename>CVE-2017-8287</cvename>
</references>
<dates>
<discovery>2017-05-17</discovery>
<entry>2017-05-17</entry>
</dates>
</vuln>
<vuln vid="04cc7bd2-3686-11e7-aa64-080027ef73ec">
<topic>OpenVPN -- two remote denial-of-service vulnerabilities</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.15</lt></range>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
<package>
<name>openvpn23</name>
<range><lt>2.3.15</lt></range>
</package>
<package>
<name>openvpn-mbedtls</name>
<range><ge>2.4.0</ge><lt>2.4.2</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.15</lt></range>
</package>
<package>
<name>openvpn23-polarssl</name>
<range><lt>2.3.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://openvpn.net/index.php/open-source/downloads.html">
<p>OpenVPN v2.4.0 was audited for security vulnerabilities independently by
Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by
Private Internet Access) between December 2016 and April 2017. The
primary findings were two remote denial-of-service vulnerabilities.
Fixes to them have been backported to v2.3.15.</p>
<p>An authenticated client can do the 'three way handshake'
(P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet
is the first that is allowed to carry payload. If that payload is
too big, the OpenVPN server process will stop running due to an
ASSERT() exception. That is also the reason why servers using
tls-auth/tls-crypt are protected against this attack - the P_CONTROL
packet is only accepted if it contains the session ID we specified,
with a valid HMAC (challenge-response). (CVE-2017-7478)</p>
<p>An authenticated client can cause the server's the packet-id
counter to roll over, which would lead the server process to hit an
ASSERT() and stop running. To make the server hit the ASSERT(), the
client must first cause the server to send it 2^32 packets (at least
196 GB).</p>
</blockquote>
</body>
</description>
<references>
<url>https://openvpn.net/index.php/open-source/downloads.html</url>
<cvename>CVE-2017-7478</cvename>
<cvename>CVE-2017-7479</cvename>
<url>https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits</url>
<url>https://ostif.org/?p=870&preview=true</url>
<url>https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/</url>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-05-11</entry>
</dates>
</vuln>
<vuln vid="414c18bf-3653-11e7-9550-6cc21735f730">
<topic>PostgreSQL vulnerabilities</topic>
<affects>
<package>
<name>postgresql92-client</name>
<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
</package>
<package>
<name>postgresql93-client</name>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
</package>
<package>
<name>postgresql94-client</name>
<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
</package>
<package>
<name>postgresql95-client</name>
<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
</package>
<package>
<name>postgresql96-client</name>
<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.20</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.16</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.11</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.6</lt></range>
</package>
<package>
<name>postgresql96-server</name>
<range><ge>9.6.0</ge><lt>9.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1746/">
<p>
Security Fixes nested CASE expressions +
database and role names with embedded special characters
</p>
<ul>
<li>CVE-2017-7484: selectivity estimators bypass SELECT privilege
checks.
</li>
<li>CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
</li>
<li>CVE-2017-7486: pg_user_mappings view discloses foreign server
passwords. This applies to new databases, see the release notes for
the procedure to apply the fix to an existing database.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5423</cvename>
<cvename>CVE-2016-5424</cvename>
</references>
<dates>
<discovery>2017-05-11</discovery>
<entry>2017-05-11</entry>
</dates>
</vuln>
<vuln vid="0baee383-356c-11e7-b9a9-50e549ebab6c">
<topic>kauth: Local privilege escalation</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.30_4</lt></range>
</package>
<package>
<name>kf5-kauth</name>
<range><lt>5.33.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170510-1.txt">
<p>KAuth contains a logic flaw in which the service invoking dbus
is not properly checked.
This allows spoofing the identity of the caller and with some
carefully crafted calls can lead to gaining root from an
unprivileged account.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8422</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2017/05/10/3</mlist>
<url>https://www.kde.org/info/security/advisory-20170510-1.txt</url>
</references>
<dates>
<discovery>2017-05-10</discovery>
<entry>2017-05-10</entry>
</dates>
</vuln>
<vuln vid="57600032-34fe-11e7-8965-bcaec524bf84">
<topic>libetpan -- null dereference vulnerability in MIME parsing component</topic>
<affects>
<package>
<name>libetpan</name>
<range><lt>1.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>rwhitworth reports:</p>
<blockquote cite="https://github.com/dinhviethoa/libetpan/issues/274">
<p>I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the
mime-parse test program. Is fixing these crashes something you're
interested in? The input files can be found here:
https://github.com/rwhitworth/libetpan-fuzz/.
The files can be executed as ./mime-parse id_filename to cause
seg faults.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-8825</cvename>
<url>http://cve.circl.lu/cve/CVE-2017-8825</url>
</references>
<dates>
<discovery>2017-04-29</discovery>
<entry>2017-05-09</entry>
</dates>
</vuln>
<vuln vid="92e345d0-304d-11e7-8359-e8e0b747a45a">
<topic>chromium -- race condition vulnerability</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>58.0.3029.96</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html">
<p>1 security fix in this release:</p>
</blockquote>
<ul>
<li>[679306] High CVE-2017-5068: Race condition in WebRTC. Credit to
Philipp Hancke</li>
</ul>
</body>
</description>
<references>
<cvename>CVE-2017-5068</cvename>
<url>https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-05-02</discovery>
<entry>2017-05-03</entry>
</dates>
</vuln>
<vuln vid="a8c8001b-216c-11e7-80aa-005056925db4">
<topic>dovecot -- Dovecot DoS when passdb dict was used for authentication</topic>
<affects>
<package>
<name>dovecot</name>
<name>dovecot2</name>
<range><gt>2.2.25_6</gt><lt>2.2.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Timo Sirainen reports:</p>
<blockquote cite="https://dovecot.org/list/dovecot-news/2017-April/000341.html">
<p>passdb/userdb dict: Don't double-expand %variables in keys. If dict
was used as the authentication passdb, using specially crafted
%variables in the username could be used to cause DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2669</cvename>
<mlist>https://dovecot.org/list/dovecot-news/2017-April/000341.html</mlist>
<mlist>https://dovecot.org/list/dovecot-news/2017-April/000342.html</mlist>
</references>
<dates>
<discovery>2016-12-01</discovery>
<entry>2017-04-30</entry>
</dates>
</vuln>
<vuln vid="24673ed7-2bf3-11e7-b291-b499baebfeaf">
<topic>LibreSSL -- TLS verification vulnerability</topic>
<affects>
<package>
<name>libressl</name>
<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><ge>2.5.1</ge><lt>2.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> Jakub Jirutka reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q2/145">
<p>LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if
SSL_get_verify_result is relied upon for a later check of a
verification result, in a use case where a user-provided verification
callback returns 1, as demonstrated by acceptance of invalid
certificates by nginx.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q2/145</url>
<url>https://github.com/libressl-portable/portable/issues/307</url>
<cvename>CVE-2017-8301</cvename>
</references>
<dates>
<discovery>2017-04-27</discovery>
<entry>2017-04-28</entry>
</dates>
</vuln>
<vuln vid="631c4710-9be5-4a80-9310-eb2847fe24dd">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.57</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.46.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://jenkins.io/security/advisory/2017-04-26/">
<h1>Description</h1>
<h5>SECURITY-412 through SECURITY-420 / CVE-2017-1000356</h5>
<p>CSRF: Multiple vulnerabilities</p>
<h5>SECURITY-429 / CVE-2017-1000353</h5>
<p>CLI: Unauthenticated remote code execution</p>
<h5>SECURITY-466 / CVE-2017-1000354</h5>
<p>CLI: Login command allowed impersonating any Jenkins user</p>
<h5>SECURITY-503 / CVE-2017-1000355</h5>
<p>XStream: Java crash when trying to instantiate void/Void</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-1000356</cvename>
<cvename>CVE-2017-1000353</cvename>
<cvename>CVE-2017-1000354</cvename>
<cvename>CVE-2017-1000355</cvename>
<url>https://jenkins.io/security/advisory/2017-04-26/</url>
</references>
<dates>
<discovery>2017-04-26</discovery>
<entry>2017-04-27</entry>
</dates>
</vuln>
<vuln vid="df0144fb-295e-11e7-970f-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed a header injection vulnerability in common function
set_status_header() under Apache (thanks to Guillermo Caminer from
Flowgate).</p>
<p>Fixed byte-safety issues in Encrypt Library (DEPRECATED) when
mbstring.func_overload is enabled.</p>
<p>Fixed byte-safety issues in Encryption Library when
mbstring.func_overload is enabled.</p>
<p>Fixed byte-safety issues in compatibility functions
password_hash(), hash_pbkdf2() when mbstring.func_overload is
enabled.</p>
<p>Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv()
with MCRYPT_DEV_URANDOM.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-03-23</discovery>
<entry>2017-04-25</entry>
</dates>
</vuln>
<vuln vid="81433129-2916-11e7-ad3e-00e04c1ea73d">
<topic>weechat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>weechat</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Common Vulnerabilities and Exposures:</p>
<blockquote cite="https://weechat.org/download/security/">
<p>WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to
the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes
function during quote removal, with a buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://weechat.org/download/security/</url>
<cvename>CVE-2017-8073</cvename>
</references>
<dates>
<discovery>2017-04-23</discovery>
<entry>2017-04-24</entry>
</dates>
</vuln>
<vuln vid="1455c86c-26c2-11e7-9daa-6cf0497db129">
<topic>drupal8 -- Drupal Core - Critical - Access Bypass</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team Reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2017-002">
<p>CVE-2017-6919: Access bypass</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6919</cvename>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-21</entry>
</dates>
</vuln>
<vuln vid="95a74a48-2691-11e7-9e2d-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-pulse</name>
<range><lt>58.0.3029.81</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html">
<p>29 security fixes in this release, including:</p>
<ul>
<li>[695826] High CVE-2017-5057: Type confusion in PDFium. Credit to
Guang Gong of Alpha Team, Qihoo 360</li>
<li>[694382] High CVE-2017-5058: Heap use after free in Print Preview.
Credit to Khalil Zhani</li>
<li>[684684] High CVE-2017-5059: Type confusion in Blink. Credit to
SkyLined working with Trend Micro's Zero Day Initiative</li>
<li>[683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to
Xudong Zheng</li>
<li>[672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to
Haosheng Wang (@gnehsoah)</li>
<li>[702896] Medium CVE-2017-5062: Use after free in Chrome Apps.
Credit to anonymous</li>
<li>[700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to
Sweetchip</li>
<li>[693974] Medium CVE-2017-5064: Use after free in Blink. Credit to
Wadih Matar</li>
<li>[704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to
Khalil Zhani</li>
<li>[690821] Medium CVE-2017-5066: Incorrect signature handing in Networking.
Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen
(ICTT, Xidian University)</li>
<li>[648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to
Khalil Zhani</li>
<li>[691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to
Michael Reizelman</li>
<li>[713205] Various fixes from internal audits, fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5057</cvename>
<cvename>CVE-2017-5058</cvename>
<cvename>CVE-2017-5059</cvename>
<cvename>CVE-2017-5060</cvename>
<cvename>CVE-2017-5061</cvename>
<cvename>CVE-2017-5062</cvename>
<cvename>CVE-2017-5063</cvename>
<cvename>CVE-2017-5064</cvename>
<cvename>CVE-2017-5065</cvename>
<cvename>CVE-2017-5066</cvename>
<cvename>CVE-2017-5067</cvename>
<cvename>CVE-2017-5069</cvename>
<url>https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-21</entry>
</dates>
</vuln>
<vuln vid="607f8b57-7454-42c6-a88a-8706f327076d">
<topic>icu -- multiple vulnerabilities</topic>
<affects>
<package>
<name>icu</name>
<range><lt>58.2_2,1</lt></range>
</package>
<package>
<name>linux-c6-icu</name>
<name>linux-c7-icu</name>
<range><lt>59.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7867">
<p>International Components for Unicode (ICU) for C/C++
before 2017-02-13 has an out-of-bounds write caused by a
heap-based buffer overflow related to the utf8TextAccess
function in common/utext.cpp and the utext_setNativeIndex*
function.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7868">
<p>International Components for Unicode (ICU) for C/C++
before 2017-02-13 has an out-of-bounds write caused by a
heap-based buffer overflow related to the utf8TextAccess
function in common/utext.cpp and the utext_moveIndex32*
function.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7867</cvename>
<cvename>CVE-2017-7868</cvename>
<url>http://bugs.icu-project.org/trac/changeset/39671</url>
<url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437</url>
</references>
<dates>
<discovery>2017-01-21</discovery>
<entry>2017-04-20</entry>
<modified>2017-05-04</modified>
</dates>
</vuln>
<vuln vid="2a96e498-3234-4950-a9ad-419bc84a839d">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<name>linux-f8-tiff</name>
<name>linux-f10-tiff</name>
<name>linux-c6-tiff</name>
<name>linux-c7-tiff</name>
<range><lt>4.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-5225">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5225</cvename>
<cvename>CVE-2017-7592</cvename>
<cvename>CVE-2017-7593</cvename>
<cvename>CVE-2017-7594</cvename>
<cvename>CVE-2017-7595</cvename>
<cvename>CVE-2017-7596</cvename>
<cvename>CVE-2017-7597</cvename>
<cvename>CVE-2017-7598</cvename>
<cvename>CVE-2017-7599</cvename>
<cvename>CVE-2017-7600</cvename>
<cvename>CVE-2017-7601</cvename>
<cvename>CVE-2017-7602</cvename>
<url>https://github.com/vadz/libtiff/commit/5c080298d59e</url>
<url>https://github.com/vadz/libtiff/commit/48780b4fcc42</url>
<url>https://github.com/vadz/libtiff/commit/d60332057b95</url>
<url>https://github.com/vadz/libtiff/commit/2ea32f7372b6</url>
<url>https://github.com/vadz/libtiff/commit/8283e4d1b7e5</url>
<url>https://github.com/vadz/libtiff/commit/47f2fb61a3a6</url>
<url>https://github.com/vadz/libtiff/commit/3cfd62d77c2a</url>
<url>https://github.com/vadz/libtiff/commit/3144e57770c1</url>
<url>https://github.com/vadz/libtiff/commit/0a76a8c765c7</url>
<url>https://github.com/vadz/libtiff/commit/66e7bd595209</url>
</references>
<dates>
<discovery>2017-04-01</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="d44129d6-b22e-4e9c-b200-6a46e8bd3e60">
<topic>libsamplerate -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsamplerate</name>
<name>linux-c6-libsamplerate</name>
<name>linux-c7-libsamplerate</name>
<range><lt>0.1.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7697">
<p>In libsamplerate before 0.1.9, a buffer over-read
occurs in the calc_output_single function in src_sinc.c
via a crafted audio file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7697</cvename>
<url>https://github.com/erikd/libsamplerate/commit/c3b66186656d</url>
</references>
<dates>
<discovery>2017-04-11</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="5a97805e-93ef-4dcb-8d5e-dbcac263bfc2">
<topic>libsndfile -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libsndfile</name>
<name>linux-c6-libsndfile</name>
<name>linux-c7-libsndfile</name>
<range><lt>1.0.28_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7585">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a stack-based buffer overflow via a specially crafted
FLAC file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7586">
<p>In libsndfile before 1.0.28, an error in the
"header_read()" function (common.c) when handling ID3 tags
can be exploited to cause a stack-based buffer overflow
via a specially crafted FLAC file.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7741">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a segmentation violation (with write memory access)
via a specially crafted FLAC file during a resample
attempt, a similar issue to CVE-2017-7585.</p>
</blockquote>
<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7742">
<p>In libsndfile before 1.0.28, an error in the
"flac_buffer_copy()" function (flac.c) can be exploited to
cause a segmentation violation (with read memory access)
via a specially crafted FLAC file during a resample
attempt, a similar issue to CVE-2017-7585.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7585</cvename>
<cvename>CVE-2017-7586</cvename>
<cvename>CVE-2017-7741</cvename>
<cvename>CVE-2017-7742</cvename>
<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
<url>https://github.com/erikd/libsndfile/commit/708e996c87c5</url>
<url>https://github.com/erikd/libsndfile/commit/f457b7b5ecfe</url>
<url>https://github.com/erikd/libsndfile/commit/60b234301adf</url>
</references>
<dates>
<discovery>2017-04-07</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="3e2e9b44-25ce-11e7-a175-939b30e0836d">
<topic>cURL -- TLS session resumption client cert bypass (again)</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.54.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>cURL security advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170419.html">
<p>libcurl would attempt to resume a TLS session even if the client
certificate had changed. That is unacceptable since a server by
specification is allowed to skip the client certificate check on
resume, and may instead use the old identity which was established
by the previous certificate (or no certificate).</p>
<p>libcurl supports by default the use of TLS session id/ticket to
resume previous TLS sessions to speed up subsequent TLS handshakes.
They are used when for any reason an existing TLS connection
couldn't be kept alive to make the next handshake faster.</p>
<p>This flaw is a regression and identical to CVE-2016-5419 reported
on August 3rd 2016, but affecting a different version range.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7468</cvename>
<url>https://curl.haxx.se/docs/adv_20170419.html</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-20</entry>
</dates>
</vuln>
<vuln vid="cf133acc-82e7-4755-a66a-5ddf90dacbe6">
<topic>graphite2 -- out-of-bounds write with malicious font</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.9_1</lt></range>
</package>
<package>
<name>linux-c7-graphite2</name>
<range><lt>1.3.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>An out-of-bounds write in the Graphite 2 library
triggered with a maliciously crafted Graphite font. This
results in a potentially exploitable crash. This issue was
fixed in the Graphite 2 library as well as Mozilla
products.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5436</cvename>
<url>https://github.com/silnrsi/graphite/commit/1ce331d5548b</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
<modified>2017-04-20</modified>
</dates>
</vuln>
<vuln vid="b8ee7a81-a879-4358-9b30-7dd1bd4c14b1">
<topic>libevent -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libevent</name>
<name>libevent2</name>
<name>linux-c6-libevent2</name>
<name>linux-c7-libevent</name>
<range><lt>2.1.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian Security reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/DSA-3789-1">
<p>CVE-2016-10195: The name_parse function in evdns.c in
libevent before 2.1.6-beta allows remote attackers to have
unspecified impact via vectors involving the label_len
variable, which triggers an out-of-bounds stack read.</p>
<p>CVE-2016-10196: Stack-based buffer overflow in the
evutil_parse_sockaddr_port function in evutil.c in libevent
before 2.1.6-beta allows attackers to cause a denial of
service (segmentation fault) via vectors involving a long
string in brackets in the ip_as_string argument.</p>
<p>CVE-2016-10197: The search_make_new function in evdns.c
in libevent before 2.1.6-beta allows attackers to cause a
denial of service (out-of-bounds read) via an empty
hostname.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10195</cvename>
<cvename>CVE-2016-10196</cvename>
<cvename>CVE-2016-10197</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/31/17</url>
<url>https://github.com/libevent/libevent/issues/317</url>
<url>https://github.com/libevent/libevent/issues/318</url>
<url>https://github.com/libevent/libevent/issues/332</url>
<url>https://github.com/libevent/libevent/issues/335</url>
</references>
<dates>
<discovery>2017-01-31</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="4cb165f0-6e48-423e-8147-92255d35c0f7">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-f10-nss</name>
<name>linux-c6-nss</name>
<name>linux-c7-nss</name>
<range><ge>3.30</ge><lt>3.30.1</lt></range>
<range><ge>3.29</ge><lt>3.29.5</lt></range>
<range><ge>3.22</ge><lt>3.28.4</lt></range>
<range><lt>3.21.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>An out-of-bounds write during Base64 decoding operation
in the Network Security Services (NSS) library due to
insufficient memory being allocated to the buffer. This
results in a potentially exploitable crash. The NSS library
has been updated to fix this issue to address this issue and
Firefox 53 has been updated with NSS version 3.29.5.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>A flaw in DRBG number generation within the Network
Security Services (NSS) library where the internal state V
does not correctly carry bits over. The NSS library has been
updated to fix this issue to address this issue and Firefox
53 has been updated with NSS version 3.29.5.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5461</cvename>
<cvename>CVE-2017-5462</cvename>
<url>https://hg.mozilla.org/projects/nss/rev/99a86619eac9</url>
<url>https://hg.mozilla.org/projects/nss/rev/e126381a3c29</url>
</references>
<dates>
<discovery>2017-03-17</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="5e0a038a-ca30-416d-a2f5-38cbf5e7df33">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>53.0_2,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49.1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>46.0,1</ge><lt>52.1.0_2,1</lt></range>
<range><lt>45.9.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>46.0,2</ge><lt>52.1.0,2</lt></range>
<range><lt>45.9.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><ge>46.0</ge><lt>52.1.0</lt></range>
<range><lt>45.9.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>46.0</ge><lt>52.1.0</lt></range>
<range><lt>45.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5433</cvename>
<cvename>CVE-2017-5435</cvename>
<cvename>CVE-2017-5436</cvename>
<cvename>CVE-2017-5461</cvename>
<cvename>CVE-2017-5459</cvename>
<cvename>CVE-2017-5466</cvename>
<cvename>CVE-2017-5434</cvename>
<cvename>CVE-2017-5432</cvename>
<cvename>CVE-2017-5460</cvename>
<cvename>CVE-2017-5438</cvename>
<cvename>CVE-2017-5439</cvename>
<cvename>CVE-2017-5440</cvename>
<cvename>CVE-2017-5441</cvename>
<cvename>CVE-2017-5442</cvename>
<cvename>CVE-2017-5464</cvename>
<cvename>CVE-2017-5443</cvename>
<cvename>CVE-2017-5444</cvename>
<cvename>CVE-2017-5446</cvename>
<cvename>CVE-2017-5447</cvename>
<cvename>CVE-2017-5465</cvename>
<cvename>CVE-2017-5448</cvename>
<cvename>CVE-2017-5437</cvename>
<cvename>CVE-2017-5454</cvename>
<cvename>CVE-2017-5455</cvename>
<cvename>CVE-2017-5456</cvename>
<cvename>CVE-2017-5469</cvename>
<cvename>CVE-2017-5445</cvename>
<cvename>CVE-2017-5449</cvename>
<cvename>CVE-2017-5450</cvename>
<cvename>CVE-2017-5451</cvename>
<cvename>CVE-2017-5462</cvename>
<cvename>CVE-2017-5463</cvename>
<cvename>CVE-2017-5467</cvename>
<cvename>CVE-2017-5452</cvename>
<cvename>CVE-2017-5453</cvename>
<cvename>CVE-2017-5458</cvename>
<cvename>CVE-2017-5468</cvename>
<cvename>CVE-2017-5430</cvename>
<cvename>CVE-2017-5429</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/</url>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
<modified>2017-09-19</modified>
</dates>
</vuln>
<vuln vid="d9e01c35-2531-11e7-b291-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.55</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.31</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.23</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.55</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.36</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html">
<p>This Critical Patch Update contains 39 new security fixes for
Oracle MySQL. 11 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without requiring user credentials.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html</url>
<cvename>CVE-2017-3308</cvename>
<cvename>CVE-2017-3309</cvename>
<cvename>CVE-2017-3450</cvename>
<cvename>CVE-2017-3599</cvename>
<cvename>CVE-2017-3329</cvename>
<cvename>CVE-2017-3600</cvename>
<cvename>CVE-2017-3331</cvename>
<cvename>CVE-2017-3453</cvename>
<cvename>CVE-2017-3452</cvename>
<cvename>CVE-2017-3454</cvename>
<cvename>CVE-2017-3455</cvename>
<cvename>CVE-2017-3305</cvename>
<cvename>CVE-2017-3460</cvename>
<cvename>CVE-2017-3456</cvename>
<cvename>CVE-2017-3458</cvename>
<cvename>CVE-2017-3457</cvename>
<cvename>CVE-2017-3459</cvename>
<cvename>CVE-2017-3463</cvename>
<cvename>CVE-2017-3462</cvename>
<cvename>CVE-2017-3461</cvename>
<cvename>CVE-2017-3464</cvename>
<cvename>CVE-2017-3465</cvename>
<cvename>CVE-2017-3467</cvename>
<cvename>CVE-2017-3468</cvename>
</references>
<dates>
<discovery>2017-04-19</discovery>
<entry>2017-04-19</entry>
</dates>
</vuln>
<vuln vid="c6861494-1ffb-11e7-934d-d05099c0ae8c">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P8</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P8</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P5</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2017.03.25</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01465/0">
<p>A query with a specific set of characteristics could
cause a server using DNS64 to encounter an assertion
failure and terminate.</p>
<p>An attacker could deliberately construct a query,
enabling denial-of-service against a server if it
was configured to use the DNS64 feature and other
preconditions were met.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01466/0">
<p>Mistaken assumptions about the ordering of records in
the answer section of a response containing CNAME or
DNAME resource records could lead to a situation in
which named would exit with an assertion failure when
processing a response in which records occurred in an
unusual order.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01471/0">
<p>named contains a feature which allows operators to
issue commands to a running server by communicating
with the server process over a control channel,
using a utility program such as rndc.</p>
<p>A regression introduced in a recent feature change
has created a situation under which some versions of
named can be caused to exit with a REQUIRE assertion
failure if they are sent a null command string.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-3136</cvename>
<cvename>CVE-2017-3137</cvename>
<cvename>CVE-2017-3138</cvename>
<url>https://kb.isc.org/article/AA-01465/0</url>
<url>https://kb.isc.org/article/AA-01466/0</url>
<url>https://kb.isc.org/article/AA-01471/0</url>
</references>
<dates>
<discovery>2017-04-12</discovery>
<entry>2017-04-13</entry>
<modified>2017-04-13</modified>
</dates>
</vuln>
<vuln vid="e48355d7-1548-11e7-8611-0090f5f2f347">
<topic>id Tech 3 -- remote code execution vulnerability</topic>
<affects>
<package>
<name>ioquake3</name>
<range><lt>1.36_16</lt></range>
</package>
<package>
<name>ioquake3-devel</name>
<range><lt>g2930</lt></range>
</package>
<package>
<name>iourbanterror</name>
<range><lt>4.3.2,1</lt></range>
</package>
<package>
<name>openarena</name>
<range><lt>0.8.8.s1910_3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The content auto-download of id Tech 3 can be used to deliver
maliciously crafted content, that triggers downloading of
further content and loading and executing it as native code
with user credentials. This affects ioquake3, ioUrbanTerror,
OpenArena, the original Quake 3 Arena and other forks.</p>
</body>
</description>
<references>
<cvename>CVE-2017-6903</cvename>
<url>https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-04-07</entry>
</dates>
</vuln>
<vuln vid="90becf7c-1acf-11e7-970f-002590263bf5">
<topic>xen-kernel -- broken check in memory_exchange() permits PV guest breakout</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
<p>The XSA-29 fix introduced an insufficient check on XENMEM_exchange
input, allowing the caller to drive hypervisor memory accesses
outside of the guest provided input/output arrays.</p>
<p>A malicious or buggy 64-bit PV guest may be able to access all of
system memory, allowing for all of privilege escalation, host
crashes, and information leaks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-7228</cvename>
<url>https://xenbits.xen.org/xsa/advisory-212.html</url>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2017-04-06</entry>
</dates>
</vuln>
<vuln vid="04f29189-1a05-11e7-bc6e-b499baebfeaf">
<topic>cURL -- potential memory disclosure</topic>
<affects>
<package>
<name>curl</name>
<range><ge>6.5</ge><lt>7.53.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170403.html">
<p>There were two bugs in curl's parser for the command line option
--write-out (or -w for short) that would skip the end of string
zero byte if the string ended in a % (percent) or \ (backslash),
and it would read beyond that buffer in the heap memory and it
could then potentially output pieces of that memory to the
terminal or the target file etc..</p>
<p>This flaw only exists in the command line tool.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20170403.html</url>
<cvename>CVE-2017-7407</cvename>
</references>
<dates>
<discovery>2017-04-03</discovery>
<entry>2017-04-05</entry>
<modified>2017-04-06</modified>
</dates>
</vuln>
<vuln vid="dc880d6c-195d-11e7-8c63-0800277dcc69">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<name>py36-django</name>
<range><lt>1.8.18</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<name>py36-django18</name>
<range><lt>1.8.18</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<name>py36-django19</name>
<range><lt>1.9.13</lt></range>
</package>
<package>
<name>py27-django110</name>
<name>py33-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<name>py36-django110</name>
<range><lt>1.10.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django team reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2017/apr/04/security-releases/">
<p>These release addresses two security issues detailed below. We
encourage all users of Django to upgrade as soon as possible.</p>
<ul>
<li>Open redirect and possible XSS attack via user-supplied numeric
redirect URLs</li>
<li>Open redirect vulnerability in django.views.static.serve()</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2017/apr/04/security-releases/</url>
<cvename>CVE-2017-7233</cvename>
<cvename>CVE-2017-7234</cvename>
</references>
<dates>
<discovery>2017-04-04</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="356b02e9-1954-11e7-9608-001999f8d30b">
<topic>asterisk -- Buffer overflow in CDR's set user</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>No size checking is done when setting the user field
on a CDR. Thus, it is possible for someone to use an
arbitrarily large string and write past the end of the
user field storage buffer. This allows the possibility
of remote code injection.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2017-001.html</url>
<url>https://issues.asterisk.org/jira/browse/ASTERISK-26897</url>
</references>
<dates>
<discovery>2017-03-27</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="057e6616-1885-11e7-bb4d-a0d3c19bfa21">
<topic>NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler</topic>
<affects>
<package>
<name>nvidia-driver</name>
<range><lt>375.39</lt></range>
</package>
<package>
<name>nvidia-driver-340</name>
<range><lt>340.102</lt></range>
</package>
<package>
<name>nvidia-driver-304</name>
<range><lt>304.135</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVIDIA Unix security team reports:</p>
<blockquote cite="http://nvidia.custhelp.com/app/answers/detail/a_id/4398">
<p>NVIDIA GPU Display Driver contains vulnerabilities in the
kernel mode layer handler where multiple integer overflows,
improper access control, and improper validation of a user
input may cause a denial of service or potential escalation
of privileges.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0309</cvename>
<cvename>CVE-2017-0310</cvename>
<cvename>CVE-2017-0311</cvename>
<cvename>CVE-2017-0318</cvename>
<cvename>CVE-2017-0321</cvename>
<url>http://nvidia.custhelp.com/app/answers/detail/a_id/4398</url>
</references>
<dates>
<discovery>2017-02-14</discovery>
<entry>2017-04-04</entry>
</dates>
</vuln>
<vuln vid="7cf058d8-158d-11e7-ba2c-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>57.0.2987.133</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[698622] Critical CVE-2017-5055: Use after free in printing. Credit to
Wadih Matar</li>
<li>[699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to
Nicolas Trippar of Zimperium zLabs</li>
<li>[662767] High CVE-2017-5052: Bad cast in Blink. Credit to
JeongHoon Shin</li>
<li>[705445] High CVE-2017-5056: Use after free in Blink. Credit to
anonymous</li>
<li>[702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to
Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5055</cvename>
<cvename>CVE-2017-5054</cvename>
<cvename>CVE-2017-5052</cvename>
<cvename>CVE-2017-5056</cvename>
<cvename>CVE-2017-5053</cvename>
<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2017-03-29</discovery>
<entry>2017-03-30</entry>
</dates>
</vuln>
<vuln vid="47873d72-14eb-11e7-970f-002590263bf5">
<topic>xen-tools -- xenstore denial of service via repeated update</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-206.html">
<p>Unprivileged guests may be able to stall progress of the control
domain or driver domain, possibly leading to a Denial of Service
(DoS) of the entire host.</p>
</blockquote>
</body>
</description>
<references>
<url>http://xenbits.xen.org/xsa/advisory-206.html</url>
</references>
<dates>
<discovery>2017-03-28</discovery>
<entry>2017-03-30</entry>
</dates>
</vuln>
<vuln vid="68611303-149e-11e7-b9bb-6805ca0b3d42">
<topic>phpMyAdmin -- bypass 'no password' restriction</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-8/">
<h3>Summary</h3>
<p>Bypass $cfg['Servers'][$i]['AllowNoPassword']</p>
<h3>Description</h3>
<p>A vulnerability was discovered where the restrictions
caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are
bypassed under certain PHP versions. This can allow the
login of users who have no password set even if the
administrator has set $cfg['Servers'][$i]['AllowNoPassword']
to false (which is also the default).</p>
<p>This behavior depends on the PHP version used (it seems
PHP 5 is affected, while PHP 7.0 is not).</p>
<h3>Severity</h3>
<p>We consider this vulnerability to be of moderate severity.</p>
<h3>Mitigation factor</h3>
<p>Set a password for all users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-8/</url>
</references>
<dates>
<discovery>2017-03-28</discovery>
<entry>2017-03-29</entry>
</dates>
</vuln>
<vuln vid="04bc4e23-9a70-42cb-9fec-3613632d34bc">
<cancelled superseded="967b852b-1e28-11e6-8dd3-002590263bf5"/>
</vuln>
<vuln vid="2826317b-10ec-11e7-944e-000c292e4fd8">
<topic>samba -- symlink race allows access outside share definition</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><le>4.2.14</le></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><le>4.3.13</le></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.12</lt></range>
</package>
<package>
<name>samba45</name>
<range><ge>4.5.0</ge><lt>4.5.7</lt></range>
</package>
<package>
<name>samba46</name>
<range><ge>4.6.0</ge><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2017-2619.html">
<p>A time-of-check, time-of-use race condition
can allow clients to access non-exported parts
of the file system via symlinks.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.samba.org/samba/security/CVE-2017-2619.html</url>
<cvename>CVE-2017-2619</cvename>
</references>
<dates>
<discovery>2017-03-23</discovery>
<entry>2017-03-24</entry>
</dates>
</vuln>
<vuln vid="af19ecd0-0f6a-11e7-970f-002590263bf5">
<topic>xen-tools -- Cirrus VGA Heap overflow via display refresh</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-211.html">
<p>A privileged user within the guest VM can cause a heap overflow in
the device model process, potentially escalating their privileges to
that of the device model process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9603</cvename>
<url>http://xenbits.xen.org/xsa/advisory-211.html</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-03-23</entry>
</dates>
</vuln>
<vuln vid="06f931c0-0be0-11e7-b4bf-5404a68ad561">
<topic>irssi -- use-after-free potential code execution</topic>
<affects>
<package>
<name>irssi</name>
<range><gt>0.8.21,1</gt><lt>1.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The irssi project reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_03.txt">
<p>Use after free while producing list of netjoins (CWE-416).
This issue was found and reported to us by APic.
This issue usually leads to segmentation faults.
Targeted code execution should be difficult.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2017_03.txt</url>
<cvename>CVE-2017-7191</cvename>
</references>
<dates>
<discovery>2017-03-11</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="7c27192f-0bc3-11e7-9940-b499baebfeaf">
<topic>mysql -- denial of service vulnerability</topic>
<affects>
<package>
<name>mariadb55-client</name>
<range><le>5.5.54</le></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.30</lt></range>
</package>
<package>
<name>mariadb101-client</name>
<range><lt>10.1.22</lt></range>
</package>
<package>
<name>mysql55-client</name>
<range><le>5.5.54</le></range>
</package>
<package>
<name>mysql56-client</name>
<range><lt>5.6.21</lt></range>
</package>
<package>
<name>mysql57-client</name>
<range><lt>5.7.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openwall reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/02/11/11">
<p>C client library for MySQL (libmysqlclient.so) has
use-after-free defect which can cause crash of applications
using that MySQL client.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/02/11/11</url>
<cvename>CVE-2017-3302</cvename>
</references>
<dates>
<discovery>2017-01-27</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="5f453b69-abab-4e76-b6e5-2ed0bafcaee3">
<topic>firefox -- integer overflow in createImageBitmap()</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>52.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/">
<p>An integer overflow in createImageBitmap() was reported
through the Pwn2Own contest. The fix for this vulnerability
disables the experimental extensions to the
createImageBitmap API. This function runs in the content
sandbox, requiring a second vulnerability to compromise a
user's computer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5428</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-08/</url>
</references>
<dates>
<discovery>2017-03-17</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="df45b4bd-0b7f-11e7-970f-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><le>2.9.9</le></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.9</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.5</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/news/#p1408104">
<p>In addition to a number of bug fixes and small improvements,
security vulnerabilities have been discovered and fixed. We highly
recommend that you upgrade your sites as soon as possible.
Upgrading should be very straightforward. As per our usual policy,
admins of all registered Moodle sites will be notified of security
issue details directly via email and we'll publish details more
widely in a week.</p>
</blockquote>
</body>
</description>
<references>
<url>https://moodle.org/news/#p1408104</url>
</references>
<dates>
<discovery>2017-03-13</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="f72d98d1-0b7e-11e7-970f-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><le>2.9.9</le></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.8</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.4</lt></range>
</package>
<package>
<name>moodle32</name>
<range><lt>3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-17-0001: System file inclusion when adding own preset
file in Boost theme</p></li>
<li><p>MSA-17-0002: Incorrect sanitation of attributes in forums
</p></li>
<li><p>MSA-17-0003: PHPMailer vulnerability in no-reply address
</p></li>
<li><p>MSA-17-0004: XSS in assignment submission page</p></li>
</ul>
<p>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2576</cvename>
<cvename>CVE-2017-2578</cvename>
<cvename>CVE-2016-10045</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2017-01-17</discovery>
<entry>2017-03-18</entry>
</dates>
</vuln>
<vuln vid="2730c668-0b1c-11e7-8d52-6cf0497db129">
<topic>drupal8 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal8</name>
<range><lt>8.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-2017-001">
<p>CVE-2017-6377: Editor module incorrectly checks access to inline private files</p>
<p>CVE-2017-6379: Some admin paths were not protected with a CSRF token</p>
<p>CVE-2017-6381: Remote code execution</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-6377</cvename>
<cvename>CVE-2017-6379</cvename>
<cvename>CVE-2017-6381</cvename>
<url>https://www.drupal.org/SA-2017-001</url>
</references>
<dates>
<discovery>2017-03-15</discovery>
<entry>2017-03-17</entry>
</dates>
</vuln>
<vuln vid="9b973e97-0a99-11e7-ace7-080027ef73ec">
<topic>PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.68</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon G. Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html">
<p>Many versions of PuTTY prior to 0.68 have a heap-corrupting integer
overflow bug in the ssh_agent_channel_data function which processes
messages sent by remote SSH clients to a forwarded agent connection. [...]</p>
<p>This bug is only exploitable at all if you have enabled SSH
agent forwarding, which is turned off by default. Moreover, an
attacker able to exploit this bug would have to have already be able
to connect to the Unix-domain socket representing the forwarded
agent connection. Since any attacker with that capability would
necessarily already be able to generate signatures with your agent's
stored private keys, you should in normal circumstances be defended
against this vulnerability by the same precautions you and your
operating system were already taking to prevent untrusted people
from accessing your SSH agent.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html</url>
<cvename>CVE-2017-6542</cvename>
</references>
<dates>
<discovery>2017-01-29</discovery>
<entry>2017-03-16</entry>
</dates>
</vuln>
<vuln vid="4ffb633c-0a3b-11e7-a9f2-0011d823eebd">
<topic>Flash Player -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>25.0.0.127</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-07.html">
<ul>
<li>These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2017-2997).</li>
<li>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2017-2998, CVE-2017-2999).</li>
<li>These updates resolve a random number generator vulnerability
used for constant blinding that could lead to information
disclosure (CVE-2017-3000).</li>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2017-3001, CVE-2017-3002,
CVE-2017-3003).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2997</cvename>
<cvename>CVE-2017-2998</cvename>
<cvename>CVE-2017-2999</cvename>
<cvename>CVE-2017-3000</cvename>
<cvename>CVE-2017-3001</cvename>
<cvename>CVE-2017-3002</cvename>
<cvename>CVE-2017-3003</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-07.html</url>
</references>
<dates>
<discovery>2017-03-14</discovery>
<entry>2017-03-16</entry>
</dates>
</vuln>
<vuln vid="f41e3e54-076b-11e7-a9f2-0011d823eebd">
<topic>mbed TLS (PolarSSL) -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mbedtls</name>
<range><lt>2.4.2</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><lt>1.3.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Janos Follath reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01">
<ul>
<li>If a malicious peer supplies a certificate with a specially
crafted secp224k1 public key, then an attacker can cause the
server or client to attempt to free block of memory held on
stack. Depending on the platform, this could result in a Denial
of Service (client crash) or potentially could be exploited to
allow remote code execution with the same privileges as the host
application.</li>
<li>If the client and the server both support MD5 and the client
can be tricked to authenticate to a malicious server, then the
malicious server can impersonate the client. To launch this man
in the middle attack, the adversary has to compute a
chosen-prefix MD5 collision in real time. This is very expensive
computationally, but can be practical. Depending on the
platform, this could result in a Denial of Service (client crash)
or potentially could be exploited to allow remote code execution
with the same privileges as the host application.</li>
<li>A bug in the logic of the parsing of a PEM encoded Certificate
Revocation List in mbedtls_x509_crl_parse() can result in an
infinite loop. In versions before 1.3.10 the same bug results in
an infinite recursion stack overflow that usually crashes the
application. Methods and means of acquiring the CRLs is not part
of the TLS handshake and in the strict TLS setting this
vulnerability cannot be triggered remotely. The vulnerability
cannot be triggered unless the application explicitly calls
mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM
formatted CRL of untrusted origin. In which case the
vulnerability can be exploited to launch a denial of service
attack against the application.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01</url>
</references>
<dates>
<discovery>2017-03-11</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="a505d397-0758-11e7-8d8b-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>57.0.2987.98</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html">
<p>36 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5030</cvename>
<cvename>CVE-2017-5031</cvename>
<cvename>CVE-2017-5032</cvename>
<cvename>CVE-2017-5029</cvename>
<cvename>CVE-2017-5034</cvename>
<cvename>CVE-2017-5035</cvename>
<cvename>CVE-2017-5036</cvename>
<cvename>CVE-2017-5037</cvename>
<cvename>CVE-2017-5039</cvename>
<cvename>CVE-2017-5040</cvename>
<cvename>CVE-2017-5041</cvename>
<cvename>CVE-2017-5033</cvename>
<cvename>CVE-2017-5042</cvename>
<cvename>CVE-2017-5038</cvename>
<cvename>CVE-2017-5043</cvename>
<cvename>CVE-2017-5044</cvename>
<cvename>CVE-2017-5045</cvename>
<cvename>CVE-2017-5046</cvename>
<url>https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-03-09</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="89cf8cd2-0698-11e7-aa3f-001b216d295b">
<topic>Several Security Defects in the Bouncy Castle Crypto APIs</topic>
<affects>
<package>
<name>bouncycastle15</name>
<range><ge>1.51</ge><lt>1.56</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Legion of the Bouncy Castle reports:</p>
<blockquote cite="https://www.bouncycastle.org/releasenotes.html">
<p>Release: 1.56</p>
<p>2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/215507</freebsdpr>
<url>https://www.bouncycastle.org/releasenotes.html</url>
</references>
<dates>
<discovery>2016-12-23</discovery>
<entry>2017-03-12</entry>
</dates>
</vuln>
<vuln vid="41fe4724-06a2-11e7-8e3e-5453ed2e2b49">
<topic>kde-runtime -- kdesu: displayed command truncated by unicode string terminator</topic>
<affects>
<package>
<name>kde-runtime</name>
<range><lt>4.14.3_5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20160930-1.txt">
<p>A maliciously crafted command line for kdesu can result in the
user only seeing part of the commands that will actually get executed
as super user.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7787</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2016/09/29/7</mlist>
<url>https://www.kde.org/info/security/advisory-20160930-1.txt</url>
</references>
<dates>
<discovery>2016-09-30</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="e550fc62-069a-11e7-8e3e-5453ed2e2b49">
<topic>kdepimlibs -- directory traversal on KTNEF</topic>
<affects>
<package>
<name>kdepimlibs</name>
<range><lt>4.14.10_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Aastals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170227-1.txt">
<p>A directory traversal issue was found in KTNEF which can be
exploited by tricking a user into opening a malicious winmail.dat
file. The issue allows to write files with the permission of the user
opening the winmail.dat file during extraction.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20170227-1.txt</url>
</references>
<dates>
<discovery>2017-02-27</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="f714d8ab-028e-11e7-8042-50e549ebab6c">
<topic>kio: Information Leak when accessing https when using a malicious PAC file</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.29_10</lt></range>
</package>
<package>
<name>kf5-kio</name>
<range><lt>5.31.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Albert Astals Cid reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20170228-1.txt">
<p>Using a malicious PAC file, and then using exfiltration methods in the PAC
function FindProxyForURL() enables the attacker to expose full https URLs.</p>
<p>This is a security issue since https URLs may contain sensitive
information in the URL authentication part (user:password@host), and in the
path and the query (e.g. access tokens).</p>
<p>This attack can be carried out remotely (over the LAN) since proxy settings
allow "Detect Proxy Configuration Automatically".
This setting uses WPAD to retrieve the PAC file, and an attacker who has access
to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP)
and inject his/her own malicious PAC instead of the legitimate one.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kde.org/info/security/advisory-20170228-1.txt</url>
</references>
<dates>
<discovery>2017-02-28</discovery>
<entry>2017-03-11</entry>
</dates>
</vuln>
<vuln vid="82752070-0349-11e7-b48d-00e04c1ea73d">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/">
<p>WordPress versions 4.7.2 and earlier are affected by six security issues.</p>
<ul>
<li>Cross-site scripting (XSS) via media file metadata.</li>
<li>Control characters can trick redirect URL validation.</li>
<li>Unintended files can be deleted by administrators using the
plugin deletion functionality.</li>
<li>Cross-site scripting (XSS) via video URL in YouTube embeds.</li>
<li>Cross-site scripting (XSS) via taxonomy term names.</li>
<li>Cross-site request forgery (CSRF) in Press This leading to
excessive use of server resources.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/03/07/3</url>
<url>https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-03-07</discovery>
<entry>2017-03-07</entry>
</dates>
</vuln>
<vuln vid="96eca031-1313-4daf-9be2-9d6e1c4f1eb5">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>52.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.49</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>46.0,1</ge><lt>52.0,1</lt></range>
<range><lt>45.8.0_1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><ge>46.0,2</ge><lt>52.0,2</lt></range>
<range><lt>45.8.0_1,2</lt></range>
</package>
<package>
<name>libxul</name>
<range><ge>46.0</ge><lt>52.0</lt></range>
<range><lt>45.8.0_1</lt></range>
</package>
<package>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>46.0</ge><lt>52.0</lt></range>
<range><lt>45.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5400</cvename>
<cvename>CVE-2017-5401</cvename>
<cvename>CVE-2017-5402</cvename>
<cvename>CVE-2017-5403</cvename>
<cvename>CVE-2017-5404</cvename>
<cvename>CVE-2017-5406</cvename>
<cvename>CVE-2017-5407</cvename>
<cvename>CVE-2017-5410</cvename>
<cvename>CVE-2017-5411</cvename>
<cvename>CVE-2017-5409</cvename>
<cvename>CVE-2017-5408</cvename>
<cvename>CVE-2017-5412</cvename>
<cvename>CVE-2017-5413</cvename>
<cvename>CVE-2017-5414</cvename>
<cvename>CVE-2017-5415</cvename>
<cvename>CVE-2017-5416</cvename>
<cvename>CVE-2017-5417</cvename>
<cvename>CVE-2017-5425</cvename>
<cvename>CVE-2017-5426</cvename>
<cvename>CVE-2017-5427</cvename>
<cvename>CVE-2017-5418</cvename>
<cvename>CVE-2017-5419</cvename>
<cvename>CVE-2017-5420</cvename>
<cvename>CVE-2017-5405</cvename>
<cvename>CVE-2017-5421</cvename>
<cvename>CVE-2017-5422</cvename>
<cvename>CVE-2017-5399</cvename>
<cvename>CVE-2017-5398</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-05/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-06/</url>
</references>
<dates>
<discovery>2017-03-07</discovery>
<entry>2017-03-07</entry>
</dates>
</vuln>
<vuln vid="71ebbc50-01c1-11e7-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed an XSS vulnerability in Security Library method xss_clean().
</p>
<p>Fixed a possible file inclusion vulnerability in Loader Library
method vars().</p>
<p>Fixed a possible remote code execution vulnerability in the Email
Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane
from NamePros).</p>
<p>Added protection against timing side-channel attacks in Security
Library method csrf_verify().</p>
<p>Added protection against BREACH attacks targeting the CSRF token
field generated by Form Helper function form_open().</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="7b35a77a-0151-11e7-ae1b-002590263bf5">
<topic>ikiwiki -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20170111</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ikiwiki reports:</p>
<blockquote cite="https://ikiwiki.info/security/#index48h2">
<p>The ikiwiki maintainers discovered further flaws similar to
CVE-2016-9646 in the passwordauth plugin's use of
CGI::FormBuilder, with a more serious impact:</p>
<p>An attacker who can log in to a site with a password can log in as
a different and potentially more privileged user.</p>
<p>An attacker who can create a new account can set arbitrary fields
in the user database for that account</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0356</cvename>
<url>https://ikiwiki.info/security/#index48h2</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="5ed094a0-0150-11e7-ae1b-002590263bf5">
<topic>ikiwiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20161229</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10026">
<p>ikiwiki 3.20161219 does not properly check if a revision changes
the access permissions for a page on sites with the git and
recentchanges plugins and the CGI interface enabled, which allows
remote attackers to revert certain changes by leveraging permissions
to change the page before the revision was made.</p>
</blockquote>
<blockquote cite="https://ikiwiki.info/security/#index47h2">
<p>When CGI::FormBuilder->field("foo") is called in list context
(and in particular in the arguments to a subroutine that takes named
arguments), it can return zero or more values for foo from the CGI
request, rather than the expected single value. This breaks the
usual Perl parsing convention for named arguments, similar to
CVE-2014-1572 in Bugzilla (which was caused by a similar API design
issue in CGI.pm).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10026</cvename>
<cvename>CVE-2016-9645</cvename>
<cvename>CVE-2016-9646</cvename>
<url>https://ikiwiki.info/security/#index46h2</url>
<url>https://ikiwiki.info/security/#index47h2</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2017-03-05</entry>
</dates>
</vuln>
<vuln vid="f4eb9a25-fde0-11e6-9ad0-b8aeed92ecc4">
<topic>potrace -- multiple memory failure</topic>
<affects>
<package>
<name>potrace</name>
<range><lt>1.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>potrace reports:</p>
<blockquote cite="https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/">
<p>CVE-2016-8685: invalid memory access in findnext</p>
<p>CVE-2016-8686: memory allocation failure</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/</url>
<cvename>CVE-2016-8685</cvename>
<cvename>CVE-2016-8686</cvename>
</references>
<dates>
<discovery>2016-10-15</discovery>
<entry>2017-02-28</entry>
</dates>
</vuln>
<vuln vid="765d165b-fbfe-11e6-aae7-5404a68ad561">
<topic>MPD -- buffer overflows in http output</topic>
<affects>
<package>
<name>musicpd</name>
<range><lt>0.20.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MPD project reports:</p>
<blockquote cite="http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5">
<p>httpd: fix two buffer overflows in IcyMetaData length calculation</p>
</blockquote>
</body>
</description>
<references>
<url>http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5</url>
</references>
<dates>
<discovery>2017-02-18</discovery>
<entry>2017-02-26</entry>
</dates>
</vuln>
<vuln vid="311e4b1c-f8ee-11e6-9940-b499baebfeaf">
<topic>cURL -- ocsp status validation error</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.53.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20170222.html">
<p>SSL_VERIFYSTATUS ignored<br/>
curl and libcurl support "OCSP stapling", also known as the TLS
Certificate Status Request extension (using the
CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this
feature, it uses that TLS extension to ask for a fresh proof of
the server's certificate's validity. If the server doesn't support
the extension, or fails to provide said proof, curl is expected to
return an error.<br/>
Due to a coding mistake, the code that checks for a test success or
failure, ends up always thinking there's valid proof, even when
there is none or if the server doesn't support the TLS extension in
question. Contrary to how it used to function and contrary to how
this feature is documented to work.<br/>
This could lead to users not detecting when a server's certificate
goes invalid or otherwise be mislead that the server is in a better
shape than it is in reality.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20170222.html</url>
<cvename>CVE-2017-2629</cvename>
</references>
<dates>
<discovery>2017-02-22</discovery>
<entry>2017-02-22</entry>
</dates>
</vuln>
<vuln vid="8cbd9c08-f8b9-11e6-ae1b-002590263bf5">
<topic>xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-209.html">
<p>In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
cirrus_bitblt_cputovideo fails to check whether the specified
memory region is safe. A malicious guest administrator can cause
an out of bounds memory write, very likely exploitable as a
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2620</cvename>
<url>http://xenbits.xen.org/xsa/advisory-209.html</url>
</references>
<dates>
<discovery>2017-02-21</discovery>
<entry>2017-02-22</entry>
</dates>
</vuln>
<vuln vid="786a7d87-f826-11e6-9436-14dae9d5a9d2">
<topic>fbsdmon -- information disclosure vulnerability</topic>
<affects>
<package>
<name>fbsdmon</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alan Somers reports:</p>
<blockquote cite="https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099">
<p>The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099</url>
</references>
<dates>
<discovery>2017-02-14</discovery>
<entry>2017-02-21</entry>
</dates>
</vuln>
<vuln vid="f1075415-f5e9-11e6-a4e2-5404a68ad561">
<topic>wavpack -- multiple invalid memory reads</topic>
<affects>
<package>
<name>wavpack</name>
<range><lt>5.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Bryant reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/23/4">
<p>global buffer overread in read_code / read_words.c</p>
<p>heap out of bounds read in WriteCaffHeader / caff.c</p>
<p>heap out of bounds read in unreorder_channels / wvunpack.c</p>
<p>heap oob read in read_new_config_info / open_utils.c</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2017/01/23/4</url>
<cvename>CVE-2016-10169</cvename>
<cvename>CVE-2016-10170</cvename>
<cvename>CVE-2016-10171</cvename>
<cvename>CVE-2016-10172</cvename>
<url>https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc</url>
</references>
<dates>
<discovery>2017-01-21</discovery>
<entry>2017-02-18</entry>
</dates>
</vuln>
<vuln vid="8fedf75c-ef2f-11e6-900e-003048f78448">
<topic>optipng -- multiple vulnerabilities</topic>
<affects>
<package>
<name>optipng</name>
<range><lt>0.7.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7802">
<p>ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2191">
<p>The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3981">
<p>Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3982">
<p>Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7802</cvename>
<cvename>CVE-2016-2191</cvename>
<cvename>CVE-2016-3981</cvename>
<cvename>CVE-2016-3982</cvename>
</references>
<dates>
<discovery>2015-10-09</discovery>
<entry>2017-02-16</entry>
</dates>
</vuln>
<vuln vid="1a802ba9-f444-11e6-9940-b499baebfeaf">
<topic>openssl -- crash on handshake</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0e</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20170216.txt">
<p>Severity: High<br/>
During a renegotiation handshake if the Encrypt-Then-Mac
extension is negotiated where it was not in the original
handshake (or vice-versa) then this can cause OpenSSL to
crash (dependent on ciphersuite). Both clients and servers
are affected.<br/>
This issue does not affect OpenSSL version 1.0.2.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20170216.txt</url>
<cvename>CVE-2017-3733</cvename>
</references>
<dates>
<discovery>2017-02-16</discovery>
<entry>2017-02-16</entry>
</dates>
</vuln>
<vuln vid="077bbadf-f2f4-11e6-92a7-902b34361349">
<topic>diffoscope -- arbitrary file write</topic>
<affects>
<package>
<name>py34-diffoscope</name>
<name>py35-diffoscope</name>
<name>py36-diffoscope</name>
<range><ge>67</ge><lt>76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ximin Luo reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723">
<p>[v67] introduced a security hole where diffoscope may write to
arbitrary locations on disk depending on the contents of an
untrusted archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-0359</cvename>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723</url>
</references>
<dates>
<discovery>2017-02-09</discovery>
<entry>2017-02-14</entry>
<modified>2017-02-16</modified>
</dates>
</vuln>
<vuln vid="7f9b696f-f11b-11e6-b50e-5404a68ad561">
<topic>ffmpeg -- heap overflow in lavf/mov.c</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>3.2.4,1</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-29.x has ffmpeg-3.2 -->
<range><lt>29.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>FFmpeg 3.2.4 fixes the following vulnerabilities:
CVE-2017-5024, CVE-2017-5025</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5024</cvename>
<url>https://www.ffmpeg.org/security.html</url>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
<cvename>CVE-2017-5025</cvename>
<url>https://www.ffmpeg.org/security.html</url>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-01-25</discovery>
<entry>2017-02-12</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="79bbb8f8-f049-11e6-8a6a-bcaec565249c">
<topic>gtk-vnc -- bounds checking vulnerabilities</topic>
<affects>
<package>
<name>gtk-vnc</name>
<range><lt>0.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel P. Berrange reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html">
<p>CVE-2017-5884 - fix bounds checking for RRE, hextile and
copyrect encodings</p>
<p>CVE-2017-5885 - fix color map index bounds checking.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html</url>
<cvename>CVE-2017-5884</cvename>
<cvename>CVE-2017-5885</cvename>
</references>
<dates>
<discovery>2017-02-09</discovery>
<entry>2017-02-11</entry>
</dates>
</vuln>
<vuln vid="a73aba9a-effe-11e6-ae1b-002590263bf5">
<topic>xen-tools -- oob access in cirrus bitblt copy</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-208.html">
<p>When doing bitblt copy backwards, qemu should negate the blit
width. This avoids an oob access before the start of video
memory.</p>
<p>A malicious guest administrator can cause an out of bounds memory
access, possibly leading to information disclosure or privilege
escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2615</cvename>
<url>http://xenbits.xen.org/xsa/advisory-208.html</url>
</references>
<dates>
<discovery>2017-02-10</discovery>
<entry>2017-02-11</entry>
</dates>
</vuln>
<vuln vid="fb74eacc-ec8a-11e6-bc8a-0011d823eebd">
<topic>tiff -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.7</lt></range>
</package>
<package>
<name>linux-c6-libtiff</name>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_5</lt></range>
</package>
<package>
<name>linux-c7-libtiff</name>
<name>linux-c7-tiff</name>
<range><lt>4.0.3_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libtiff project reports:</p>
<blockquote cite="http://simplesystems.org/libtiff/v4.0.7.html">
<p>Multiple flaws have been discovered in libtiff library and
utilities.</p>
</blockquote>
</body>
</description>
<references>
<url>http://simplesystems.org/libtiff/v4.0.7.html</url>
<cvename>CVE-2016-9533</cvename>
<cvename>CVE-2016-9534</cvename>
<cvename>CVE-2016-9535</cvename>
<cvename>CVE-2015-8870</cvename>
<cvename>CVE-2016-5652</cvename>
<cvename>CVE-2016-9540</cvename>
<cvename>CVE-2016-9537</cvename>
<cvename>CVE-2016-9536</cvename>
</references>
<dates>
<discovery>2016-11-19</discovery>
<entry>2017-02-06</entry>
</dates>
</vuln>
<vuln vid="2b63e964-eb04-11e6-9ac1-a4badb2f4699">
<topic>mantis -- XSS vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>wdollman reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=21611">
<p>The value of the view_type parameter on the
view_all_bug_page.php page is not encoded before being displayed on the
page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mantisbt.org/bugs/view.php?id=21611</url>
<cvename>CVE-2016-6837</cvename>
<freebsdpr>ports/216662</freebsdpr>
</references>
<dates>
<discovery>2016-08-15</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="b4ecf774-eb01-11e6-9ac1-a4badb2f4699">
<topic>guile2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>guile2</name>
<range><lt>2.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ludovic Courtès reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/10/11/1">
<p>The REPL server is vulnerable to
the HTTP inter-protocol attack</p>
<p>The ‘mkdir’ procedure of GNU Guile, an implementation of
the Scheme programming language, temporarily changed the process’ umask
to zero. During that time window, in a multithreaded application, other
threads could end up creating files with insecure permissions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/10/11/1</url>
<url>http://www.openwall.com/lists/oss-security/2016/10/12/2</url>
<cvename>CVE-2016-8605</cvename>
<cvename>CVE-2016-8606</cvename>
<freebsdpr>ports/216663</freebsdpr>
</references>
<dates>
<discovery>2016-10-12</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="c6932dd4-eaff-11e6-9ac1-a4badb2f4699">
<topic>chicken -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chicken</name>
<range><lt>4.12,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Bex reports:</p>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html">
<p>A buffer overflow error was found in the POSIX unit's procedures
process-execute and process-spawn.</p>
<p>Additionally, a memory leak existed in this code, which would be
triggered when an error is raised during argument and environment
processing.</p>
</blockquote>
<blockquote cite="http://lists.nongnu.org/archive/html/chicken-announce/2016-12/msg00000.html">
<p>Irregex versions before 0.9.6 contain a resource exhaustion
vulnerability: when compiling deeply nested regexes containing the
"+" operator due to exponential expansion behaviour.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html</url>
<cvename>CVE-2016-6830</cvename>
<cvename>CVE-2016-6831</cvename>
<cvename>CVE-2016-9954</cvename>
<freebsdpr>ports/216661</freebsdpr>
</references>
<dates>
<discovery>2016-08-12</discovery>
<entry>2017-02-04</entry>
<modified>2017-03-05</modified>
</dates>
</vuln>
<vuln vid="a130bd8c-eafe-11e6-9ac1-a4badb2f4699">
<topic>libebml -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libebml</name>
<range><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mortiz Bunkus reports:</p>
<blockquote cite="https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html">
<p>Multiple invalid memory accesses vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html</url>
<cvename>CVE-2015-8789</cvename>
<cvename>CVE-2015-8790</cvename>
<cvename>CVE-2015-8791</cvename>
<freebsdpr>ports/216659</freebsdpr>
</references>
<dates>
<discovery>2015-10-20</discovery>
<entry>2017-02-04</entry>
</dates>
</vuln>
<vuln vid="5b1631dc-eafd-11e6-9ac1-a4badb2f4699">
<topic>freeimage -- code execution vulnerability</topic>
<affects>
<package>
<name>freeimage</name>
<range><lt>3.16.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TALOS reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0189/">
<p>An exploitable out-of-bounds write vulnerability exists in
the XMP image handling functionality of the FreeImage library.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.talosintelligence.com/reports/TALOS-2016-0189/</url>
<cvename>CVE-2016-5684</cvename>
<freebsdpr>ports/216657</freebsdpr>
</references>
<dates>
<discovery>2016-10-03</discovery>
<entry>2017-02-04</entry>
<modified>2018-04-14</modified>
</dates>
</vuln>
<vuln vid="5a9b3d70-48e2-4267-b196-83064cb14fe0">
<topic>shotwell -- failure to encrypt authentication</topic>
<affects>
<package>
<name>shotwell</name>
<range><lt>0.24.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jens Georg reports:</p>
<blockquote cite="https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html">
<p>I have just released Shotwell 0.24.5 and 0.25.4 which turn
on HTTPS encryption all over the publishing plugins.</p>
<p>Users using Tumblr and Yandex.Fotki publishing are strongly
advised to change their passwords and reauthenticate Shotwell
to those services after upgrade.</p>
<p>Users of Picasa and Youtube publishing are strongly advised
to reauthenticate (Log out and back in) Shotwell to those
services after upgrade.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html</url>
</references>
<dates>
<discovery>2017-01-31</discovery>
<entry>2017-02-01</entry>
</dates>
</vuln>
<vuln vid="5cfa9d0c-73d7-4642-af4f-28fbed9e9404">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>2.44</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>2.32.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2598</cvename>
<cvename>CVE-2017-2599</cvename>
<cvename>CVE-2017-2600</cvename>
<cvename>CVE-2011-4969</cvename>
<cvename>CVE-2017-2601</cvename>
<cvename>CVE-2015-0886</cvename>
<cvename>CVE-2017-2602</cvename>
<cvename>CVE-2017-2603</cvename>
<cvename>CVE-2017-2604</cvename>
<cvename>CVE-2017-2605</cvename>
<cvename>CVE-2017-2606</cvename>
<cvename>CVE-2017-2607</cvename>
<cvename>CVE-2017-2608</cvename>
<cvename>CVE-2017-2609</cvename>
<cvename>CVE-2017-2610</cvename>
<cvename>CVE-2017-2611</cvename>
<cvename>CVE-2017-2612</cvename>
<cvename>CVE-2017-2613</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01</url>
</references>
<dates>
<discovery>2017-02-01</discovery>
<entry>2017-02-01</entry>
</dates>
</vuln>
<vuln vid="14ea4458-e5cd-11e6-b56d-38d547003487">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron D. Campbell reports:</p>
<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/">
<p>WordPress versions 4.7.1 and earlier are affected by three security
issues:</p>
<ul>
<li>The user interface for assigning taxonomy terms in Press This is
shown to users who do not have permissions to use it.</li>
<li>WP_Query is vulnerable to a SQL injection (SQLi) when passing
unsafe data. WordPress core is not directly vulnerable to this
issue, but we’ve added hardening to prevent plugins and
themes from accidentally causing a vulnerability.</li>
<li>A cross-site scripting (XSS) vulnerability was discovered in the
posts list table.</li>
<li>An unauthenticated privilege escalation vulnerability was
discovered in a REST API endpoint.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5610</cvename>
<cvename>CVE-2017-5611</cvename>
<cvename>CVE-2017-5612</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/28/5</url>
<url>https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/</url>
<url>https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/</url>
</references>
<dates>
<discovery>2017-01-26</discovery>
<entry>2017-01-29</entry>
</dates>
</vuln>
<vuln vid="6e83b2f3-e4e3-11e6-9ac1-a4badb2f4699">
<topic>nfsen -- remote command execution</topic>
<affects>
<package>
<name>nfsen</name>
<range><lt>1.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Haag reports:</p>
<blockquote cite="https://sourceforge.net/p/nfsen/mailman/message/35623845/">
<p>A remote attacker with access to the web interface to
execute arbitrary commands on the host operating system.</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/nfsen/mailman/message/35623845/</url>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-27</entry>
</dates>
</vuln>
<vuln vid="4b9ca994-e3d9-11e6-813d-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>56.0.2924.76</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html">
<p>51 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5007</cvename>
<cvename>CVE-2017-5006</cvename>
<cvename>CVE-2017-5008</cvename>
<cvename>CVE-2017-5010</cvename>
<cvename>CVE-2017-5011</cvename>
<cvename>CVE-2017-5009</cvename>
<cvename>CVE-2017-5012</cvename>
<cvename>CVE-2017-5013</cvename>
<cvename>CVE-2017-5014</cvename>
<cvename>CVE-2017-5015</cvename>
<cvename>CVE-2017-5019</cvename>
<cvename>CVE-2017-5016</cvename>
<cvename>CVE-2017-5017</cvename>
<cvename>CVE-2017-5018</cvename>
<cvename>CVE-2017-2020</cvename>
<cvename>CVE-2017-2021</cvename>
<cvename>CVE-2017-2022</cvename>
<cvename>CVE-2017-2023</cvename>
<cvename>CVE-2017-2024</cvename>
<cvename>CVE-2017-2025</cvename>
<cvename>CVE-2017-2026</cvename>
<url>https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2017-01-25</discovery>
<entry>2017-01-26</entry>
</dates>
</vuln>
<vuln vid="d455708a-e3d3-11e6-9940-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2k,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0d</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_13</lt></range>
</package>
<package>
<name>linux-c7-openssl-libs</name>
<range><lt>1.0.1e_3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_8</lt></range>
<range><ge>10.3</ge><lt>10.3_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20170126.txt">
<ul>
<li>Truncated packet could crash via OOB read (CVE-2017-3731)</li>
<li>Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)</li>
<li>BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)</li>
<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20170126.txt</url>
<cvename>CVE-2016-7055</cvename>
<cvename>CVE-2017-3730</cvename>
<cvename>CVE-2017-3731</cvename>
<cvename>CVE-2017-3732</cvename>
<freebsdsa>SA-17:02.openssl</freebsdsa>
</references>
<dates>
<discovery>2017-01-26</discovery>
<entry>2017-01-26</entry>
<modified>2017-05-26</modified>
</dates>
</vuln>
<vuln vid="e60169c4-aa86-46b0-8ae2-0d81f683df09">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>51.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.48</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.7.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.7.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5373</cvename>
<cvename>CVE-2017-5374</cvename>
<cvename>CVE-2017-5375</cvename>
<cvename>CVE-2017-5376</cvename>
<cvename>CVE-2017-5377</cvename>
<cvename>CVE-2017-5378</cvename>
<cvename>CVE-2017-5379</cvename>
<cvename>CVE-2017-5380</cvename>
<cvename>CVE-2017-5381</cvename>
<cvename>CVE-2017-5382</cvename>
<cvename>CVE-2017-5383</cvename>
<cvename>CVE-2017-5384</cvename>
<cvename>CVE-2017-5385</cvename>
<cvename>CVE-2017-5386</cvename>
<cvename>CVE-2017-5387</cvename>
<cvename>CVE-2017-5388</cvename>
<cvename>CVE-2017-5389</cvename>
<cvename>CVE-2017-5390</cvename>
<cvename>CVE-2017-5391</cvename>
<cvename>CVE-2017-5392</cvename>
<cvename>CVE-2017-5393</cvename>
<cvename>CVE-2017-5394</cvename>
<cvename>CVE-2017-5395</cvename>
<cvename>CVE-2017-5396</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2017-01/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2017-02/</url>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-24</entry>
</dates>
</vuln>
<vuln vid="7721562b-e20a-11e6-b2e2-6805ca0b3d42">
<topic>phpMyAdmin -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.6.0</ge><lt>4.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-1/">
<p>Open redirect</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-2/">
<p>php-gettext code execution</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-3/">
<p>DOS vulnerability in table editing</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-4/">
<p>CSS injection in themes</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-5/">
<p>Cookie attribute injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-6/">
<p>SSRF in replication</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2017-7/">
<p>DOS in replication status</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2017-1</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-2</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-3</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-4</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-5</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-6</url>
<url>https://www.phpmyadmin.net/security/PMASA-2017-7</url>
<cvename>CVE-2015-8980</cvename>
</references>
<dates>
<discovery>2017-01-24</discovery>
<entry>2017-01-24</entry>
</dates>
</vuln>
<vuln vid="a4b7def1-e165-11e6-9d84-90e2ba9881c8">
<topic>Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability</topic>
<affects>
<package>
<name>intel-nvmupdate</name>
<range><lt>5.05</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Intel Corporation reports:</p>
<blockquote cite="https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr">
<p>A security vulnerability in the Intel(R) Ethernet Controller X710
and Intel(R) Ethernet Controller XL710 family of products
(Fortville) has been found in the Non-Volatile Flash Memory (NVM)
image.</p>
</blockquote>
</body>
</description>
<references>
<url>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr</url>
<cvename>CVE-2016-8106</cvename>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-23</entry>
</dates>
</vuln>
<vuln vid="709e025a-de8b-11e6-a9a5-b499baebfeaf">
<topic>PHP -- undisclosed vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-2">
<p>The PHP development team announces the immediate availability of
PHP 7.0.15. This is a security release. Several security bugs were
fixed in this release.</p>
</blockquote>
<blockquote cite="http://php.net/archive/2017.php#id2017-01-19-3">
<p>The PHP development team announces the immediate availability of
PHP 5.6.30. This is a security release. Several security bugs were
fixed in this release.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2017.php#id2017-01-19-2</url>
<url>http://php.net/archive/2017.php#id2017-01-19-3</url>
</references>
<dates>
<discovery>2017-01-19</discovery>
<entry>2017-01-19</entry>
<modified>2017-01-20</modified>
</dates>
</vuln>
<vuln vid="57facd35-ddf6-11e6-915d-001b3856973b">
<topic>icoutils -- check_offset overflow on 64-bit systems</topic>
<affects>
<package>
<name>icoutils</name>
<range><lt>0.31.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Choongwoo Han reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q1/38">
<p>An exploitable crash exists in the wrestool utility on 64-bit systems
where the result of subtracting two pointers exceeds the size of int.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5208</cvename>
<cvename>CVE-2017-5331</cvename>
<cvename>CVE-2017-5332</cvename>
<cvename>CVE-2017-5333</cvename>
<url>http://seclists.org/oss-sec/2017/q1/38</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-19</entry>
</dates>
</vuln>
<vuln vid="4d2f9d09-ddb7-11e6-a9a5-b499baebfeaf">
<topic>mysql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.54</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.30</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.22</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.54</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.35</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL">
<p>No further details have been provided in the Critical Patch Update</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL</url>
<cvename>CVE-2016-8318</cvename>
<cvename>CVE-2017-3312</cvename>
<cvename>CVE-2017-3258</cvename>
<cvename>CVE-2017-3273</cvename>
<cvename>CVE-2017-3244</cvename>
<cvename>CVE-2017-3257</cvename>
<cvename>CVE-2017-3238</cvename>
<cvename>CVE-2017-3256</cvename>
<cvename>CVE-2017-3291</cvename>
<cvename>CVE-2017-3265</cvename>
<cvename>CVE-2017-3251</cvename>
<cvename>CVE-2017-3313</cvename>
<cvename>CVE-2017-3243</cvename>
<cvename>CVE-2016-8327</cvename>
<cvename>CVE-2017-3317</cvename>
<cvename>CVE-2017-3318</cvename>
<cvename>CVE-2017-3319</cvename>
<cvename>CVE-2017-3320</cvename>
</references>
<dates>
<discovery>2017-01-18</discovery>
<entry>2017-01-18</entry>
<modified>2017-03-14</modified>
</dates>
</vuln>
<vuln vid="e3200958-dd6c-11e6-ae1b-002590263bf5">
<topic>powerdns -- multiple vulnerabilities</topic>
<affects>
<package>
<name>powerdns</name>
<range><lt>3.4.11</lt></range>
<range><ge>4.0.0</ge><lt>4.0.2</lt></range>
</package>
<package>
<name>powerdns-recursor</name>
<range><lt>3.7.4</lt></range>
<range><ge>4.0.0</ge><lt>4.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/">
<p>2016-02: Crafted queries can cause abnormal CPU usage</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/">
<p>2016-03: Denial of service via the web server</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/">
<p>2016-04: Insufficient validation of TSIG signatures</p>
</blockquote>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/">
<p>2016-05: Crafted zone record can cause a denial of service</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7068</cvename>
<cvename>CVE-2016-7072</cvename>
<cvename>CVE-2016-7073</cvename>
<cvename>CVE-2016-7074</cvename>
<cvename>CVE-2016-2120</cvename>
<freebsdpr>ports/216135</freebsdpr>
<freebsdpr>ports/216136</freebsdpr>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/</url>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/</url>
<url>https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/</url>
<url>https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/</url>
</references>
<dates>
<discovery>2016-12-15</discovery>
<entry>2017-01-18</entry>
</dates>
</vuln>
<vuln vid="4af92a40-db33-11e6-ae1b-002590263bf5">
<topic>groovy -- remote execution of untrusted code/DoS vulnerability</topic>
<affects>
<package>
<name>groovy</name>
<range><ge>1.7.0</ge><lt>2.4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Groovy project reports:</p>
<blockquote cite="http://groovy-lang.org/security.html">
<p>When an application with Groovy on classpath uses standard Java
serialization mechanisms, e.g. to communicate between servers or to
store local data, it is possible for an attacker to bake a special
serialized object that will execute code directly when deserialized.
All applications which rely on serialization and do not isolate the
code which deserializes objects are subject to this vulnerability.
This is similar to CVE-2015-3253 but this exploit involves extra
wrapping of objects and catching of exceptions which are now safe
guarded against.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6814</cvename>
<url>http://groovy-lang.org/security.html</url>
</references>
<dates>
<discovery>2016-09-20</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="6aa956fb-d97f-11e6-a071-001e67f15f5a">
<topic>RabbitMQ -- Authentication vulnerability</topic>
<affects>
<package>
<name>rabbitmq</name>
<range><ge>3.0.0</ge><lt>3.5.8</lt></range>
<range><ge>3.6.0</ge><lt>3.6.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pivotal.io reports:</p>
<blockquote cite="https://pivotal.io/security/cve-2016-9877">
<p>MQTT (MQ Telemetry Transport) connection authentication with a
username/password pair succeeds if an existing username is
provided but the password is omitted from the connection
request. Connections that use TLS with a client-provided
certificate are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9877</cvename>
<url>https://pivotal.io/security/cve-2016-9877</url>
<url>https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6</url>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="b180d1fb-dac6-11e6-ae1b-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.7.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron D. Campbell reports:</p>
<blockquote cite="https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/">
<p>WordPress versions 4.7 and earlier are affected by eight security
issues...</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5487</cvename>
<cvename>CVE-2017-5488</cvename>
<cvename>CVE-2017-5489</cvename>
<cvename>CVE-2017-5490</cvename>
<cvename>CVE-2017-5491</cvename>
<cvename>CVE-2017-5492</cvename>
<cvename>CVE-2017-5493</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/14/6</url>
<url>https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-15</entry>
</dates>
</vuln>
<vuln vid="e5186c65-d729-11e6-a9a5-b499baebfeaf">
<topic>mysql -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html">
<p>Local security vulnerability in 'Server: Packaging' sub component.</p>
</blockquote>
</body>
</description>
<references>
<bid>93617</bid>
<cvename>CVE-2016-5625</cvename>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html</url>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2017-01-14</entry>
<modified>2017-01-15</modified>
</dates>
</vuln>
<vuln vid="22373c43-d728-11e6-a9a5-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-client</name>
<name>mariadb55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<name>mariadb100-server</name>
<range><lt>10.0.28</lt></range>
</package>
<package>
<name>mariadb101-client</name>
<name>mariadb101-server</name>
<range><lt>10.1.18</lt></range>
</package>
<package>
<name>mysql55-client</name>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mysql56-client</name>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>percona55-client</name>
<name>percona55-server</name>
<range><lt>5.5.51.38.2</lt></range>
</package>
<package>
<name>percona56-client</name>
<name>percona56-server</name>
<range><lt>5.6.32.78.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MySQL project reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL">
<ul>
<li>CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer'
sub component.</li>
<li>CVE-2016-5616, CVE-2016-6663: Race condition allows local users with
certain permissions to gain privileges by leveraging use of my_copystat
by REPAIR TABLE to repair a MyISAM table.</li>
<li>CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based
logging, allows local users with access to the mysql account to gain
root privileges via a symlink attack on error logs and possibly other
files.</li>
<li>CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub
component.</li>
<li>CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub
component.</li>
<li>CVE-2016-5629: Remote security vulnerability in 'Server: Federated'
sub component.</li>
<li>CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub
component.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/</url>
<cvename>CVE-2016-3492</cvename>
<cvename>CVE-2016-5616</cvename>
<cvename>CVE-2016-5617</cvename>
<cvename>CVE-2016-5624</cvename>
<cvename>CVE-2016-5626</cvename>
<cvename>CVE-2016-5629</cvename>
<cvename>CVE-2016-6663</cvename>
<cvename>CVE-2016-6664</cvename>
<cvename>CVE-2016-8283</cvename>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2017-01-14</entry>
</dates>
</vuln>
<vuln vid="a93c3287-d8fd-11e6-be5c-001fbc0f280f">
<topic>Ansible -- Command execution on Ansible controller from host</topic>
<affects>
<package>
<name>ansible</name>
<range><gt>1.9.6_1</gt><lt>2.2.0.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Computest reports:</p>
<blockquote cite="https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt">
<p>Computest found and exploited several issues
that allow a compromised host to execute commands
on the Ansible controller and thus gain access
to other hosts controlled by that controller.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9587</cvename>
<url>https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt</url>
<url>https://lwn.net/Articles/711357/</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="7ae0be99-d8bb-11e6-9b7f-d43d7e971a1b">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.22</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>2017.01.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SecurityFocus reports:</p>
<blockquote cite="http://www.securityfocus.com/bid/95328/discuss">
<p>PHPMailer is prone to an local information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information
that may aid in launching further attacks.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/bid/95328/discuss</url>
<cvename>CVE-2017-5223</cvename>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="d4c7e9a9-d893-11e6-9b4d-d050996490d0">
<topic>BIND -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P5</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P5</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.12.28</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01439/0">
<p>A malformed query response received by a recursive
server in response to a query of RTYPE ANY could
trigger an assertion failure while named is attempting
to add the RRs in the query response to the cache.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01440/0">
<p>Depending on the type of query and the EDNS options
in the query they receive, DNSSEC-enabled authoritative
servers are expected to include RRSIG and other RRsets
in their responses to recursive servers.
DNSSEC-validating servers will also make specific queries
for DS and other RRsets.
Whether DNSSEC-validating or not, an error in processing
malformed query responses that contain DNSSEC-related
RRsets that are inconsistent with other RRsets in the
same query response can trigger an assertion failure.
Although the combination of properties which triggers
the assertion should not occur in normal traffic, it
is potentially possible for the assertion to be triggered
deliberately by an attacker sending a specially-constructed
answer.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01441/0">
<p>An unusually-formed answer containing a DS resource
record could trigger an assertion failure. While the
combination of properties which triggers the assertion
should not occur in normal traffic, it is potentially
possible for the assertion to be triggered deliberately
by an attacker sending a specially-constructed answer
having the required properties.</p>
</blockquote>
<blockquote cite="https://kb.isc.org/article/AA-01442/0">
<p>An error in handling certain queries can cause an
assertion failure when a server is using the
nxdomain-redirect feature to cover a zone for which
it is also providing authoritative service.
A vulnerable server could be intentionally stopped
by an attacker if it was using a configuration that
met the criteria for the vulnerability and if the
attacker could cause it to accept a query that
possessed the required attributes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9131</cvename>
<cvename>CVE-2016-9147</cvename>
<cvename>CVE-2016-9444</cvename>
<cvename>CVE-2016-9778</cvename>
<url>https://kb.isc.org/article/AA-01439/0</url>
<url>https://kb.isc.org/article/AA-01440/0</url>
<url>https://kb.isc.org/article/AA-01441/0</url>
<url>https://kb.isc.org/article/AA-01442/0</url>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-12</entry>
</dates>
</vuln>
<vuln vid="2c948527-d823-11e6-9171-14dae9d210b8">
<topic>FreeBSD -- OpenSSH multiple vulnerabilities</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3.p1_5,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_7</lt></range>
<range><ge>10.3</ge><lt>10.3_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The ssh-agent(1) agent supports loading a PKCS#11 module
from outside a trusted whitelist. An attacker can request
loading of a PKCS#11 module across forwarded agent-socket.
[CVE-2016-10009]</p>
<p>When privilege separation is disabled, forwarded Unix
domain sockets would be created by sshd(8) with the privileges
of 'root' instead of the authenticated user. [CVE-2016-10010]</p>
<h1>Impact:</h1>
<p>A remote attacker who have control of a forwarded
agent-socket on a remote system and have the ability to
write files on the system running ssh-agent(1) agent can
run arbitrary code under the same user credential. Because
the attacker must already have some control on both systems,
it is relatively hard to exploit this vulnerability in a
practical attack. [CVE-2016-10009]</p>
<p>When privilege separation is disabled (on FreeBSD,
privilege separation is enabled by default and has to be
explicitly disabled), an authenticated attacker can potentially
gain root privileges on systems running OpenSSH server.
[CVE-2016-10010]</p>
</body>
</description>
<references>
<cvename>CVE-2016-10009</cvename>
<cvename>CVE-2016-10010</cvename>
<freebsdsa>SA-17:01.openssh</freebsdsa>
</references>
<dates>
<discovery>2017-01-11</discovery>
<entry>2017-01-11</entry>
<modified>2017-01-13</modified>
</dates>
</vuln>
<vuln vid="7caebe30-d7f1-11e6-a9a5-b499baebfeaf">
<topic>openssl -- timing attack vulnerability</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.4.4_1</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.5.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cesar Pereida Garcia reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2017/q1/52">
<p>The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL
versions and forks is vulnerable to timing attacks when signing with the
standardized elliptic curve P-256 despite featuring constant-time curve
operations and modular inversion. A software defect omits setting the
BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in
the BN_mod_inverse method and therefore resulting in a cache-timing attack
vulnerability.<br/>
A malicious user with local access can recover ECDSA P-256 private keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2017/q1/52</url>
<cvename>CVE-2016-7056</cvename>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-11</entry>
<modified>2017-01-11</modified>
</dates>
</vuln>
<vuln vid="2a7bdc56-d7a3-11e6-ae1b-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-flashplayer</name>
<range><lt>24.0.0.194</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb17-02.html">
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2017-2938).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2017-2932, CVE-2017-2936,
CVE-2017-2937).</p>
<p>These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2017-2927, CVE-2017-2933,
CVE-2017-2934, CVE-2017-2935).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928,
CVE-2017-2930, CVE-2017-2931).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-2925</cvename>
<cvename>CVE-2017-2926</cvename>
<cvename>CVE-2017-2927</cvename>
<cvename>CVE-2017-2928</cvename>
<cvename>CVE-2017-2930</cvename>
<cvename>CVE-2017-2931</cvename>
<cvename>CVE-2017-2932</cvename>
<cvename>CVE-2017-2933</cvename>
<cvename>CVE-2017-2934</cvename>
<cvename>CVE-2017-2935</cvename>
<cvename>CVE-2017-2936</cvename>
<cvename>CVE-2017-2937</cvename>
<cvename>CVE-2017-2938</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb17-02.html</url>
</references>
<dates>
<discovery>2017-01-10</discovery>
<entry>2017-01-11</entry>
</dates>
</vuln>
<vuln vid="ab804e60-d693-11e6-9171-14dae9d210b8">
<topic>moinmoin -- XSS vulnerabilities</topic>
<affects>
<package>
<name>moinmoin</name>
<range><lt>1.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thomas Waldmann reports:</p>
<blockquote cite="http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES">
<ul>
<li><p>fix XSS in AttachFile view (multifile related) CVE-2016-7148</p></li>
<li><p>fix XSS in GUI editor's attachment dialogue CVE-2016-7146</p></li>
<li><p>fix XSS in GUI editor's link dialogue CVE-2016-9119</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES</url>
<cvename>CVE-2016-7148</cvename>
<cvename>CVE-2016-7146</cvename>
<cvename>CVE-2016-9119</cvename>
<freebsdpr>ports/214937</freebsdpr>
</references>
<dates>
<discovery>2016-10-31</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="64be967a-d379-11e6-a071-001e67f15f5a">
<topic>libvncserver -- multiple buffer overflows</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libvnc server reports:</p>
<blockquote cite="https://github.com/LibVNC/libvncserver/pull/137">
<p>Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/LibVNC/libvncserver/pull/137</url>
<cvename>CVE-2016-9941</cvename>
<cvename>CVE-2016-9942</cvename>
<freebsdpr>ports/215805</freebsdpr>
</references>
<dates>
<discovery>2016-11-24</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="83041ca7-d690-11e6-9171-14dae9d210b8">
<topic>libdwarf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libdwarf</name>
<range><lt>20161124</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Christian Rebischke reports:</p>
<blockquote cite="https://lwn.net/Articles/708092/">
<p>libdwarf is vulnerable to multiple issues including
arbitrary code execution, information disclosure and denial of
service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lwn.net/Articles/708092/</url>
<cvename>CVE-2016-5027</cvename>
<cvename>CVE-2016-5028</cvename>
<cvename>CVE-2016-5029</cvename>
<cvename>CVE-2016-5030</cvename>
<cvename>CVE-2016-5031</cvename>
<cvename>CVE-2016-5032</cvename>
<cvename>CVE-2016-5033</cvename>
<cvename>CVE-2016-5035</cvename>
<cvename>CVE-2016-5037</cvename>
<cvename>CVE-2016-5040</cvename>
<cvename>CVE-2016-5041</cvename>
<cvename>CVE-2016-5043</cvename>
<cvename>CVE-2016-5044</cvename>
<cvename>CVE-2016-7510</cvename>
<cvename>CVE-2016-7511</cvename>
<cvename>CVE-2016-8679</cvename>
<cvename>CVE-2016-8680</cvename>
<cvename>CVE-2016-8681</cvename>
<cvename>CVE-2016-9275</cvename>
<cvename>CVE-2016-9276</cvename>
<cvename>CVE-2016-9480</cvename>
<cvename>CVE-2016-9558</cvename>
</references>
<dates>
<discovery>2016-12-04</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="03532a19-d68e-11e6-9171-14dae9d210b8">
<topic>lynx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>lynx</name>
<range><lt>2.8.8.2_5,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote>
<p>Lynx is vulnerable to POODLE by still supporting vulnerable
version of SSL. Lynx is also vulnerable to URL attacks by incorrectly
parsing hostnames ending with an '?'.</p>
</blockquote>
</body>
</description>
<references>
<url>https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch</url>
<url>https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch</url>
<cvename>CVE-2014-3566</cvename>
<cvename>CVE-2016-9179</cvename>
<freebsdpr>ports/215464</freebsdpr>
</references>
<dates>
<discovery>2016-10-26</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="91e039ed-d689-11e6-9171-14dae9d210b8">
<topic>hdf5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>hdf5</name>
<range><lt>1.10.0</lt></range>
</package>
<package>
<name>hdf5-18</name>
<range><lt>1.8.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos Security reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/11/hdf5-vulns.html">
<ul>
<li><p>CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability</p></li>
<li><p>CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/11/hdf5-vulns.html</url>
<cvename>CVE-2016-4330</cvename>
<cvename>CVE-2016-4331</cvename>
<cvename>CVE-2016-4332</cvename>
<cvename>CVE-2016-4333</cvename>
</references>
<dates>
<discovery>2016-11-17</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="e1ff4c5e-d687-11e6-9171-14dae9d210b8">
<topic>End of Life Ports</topic>
<affects>
<package>
<name>py27-django16</name>
<name>py33-django16</name>
<name>py34-django16</name>
<name>py35-django16</name>
<range><ge>0</ge></range>
</package>
<package>
<name>drupal6</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>These packages have reached End of Life status and/or have
been removed from the Ports Tree. They may contain undocumented
security issues. Please take caution and find alternative
software as soon as possible.</p>
</body>
</description>
<references>
<freebsdpr>ports/211975</freebsdpr>
</references>
<dates>
<discovery>2017-01-06</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="c218873d-d444-11e6-84ef-f0def167eeea">
<topic>Use-After-Free Vulnerability in pcsc-lite</topic>
<affects>
<package>
<name>pcsc-lite</name>
<range><ge>1.6.0</ge><lt>1.8.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Peter Wu on Openwall mailing-list reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2017/01/03/2">
<p>The issue allows a local attacker to cause a Denial of Service,
but can potentially result in Privilege Escalation since
the daemon is running as root. while any local user can
connect to the Unix socket.
Fixed by patch which is released with hpcsc-lite 1.8.20.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10109</cvename>
<url>http://www.openwall.com/lists/oss-security/2017/01/03/2</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-06</entry>
<modified>2017-01-10</modified>
</dates>
</vuln>
<vuln vid="0c5369fc-d671-11e6-a9a5-b499baebfeaf">
<topic>GnuTLS -- Memory corruption vulnerabilities</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.5.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GnuTLS project reports:</p>
<blockquote cite="http://www.gnutls.org/news.html#2017-01-09">
<ul>
<li>It was found using the OSS-FUZZ fuzzer infrastructure that
decoding a specially crafted OpenPGP certificate could lead
to heap and stack overflows. (GNUTLS-SA-2017-2)</li>
<li>It was found using the OSS-FUZZ fuzzer infrastructure that
decoding a specially crafted X.509 certificate with Proxy
Certificate Information extension present could lead to a
double free. (GNUTLS-SA-2017-1)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.gnutls.org/news.html#2017-01-09</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-2</url>
<url>http://www.gnutls.org/security.html#GNUTLS-SA-2017-1</url>
</references>
<dates>
<discovery>2017-01-09</discovery>
<entry>2017-01-09</entry>
</dates>
</vuln>
<vuln vid="e5ec2767-d529-11e6-ae1b-002590263bf5">
<topic>tomcat -- information disclosure vulnerability</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.49</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.74</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40">
<p>Important: Information Disclosure CVE-2016-8745</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8745</cvename>
<freebsdpr>ports/215865</freebsdpr>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40</url>
</references>
<dates>
<discovery>2017-01-05</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="0b9af110-d529-11e6-ae1b-002590263bf5">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.48</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.73</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39">
<p>Important: Remote Code Execution CVE-2016-8735</p>
<p>Important: Information Disclosure CVE-2016-6816</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8735</cvename>
<cvename>CVE-2016-6816</cvename>
<freebsdpr>ports/214599</freebsdpr>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="3ae106e2-d521-11e6-ae1b-002590263bf5">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.47</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.72</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37">
<p>Low: Unrestricted Access to Global Resources CVE-2016-6797</p>
<p>Low: Security Manager Bypass CVE-2016-6796</p>
<p>Low: System Property Disclosure CVE-2016-6794</p>
<p>Low: Security Manager Bypass CVE-2016-5018</p>
<p>Low: Timing Attack CVE-2016-0762</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6797</cvename>
<cvename>CVE-2016-6796</cvename>
<cvename>CVE-2016-6794</cvename>
<cvename>CVE-2016-5018</cvename>
<cvename>CVE-2016-0762</cvename>
<url>http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47</url>
<url>http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72</url>
<url>http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2017-01-07</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="3d6be69b-d365-11e6-a071-001e67f15f5a">
<topic>Irssi -- multiple vulnerabilities</topic>
<affects>
<package>
<name>irssi</name>
<range><lt>0.8.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2017_01.txt">
<p>Five vulnerabilities have been located in Irssi</p>
<ul>
<li>A NULL pointer dereference in the nickcmp function found by
Joseph Bisch. (CWE-690)</li>
<li>Use after free when receiving invalid nick message (Issue #466,
CWE-146)</li>
<li>Out of bounds read in certain incomplete control codes found
by Joseph Bisch. (CWE-126)</li>
<li>Out of bounds read in certain incomplete character sequences
found by Hanno Böck and independently by J. Bisch. (CWE-126)</li>
<li>Out of bounds read when Printing the value '%['. Found by
Hanno Böck. (CWE-126)</li>
</ul>
<p>These issues may result in denial of service (remote crash).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2017-5193</cvename>
<cvename>CVE-2017-5194</cvename>
<cvename>CVE-2017-5195</cvename>
<cvename>CVE-2017-5196</cvename>
<cvename>CVE-2017-5356</cvename>
<freebsdpr>ports/215800</freebsdpr>
<url>https://irssi.org/security/irssi_sa_2017_01.txt</url>
</references>
<dates>
<discovery>2017-01-03</discovery>
<entry>2017-01-05</entry>
<modified>2017-01-15</modified>
</dates>
</vuln>
<vuln vid="496160d3-d3be-11e6-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed a number of new vulnerabilities in Security Library method
xss_clean().</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2016-10-28</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="5e439ee7-d3bd-11e6-ae1b-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>3.1.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://www.codeigniter.com/user_guide/changelog.html">
<p>Fixed an SQL injection in the ‘odbc’ database driver.</p>
<p>Updated set_realpath() Path Helper function to filter-out php://
wrapper inputs.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.codeigniter.com/user_guide/changelog.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2017-01-06</entry>
</dates>
</vuln>
<vuln vid="eafa3aec-211b-4dd4-9b8a-a664a3f0917a">
<topic>w3m -- multiple vulnerabilities</topic>
<affects>
<package>
<name>w3m</name>
<name>w3m-img</name>
<name>ja-w3m</name>
<name>ja-w3m-img</name>
<range><lt>0.5.3.20170102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple remote code execution and denial of service conditions present.</p>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/452</url>
<url>http://seclists.org/oss-sec/2016/q4/516</url>
<cvename>CVE-2016-9422</cvename>
<cvename>CVE-2016-9423</cvename>
<cvename>CVE-2016-9424</cvename>
<cvename>CVE-2016-9425</cvename>
<cvename>CVE-2016-9426</cvename>
<cvename>CVE-2016-9428</cvename>
<cvename>CVE-2016-9429</cvename>
<cvename>CVE-2016-9430</cvename>
<cvename>CVE-2016-9431</cvename>
<cvename>CVE-2016-9432</cvename>
<cvename>CVE-2016-9433</cvename>
<cvename>CVE-2016-9434</cvename>
<cvename>CVE-2016-9435</cvename>
<cvename>CVE-2016-9436</cvename>
<cvename>CVE-2016-9437</cvename>
<cvename>CVE-2016-9438</cvename>
<cvename>CVE-2016-9439</cvename>
<cvename>CVE-2016-9440</cvename>
<cvename>CVE-2016-9441</cvename>
<cvename>CVE-2016-9442</cvename>
<cvename>CVE-2016-9443</cvename>
<cvename>CVE-2016-9622</cvename>
<cvename>CVE-2016-9623</cvename>
<cvename>CVE-2016-9624</cvename>
<cvename>CVE-2016-9625</cvename>
<cvename>CVE-2016-9626</cvename>
<cvename>CVE-2016-9627</cvename>
<cvename>CVE-2016-9628</cvename>
<cvename>CVE-2016-9629</cvename>
<cvename>CVE-2016-9630</cvename>
<cvename>CVE-2016-9631</cvename>
<cvename>CVE-2016-9632</cvename>
<cvename>CVE-2016-9633</cvename>
</references>
<dates>
<discovery>2016-11-03</discovery>
<entry>2017-01-01</entry>
<modified>2017-01-09</modified>
</dates>
</vuln>
<vuln vid="d0b12952-cb86-11e6-906f-0cc47a065786">
<topic>h2o -- Use-after-free vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>2.0.4_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kazuho Oku reports:</p>
<blockquote cite="https://github.com/h2o/h2o/issues?q=label%3Avulnerability">
<p>A use-after-free vulnerability exists in H2O up to and including
version 2.0.4 / 2.1.0-beta3 that can be used by a remote attacker to
mount DoS attacks and / or information theft.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/releases/tag/v2.0.5</url>
<url>https://github.com/h2o/h2o/issues/1144</url>
</references>
<dates>
<discovery>2016-09-09</discovery>
<entry>2016-12-29</entry>
</dates>
</vuln>
<vuln vid="1b61ecef-cdb9-11e6-a9a5-b499baebfeaf">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Check Point reports:</p>
<blockquote cite="http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/">
<p>... discovered 3 fresh and previously unknown vulnerabilities
(CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7
unserialize mechanism.</p>
<p>The first two vulnerabilities allow attackers to take full control
over servers, allowing them to do anything they want with the
website, from spreading malware to defacing it or stealing customer
data.</p>
<p>The last vulnerability generates a Denial of Service attack which
basically hangs the website, exhausts its memory consumption, and
shuts it down.</p>
<p>The PHP security team issued fixes for two of the vulnerabilities
on the 13th of October and 1st of December.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7/</url>
<cvename>CVE-2016-7478</cvename>
<cvename>CVE-2016-7479</cvename>
<cvename>CVE-2016-7480</cvename>
</references>
<dates>
<discovery>2016-12-27</discovery>
<entry>2016-12-29</entry>
<modified>2017-01-04</modified>
</dates>
</vuln>
<vuln vid="6972668d-cdb7-11e6-a9a5-b499baebfeaf">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.14">
<ul>
<li>Use After Free Vulnerability in unserialize() (CVE-2016-9936)</li>
<li>Invalid read when wddx decodes empty boolean element
(CVE-2016-9935)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.14</url>
<cvename>CVE-2016-9935</cvename>
<cvename>CVE-2016-9936</cvename>
</references>
<dates>
<discovery>2016-12-08</discovery>
<entry>2016-12-29</entry>
</dates>
</vuln>
<vuln vid="3c4693de-ccf7-11e6-a9a5-b499baebfeaf">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.20</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>29.12.2016.04.37</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Legal Hackers reports:</p>
<blockquote cite="https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html">
<p>An independent research uncovered a critical vulnerability in
PHPMailer that could potentially be used by (unauthenticated)
remote attackers to achieve remote arbitrary code execution in
the context of the web server user and remotely compromise the
target web application.</p>
<p>To exploit the vulnerability an attacker could target common
website components such as contact/feedback forms, registration
forms, password email resets and others that send out emails with
the help of a vulnerable version of the PHPMailer class.</p>
<p>The first patch of the vulnerability CVE-2016-10033 was incomplete.
This advisory demonstrates the bypass of the patch. The bypass allows
to carry out Remote Code Execution on all current versions (including
5.2.19).</p>
</blockquote>
</body>
</description>
<references>
<url>https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html</url>
<cvename>CVE-2016-10045</cvename>
</references>
<dates>
<discovery>2016-12-28</discovery>
<entry>2016-12-28</entry>
</dates>
</vuln>
<vuln vid="e4bc323f-cc73-11e6-b704-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_4</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><le>4.2.14</le></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.13</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.8</lt></range>
</package>
<package>
<name>samba45</name>
<range><ge>4.5.0</ge><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.5.3">
<p>[CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes
on DNS objects and trigger a controlled memory corruption.</p>
<p>[CVE-2016-2125] Samba client code always requests a forwardable ticket
when using Kerberos authentication. This means the target server, which must be in the current or trusted
domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to
fully impersonate the authenticated user or service.</p>
<p>[CVE-2016-2126] A remote, authenticated, attacker can cause the winbindd process
to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum.
A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2123</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2123.html</url>
<cvename>CVE-2016-2125</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2125.html</url>
<cvename>CVE-2016-2126</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2126.html</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2016-12-26</entry>
<modified>2016-12-26</modified>
</dates>
</vuln>
<vuln vid="244c8288-cc4a-11e6-a475-bcaec524bf84">
<topic>upnp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>upnp</name>
<range><lt>1.6.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthew Garett reports:</p>
<blockquote cite="https://twitter.com/mjg59/status/755062278513319936">
<p>Reported this to upstream 8 months ago without response,
so: libupnp's default behaviour allows anyone to write to your
filesystem. Seriously. Find a device running a libupnp based server
(Shodan says there's rather a lot), and POST a file to /testfile.
Then GET /testfile ... and yeah if the server is running as root
(it is) and is using / as the web root (probably not, but maybe)
this gives full host fs access.</p>
</blockquote>
<p>Scott Tenaglia reports:</p>
<blockquote cite="https://sourceforge.net/p/pupnp/bugs/133/">
<p>There is a heap buffer overflow vulnerability in the
create_url_list function in upnp/src/gena/gena_device.c.</p>
</blockquote>
</body>
</description>
<references>
<url>https://twitter.com/mjg59/status/755062278513319936</url>
<url>https://sourceforge.net/p/pupnp/bugs/133/</url>
<cvename>CVE-2016-6255</cvename>
<cvename>CVE-2016-8863</cvename>
</references>
<dates>
<discovery>2016-02-23</discovery>
<entry>2016-12-27</entry>
</dates>
</vuln>
<vuln vid="c7656d4c-cb60-11e6-a9a5-b499baebfeaf">
<topic>phpmailer -- Remote Code Execution</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.18</lt></range>
</package>
<package>
<name>tt-rss</name>
<range><lt>26.12.2016.07.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Legal Hackers reports:</p>
<blockquote cite="http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html">
<p>An independent research uncovered a critical vulnerability in
PHPMailer that could potentially be used by (unauthenticated)
remote attackers to achieve remote arbitrary code execution in
the context of the web server user and remotely compromise the
target web application.</p>
<p>To exploit the vulnerability an attacker could target common
website components such as contact/feedback forms, registration
forms, password email resets and others that send out emails with
the help of a vulnerable version of the PHPMailer class.</p>
</blockquote>
</body>
</description>
<references>
<url>http://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html</url>
<url>https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md</url>
<cvename>CVE-2016-10033</cvename>
</references>
<dates>
<discovery>2016-12-26</discovery>
<entry>2016-12-26</entry>
</dates>
</vuln>
<vuln vid="e7002b26-caaa-11e6-a76a-9f7324e5534e">
<topic>exim -- DKIM private key leak</topic>
<affects>
<package>
<name>exim</name>
<range><gt>4.69</gt><lt>4.87.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Exim project reports:</p>
<blockquote cite="https://exim.org/static/doc/CVE-2016-9963.txt">
<p>Exim leaks the private DKIM signing key to the log files.
Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used,
the key material is included in the bounce message.</p>
</blockquote>
</body>
</description>
<references>
<url>https://exim.org/static/doc/CVE-2016-9963.txt</url>
<cvename>CVE-2016-9963</cvename>
</references>
<dates>
<discovery>2016-12-15</discovery>
<entry>2016-12-25</entry>
</dates>
</vuln>
<vuln vid="2aedd15f-ca8b-11e6-a9a5-b499baebfeaf">
<cancelled superseded="2c948527-d823-11e6-9171-14dae9d210b8"/>
</vuln>
<vuln vid="c40ca16c-4d9f-4d70-8b6c-4d53aeb8ead4">
<topic>cURL -- uninitialized random vulnerability</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.52.0</ge><lt>7.52.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Project curl Security Advisory:</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20161223.html">
<p>libcurl's (new) internal function that returns a good 32bit
random value was implemented poorly and overwrote the pointer
instead of writing the value into the buffer the pointer
pointed to.</p>
<p>This random value is used to generate nonces for Digest and
NTLM authentication, for generating boundary strings in HTTP
formposts and more. Having a weak or virtually non-existent
random there makes these operations vulnerable.</p>
<p>This function is brand new in 7.52.0 and is the result of an
overhaul to make sure libcurl uses strong random as much as
possible - provided by the backend TLS crypto libraries when
present. The faulty function was introduced in this commit.</p>
<p>We are not aware of any exploit of this flaw.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20161223.html</url>
<cvename>CVE-2016-9594</cvename>
</references>
<dates>
<discovery>2016-12-23</discovery>
<entry>2016-12-24</entry>
</dates>
</vuln>
<vuln vid="41f8af15-c8b9-11e6-ae1b-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.1</ge><lt>3.5.23</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><ge>4.0</ge><lt>4.0.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:10 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_10.txt">
<p>Due to incorrect comparison of request headers Squid can deliver
responses containing private data to clients it should not have
reached.</p>
<p>This problem allows a remote attacker to discover private and
sensitive information about another clients browsing session.
Potentially including credentials which allow access to further
sensitive resources. This problem only affects Squid configured
to use the Collapsed Forwarding feature. It is of particular
importance for HTTPS reverse-proxy sites with Collapsed
Forwarding.</p>
</blockquote>
<p>Squid security advisory 2016:11 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_11.txt">
<p>Due to incorrect HTTP conditional request handling Squid can
deliver responses containing private data to clients it should not
have reached.</p>
<p>This problem allows a remote attacker to discover private and
sensitive information about another clients browsing session.
Potentially including credentials which allow access to further
sensitive resources..</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10002</cvename>
<cvename>CVE-2016-10003</cvename>
<freebsdpr>ports/215416</freebsdpr>
<freebsdpr>ports/215418</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_10.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_11.txt</url>
</references>
<dates>
<discovery>2016-12-16</discovery>
<entry>2016-12-23</entry>
</dates>
</vuln>
<vuln vid="c11629d3-c8ad-11e6-ae1b-002590263bf5">
<topic>vim -- arbitrary command execution</topic>
<affects>
<package>
<name>vim</name>
<name>vim-console</name>
<name>vim-lite</name>
<range><lt>8.0.0056</lt></range>
</package>
<package>
<name>neovim</name>
<range><lt>0.1.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248">
<p>vim before patch 8.0.0056 does not properly validate values for the
'filetype', 'syntax' and 'keymap' options, which may result in the
execution of arbitrary code if a file with a specially crafted
modeline is opened.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1248</cvename>
<bid>94478</bid>
<url>https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a</url>
<url>https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-23</entry>
</dates>
</vuln>
<vuln vid="c290f093-c89e-11e6-821e-68f7288bdf41">
<topic>Pligg CMS -- XSS Vulnerability</topic>
<affects>
<package>
<name>pligg</name>
<range><le>2.0.2,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Netsparker reports: </p>
<blockquote cite="https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/">
<p>Proof of Concept URL for XSS in Pligg CMS:</p>
<p>Page: groups.php</p>
<p>Parameter Name: keyword</p>
<p>Parameter Type: GET</p>
<p>Attack Pattern: http://example.com/pligg-cms-2.0.2/groups.php?view=search&keyword='+alert(0x000D82)+'</p>
<p>For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.netsparker.com/web-applications-advisories/ns-15-011-xss-vulnerability-identified-in-pligg-cms/</url>
</references>
<dates>
<discovery>2015-05-13</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="fcedcdbb-c86e-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities of ntp</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_6</lt></range>
<range><ge>10.3</ge><lt>10.3_15</lt></range>
<range><ge>10.2</ge><lt>10.2_28</lt></range>
<range><ge>10.1</ge><lt>10.1_45</lt></range>
<range><ge>9.3</ge><lt>9.3_53</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple vulnerabilities have been discovered in the NTP
suite:</p>
<p>CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy
of Cisco ASIG.</p>
<p>CVE-2016-9310: Mode 6 unauthenticated trap information
disclosure and DDoS vector. Reported by Matthew Van Gundy
of Cisco ASIG.</p>
<p>CVE-2016-7427: Broadcast Mode Replay Prevention DoS.
Reported by Matthew Van Gundy of Cisco ASIG.</p>
<p>CVE-2016-7428: Broadcast Mode Poll Interval Enforcement
DoS. Reported by Matthew Van Gundy of Cisco ASIG.</p>
<p>CVE-2016-7431: Regression: 010-origin: Zero Origin
Timestamp Bypass. Reported by Sharon Goldberg and Aanchal
Malhotra of Boston University.</p>
<p>CVE-2016-7434: Null pointer dereference in
_IO_str_init_static_internal(). Reported by Magnus Stubman.</p>
<p>CVE-2016-7426: Client rate limiting and server responses.
Reported by Miroslav Lichvar of Red Hat.</p>
<p>CVE-2016-7433: Reboot sync calculation problem. Reported
independently by Brian Utterback of Oracle, and by Sharon
Goldberg and Aanchal Malhotra of Boston University.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send a specially crafted packet
to cause a NULL pointer dereference that will crash ntpd,
resulting in a Denial of Service. [CVE-2016-9311]</p>
<p>An exploitable configuration modification vulnerability
exists in the control mode (mode 6) functionality of ntpd.
If, against long-standing BCP recommendations, "restrict
default noquery ..." is not specified, a specially crafted
control mode packet can set ntpd traps, providing information
disclosure and DDoS amplification, and unset ntpd traps,
disabling legitimate monitoring by an attacker from remote.
[CVE-2016-9310]</p>
<p>An attacker with access to the NTP broadcast domain can
periodically inject specially crafted broadcast mode NTP
packets into the broadcast domain which, while being logged
by ntpd, can cause ntpd to reject broadcast mode packets
from legitimate NTP broadcast servers. [CVE-2016-7427]</p>
<p>An attacker with access to the NTP broadcast domain can
send specially crafted broadcast mode NTP packets to the
broadcast domain which, while being logged by ntpd, will
cause ntpd to reject broadcast mode packets from legitimate
NTP broadcast servers. [CVE-2016-7428]</p>
<p>Origin timestamp problems were fixed in ntp 4.2.8p6.
However, subsequent timestamp validation checks introduced
a regression in the handling of some Zero origin timestamp
checks. [CVE-2016-7431]</p>
<p>If ntpd is configured to allow mrulist query requests
from a server that sends a crafted malicious packet, ntpd
will crash on receipt of that crafted malicious mrulist
query packet. [CVE-2016-7434]</p>
<p>An attacker who knows the sources (e.g., from an IPv4
refid in server response) and knows the system is (mis)configured
in this way can periodically send packets with spoofed
source address to keep the rate limiting activated and
prevent ntpd from accepting valid responses from its sources.
[CVE-2016-7426]</p>
<p>Ntp Bug 2085 described a condition where the root delay
was included twice, causing the jitter value to be higher
than expected. Due to a misinterpretation of a small-print
variable in The Book, the fix for this problem was incorrect,
resulting in a root distance that did not include the peer
dispersion. The calculations and formulas have been reviewed
and reconciled, and the code has been updated accordingly.
[CVE-2016-7433]</p>
</body>
</description>
<references>
<cvename>CVE-2016-7426</cvename>
<cvename>CVE-2016-7427</cvename>
<cvename>CVE-2016-7428</cvename>
<cvename>CVE-2016-7431</cvename>
<cvename>CVE-2016-7433</cvename>
<cvename>CVE-2016-7434</cvename>
<cvename>CVE-2016-9310</cvename>
<cvename>CVE-2016-9311</cvename>
<freebsdsa>SA-16:39.ntp</freebsdsa>
</references>
<dates>
<discovery>2016-12-22</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="42880202-c81c-11e6-a9a5-b499baebfeaf">
<topic>cURL -- buffer overflow</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.1</ge><lt>7.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="https://curl.haxx.se/docs/vuln-7.51.0.html">
<h2>printf floating point buffer overflow</h2>
<p>libcurl's implementation of the printf() functions triggers a
buffer overflow when doing a large floating point output. The bug
occurs when the conversion outputs more than 255 bytes.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/vuln-7.51.0.html</url>
<cvename>CVE-2016-9586</cvename>
</references>
<dates>
<discovery>2016-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="624b45c0-c7f3-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.6.0</ge><lt>3.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html">
<h2>[20161201] - Core - Elevated Privileges</h2>
<p>Incorrect use of unfiltered data stored to the session on a form
validation failure allows for existing user accounts to be modified;
to include resetting their username, password, and user group
assignments.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html">
<h2>[20161202] - Core - Shell Upload</h2>
<p>Inadequate filesystem checks allowed files with alternative PHP
file extensions to be uploaded.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html">
<h2>[20161203] - Core - Information Disclosure</h2>
<p>Inadequate ACL checks in the Beez3 com_content article layout
override enables a user to view restricted content.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9836</cvename>
<cvename>CVE-2016-9837</cvename>
<cvename>CVE-2016-9838</cvename>
<url>https://developer.joomla.org/security-centre/664-20161201-core-elevated-privileges.html</url>
<url>https://developer.joomla.org/security-centre/665-20161202-core-shell-upload.html</url>
<url>https://developer.joomla.org/security-centre/666-20161203-core-information-disclosure.html</url>
<url>https://www.joomla.org/announcements/release-news/5693-joomla-3-6-5-released.html</url>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="a27d234a-c7f2-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.4.4</ge><lt>3.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html">
<h2>[20161001] - Core - Account Creation</h2>
<p>Inadequate checks allows for users to register on a site when
registration has been disabled.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html">
<h2>[20161002] - Core - Elevated Privilege</h2>
<p>Incorrect use of unfiltered data allows for users to register on a
site with elevated privileges.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html">
<h2>[20161003] - Core - Account Modifications</h2>
<p>Incorrect use of unfiltered data allows for existing user accounts
to be modified; to include resetting their username, password, and
user group assignments.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8869</cvename>
<cvename>CVE-2016-8870</cvename>
<cvename>CVE-2016-9081</cvename>
<url>https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html</url>
<url>https://developer.joomla.org/security-centre/660-20161002-core-elevated-privileges.html</url>
<url>https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.html</url>
<url>https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html</url>
</references>
<dates>
<discovery>2016-10-25</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="f0806cad-c7f1-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.6.0</ge><lt>3.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html">
<h2>[20160801] - Core - ACL Violation</h2>
<p>Inadequate ACL checks in com_content provide potential read access
to data which should be access restricted to users with edit_own
level.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html">
<h2>[20160802] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in mail component.
</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/654-20160803-core-csrf.html">
<h2>[20160803] - Core - CSRF</h2>
<p>Add additional CSRF hardening in com_joomlaupdate.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/652-20160801-core-core-acl-violations.html</url>
<url>https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerability.html</url>
<url>https://developer.joomla.org/security-centre/654-20160803-core-csrf.html</url>
<url>https://www.joomla.org/announcements/release-news/5665-joomla-3-6-1-released.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="c0ef061a-c7f0-11e6-ae1b-002590263bf5">
<topic>Joomla! -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>1.5.0</ge><lt>3.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html">
<h2>[20151206] - Core - Session Hardening</h2>
<p>The Joomla Security Strike team has been following up on the
critical security vulnerability patched last week. Since the recent
update it has become clear that the root cause is a bug in PHP
itself. This was fixed by PHP in September of 2015 with the releases
of PHP 5.4.45, 5.5.29, 5.6.13 (Note that this is fixed in all
versions of PHP 7 and has been back-ported in some specific Linux
LTS versions of PHP 5.3). This fixes the bug across all supported
PHP versions.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html">
<h2>[20151207] - Core - SQL Injection</h2>
<p>Inadequate filtering of request data leads to a SQL Injection
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://developer.joomla.org/security-centre/639-20151206-core-session-hardening.html</url>
<url>https://developer.joomla.org/security-centre/640-20151207-core-sql-injection.html</url>
<url>https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7.html</url>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="3ae078ca-c7eb-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 PV guests may be able to mask interrupts</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-202.html">
<p>Certain PV guest kernel operations (page table writes in
particular) need emulation, and use Xen's general x86 instruction
emulator. This allows a malicious guest kernel which asynchronously
modifies its instruction stream to effect the clearing of EFLAGS.IF
from the state used to return to guest context.</p>
<p>A malicious guest kernel administrator can cause a host hang or
crash, resulting in a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10024</cvename>
<url>https://xenbits.xen.org/xsa/advisory-202.html</url>
</references>
<dates>
<discovery>2016-12-21</discovery>
<entry>2016-12-22</entry>
</dates>
</vuln>
<vuln vid="862d6ab3-c75e-11e6-9f98-20cf30e32f6d">
<topic>Apache httpd -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2016-8743</cvename>
<cvename>CVE-2016-2161</cvename>
<cvename>CVE-2016-0736</cvename>
<cvename>CVE-2016-8740</cvename>
<cvename>CVE-2016-5387</cvename>
</references>
<dates>
<discovery>2016-12-20</discovery>
<entry>2016-12-21</entry>
<modified>2016-12-22</modified>
</dates>
</vuln>
<vuln vid="942433db-c661-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-204.html">
<p>The typical behaviour of singlestepping exceptions is determined at
the start of the instruction, with a #DB trap being raised at the
end of the instruction. SYSCALL (and SYSRET, although we don't
implement it) behave differently because the typical behaviour
allows userspace to escalate its privilege. (This difference in
behaviour seems to be undocumented.) Xen wrongly raised the
exception based on the flags at the start of the instruction.</p>
<p>Guest userspace which can invoke the instruction emulator can use
this flaw to escalate its privilege to that of the guest kernel.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-10013</cvename>
<url>http://xenbits.xen.org/xsa/advisory-204.html</url>
</references>
<dates>
<discovery>2016-12-19</discovery>
<entry>2016-12-20</entry>
</dates>
</vuln>
<vuln vid="e47ab5db-c333-11e6-ae1b-002590263bf5">
<topic>atheme-services -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atheme-services</name>
<range><lt>7.2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9773">
<p>modules/chanserv/flags.c in Atheme before 7.2.7 allows remote
attackers to modify the Anope FLAGS behavior by registering and
dropping the (1) LIST, (2) CLEAR, or (3) MODIFY keyword nicks.</p>
</blockquote>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4478">
<p>Buffer overflow in the xmlrpc_char_encode function in
modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows
remote attackers to cause a denial of service via vectors related
to XMLRPC response encoding.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/209217</freebsdpr>
<cvename>CVE-2014-9773</cvename>
<cvename>CVE-2016-4478</cvename>
<url>https://github.com/atheme/atheme/commit/87580d767868360d2fed503980129504da84b63e</url>
<url>https://github.com/atheme/atheme/commit/c597156adc60a45b5f827793cd420945f47bc03b</url>
</references>
<dates>
<discovery>2016-01-09</discovery>
<entry>2016-12-16</entry>
</dates>
</vuln>
<vuln vid="512c0ffd-cd39-4da4-b2dc-81ff4ba8e238">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.1.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.47</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.6.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.6.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/">
<p>CVE-2016-9894: Buffer overflow in SkiaGL</p>
<p>CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements</p>
<p>CVE-2016-9895: CSP bypass using marquee tag</p>
<p>CVE-2016-9896: Use-after-free with WebVR</p>
<p>CVE-2016-9897: Memory corruption in libGLES</p>
<p>CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees</p>
<p>CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs</p>
<p>CVE-2016-9904: Cross-origin information leak in shared atoms</p>
<p>CVE-2016-9901: Data from Pocket server improperly sanitized before execution</p>
<p>CVE-2016-9902: Pocket extension does not validate the origin of events</p>
<p>CVE-2016-9903: XSS injection vulnerability in add-ons SDK</p>
<p>CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1</p>
<p>CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9894</cvename>
<cvename>CVE-2016-9899</cvename>
<cvename>CVE-2016-9895</cvename>
<cvename>CVE-2016-9896</cvename>
<cvename>CVE-2016-9897</cvename>
<cvename>CVE-2016-9898</cvename>
<cvename>CVE-2016-9900</cvename>
<cvename>CVE-2016-9904</cvename>
<cvename>CVE-2016-9901</cvename>
<cvename>CVE-2016-9902</cvename>
<cvename>CVE-2016-9903</cvename>
<cvename>CVE-2016-9080</cvename>
<cvename>CVE-2016-9893</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-94/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-95/</url>
</references>
<dates>
<discovery>2016-12-13</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="54e50cd9-c1a8-11e6-ae1b-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.6.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeremy Felt reports:</p>
<blockquote cite="https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/">
<p>WordPress versions 4.6 and earlier are affected by two security
issues: a cross-site scripting vulnerability via image filename,
reported by SumOfPwn researcher Cengiz Han Sahin; and a path
traversal vulnerability in the upgrade package uploader, reported
by Dominik Schilling from the WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-09-07</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="80a897a2-c1a6-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 CMPXCHG8B emulation fails to ignore operand size override</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-200.html">
<p>The x86 instruction CMPXCHG8B is supposed to ignore legacy operand
size overrides; it only honors the REX.W override (making it
CMPXCHG16B). So, the operand size is always 8 or 16. When support
for CMPXCHG16B emulation was added to the instruction emulator,
this restriction on the set of possible operand sizes was relied on
in some parts of the emulation; but a wrong, fully general, operand
size value was used for other parts of the emulation. As a result,
if a guest uses a supposedly-ignored operand size prefix, a small
amount of hypervisor stack data is leaked to the guests: a 96 bit
leak to guests running in 64-bit mode; or, a 32 bit leak to other
guests.</p>
<p>A malicious unprivileged guest may be able to obtain sensitive
information from the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9932</cvename>
<url>http://xenbits.xen.org/xsa/advisory-200.html</url>
</references>
<dates>
<discovery>2016-12-13</discovery>
<entry>2016-12-14</entry>
</dates>
</vuln>
<vuln vid="2d56308b-c0a8-11e6-a9a5-b499baebfeaf">
<topic>PHP -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.29</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP project reports:</p>
<blockquote cite="http://php.net/archive/2016.php#id2016-12-08-1">
<p>This is a security release. Several security bugs were fixed in
this release.</p>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/archive/2016.php#id2016-12-08-1</url>
<url>http://php.net/archive/2016.php#id2016-12-08-2</url>
</references>
<dates>
<discovery>2016-12-12</discovery>
<entry>2016-12-12</entry>
</dates>
</vuln>
<vuln vid="c0b13887-be44-11e6-b04f-001999f8d30b">
<topic>asterisk -- Authentication Bypass</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.25.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The chan_sip channel driver has a liberal definition
for whitespace when attempting to strip the content between
a SIP header name and a colon character. Rather than
following RFC 3261 and stripping only spaces and horizontal
tabs, Asterisk treats any non-printable ASCII character
as if it were whitespace.</p>
<p>This mostly does not pose a problem until Asterisk is
placed in tandem with an authenticating SIP proxy. In
such a case, a crafty combination of valid and invalid
To headers can cause a proxy to allow an INVITE request
into Asterisk without authentication since it believes
the request is an in-dialog request. However, because of
the bug described above, the request will look like an
out-of-dialog request to Asterisk. Asterisk will then
process the request as a new call. The result is that
Asterisk can process calls from unvetted sources without
any authentication.</p>
<p>If you do not use a proxy for authentication, then
this issue does not affect you.</p>
<p>If your proxy is dialog-aware (meaning that the proxy
keeps track of what dialogs are currently valid), then
this issue does not affect you.</p>
<p>If you use chan_pjsip instead of chan_sip, then this
issue does not affect you.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.digium.com/pub/security/ASTERISK-2016-009.html</url>
</references>
<dates>
<discovery>2016-11-28</discovery>
<entry>2016-12-09</entry>
</dates>
</vuln>
<vuln vid="9e6640fe-be3a-11e6-b04f-001999f8d30b">
<topic>asterisk -- Crash on SDP offer or answer from endpoint using Opus</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.12.0</ge><lt>13.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>If an SDP offer or answer is received with the Opus
codec and with the format parameters separated using a
space the code responsible for parsing will recursively
call itself until it crashes. This occurs as the code
does not properly handle spaces separating the parameters.
This does NOT require the endpoint to have Opus configured
in Asterisk. This also does not require the endpoint to
be authenticated. If guest is enabled for chan_sip or
anonymous in chan_pjsip an SDP offer or answer is still
processed and the crash occurs.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-008.html</url>
</references>
<dates>
<discovery>2016-11-11</discovery>
<entry>2016-12-09</entry>
</dates>
</vuln>
<vuln vid="eab68cff-bc0c-11e6-b2ca-001b3856973b">
<topic>cryptopp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cryptopp</name>
<range><lt>5.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple sources report:</p>
<blockquote cite="https://eprint.iacr.org/2015/368">
<p>CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function
in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key
operations for the Rabin-Williams digital signature algorithm, which
allows remote attackers to obtain private keys via a timing attack.
Fixed in 5.6.3.</p>
</blockquote>
<blockquote cite="https://github.com/weidai11/cryptopp/issues/146">
<p>CVE-2016-3995: Incorrect implementation of Rijndael timing attack
countermeasure. Fixed in 5.6.4.</p>
</blockquote>
<blockquote cite="https://github.com/weidai11/cryptopp/issues/277">
<p>CVE-2016-7420: Library built without -DNDEBUG could egress sensitive
information to the filesystem via a core dump if an assert was triggered.
Fixed in 5.6.5.</p>
</blockquote>
</body>
</description>
<references>
<url>https://eprint.iacr.org/2015/368</url>
<url>https://github.com/weidai11/cryptopp/issues/146</url>
<url>https://github.com/weidai11/cryptopp/issues/277</url>
<cvename>CVE-2015-2141</cvename>
<cvename>CVE-2016-3995</cvename>
<cvename>CVE-2016-7420</cvename>
</references>
<dates>
<discovery>2015-02-27</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="e722e3c6-bbee-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- bhyve(8) virtual machine escape</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_4</lt></range>
<range><ge>10.3</ge><lt>10.3_13</lt></range>
<range><ge>10.2</ge><lt>10.2_26</lt></range>
<range><ge>10.1</ge><lt>10.1_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The bounds checking of accesses to guest memory greater
than 4GB by device emulations is subject to integer
overflow.</p>
<h1>Impact:</h1>
<p>For a bhyve virtual machine with more than 3GB of guest
memory configured, a malicious guest could craft device
descriptors that could give it access to the heap of the
bhyve process. Since the bhyve process is running as root,
this may allow guests to obtain full control of the hosts
they're running on.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1889</cvename>
<freebsdsa>SA-16:38.bhyve</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="0282269d-bbee-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- link_ntoa(3) buffer overflow</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_5</lt></range>
<range><ge>10.3</ge><lt>10.3_14</lt></range>
<range><ge>10.2</ge><lt>10.2_27</lt></range>
<range><ge>10.1</ge><lt>10.1_44</lt></range>
<range><ge>9.3</ge><lt>9.3_52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A specially crafted argument can trigger a static buffer
overflow in the library, with possibility to rewrite following
static buffers that belong to other library functions.</p>
<h1>Impact:</h1>
<p>Due to very limited use of the function in the existing
applications, and limited length of the overflow, exploitation
of the vulnerability does not seem feasible. None of the
utilities and daemons in the base system are known to be
vulnerable. However, careful review of third party software
that may use the function was not performed.</p>
</body>
</description>
<references>
<cvename>CVE-2016-6559</cvename>
<freebsdsa>SA-16:37.libc</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
<modified>2016-12-08</modified>
</dates>
</vuln>
<vuln vid="e00304d2-bbed-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- Possible login(1) argument injection in telnetd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_4</lt></range>
<range><ge>10.3</ge><lt>10.3_13</lt></range>
<range><ge>10.2</ge><lt>10.2_26</lt></range>
<range><ge>10.1</ge><lt>10.1_43</lt></range>
<range><ge>9.3</ge><lt>9.3_51</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An unexpected sequence of memory allocation failures
combined with insufficient error checking could result in
the construction and execution of an argument sequence that
was not intended.</p>
<h1>Impact:</h1>
<p>An attacker who controls the sequence of memory allocation
failures and success may cause login(1) to run without
authentication and may be able to cause misbehavior of
login(1) replacements.</p>
<p>No practical way of controlling these memory allocation
failures is known at this time.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1888</cvename>
<freebsdsa>SA-16:36.telnetd</freebsdsa>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="cb0bf1ec-bb92-11e6-a9a5-b499baebfeaf">
<topic>Apache httpd -- denial of service in HTTP/2</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.17</ge><le>2.4.23_1</le></range>
</package>
<package>
<name>mod_http2-devel</name>
<range><lt>1.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>mod_http2 reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E">
<p>The Apache HTTPD web server (from 2.4.17-2.4.23) did not apply
limitations on request headers correctly when experimental module
for the HTTP/2 protocol is used to access a resource.</p>
<p>The net result is that a the server allocates too much memory
instead of denying the request. This can lead to memory exhaustion
of the server by a properly crafted request.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201612.mbox/%3C1A097A43-7CCB-4BA1-861F-E0C7EEE83A4B%40apache.org%3E</url>
<url>https://github.com/icing/mod_h2/releases/tag/v1.8.3</url>
<cvename>CVE-2016-8740</cvename>
</references>
<dates>
<discovery>2016-12-06</discovery>
<entry>2016-12-06</entry>
</dates>
</vuln>
<vuln vid="603fe0a1-bb26-11e6-8e5a-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>55.0.2883.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html">
<p>36 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9651</cvename>
<cvename>CVE-2016-5208</cvename>
<cvename>CVE-2016-5207</cvename>
<cvename>CVE-2016-5206</cvename>
<cvename>CVE-2016-5205</cvename>
<cvename>CVE-2016-5204</cvename>
<cvename>CVE-2016-5209</cvename>
<cvename>CVE-2016-5203</cvename>
<cvename>CVE-2016-5210</cvename>
<cvename>CVE-2016-5212</cvename>
<cvename>CVE-2016-5211</cvename>
<cvename>CVE-2016-5213</cvename>
<cvename>CVE-2016-5214</cvename>
<cvename>CVE-2016-5216</cvename>
<cvename>CVE-2016-5215</cvename>
<cvename>CVE-2016-5217</cvename>
<cvename>CVE-2016-5218</cvename>
<cvename>CVE-2016-5219</cvename>
<cvename>CVE-2016-5221</cvename>
<cvename>CVE-2016-5220</cvename>
<cvename>CVE-2016-5222</cvename>
<cvename>CVE-2016-9650</cvename>
<cvename>CVE-2016-5223</cvename>
<cvename>CVE-2016-5226</cvename>
<cvename>CVE-2016-5225</cvename>
<cvename>CVE-2016-5224</cvename>
<cvename>CVE-2016-9652</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/12/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-12-01</discovery>
<entry>2016-12-05</entry>
</dates>
</vuln>
<vuln vid="e1f67063-aab4-11e6-b2d3-60a44ce6887b">
<topic>ImageMagick7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.3.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Multiple sources report:</p>
<blockquote cite="https://github.com/ImageMagick/ImageMagick/issues/296">
<p>CVE-2016-9298: heap overflow in WaveletDenoiseImage(), fixed in ImageMagick7-7.0.3.6, discovered 2016-10-31</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/">
<p>CVE-2016-8866: memory allocation failure in AcquireMagickMemory (incomplete previous fix for CVE-2016-8862), not fixed yet with the release of this announcement, re-discovered 2016-10-13.</p>
</blockquote>
<blockquote cite="https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/">
<p>CVE-2016-8862: memory allocation failure in AcquireMagickMemory, initially partially fixed in ImageMagick7-7.0.3.3, discovered 2016-09-14.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
<url>https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/</url>
<url>https://blogs.gentoo.org/ago/2016/10/17/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c/</url>
<cvename>CVE-2016-9298</cvename>
<cvename>CVE-2016-8866</cvename>
<cvename>CVE-2016-8862</cvename>
<freebsdpr>ports/214514</freebsdpr>
</references>
<dates>
<discovery>2016-09-14</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="bc4898d5-a794-11e6-b2d3-60a44ce6887b">
<topic>Pillow -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>3.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pillow reports:</p>
<blockquote cite="http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html">
<p>Pillow prior to 3.3.2 may experience integer overflow
errors in map.c when reading specially crafted image files. This may
lead to memory disclosure or corruption.</p>
<p>Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check
for negative image sizes in ImagingNew in Storage.c. A negative image
size can lead to a smaller allocation than expected, leading to arbi
trary writes.</p>
</blockquote>
</body>
</description>
<references>
<url>http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html</url>
<url>https://github.com/python-pillow/Pillow/issues/2105</url>
<cvename>CVE-2016-9189</cvename>
<cvename>CVE-2016-9190</cvename>
<freebsdpr>ports/214410</freebsdpr>
</references>
<dates>
<discovery>2016-09-06</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="19d35b0f-ba73-11e6-b1cf-14dae9d210b8">
<topic>ImageMagick -- heap overflow vulnerability</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.6.4,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><lt>7.0.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bastien Roucaries reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q4/413">
<p>Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b
suffer from a heap overflow in WaveletDenoiseImage(). This problem is
easily trigerrable from a Perl script.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/413</url>
<url>https://github.com/ImageMagick/ImageMagick/issues/296</url>
<cvename>CVE-2016-9298</cvename>
<freebsdpr>ports/214517</freebsdpr>
<freebsdpr>ports/214511</freebsdpr>
<freebsdpr>ports/214520</freebsdpr>
</references>
<dates>
<discovery>2016-11-13</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="e5dcb942-ba6f-11e6-b1cf-14dae9d210b8">
<topic>py-cryptography -- vulnerable HKDF key generation</topic>
<affects>
<package>
<name>py27-cryptography</name>
<name>py33-cryptography</name>
<name>py34-cryptography</name>
<name>py35-cryptography</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alex Gaynor reports:</p>
<blockquote cite="https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d">
<p>Fixed a bug where ``HKDF`` would return an empty
byte-string if used with a ``length`` less than
``algorithm.digest_size``.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/pyca/cryptography/commit/b94cacf2ae6e75e4007a79709bbf5360435b512d</url>
<cvename>CVE-2016-9243</cvename>
<freebsdpr>ports/214915</freebsdpr>
</references>
<dates>
<discovery>2016-11-05</discovery>
<entry>2016-12-04</entry>
<modified>2016-12-06</modified>
</dates>
</vuln>
<vuln vid="a228c7a0-ba66-11e6-b1cf-14dae9d210b8">
<topic>qemu -- denial of service vulnerability</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<name>qemu-sbruno</name>
<range><lt>2.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel P. Berrange reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html">
<p>The VNC server websockets decoder will read and buffer data
from websockets clients until it sees the end of the HTTP headers,
as indicated by \r\n\r\n. In theory this allows a malicious to
trick QEMU into consuming an arbitrary amount of RAM.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04895.html</url>
<cvename>CVE-2015-1779</cvename>
<freebsdpr>ports/206725</freebsdpr>
</references>
<dates>
<discovery>2015-03-23</discovery>
<entry>2016-12-04</entry>
<modified>2016-12-06</modified>
</dates>
</vuln>
<vuln vid="59f79c99-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-tools -- delimiter injection vulnerabilities in pygrub</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-198.html">
<p>pygrub, the boot loader emulator, fails to quote (or sanity check)
its results when reporting them to its caller.</p>
<p>A malicious guest administrator can obtain the contents of
sensitive host files (an information leak). Additionally, a
malicious guest administrator can cause files on the host to be
removed, causing a denial of service. In some unusual host
configurations, ability to remove certain files may be usable for
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9379</cvename>
<cvename>CVE-2016-9380</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-198.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="58685e23-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-tools -- qemu incautious about shared ring processing</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-197.html">
<p>The compiler can emit optimizations in qemu which can lead to
double fetch vulnerabilities. Specifically data on the rings shared
between qemu and the hypervisor (which the guest under control can
obtain mappings of) can be fetched twice (during which time the
guest can alter the contents) possibly leading to arbitrary code
execution in qemu.</p>
<p>Malicious administrators can exploit this vulnerability to take
over the qemu process, elevating its privilege to that of the qemu
process.</p>
<p>In a system not using a device model stub domain (or other
techniques for deprivileging qemu), malicious guest administrators
can thus elevate their privilege to that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9381</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-197.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="56f0f11e-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 64-bit bit test instruction emulation broken</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-195.html">
<p>The x86 instructions BT, BTC, BTR, and BTS, when used with a
destination memory operand and a source register rather than an
immediate operand, access a memory location offset from that
specified by the memory operand as specified by the high bits of
the register source.</p>
<p>A malicious guest can modify arbitrary memory, allowing for
arbitrary code execution (and therefore privilege escalation
affecting the whole host), a crash of the host (leading to a DoS),
or information leaks. The vulnerability is sometimes exploitable
by unprivileged guest user processes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9383</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-195.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="5555120d-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- guest 32-bit ELF symbol table load leaking host data</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.7</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-194.html">
<p>Along with their main kernel binary, unprivileged guests may
arrange to have their Xen environment load (kernel) symbol tables
for their use. The ELF image metadata created for this purpose has a
few unused bytes when the symbol table binary is in 32-bit ELF
format. These unused bytes were not properly cleared during symbol
table loading.</p>
<p>A malicious unprivileged guest may be able to obtain sensitive
information from the host.</p>
<p>The information leak is small and not under the control of the
guest, so effectively exploiting this vulnerability is probably
difficult.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9384</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-194.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="53dbd096-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 segment base write emulation lacking canonical address checks</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-193.html">
<p>Both writes to the FS and GS register base MSRs as well as the
WRFSBASE and WRGSBASE instructions require their input values to be
canonical, or a #GP fault will be raised. When the use of those
instructions by the hypervisor was enabled, the previous guard
against #GP faults (having recovery code attached) was accidentally
removed.</p>
<p>A malicious guest administrator can crash the host, leading to a
DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9385</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-193.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="523bb0b7-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 task switch to VM86 mode mis-handled</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-192.html">
<p>LDTR, just like TR, is purely a protected mode facility. Hence even
when switching to a VM86 mode task, LDTR loading needs to follow
protected mode semantics. This was violated by the code.</p>
<p>On SVM (AMD hardware): a malicious unprivileged guest process can
escalate its privilege to that of the guest operating system.</p>
<p>On both SVM and VMX (Intel hardware): a malicious unprivileged
guest process can crash the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9382</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-192.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="50ac2e96-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 null segments not always treated as unusable</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-191.html">
<p>The Xen x86 emulator erroneously failed to consider the unusability
of segments when performing memory accesses.</p>
<p> The intended behaviour is as follows: The user data segment (%ds,
%es, %fs and %gs) selectors may be NULL in 32-bit to prevent access.
In 64-bit, NULL has a special meaning for user segments, and there
is no way of preventing access. However, in both 32-bit and 64-bit,
a NULL LDT system segment is intended to prevent access.</p>
<p>On Intel hardware, loading a NULL selector zeros the base as well
as most attributes, but sets the limit field to its largest possible
value. On AMD hardware, loading a NULL selector zeros the attributes,
leaving the stale base and limit intact.</p>
<p>Xen may erroneously permit the access using unexpected base/limit
values.</p>
<p>Ability to exploit this vulnerability on Intel is easy, but on AMD
depends in a complicated way on how the guest kernel manages LDTs.
</p>
<p>An unprivileged guest user program may be able to elevate its
privilege to that of the guest operating system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9386</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-191.html</url>
</references>
<dates>
<discovery>2016-11-22</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4d7cf654-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-190.html">
<p>Instructions touching FPU, MMX, or XMM registers are required to
raise a Device Not Available Exception (#NM) when either CR0.EM or
CR0.TS are set. (Their AVX or AVX-512 extensions would consider only
CR0.TS.) While during normal operation this is ensured by the
hardware, if a guest modifies instructions while the hypervisor is
preparing to emulate them, the #NM delivery could be missed.</p>
<p>Guest code in one task may thus (unintentionally or maliciously)
read or modify register state belonging to another task in the same
VM.</p>
<p>A malicious unprivileged guest user may be able to obtain or
corrupt sensitive information (including cryptographic material) in
other programs in the same guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7777</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-190.html</url>
</references>
<dates>
<discovery>2016-10-04</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4bf57137-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- use after free in FIFO event channel code</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.4</ge><lt>4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-188.html">
<p>When the EVTCHNOP_init_control operation is called with a bad guest
frame number, it takes an error path which frees a control structure
without also clearing the corresponding pointer. Certain subsequent
operations (EVTCHNOP_expand_array or another EVTCHNOP_init_control),
upon finding the non-NULL pointer, continue operation assuming it
points to allocated memory.</p>
<p>A malicious guest administrator can crash the host, leading to a
DoS. Arbitrary code execution (and therefore privilege escalation),
and information leaks, cannot be excluded.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7154</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-188.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="4aae54be-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[]</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-187.html">
<p>x86 HVM guests running with shadow paging use a subset of the x86
emulator to handle the guest writing to its own pagetables. There
are situations a guest can provoke which result in exceeding the
space allocated for internal state.</p>
<p>A malicious HVM guest administrator can cause Xen to fail a bug
check, causing a denial of service to the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7094</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-187.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="49211361-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><eq>4.5.3</eq></range>
<range><eq>4.6.3</eq></range>
<range><ge>4.7.0</ge><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-186.html">
<p>When emulating HVM instructions, Xen uses a small i-cache for
fetches from guest memory. The code that handles cache misses does
not check if the address from which it fetched lies within the cache
before blindly writing to it. As such it is possible for the guest
to overwrite hypervisor memory.</p>
<p>It is currently believed that the only way to trigger this bug is
to use the way that Xen currently incorrectly wraps CS:IP in 16 bit
modes. The included patch prevents such wrapping.</p>
<p>A malicious HVM guest administrator can escalate their privilege to
that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7093</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-186.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="45ca25b5-ba4d-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="https://xenbits.xen.org/xsa/advisory-185.html">
<p>On real hardware, a 32-bit PAE guest must leave the USER and RW bit
clear in L3 pagetable entries, but the pagetable walk behaves as if
they were set. (The L3 entries are cached in processor registers,
and don't actually form part of the pagewalk.)</p>
<p>When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR
in the USER and RW bits for L3 updates for the guest to observe
architectural behaviour. This is unsafe in combination with
recursive pagetables.</p>
<p>As there is no way to construct an L3 recursive pagetable in native
32-bit PAE mode, disallow this option in 32-bit PV guests.</p>
<p>A malicious 32-bit PV guest administrator can escalate their
privilege to that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7092</cvename>
<freebsdpr>ports/214936</freebsdpr>
<url>https://xenbits.xen.org/xsa/advisory-185.html</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-12-04</entry>
</dates>
</vuln>
<vuln vid="7fff2b16-b0ee-11e6-86b8-589cfc054129">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tshark</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>tshark-lite</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark-lite</name>
<range><lt>2.2.2</lt></range>
</package>
<package>
<name>wireshark-qt5</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark project reports:</p>
<blockquote cite="://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html">
<p>Wireshark project is releasing Wireshark 2.2.2, which addresses:</p>
<ul>
<li>wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372</li>
<li>wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374</li>
<li>wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376</li>
<li>wnpa-sec-2016-61: DCERPC crash - CVE-2016-9373</li>
<li>wnpa-sec-2016-62: DTN infinite loop - CVE-2016-9375</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.2.2.html</url>
<cvename>CVE-2016-9372</cvename>
<cvename>CVE-2016-9373</cvename>
<cvename>CVE-2016-9374</cvename>
<cvename>CVE-2016-9375</cvename>
<cvename>CVE-2016-9376</cvename>
</references>
<dates>
<discovery>2016-11-16</discovery>
<entry>2016-12-01</entry>
</dates>
</vuln>
<vuln vid="18f39fb6-7400-4063-acaf-0806e92c094f">
<topic>Mozilla -- SVG Animation Remote Code Execution</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0.2,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.5.1,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.5.1,2</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>45.5.1</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>45.5.1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>45.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/">
<p>A use-after-free vulnerability in SVG Animation has been
discovered. An exploit built on this vulnerability has been
discovered in the wild targeting Firefox and Tor Browser
users on Windows.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9079</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/</url>
</references>
<dates>
<discovery>2016-11-30</discovery>
<entry>2016-12-01</entry>
<modified>2016-12-16</modified>
</dates>
</vuln>
<vuln vid="479c5b91-b6cc-11e6-a04e-3417eb99b9a0">
<topic>wget -- Access List Bypass / Race Condition</topic>
<affects>
<package>
<name>wget</name>
<range><le>1.17</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dawid Golunski reports:</p>
<blockquote cite="https://legalhackers.com/advisories/Wget-Exploit-ACL-bypass-RaceCond-CVE-2016-7098.html">
<p>GNU wget in version 1.17 and earlier, when used in
mirroring/recursive mode, is affected by a Race Condition
vulnerability that might allow remote attackers to bypass intended
wget access list restrictions specified with -A parameter.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7098</url>
<cvename>CVE-2016-7098</cvename>
</references>
<dates>
<discovery>2016-11-24</discovery>
<entry>2016-11-30</entry>
</dates>
</vuln>
<vuln vid="48e83187-b6e9-11e6-b6cf-5453ed2e2b49">
<topic>p7zip -- Null pointer dereference</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9296">
<p>A null pointer dereference bug affects the 16.02 and many old
versions of p7zip. A lack of null pointer check for the variable
<code>folders.PackPositions</code> in function
<code>CInArchive::ReadAndDecodePackedStreams</code>, as used in
the 7z.so library and in 7z applications, will cause a crash and a
denial of service when decoding malformed 7z files.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9296</cvename>
<url>https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/</url>
<url>https://sourceforge.net/p/p7zip/bugs/185/</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9296</url>
</references>
<dates>
<discovery>2016-07-17</discovery>
<entry>2016-11-30</entry>
</dates>
</vuln>
<vuln vid="ac256985-b6a9-11e6-a3bf-206a8a720317">
<topic>subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s)</topic>
<affects>
<package>
<name>subversion18</name>
<range><lt>1.8.17</lt></range>
</package>
<package>
<name>subversion</name>
<range><lt>1.9.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-8734-advisory.txt">
<p>The mod_dontdothat module of subversion and subversion clients using
http(s):// are vulnerable to a denial-of-service attack, caused by
exponential XML entity expansion. The attack targets XML parsers
causing targeted process to consume excessive amounts of resources.
The attack is also known as the "billions of laughs attack."</p>
</blockquote>
</body>
</description>
<references>
<url>http://subversion.apache.org/security/CVE-2016-8734-advisory.txt</url>
<cvename>CVE-2016-8734</cvename>
</references>
<dates>
<discovery>2016-11-29</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="18449f92-ab39-11e6-8011-005056925db4">
<topic>libwww -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libwww</name>
<range><lt>5.4.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3183">
<p>The HTBoundary_put_block function in HTBound.c for W3C libwww
(w3c-libwww) allows remote servers to cause a denial of service
(segmentation fault) via a crafted multipart/byteranges MIME message
that triggers an out-of-bounds read.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560">
<p>The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
as used in the XML-Twig module for Perl, allows context-dependent
attackers to cause a denial of service (application crash) via an XML
document with malformed UTF-8 sequences that trigger a buffer
over-read, related to the doProlog function in lib/xmlparse.c, a
different vulnerability than CVE-2009-2625 and CVE-2009-3720.</p>
</blockquote>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720">
<p>The updatePosition function in lib/xmltok_impl.c in libexpat in
Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other
software, allows context-dependent attackers to cause a denial of
service (application crash) via an XML document with crafted UTF-8
sequences that trigger a buffer over-read, a different vulnerability
than CVE-2009-2625.</p>
</blockquote>
</body>
</description>
<references>
<bid>15035</bid>
<cvename>CVE-2005-3183</cvename>
<cvename>CVE-2009-3560</cvename>
<cvename>CVE-2009-3720</cvename>
<freebsdpr>ports/214546</freebsdpr>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=170518</url>
</references>
<dates>
<discovery>2005-10-12</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e">
<topic>mozilla -- data: URL can inherit wrong origin after an HTTP redirect</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-91/">
<p>Redirection from an HTTP connection to a data: URL
assigns the referring site's origin to the data: URL in some
circumstances. This can result in same-origin violations
against a domain if it loads resources from malicious
sites. Cross-origin setting of cookies has been demonstrated
without the ability to read them.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9078</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-91/</url>
</references>
<dates>
<discovery>2016-11-28</discovery>
<entry>2016-11-29</entry>
</dates>
</vuln>
<vuln vid="125f5958-b611-11e6-a9a5-b499baebfeaf">
<topic>Roundcube -- arbitrary command execution</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.2.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Roundcube project reports</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-9920">
<p>steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before
1.2.3, when no SMTP server is configured and the sendmail program is
enabled, does not properly restrict the use of custom envelope-from
addresses on the sendmail command line, which allows remote
authenticated users to execute arbitrary code via a modified HTTP
request that sends a crafted e-mail message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9920</cvename>
<bid>94858</bid>
<url>http://www.openwall.com/lists/oss-security/2016/12/08/17</url>
<url>https://github.com/roundcube/roundcubemail/wiki/Changelog#release-123</url>
</references>
<dates>
<discovery>2016-11-29</discovery>
<entry>2016-11-29</entry>
<modified>2016-12-14</modified>
</dates>
</vuln>
<vuln vid="8db24888-b2f5-11e6-8153-00248c0c745d">
<topic>Drupal Code -- Multiple Vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><ge>7.0</ge><lt>7.52</lt></range>
</package>
<package>
<name>drupal8</name>
<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-005">
<h3>Inconsistent name for term access query (Less critical - Drupal
7 and Drupal 8)</h3>
<p>Drupal provides a mechanism to alter database SELECT queries before
they are executed. Contributed and custom modules may use this
mechanism to restrict access to certain entities by implementing
hook_query_alter() or hook_query_TAG_alter() in order to add
additional conditions. Queries can be distinguished by means of
query tags. As the documentation on EntityFieldQuery::addTag()
suggests, access-tags on entity queries normally follow the form
ENTITY_TYPE_access (e.g. node_access). However, the taxonomy
module's access query tag predated this system and used term_access
as the query tag instead of taxonomy_term_access.</p>
<p>As a result, before this security release modules wishing to
restrict access to taxonomy terms may have implemented an
unsupported tag, or needed to look for both tags (term_access and
taxonomy_term_access) in order to be compatible with queries
generated both by Drupal core as well as those generated by
contributed modules like Entity Reference. Otherwise information
on taxonomy terms might have been disclosed to unprivileged users.
</p>
<h3>Incorrect cache context on password reset page (Less critical -
Drupal 8)</h3>
<p>The user password reset form does not specify a proper cache
context, which can lead to cache poisoning and unwanted content on
the page.</p>
<h3>Confirmation forms allow external URLs to be injected (Moderately
critical - Drupal 7)</h3>
<p>Under certain circumstances, malicious users could construct a URL
to a confirmation form that would trick users into being redirected
to a 3rd party website after interacting with the form, thereby
exposing the users to potential social engineering attacks.</p>
<h3>Denial of service via transliterate mechanism (Moderately critical
- Drupal 8)</h3>
<p>A specially crafted URL can cause a denial of service via the
transliterate mechanism.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9449</cvename>
<cvename>CVE-2016-9450</cvename>
<cvename>CVE-2016-9451</cvename>
<cvename>CVE-2016-9452</cvename>
</references>
<dates>
<discovery>2016-11-16</discovery>
<entry>2016-11-25</entry>
<modified>2016-11-27</modified>
</dates>
</vuln>
<vuln vid="6fe72178-b2e3-11e6-8b2a-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.6.0</ge><lt>4.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-57/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-58/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-59/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-60/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-61/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-62/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-63/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-64/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-65/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-66/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-67/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-68/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-69/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-70/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-71/</url>
<cvename>CVE-2016-6632</cvename>
<cvename>CVE-2016-6633</cvename>
<cvename>CVE-2016-4412</cvename>
</references>
<dates>
<discovery>2016-11-25</discovery>
<entry>2016-11-25</entry>
</dates>
</vuln>
<vuln vid="dc596a17-7a9e-11e6-b034-f0def167eeea">
<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>mysql56-client</name>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql55-client</name>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LegalHackers' reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
It works by manipulating my.cnf files and using --malloc-lib.
The bug seems fixed in MySQL 5.7.15 by Oracle</p>
</blockquote>
</body>
</description>
<references>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-11-24</entry>
<modified>2016-11-24</modified>
</dates>
</vuln>
<vuln vid="8db8d62a-b08b-11e6-8eba-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p9</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se">
<p>NTF's NTP Project is releasing ntp-4.2.8p9, which addresses:</p>
<ul>
<li>1 HIGH severity vulnerability that only affects Windows</li>
<li>2 MEDIUM severity vulnerabilities</li>
<li>2 MEDIUM/LOW severity vulnerabilities</li>
<li>5 LOW severity vulnerabilities</li>
<li>28 other non-security fixes and improvements</li>
</ul>
<p>All of the security issues in this release are listed in
<a href="http://www.kb.cert.org/vuls/id/633847">VU#633847</a>.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7426</cvename>
<cvename>CVE-2016-7427</cvename>
<cvename>CVE-2016-7428</cvename>
<cvename>CVE-2016-7429</cvename>
<cvename>CVE-2016-7431</cvename>
<cvename>CVE-2016-7433</cvename>
<cvename>CVE-2016-7434</cvename>
<cvename>CVE-2016-9310</cvename>
<cvename>CVE-2016-9311</cvename>
<cvename>CVE-2016-9312</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se</url>
<url>http://www.kb.cert.org/vuls/id/633847</url>
</references>
<dates>
<discovery>2016-11-21</discovery>
<entry>2016-11-22</entry>
</dates>
</vuln>
<vuln vid="81fc7705-b002-11e6-b20a-14dae9d5a9d2">
<topic>teeworlds -- Remote code execution</topic>
<affects>
<package>
<name>teeworlds</name>
<range><lt>0.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Teeworlds project reports:</p>
<blockquote cite="https://www.teeworlds.com/?page=news&id=12086">
<p>Attacker controlled memory-writes and possibly arbitrary code
execution on the client, abusable by any server the client joins</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.teeworlds.com/?page=news&id=12086</url>
</references>
<dates>
<discovery>2016-11-13</discovery>
<entry>2016-11-21</entry>
</dates>
</vuln>
<vuln vid="27eee66d-9474-44a5-b830-21ec12a1c307">
<topic>jenkins -- Remote code execution vulnerability in remoting module</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.31</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>2.19.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16">
<p>An unauthenticated remote code execution vulnerability allowed
attackers to transfer a serialized Java object to the Jenkins CLI,
making Jenkins connect to an attacker-controlled LDAP server, which
in turn can send a serialized payload leading to code execution,
bypassing existing protection mechanisms.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9299</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16</url>
</references>
<dates>
<discovery>2016-11-11</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="f6565fbf-ab9e-11e6-ae1b-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><lt>2.9.9</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.7</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0023: Question engine allows access to files that
should not be available</p></li>
<li><p>MSA-16-0024: Non-admin site managers may accidentally edit
admins via web services</p></li>
<li><p>MSA-16-0025: Capability to view course notes is checked in
the wrong context</p></li>
<li><p>MSA-16-0026: When debugging is enabled, error exceptions
returned from webservices could contain private data</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8642</cvename>
<cvename>CVE-2016-8643</cvename>
<cvename>CVE-2016-8644</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-11-14</discovery>
<entry>2016-11-16</entry>
<modified>2016-11-27</modified>
</dates>
</vuln>
<vuln vid="ab02f981-ab9e-11e6-ae1b-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle29</name>
<range><lt>2.9.8</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.6</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0022: Web service tokens should be invalidated when
the user password is changed or forced to be changed.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7038</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="d1853110-07f4-4645-895b-6fd462ad0589">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>50.0_1,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.47</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.5.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.5.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5289</cvename>
<cvename>CVE-2016-5290</cvename>
<cvename>CVE-2016-5291</cvename>
<cvename>CVE-2016-5292</cvename>
<cvename>CVE-2016-5293</cvename>
<cvename>CVE-2016-5294</cvename>
<cvename>CVE-2016-5295</cvename>
<cvename>CVE-2016-5296</cvename>
<cvename>CVE-2016-5297</cvename>
<cvename>CVE-2016-5298</cvename>
<cvename>CVE-2016-5299</cvename>
<cvename>CVE-2016-9061</cvename>
<cvename>CVE-2016-9062</cvename>
<cvename>CVE-2016-9063</cvename>
<cvename>CVE-2016-9064</cvename>
<cvename>CVE-2016-9065</cvename>
<cvename>CVE-2016-9066</cvename>
<cvename>CVE-2016-9067</cvename>
<cvename>CVE-2016-9068</cvename>
<cvename>CVE-2016-9070</cvename>
<cvename>CVE-2016-9071</cvename>
<cvename>CVE-2016-9072</cvename>
<cvename>CVE-2016-9073</cvename>
<cvename>CVE-2016-9074</cvename>
<cvename>CVE-2016-9075</cvename>
<cvename>CVE-2016-9076</cvename>
<cvename>CVE-2016-9077</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-89/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-90/</url>
</references>
<dates>
<discovery>2016-11-15</discovery>
<entry>2016-11-16</entry>
</dates>
</vuln>
<vuln vid="a8e9d834-a916-11e6-b9b4-bcaec524bf84">
<topic>lives -- insecure files permissions</topic>
<affects>
<package>
<name>lives</name>
<range><lt>2.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565">
<p>smogrify script creates insecure temporary files.</p>
</blockquote>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043">
<p>lives creates and uses world-writable directory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756565</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798043</url>
</references>
<dates>
<discovery>2016-07-30</discovery>
<entry>2016-11-12</entry>
</dates>
</vuln>
<vuln vid="50751310-a763-11e6-a881-b499baebfeaf">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20161110.txt">
<ul>
<li>ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)<br/>
Severity: High<br/>
TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS
attack by corrupting larger payloads. This can result in an OpenSSL crash. This
issue is not considered to be exploitable beyond a DoS.</li>
<li>CMS Null dereference (CVE-2016-7053)<br/>
Severity: Medium<br/>
Applications parsing invalid CMS structures can crash with a NULL pointer
dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type
in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure
callback if an attempt is made to free certain invalid encodings. Only CHOICE
structures using a callback which do not handle NULL value are affected.</li>
<li>Montgomery multiplication may produce incorrect results (CVE-2016-7055)i<br/>
Severity: Low<br/>
There is a carry propagating bug in the Broadwell-specific Montgomery
multiplication procedure that handles input lengths divisible by, but
longer than 256 bits.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20161110.txt</url>
<cvename>CVE-2016-7054</cvename>
<cvename>CVE-2016-7053</cvename>
<cvename>CVE-2016-7055</cvename>
</references>
<dates>
<discovery>2016-11-10</discovery>
<entry>2016-11-10</entry>
<modified>2016-11-11</modified>
</dates>
</vuln>
<vuln vid="a3473f5a-a739-11e6-afaa-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.100</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html">
<p>4 security fixes in this release, including:</p>
<ul>
<li>[643948] High CVE-2016-5199: Heap corruption in FFmpeg. Credit to
Paul Mehta</li>
<li>[658114] High CVE-2016-5200: Out of bounds memory access in V8. Credit to
Choongwoo Han</li>
<li>[660678] Medium CVE-2016-5201: Info leak in extensions. Credit to
Rob Wu</li>
<li>[662843] CVE-2016-5202: Various fixes from internal audits,
fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5199</cvename>
<cvename>CVE-2016-5200</cvename>
<cvename>CVE-2016-5201</cvename>
<cvename>CVE-2016-5202</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop_9.html</url>
</references>
<dates>
<discovery>2016-11-09</discovery>
<entry>2016-11-10</entry>
</dates>
</vuln>
<vuln vid="96f6bf10-a731-11e6-95ca-0011d823eebd">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c7-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.644</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-37.html">
<ul>
<li>These updates resolve type confusion vulnerabilities that
could lead to code execution (CVE-2016-7860, CVE-2016-7861,
CVE-2016-7865).</li>
<li>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2016-7857, CVE-2016-7858,
CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-37.html</url>
<cvename>CVE-2016-7857</cvename>
<cvename>CVE-2016-7858</cvename>
<cvename>CVE-2016-7859</cvename>
<cvename>CVE-2016-7860</cvename>
<cvename>CVE-2016-7861</cvename>
<cvename>CVE-2016-7862</cvename>
<cvename>CVE-2016-7863</cvename>
<cvename>CVE-2016-7864</cvename>
<cvename>CVE-2016-7865</cvename>
</references>
<dates>
<discovery>2016-11-08</discovery>
<entry>2016-11-10</entry>
</dates>
</vuln>
<vuln vid="10968dfd-a687-11e6-b2d3-60a44ce6887b">
<topic>gitlab -- Directory traversal via "import/export" feature</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.10.0</ge><le>8.10.12</le></range>
<range><ge>8.11.0</ge><le>8.11.9</le></range>
<range><ge>8.12.0</ge><le>8.12.7</le></range>
<range><ge>8.13.0</ge><le>8.13.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/">
<p>The import/export feature did not properly check for symbolic links
in user-provided archives and therefore it was possible for an
authenticated user to retrieve the contents of any file
accessible to the GitLab service account. This included
sensitive files such as those that contain secret tokens used
by the GitLab service to authenticate users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://about.gitlab.com/2016/11/02/cve-2016-9086-patches/</url>
<cvename>CVE-2016-9086</cvename>
<freebsdpr>ports/214360</freebsdpr>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-09</entry>
<modified>2017-05-18</modified>
</dates>
</vuln>
<vuln vid="ae9cb9b8-a203-11e6-a265-3065ec8fd3ec">
<topic>chromium -- out-of-bounds memory access</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.90</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html">
<p>[659475] High CVE-2016-5198: Out of bounds memory access in V8.
Credit to Tencent Keen Security Lab, working with Trend Micro's
Zero Day Initiative.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5198</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/11/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-03</entry>
</dates>
</vuln>
<vuln vid="0fcd3af0-a0fe-11e6-b1cf-14dae9d210b8">
<topic>FreeBSD -- OpenSSL Remote DoS vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_12</lt></range>
<range><ge>10.2</ge><lt>10.2_25</lt></range>
<range><ge>10.1</ge><lt>10.1_42</lt></range>
<range><ge>9.3</ge><lt>9.3_50</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2i,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0a</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_13</lt></range>
</package>
<package>
<name>linux-c7-openssl-libs</name>
<range><lt>1.0.1e_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to improper handling of alert packets, OpenSSL would
consume an excessive amount of CPU time processing undefined
alert messages.</p>
<h1>Impact:</h1>
<p>A remote attacker who can initiate handshakes with an
OpenSSL based server can cause the server to consume a lot
of computation power with very little bandwidth usage, and
may be able to use this technique in a leveraged Denial of
Service attack.</p>
</body>
</description>
<references>
<cvename>CVE-2016-8610</cvename>
<freebsdsa>SA-16:35.openssl</freebsdsa>
<url>http://seclists.org/oss-sec/2016/q4/224</url>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-02</entry>
<modified>2017-02-22</modified>
</dates>
</vuln>
<vuln vid="cb116651-79db-4c09-93a2-c38f9df46724">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.16</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.16</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.11</lt></range>
</package>
<package>
<name>py27-django110</name>
<name>py33-django110</name>
<name>py34-django110</name>
<name>py35-django110</name>
<range><lt>1.10.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Django project reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/nov/01/security-releases/">
<p>Today the Django team released Django 1.10.3, Django 1.9.11,
and 1.8.16. These releases addresses two security issues
detailed below. We encourage all users of Django to upgrade
as soon as possible.</p>
<ul>
<li>User with hardcoded password created when running tests on Oracle</li>
<li>DNS rebinding vulnerability when DEBUG=True</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/nov/01/security-releases/</url>
<cvename>CVE-2016-9013</cvename>
<cvename>CVE-2016-9014</cvename>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="765feb7d-a0d1-11e6-a881-b499baebfeaf">
<topic>cURL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.1</ge><lt>7.51.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<ul>
<li>cookie injection for other servers</li>
<li>case insensitive password comparison</li>
<li>OOB write via unchecked multiplication</li>
<li>double-free in curl_maprintf</li>
<li>double-free in krb5 code</li>
<li>glob parser write/read out of bounds</li>
<li>curl_getdate read out of bounds</li>
<li>URL unescape heap overflow via integer truncation</li>
<li>Use-after-free via shared cookies</li>
<li>invalid URL parsing with '#'</li>
<li>IDNA 2003 makes curl use wrong host</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/security.html</url>
<cvename>CVE-2016-8615</cvename>
<cvename>CVE-2016-8616</cvename>
<cvename>CVE-2016-8617</cvename>
<cvename>CVE-2016-8618</cvename>
<cvename>CVE-2016-8619</cvename>
<cvename>CVE-2016-8620</cvename>
<cvename>CVE-2016-8621</cvename>
<cvename>CVE-2016-8622</cvename>
<cvename>CVE-2016-8623</cvename>
<cvename>CVE-2016-8624</cvename>
<cvename>CVE-2016-8625</cvename>
</references>
<dates>
<discovery>2016-11-02</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="0b8d01a4-a0d2-11e6-9ca2-d050996490d0">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P4</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0P1</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.10.21</le></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_50</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01434/">
<p>A defect in BIND's handling of responses containing
a DNAME answer can cause a resolver to exit after
encountering an assertion failure in db.c or
resolver.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-8864</cvename>
<freebsdsa>SA-16:34.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01434/</url>
</references>
<dates>
<discovery>2016-11-01</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="f4bf713f-6ac7-4b76-8980-47bf90c5419f">
<topic>memcached -- multiple vulnerabilities</topic>
<affects>
<package>
<name>memcached</name>
<range><lt>1.4.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html">
<p>Multiple integer overflow vulnerabilities exist within Memcached
that could be exploited to achieve remote code execution on the
targeted system. These vulnerabilities manifest in various Memcached
functions that are used in inserting, appending, prepending, or
modifying key-value data pairs. Systems which also have Memcached
compiled with support for SASL authentication are also vulnerable to
a third flaw due to how Memcached handles SASL authentication
commands.</p>
<p>An attacker could exploit these vulnerabilities by sending a
specifically crafted Memcached command to the targeted server.
Additionally, these vulnerabilities could also be exploited to leak
sensitive process information which an attacker could use to bypass
common exploitation mitigations, such as ASLR, and can be triggered
multiple times. This enables reliable exploitation which makes these
vulnerabilities severe.</p>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/10/memcached-vulnerabilities.html</url>
<cvename>CVE-2016-8704</cvename>
<cvename>CVE-2016-8705</cvename>
<cvename>CVE-2016-8706</cvename>
</references>
<dates>
<discovery>2016-10-31</discovery>
<entry>2016-11-02</entry>
</dates>
</vuln>
<vuln vid="9bc14850-a070-11e6-a881-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<name>mysql55-server</name>
<range><lt>5.5.53</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.34</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The MariaDB project reports:</p>
<blockquote cite="https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/">
<p>Fixes for the following security vulnerabilities:</p>
<ul>
<li>CVE-2016-7440</li>
<li>CVE-2016-5584</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5553-release-notes/</url>
<cvename>CVE-2016-7440</cvename>
<cvename>CVE-2016-5584</cvename>
</references>
<dates>
<discovery>2016-10-17</discovery>
<entry>2016-11-01</entry>
</dates>
</vuln>
<vuln vid="9118961b-9fa5-11e6-a265-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>54.0.2840.59</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html">
<p>21 security fixes in this release, including:</p>
<ul>
<li>[645211] High CVE-2016-5181: Universal XSS in Blink. Credit to
Anonymous</li>
<li>[638615] High CVE-2016-5182: Heap overflow in Blink. Credit to
Giwan Go of STEALIEN</li>
<li>[645122] High CVE-2016-5183: Use after free in PDFium. Credit
to Anonymous</li>
<li>[630654] High CVE-2016-5184: Use after free in PDFium. Credit
to Anonymous</li>
<li>[621360] High CVE-2016-5185: Use after free in Blink. Credit to
cloudfuzzer</li>
<li>[639702] High CVE-2016-5187: URL spoofing. Credit to Luan
Herrera</li>
<li>[565760] Medium CVE-2016-5188: UI spoofing. Credit to Luan
Herrera</li>
<li>[633885] Medium CVE-2016-5192: Cross-origin bypass in Blink.
Credit to haojunhou@gmail.com</li>
<li>[646278] Medium CVE-2016-5189: URL spoofing. Credit to xisigr
of Tencent's Xuanwu Lab</li>
<li>[644963] Medium CVE-2016-5186: Out of bounds read in DevTools.
Credit to Abdulrahman Alqabandi (@qab)</li>
<li>[639126] Medium CVE-2016-5191: Universal XSS in Bookmarks.
Credit to Gareth Hughes</li>
<li>[642067] Medium CVE-2016-5190: Use after free in Internals.
Credit to Atte Kettunen of OUSPG</li>
<li>[639658] Low CVE-2016-5193: Scheme bypass. Credit to Yuyang
ZHOU (martinzhou96)</li>
<li>[654782] CVE-2016-5194: Various fixes from internal audits,
fuzzing and other initiatives</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5181</cvename>
<cvename>CVE-2016-5182</cvename>
<cvename>CVE-2016-5183</cvename>
<cvename>CVE-2016-5184</cvename>
<cvename>CVE-2016-5185</cvename>
<cvename>CVE-2016-5186</cvename>
<cvename>CVE-2016-5187</cvename>
<cvename>CVE-2016-5188</cvename>
<cvename>CVE-2016-5189</cvename>
<cvename>CVE-2016-5190</cvename>
<cvename>CVE-2016-5191</cvename>
<cvename>CVE-2016-5192</cvename>
<cvename>CVE-2016-5193</cvename>
<cvename>CVE-2016-5194</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/10/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-10-12</discovery>
<entry>2016-10-31</entry>
</dates>
</vuln>
<vuln vid="9c135c7e-9fa4-11e6-a265-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.143</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[642496] High CVE-2016-5177: Use after free in V8. Credit to
Anonymous</li>
<li>[651092] CVE-2016-5178: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5177</cvename>
<cvename>CVE-2016-5178</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_29.html</url>
</references>
<dates>
<discovery>2016-09-29</discovery>
<entry>2016-10-31</entry>
</dates>
</vuln>
<vuln vid="6a2cfcdc-9dea-11e6-a298-14dae9d210b8">
<topic>FreeBSD -- OpenSSH Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3p1_1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_3</lt></range>
<range><ge>10.3</ge><lt>10.3_12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When processing the SSH_MSG_KEXINIT message, the server
could allocate up to a few hundreds of megabytes of memory
per each connection, before any authentication take place.</p>
<h1>Impact:</h1>
<p>A remote attacker may be able to cause a SSH server to
allocate an excessive amount of memory. Note that the default
MaxStartups setting on FreeBSD will limit the effectiveness
of this attack.</p>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q4/191</url>
<cvename>CVE-2016-8858</cvename>
<freebsdsa>SA-16:33.openssh</freebsdsa>
</references>
<dates>
<discovery>2016-10-19</discovery>
<entry>2016-10-29</entry>
<modified>2016-11-02</modified>
</dates>
</vuln>
<vuln vid="2e4fbc9a-9d23-11e6-a298-14dae9d210b8">
<topic>sudo -- Potential bypass of sudo_noexec.so via wordexp()</topic>
<affects>
<package>
<name>sudo</name>
<range><ge>1.6.8</ge><lt>1.8.18p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Todd C. Miller reports:</p>
<blockquote cite="https://www.sudo.ws/alerts/noexec_wordexp.html">
<p>A flaw exists in sudo's noexec functionality that may allow
a user with sudo privileges to run additional commands even when the
NOEXEC tag has been applied to a command that uses the wordexp()
function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.sudo.ws/alerts/noexec_wordexp.html</url>
<cvename>CVE-2016-7076</cvename>
</references>
<dates>
<discovery>2016-10-28</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="ac18046c-9b08-11e6-8011-005056925db4">
<topic>Axis2 -- Security vulnerabilities on dependency Apache HttpClient</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html">
<p>Apache Axis2 1.7.4 is a maintenance release that includes fixes for
several issues, including the following security issues:
Session fixation (AXIS2-4739) and XSS (AXIS2-5683) vulnerabilities
affecting the admin console.
A dependency on an Apache HttpClient version affected by known security
vulnerabilities (CVE-2012-6153 and CVE-2014-3577); see AXIS2-5757.</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.4.html</url>
<url>https://issues.apache.org/jira/browse/AXIS2-4739</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5683</url>
<url>https://issues.apache.org/jira/browse/AXIS2-5757</url>
<cvename>CVE-2012-6153</cvename>
<cvename>CVE-2014-3577</cvename>
</references>
<dates>
<discovery>2012-12-06</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="28bb6ee5-9b5c-11e6-b799-19bef72f4b7c">
<topic>node.js -- ares_create_query single byte out of buffer write</topic>
<affects>
<package>
<name>node010</name>
<range><lt>0.10.48</lt></range>
</package>
<package>
<name>node012</name>
<range><lt>0.12.17</lt></range>
</package>
<package>
<name>node4</name>
<range><lt>4.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js has released new versions containing the following security fix:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
<p>The following releases all contain fixes for CVE-2016-5180 "ares_create_query single
byte out of buffer write": Node.js v0.10.48 (Maintenance), Node.js v0.12.17 (Maintenance),
Node.js v4.6.1 (LTS "Argon")
</p>
<p>While this is not a critical update, all users of these release lines should upgrade at
their earliest convenience.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
<cvename>CVE-2016-5180</cvename>
<freebsdpr>ports/213800</freebsdpr>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2016-10-26</entry>
</dates>
</vuln>
<vuln vid="27180c99-9b5c-11e6-b799-19bef72f4b7c">
<topic>node.js -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><ge>6.0.0</ge><lt>6.9.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Node.js v6.9.0 LTS contains the following security fixes, specific to v6.x:</p>
<blockquote cite="https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/">
<p>Disable auto-loading of openssl.cnf: Don't automatically attempt to load an OpenSSL
configuration file, from the OPENSSL_CONF environment variable or from the default
location for the current platform. Always triggering a configuration file load attempt
may allow an attacker to load compromised OpenSSL configuration into a Node.js process
if they are able to place a file in a default location.
</p>
<p>Patched V8 arbitrary memory read (CVE-2016-5172): The V8 parser mishandled scopes,
potentially allowing an attacker to obtain sensitive information from arbitrary memory
locations via crafted JavaScript code. This vulnerability would require an attacker to
be able to execute arbitrary JavaScript code in a Node.js process.
</p>
<p>Create a unique v8_inspector WebSocket address: Generate a UUID for each execution of
the inspector. This provides additional security to prevent unauthorized clients from
connecting to the Node.js process via the v8_inspector port when running with --inspect.
Since the debugging protocol allows extensive access to the internals of a running process,
and the execution of arbitrary code, it is important to limit connections to authorized
tools only. Note that the v8_inspector protocol in Node.js is still considered an
experimental feature. Vulnerability originally reported by Jann Horn.
</p>
<p>All of these vulnerabilities are considered low-severity for Node.js users, however,
users of Node.js v6.x should upgrade at their earliest convenience.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/</url>
<cvename>CVE-2016-5172</cvename>
</references>
<dates>
<discovery>2016-10-18</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="c5c6e293-9cc7-11e6-823f-b8aeed92ecc4">
<topic>urllib3 -- certificate verification failure</topic>
<affects>
<package>
<name>py-urllib3</name>
<range><lt>1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>urllib3 reports:</p>
<blockquote cite="https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst">
<p>CVE-2016-9015: Certification verification failure</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-9015</cvename>
<url>https://github.com/shazow/urllib3/blob/1.18.1/CHANGES.rst</url>
</references>
<dates>
<discovery>2016-10-27</discovery>
<entry>2016-10-28</entry>
</dates>
</vuln>
<vuln vid="de6d01d5-9c44-11e6-ba67-0011d823eebd">
<topic>flash -- remote code execution</topic>
<affects>
<package>
<name>linux-f10-flashplugin</name>
<name>linux-c6-flashplugin</name>
<name>linux-c7-flashplugin</name>
<range><lt>11.2r202.643</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-36.html">
<p>Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh, Linux and Chrome OS. These updates address a
critical vulnerability that could potentially allow an attacker to
take control of the affected system.</p>
<p>Adobe is aware of a report that an exploit for CVE-2016-7855
exists in the wild, and is being used in limited, targeted attacks
against users running Windows versions 7, 8.1 and 10.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-7855</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-36.html</url>
</references>
<dates>
<discovery>2016-10-26</discovery>
<entry>2016-10-27</entry>
</dates>
</vuln>
<vuln vid="a479a725-9adb-11e6-a298-14dae9d210b8">
<topic>FreeBSD -- bhyve - privilege escalation vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An unchecked array reference in the VGA device emulation
code could potentially allow guests access to the heap of
the bhyve process. Since the bhyve process is running as
root, this may allow guests to obtain full control of the
hosts they are running on.</p>
<h1>Impact:</h1>
<p>For bhyve virtual machines with the "fbuf" framebuffer
device configured, if exploited, a malicious guest could
obtain full access to not just the host system, but to other
virtual machines running on the system.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:32.bhyve</freebsdsa>
</references>
<dates>
<discovery>2016-10-25</discovery>
<entry>2016-10-25</entry>
<modified>2016-10-25</modified>
</dates>
</vuln>
<vuln vid="2482c798-93c6-11e6-846f-bc5ff4fb5ea1">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-c7-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.637</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-32.html">
<p>Adobe has released security updates for Adobe Flash Player for
Windows, Macintosh, Linux and ChromeOS. These updates address
critical vulnerabilities that could potentially allow an attacker
to take control of the affected system.</p>
<p>These updates resolve a type confusion vulnerability that could
lead to code execution (CVE-2016-6992).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-6981, CVE-2016-6987).</p>
<p>These updates resolve a security bypass vulnerability
(CVE-2016-4286).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4273, CVE-2016-6982,
CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986,
CVE-2016-6989, CVE-2016-6990).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4273</cvename>
<cvename>CVE-2016-4286</cvename>
<cvename>CVE-2016-6981</cvename>
<cvename>CVE-2016-6982</cvename>
<cvename>CVE-2016-6983</cvename>
<cvename>CVE-2016-6984</cvename>
<cvename>CVE-2016-6985</cvename>
<cvename>CVE-2016-6986</cvename>
<cvename>CVE-2016-6987</cvename>
<cvename>CVE-2016-6989</cvename>
<cvename>CVE-2016-6990</cvename>
<cvename>CVE-2016-6992</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-32.html</url>
</references>
<dates>
<discovery>2016-10-11</discovery>
<entry>2016-10-24</entry>
</dates>
</vuln>
<vuln vid="aaa9f3db-13b5-4a0e-9ed7-e5ab287098fa">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>49.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-87/">
<p>CVE-2016-5287: Crash in nsTArray_base<T>::SwapArrayElements</p>
<p>CVE-2016-5288: Web content can read cache entries</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5287</cvename>
<cvename>CVE-2016-5288</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-87/</url>
</references>
<dates>
<discovery>2016-10-20</discovery>
<entry>2016-10-21</entry>
</dates>
</vuln>
<vuln vid="0baadc45-92d0-11e6-8011-005056925db4">
<topic>Axis2 -- Cross-site scripting (XSS) vulnerability</topic>
<affects>
<package>
<name>axis2</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Axis2 reports:</p>
<blockquote cite="http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html">
<p>Apache Axis2 1.7.3 is a security release that contains a fix
for CVE-2010-3981. That security vulnerability affects the admin console
that is part of the Axis2 Web application and was originally reported
for SAP BusinessObjects (which includes a version of Axis2). That report
didn’t mention Axis2 at all and the Axis2 project only recently became
aware (thanks to Devesh Bhatt and Nishant Agarwala) that the issue
affects Apache Axis2 as well.</p>
</blockquote>
</body>
</description>
<references>
<url>http://axis.apache.org/axis2/java/core/release-notes/1.7.3.html</url>
<cvename>CVE-2010-3981</cvename>
<freebsdpr>ports/213546</freebsdpr>
</references>
<dates>
<discovery>2010-10-18</discovery>
<entry>2016-10-18</entry>
</dates>
</vuln>
<vuln vid="c1dc55dc-9556-11e6-b154-3065ec8fd3ec">
<topic>Tor -- remote denial of service</topic>
<affects>
<package>
<name>tor</name>
<range><lt>0.2.8.9</lt></range>
</package>
<package>
<name>tor-devel</name>
<range><lt>0.2.9.4-alpha</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Tor Blog reports:</p>
<blockquote cite="https://blog.torproject.org/blog/tor-0289-released-important-fixes">
<p>Prevent a class of security bugs caused by treating the contents
of a buffer chunk as if they were a NUL-terminated string. At least
one such bug seems to be present in all currently used versions of
Tor, and would allow an attacker to remotely crash most Tor
instances, especially those compiled with extra compiler hardening.
With this defense in place, such bugs can't crash Tor, though we
should still fix them as they occur. Closes ticket 20384
(TROVE-2016-10-001).</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.torproject.org/blog/tor-0289-released-important-fixes</url>
</references>
<dates>
<discovery>2016-10-17</discovery>
<entry>2016-10-18</entry>
</dates>
</vuln>
<vuln vid="43f1c867-654a-11e6-8286-00248c0c745d">
<topic>Rails 4 -- Possible XSS Vulnerability in Action View</topic>
<affects>
<package>
<name>rubygem-actionview</name>
<range><gt>3.0.0</gt><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Security team reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE">
<p>There is a possible XSS vulnerability in Action View. Text declared as "HTML
safe" will not have quotes escaped when used as attribute values in tag
helpers. This vulnerability has been assigned the CVE identifier
CVE-2016-6316.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE</url>
<cvename>CVE-2016-6316</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-18</entry>
</dates>
</vuln>
<vuln vid="7e61cf44-6549-11e6-8286-00248c0c745d">
<topic>Rails 4 -- Unsafe Query Generation Risk in Active Record</topic>
<affects>
<package>
<name>rubygem-activerecord4</name>
<range><gt>4.2.0</gt><lt>4.2.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby Security team reports:</p>
<blockquote cite="https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA">
<p>There is a vulnerability when Active Record is used in conjunction with JSON
parameter parsing. This vulnerability has been assigned the CVE identifier
CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694
and CVE-2013-0155.</p>
</blockquote>
</body>
</description>
<references>
<url>https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA</url>
<cvename>CVE-2016-6317</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-18</entry>
</dates>
</vuln>
<vuln vid="f471032a-8700-11e6-8d93-00248c0c745d">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<range><lt>7.0.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.11">
<ul>
<li><p>Fixed bug #73007 (add locale length check)</p></li>
<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.11</url>
<cvename>CVE-2016-7416</cvename>
<cvename>CVE-2016-7412</cvename>
<cvename>CVE-2016-7414</cvename>
<cvename>CVE-2016-7417</cvename>
<cvename>CVE-2016-7413</cvename>
<cvename>CVE-2016-7418</cvename>
</references>
<dates>
<discovery>2016-09-15</discovery>
<entry>2016-09-30</entry>
</dates>
</vuln>
<vuln vid="8d5180a6-86fe-11e6-8d93-00248c0c745d">
<topic>PHP -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php56</name>
<range><lt>5.6.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.26">
<ul>
<li><p>Fixed bug #73007 (add locale length check)</p></li>
<li><p>Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields)</p></li>
<li><p>Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)</p></li>
<li><p>Fixed bug #73029 (Missing type check when unserializing SplArray)</p></li>
<li><p>Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)</p></li>
<li><p>Fixed bug #72860 (wddx_deserialize use-after-free)</p></li>
<li><p>Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.6.26</url>
<cvename>CVE-2016-7416</cvename>
<cvename>CVE-2016-7412</cvename>
<cvename>CVE-2016-7414</cvename>
<cvename>CVE-2016-7417</cvename>
<cvename>CVE-2016-7411</cvename>
<cvename>CVE-2016-7413</cvename>
<cvename>CVE-2016-7418</cvename>
</references>
<dates>
<discovery>2016-09-16</discovery>
<entry>2016-09-30</entry>
</dates>
</vuln>
<vuln vid="ad479f89-9020-11e6-a590-14dae9d210b8">
<topic>file-roller -- path traversal vulnerability</topic>
<affects>
<package>
<name>file-roller</name>
<range><ge>3.5.4,1</ge><lt>3.20.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/4">
<p>File Roller 3.5.4 through 3.20.2 was affected by a path
traversal bug that could result in deleted files if a user
were tricked into opening a malicious archive.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/09/08/4</url>
<cvename>CVE-2016-7162</cvename>
<freebsdpr>ports/213199</freebsdpr>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="7d40edd1-901e-11e6-a590-14dae9d210b8">
<topic>VirtualBox -- undisclosed vulnerabilities</topic>
<affects>
<package>
<name>virtualbox-ose</name>
<range><ge>5.0</ge><lt>5.0.8</lt></range>
<range><ge>4.3</ge><lt>4.3.32</lt></range>
<range><ge>4.2</ge><lt>4.2.34</lt></range>
<range><ge>4.1</ge><lt>4.1.42</lt></range>
<range><ge>4.0</ge><lt>4.0.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42,
4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local
users to affect availability via unknown vectors related to Core.</p>
<p>Unspecified vulnerability in the Oracle VM VirtualBox
component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42,
4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature
(RDP) enabled, allows remote attackers to affect availability via
unknown vectors related to Core.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
<cvename>CVE-2015-4813</cvename>
<cvename>CVE-2015-4896</cvename>
<freebsdpr>ports/204406</freebsdpr>
</references>
<dates>
<discovery>2015-10-01</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="10f7f782-901c-11e6-a590-14dae9d210b8">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.5.10,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://www.debian.org/security/2016/dsa-3675">
<p>Various memory handling problems and cases of missing or
incomplete input sanitizing may result in denial of service or the
execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and
CALS files are processed.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.debian.org/security/2016/dsa-3675</url>
<freebsdpr>ports/213032</freebsdpr>
</references>
<dates>
<discovery>2016-09-23</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="2a526c78-84ab-11e6-a4a1-60a44ce6887b">
<topic>libgd -- integer overflow which could lead to heap buffer overflow</topic>
<affects>
<package>
<name>gd</name>
<range><le>2.2.3</le></range>
</package>
<package>
<name>php70-gd</name>
<range><le>7.0.11</le></range>
</package>
<package>
<name>php56-gd</name>
<range><le>5.6.26</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LibGD reports:</p>
<blockquote cite="https://github.com/libgd/libgd/issues/308">
<p>An integer overflow issue was found in function gdImageWebpCtx of file gd_webp.c which could lead to heap buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgd/libgd/issues/308</url>
<url>https://bugs.php.net/bug.php?id=73003</url>
<freebsdpr>ports/213023</freebsdpr>
</references>
<dates>
<discovery>2016-09-02</discovery>
<entry>2016-10-11</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="cb3f036d-8c7f-11e6-924a-60a44ce6887b">
<topic>libvncserver -- multiple security vulnerabilities</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nicolas Ruff reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q3/639">
<p>Integer overflow in MallocFrameBuffer() on client side.</p>
<p>Lack of malloc() return value checking on client side.</p>
<p>Server crash on a very large ClientCutText message.</p>
<p>Server crash when scaling factor is set to zero.</p>
<p>Multiple stack overflows in File Transfer feature.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q3/639</url>
<cvename>CVE-2014-6051</cvename>
<cvename>CVE-2014-6052</cvename>
<cvename>CVE-2014-6053</cvename>
<cvename>CVE-2014-6054</cvename>
<cvename>CVE-2014-6055</cvename>
<freebsdpr>ports/212380</freebsdpr>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2016-10-11</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="ab947396-9018-11e6-a590-14dae9d210b8">
<topic>openoffice -- information disclosure vulnerability</topic>
<affects>
<package>
<name>apache-openoffice</name>
<name>apache-openoffice-devel</name>
<range><lt>4.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2014-3575.html">
<p>The exposure exploits the way OLE previews are generated to
embed arbitrary file data into a specially crafted document when it is
opened. Data exposure is possible if the updated document is distributed
to other parties.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openoffice.org/security/cves/CVE-2014-3575.html</url>
<cvename>CVE-2014-3575</cvename>
<freebsdpr>ports/212379</freebsdpr>
</references>
<dates>
<discovery>2014-08-21</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="47157c14-9013-11e6-a590-14dae9d210b8">
<topic>mupdf -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mupdf</name>
<range><lt>1.9a_1,1</lt></range>
</package>
<package>
<name>llpp</name>
<range><lt>22_2</lt></range>
</package>
<package>
<name>zathura-pdf-mupdf</name>
<range><lt>0.3.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tobias Kortkamp reports:</p>
<blockquote cite="http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html">
<p>Heap-based buffer overflow in the pdf_load_mesh_params
function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a
denial of service (crash) or execute arbitrary code via a large decode
array.</p>
<p>Use-after-free vulnerability in the pdf_load_xref function in
pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of
service (crash) via a crafted PDF file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://openbsd-archive.7691.n7.nabble.com/mupdf-CVE-2016-6525-amp-CVE-2016-6265-td302904.html</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696941</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696954</url>
<cvename>CVE-2016-6525</cvename>
<cvename>CVE-2016-6265</cvename>
<freebsdpr>ports/212207</freebsdpr>
</references>
<dates>
<discovery>2016-08-27</discovery>
<entry>2016-10-12</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="b7d56d0b-7a11-11e6-af78-589cfc0654e1">
<topic>openjpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tencent's Xuanwu LAB reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/08/2">
<p>A Heap Buffer Overflow (Out-of-Bounds Write) issue was found in
function opj_dwt_interleave_v of dwt.c. This vulnerability allows
remote attackers to execute arbitrary code on vulnerable installations
of OpenJPEG.</p>
<p>An integer overflow issue exists in function opj_pi_create_decode of
pi.c. It can lead to Out-Of-Bounds Read and Out-Of-Bounds Write in
function opj_pi_next_cprl of pi.c (function opj_pi_next_lrcp,
opj_pi_next_rlcp, opj_pi_next_rpcl, opj_pi_next_pcrl may also be
vulnerable). This vulnerability allows remote attackers to execute
arbitrary code on vulnerable installations of OpenJPEG.</p>
</blockquote>
</body>
</description>
<references>
<url>"http://www.openwall.com/lists/oss-security/2016/09/08/2"</url>
<url>"http://www.openwall.com/lists/oss-security/2016/09/08/3"</url>
<cvename>CVE-2016-5157</cvename>
<cvename>CVE-2016-7163</cvename>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-10-11</entry>
</dates>
</vuln>
<vuln vid="fa175f30-8c75-11e6-924a-60a44ce6887b">
<topic>redis -- sensitive information leak through command history file</topic>
<affects>
<package>
<name>redis</name>
<name>redis-devel</name>
<range><lt>3.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redis team reports:</p>
<blockquote cite="https://github.com/antirez/redis/pull/1418">
<p>The redis-cli history file (in linenoise) is created with the
default OS umask value which makes it world readable in most systems
and could potentially expose authentication credentials to other
users.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/antirez/redis/pull/1418</url>
<url>https://github.com/antirez/redis/issues/3284</url>
<cvename>CVE-2013-7458</cvename>
</references>
<dates>
<discovery>2013-11-30</discovery>
<entry>2016-10-11</entry>
</dates>
</vuln>
<vuln vid="1a71a972-8ee7-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Multiple libarchive vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Flaws in libarchive's handling of symlinks and hard links
allow overwriting files outside the extraction directory,
or permission changes to a directory outside the extraction
directory.</p>
<h1>Impact:</h1>
<p>An attacker who can control freebsd-update's or portsnap's
input to tar(1) can change file content or permissions on
files outside of the update tool's working sandbox.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:31.libarchive</freebsdsa>
</references>
<dates>
<discovery>2016-10-05</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="e7dcd69d-8ee6-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Multiple portsnap vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Flaws in portsnap's verification of downloaded tar files
allows additional files to be included without causing the
verification to fail. Portsnap may then use or execute these
files.</p>
<h1>Impact:</h1>
<p>An attacker who can conduct man in the middle attack on
the network at the time when portsnap is run can cause
portsnap to execute arbitrary commands under the credentials
of the user who runs portsnap, typically root.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:30.portsnap</freebsdsa>
</references>
<dates>
<discovery>2016-10-10</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="ce808022-8ee6-11e6-a590-14dae9d210b8">
<topic>FreeBSD -- Heap overflow vulnerability in bspatch</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
<range><ge>10.3</ge><lt>10.3_10</lt></range>
<range><ge>10.2</ge><lt>10.2_23</lt></range>
<range><ge>10.1</ge><lt>10.1_40</lt></range>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of bspatch is susceptible to integer
overflows with carefully crafted input, potentially allowing
an attacker who can control the patch file to write at
arbitrary locations in the heap. This issue was partially
addressed in FreeBSD-SA-16:25.bspatch, but some possible
integer overflows remained.</p>
<h1>Impact:</h1>
<p>An attacker who can control the patch file can cause a
crash or run arbitrary code under the credentials of the
user who runs bspatch, in many cases, root.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:29.bspatch</freebsdsa>
</references>
<dates>
<discovery>2016-10-10</discovery>
<entry>2016-10-10</entry>
</dates>
</vuln>
<vuln vid="aeb7874e-8df1-11e6-a082-5404a68ad561">
<topic>mkvtoolnix -- code execution via specially crafted files</topic>
<affects>
<package>
<name>mkvtoolnix</name>
<range><lt>9.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moritz Bunkus reports:</p>
<blockquote cite="https://mkvtoolnix.download/doc/ChangeLog">
<p>most of the bugs fixed on 2016-09-06 and 2016-09-07 for
issue #1780 are potentially exploitable. The scenario is arbitrary
code execution with specially-crafted files.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mkvtoolnix.download/doc/ChangeLog</url>
</references>
<dates>
<discovery>2016-09-07</discovery>
<entry>2016-10-09</entry>
</dates>
</vuln>
<vuln vid="1cf65085-a760-41d2-9251-943e1af62eb8">
<topic>X.org libraries -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libX11</name>
<range><lt>1.6.4,1</lt></range>
</package>
<package>
<name>libXfixes</name>
<range><lt>5.0.3</lt></range>
</package>
<package>
<name>libXi</name>
<range><lt>1.7.7,1</lt></range>
</package>
<package>
<name>libXrandr</name>
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>libXrender</name>
<range><lt>0.9.10</lt></range>
</package>
<package>
<name>libXtst</name>
<range><lt>1.2.3</lt></range>
</package>
<package>
<name>libXv</name>
<range><lt>1.0.11,1</lt></range>
</package>
<package>
<name>libXvMC</name>
<range><lt>1.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthieu Herrb reports:</p>
<blockquote cite="https://lists.x.org/archives/xorg-announce/2016-October/002720.html">
<p>Tobias Stoeckmann from the OpenBSD project has discovered a
number of issues in the way various X client libraries handle
the responses they receive from servers, and has worked with
X.Org's security team to analyze, confirm, and fix these issues.
These issue come in addition to the ones discovered by Ilja van
Sprundel in 2013.</p>
<p>Most of these issues stem from the client libraries trusting
the server to send correct protocol data, and not verifying
that the values will not overflow or cause other damage. Most
of the time X clients and servers are run by the same user, with
the server more privileged than the clients, so this is not a
problem, but there are scenarios in which a privileged client
can be connected to an unprivileged server, for instance,
connecting a setuid X client (such as a screen lock program)
to a virtual X server (such as Xvfb or Xephyr) which the user
has modified to return invalid data, potentially allowing the
user to escalate their privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.x.org/archives/xorg-announce/2016-October/002720.html</url>
<cvename>CVE-2016-5407</cvename>
</references>
<dates>
<discovery>2016-10-04</discovery>
<entry>2016-10-07</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="c8d902b1-8550-11e6-81e7-d050996490d0">
<topic>BIND -- Remote Denial of Service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P3</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0.rc3</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.12.0.a.2016.09.10</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_48</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01419">
<p>Testing by ISC has uncovered a critical error condition
which can occur when a nameserver is constructing a
response. A defect in the rendering of messages into
packets can cause named to exit with an assertion
failure in buffer.c while constructing a response
to a query that meets certain criteria.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2776</cvename>
<freebsdsa>SA-16:28.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01419</url>
</references>
<dates>
<discovery>2016-09-27</discovery>
<entry>2016-09-28</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="bb022643-84fb-11e6-a4a1-60a44ce6887b">
<topic>django -- CSRF protection bypass on a site with Google Analytics</topic>
<affects>
<package>
<name>py-django19</name>
<range><lt>1.9.10</lt></range>
</package>
<package>
<name>py-django18</name>
<range><lt>1.8.15</lt></range>
</package>
<package>
<name>py-django</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Django Software Foundation reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/sep/26/security-releases/">
<p>An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/sep/26/security-releases/</url>
<cvename>CVE-2016-7401</cvename>
</references>
<dates>
<discovery>2016-09-26</discovery>
<entry>2016-09-27</entry>
</dates>
</vuln>
<vuln vid="91a337d8-83ed-11e6-bf52-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2j,1</lt></range>
</package>
<package>
<name>openssl-devel</name>
<range><lt>1.1.0b</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.4.3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>11.0</ge><lt>11.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160926.txt">
<p>Critical vulnerability in OpenSSL 1.1.0a<br/>
Fix Use After Free for large message sizes (CVE-2016-6309)</p>
<p>Moderate vulnerability in OpenSSL 1.0.2i<br/>
Missing CRL sanity check (CVE-2016-7052)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160926.txt</url>
<cvename>CVE-2016-6309</cvename>
<cvename>CVE-2016-7052</cvename>
<freebsdsa>SA-16:27.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-09-26</discovery>
<entry>2016-09-26</entry>
<modified>2016-10-10</modified>
</dates>
</vuln>
<vuln vid="43eaa656-80bc-11e6-bf52-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl-devel</name>
<range><ge>1.1.0</ge><lt>1.1.0_1</lt></range>
</package>
<package>
<name>openssl</name>
<range><lt>1.0.2i,1</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_11</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_8</lt></range>
<range><ge>10.2</ge><lt>10.2_21</lt></range>
<range><ge>10.1</ge><lt>10.1_38</lt></range>
<range><ge>9.3</ge><lt>9.3_46</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160922.txt">
<p>High: OCSP Status Request extension unbounded memory growth</p>
<p>SSL_peek() hang on empty record</p>
<p>SWEET32 Mitigation</p>
<p>OOB write in MDC2_Update()</p>
<p>Malformed SHA512 ticket DoS</p>
<p>OOB write in BN_bn2dec()</p>
<p>OOB read in TS_OBJ_print_bio()</p>
<p>Pointer arithmetic undefined behaviour</p>
<p>Constant time flag not preserved in DSA signing</p>
<p>DTLS buffered message DoS</p>
<p>DTLS replay protection DoS</p>
<p>Certificate message OOB reads</p>
<p>Excessive allocation of memory in tls_get_message_header()</p>
<p>Excessive allocation of memory in dtls1_preprocess_fragment()</p>
<p>NB: LibreSSL is only affected by CVE-2016-6304</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160922.txt</url>
<cvename>CVE-2016-6304</cvename>
<cvename>CVE-2016-6305</cvename>
<cvename>CVE-2016-2183</cvename>
<cvename>CVE-2016-6303</cvename>
<cvename>CVE-2016-6302</cvename>
<cvename>CVE-2016-2182</cvename>
<cvename>CVE-2016-2180</cvename>
<cvename>CVE-2016-2177</cvename>
<cvename>CVE-2016-2178</cvename>
<cvename>CVE-2016-2179</cvename>
<cvename>CVE-2016-2181</cvename>
<cvename>CVE-2016-6306</cvename>
<cvename>CVE-2016-6307</cvename>
<cvename>CVE-2016-6308</cvename>
<freebsdsa>SA-16:26.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-09-22</discovery>
<entry>2016-09-22</entry>
<modified>2016-10-11</modified>
</dates>
</vuln>
<vuln vid="e78261e4-803d-11e6-a590-14dae9d210b8">
<topic>irssi -- heap corruption and missing boundary checks</topic>
<affects>
<package>
<name>irssi</name>
<name>zh-irssi</name>
<range><ge>0.8.17</ge><lt>0.8.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Irssi reports:</p>
<blockquote cite="https://irssi.org/security/irssi_sa_2016.txt">
<p>Remote crash and heap corruption. Remote code execution seems
difficult since only Nuls are written.</p>
</blockquote>
</body>
</description>
<references>
<url>https://irssi.org/security/irssi_sa_2016.txt</url>
<cvename>CVE-2016-7044</cvename>
<cvename>CVE-2016-7045</cvename>
</references>
<dates>
<discovery>2016-09-21</discovery>
<entry>2016-09-21</entry>
<modified>2016-09-22</modified>
</dates>
</vuln>
<vuln vid="2c57c47e-8bb3-4694-83c8-9fc3abad3964">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>49.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.46</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.4.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.4.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/">
<p>CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy [low]</p>
<p>CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 [critical]</p>
<p>CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]</p>
<p>CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]</p>
<p>CVE-2016-5271 - Out-of-bounds read in PropertyProvider::GetSpacingInternal [low]</p>
<p>CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]</p>
<p>CVE-2016-5273 - crash in mozilla::a11y::HyperTextAccessible::GetChildOffset [high]</p>
<p>CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]</p>
<p>CVE-2016-5275 - global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions [critical]</p>
<p>CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]</p>
<p>CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]</p>
<p>CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]</p>
<p>CVE-2016-5279 - Full local path of files is available to web pages after drag and drop [moderate]</p>
<p>CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]</p>
<p>CVE-2016-5281 - use-after-free in DOMSVGLength [high]</p>
<p>CVE-2016-5282 - Don't allow content to request favicons from non-whitelisted schemes [moderate]</p>
<p>CVE-2016-5283 - <iframe src> fragment timing attack can reveal cross-origin data [high]</p>
<p>CVE-2016-5284 - Add-on update site certificate pin expiration [high]</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2827</cvename>
<cvename>CVE-2016-5256</cvename>
<cvename>CVE-2016-5257</cvename>
<cvename>CVE-2016-5270</cvename>
<cvename>CVE-2016-5271</cvename>
<cvename>CVE-2016-5272</cvename>
<cvename>CVE-2016-5273</cvename>
<cvename>CVE-2016-5274</cvename>
<cvename>CVE-2016-5275</cvename>
<cvename>CVE-2016-5276</cvename>
<cvename>CVE-2016-5277</cvename>
<cvename>CVE-2016-5278</cvename>
<cvename>CVE-2016-5279</cvename>
<cvename>CVE-2016-5280</cvename>
<cvename>CVE-2016-5281</cvename>
<cvename>CVE-2016-5282</cvename>
<cvename>CVE-2016-5283</cvename>
<cvename>CVE-2016-5284</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-85/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-86/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-88/</url>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2016-09-20</entry>
<modified>2016-10-21</modified>
</dates>
</vuln>
<vuln vid="653a8059-7c49-11e6-9242-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html">
<p>Several security fixes in this release, including:</p>
<ul>
<li>[641101] High CVE-2016-5170: Use after free in Blink.Credit to
Anonymous</li>
<li>[643357] High CVE-2016-5171: Use after free in Blink. Credit to
Anonymous</li>
<li>[616386] Medium CVE-2016-5172: Arbitrary Memory Read in v8.
Credit to Choongwoo Han</li>
<li>[468931] Medium CVE-2016-5173: Extension resource access.
Credit to Anonymous</li>
<li>[579934] Medium CVE-2016-5174: Popup not correctly suppressed.
Credit to Andrey Kovalev (@L1kvID) Yandex Security Team</li>
<li>[646394] CVE-2016-5175: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5170</cvename>
<cvename>CVE-2016-5171</cvename>
<cvename>CVE-2016-5172</cvename>
<cvename>CVE-2016-5173</cvename>
<cvename>CVE-2016-5174</cvename>
<cvename>CVE-2016-5175</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/09/stable-channel-update-for-desktop_13.html</url>
</references>
<dates>
<discovery>2016-09-13</discovery>
<entry>2016-09-16</entry>
</dates>
</vuln>
<vuln vid="b64a7389-7c27-11e6-8aaa-5404a68ad561">
<topic>Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662</topic>
<affects>
<package>
<name>mysql57-client</name>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LegalHackers' reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html">
<p>RCE Bugs discovered in MySQL and its variants like MariaDB.
It works by manipulating my.cnf files and using --malloc-lib.
The bug seems fixed in MySQL 5.7.15 by Oracle</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6662</cvename>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html</url>
<url>https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-15.html</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="bc19dcca-7b13-11e6-b99e-589cfc0654e1">
<topic>dropbear -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2016.74</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnston reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/09/15/2">
<p>If specific usernames including "%" symbols can be created on a system
(validated by getpwnam()) then an attacker could run arbitrary code as root
when connecting to Dropbear server.
A dbclient user who can control username or host arguments could potentially
run arbitrary code as the dbclient user. This could be a problem if scripts
or webpages pass untrusted input to the dbclient program.</p>
<p>dropbearconvert import of OpenSSH keys could run arbitrary code as
the local dropbearconvert user when parsing malicious key files.</p>
<p>dbclient could run arbitrary code as the local dbclient user if
particular -m or -c arguments are provided. This could be an issue where
dbclient is used in scripts.</p>
<p>dbclient or dropbear server could expose process memory to the
running user if compiled with DEBUG_TRACE and running with -v</p>
</blockquote>
</body>
</description>
<references>
<url>"http://www.openwall.com/lists/oss-security/2016/09/15/2"</url>
<cvename>CVE-2016-7406</cvename>
<cvename>CVE-2016-7407</cvename>
<cvename>CVE-2016-7408</cvename>
<cvename>CVE-2016-7409</cvename>
</references>
<dates>
<discovery>2016-07-12</discovery>
<entry>2016-09-15</entry>
</dates>
</vuln>
<vuln vid="08664d42-7989-11e6-b7a8-74d02b9a84d5">
<topic>h2o -- fix DoS attack vector</topic>
<affects>
<package>
<name>h2o</name>
<range>
<lt>2.0.4</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frederik Deweerdt reported a denial-of-service attack vector
due to an unhandled error condition during socket connection.</p>
</body>
</description>
<references>
<url>https://github.com/h2o/h2o/issues/1077</url>
<cvename>CVE-2016-4864</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="b018121b-7a4b-11e6-bf52-b499baebfeaf">
<topic>cURL -- Escape and unescape integer overflows</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.11.1</ge><lt>7.50.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports</p>
<blockquote cite="https://curl.haxx.se/docs/adv_20160914.html">
<p>The four libcurl functions curl_escape(), curl_easy_escape(),
curl_unescape and curl_easy_unescape perform string URL percent
escaping and unescaping. They accept custom string length inputs
in signed integer arguments.</p>
<p>The provided string length arguments were not properly checked
and due to arithmetic in the functions, passing in the length
0xffffffff (2^32-1 or UINT_MAX or even just -1) would end up
causing an allocation of zero bytes of heap memory that curl
would attempt to write gigabytes of data into.</p>
</blockquote>
</body>
</description>
<references>
<url>https://curl.haxx.se/docs/adv_20160914.html</url>
<cvename>CVE-2016-7167</cvename>
</references>
<dates>
<discovery>2016-09-14</discovery>
<entry>2016-09-14</entry>
</dates>
</vuln>
<vuln vid="769ba449-79e1-11e6-bf75-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>53.0.2785.92</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html">
<p>33 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5147</cvename>
<cvename>CVE-2016-5148</cvename>
<cvename>CVE-2016-5149</cvename>
<cvename>CVE-2016-5150</cvename>
<cvename>CVE-2016-5151</cvename>
<cvename>CVE-2016-5152</cvename>
<cvename>CVE-2016-5153</cvename>
<cvename>CVE-2016-5154</cvename>
<cvename>CVE-2016-5155</cvename>
<cvename>CVE-2016-5156</cvename>
<cvename>CVE-2016-5157</cvename>
<cvename>CVE-2016-5158</cvename>
<cvename>CVE-2016-5159</cvename>
<cvename>CVE-2016-5160</cvename>
<cvename>CVE-2016-5161</cvename>
<cvename>CVE-2016-5162</cvename>
<cvename>CVE-2016-5163</cvename>
<cvename>CVE-2016-5164</cvename>
<cvename>CVE-2016-5165</cvename>
<cvename>CVE-2016-5166</cvename>
<cvename>CVE-2016-5167</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop_31.html</url>
</references>
<dates>
<discovery>2016-08-31</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="958b9cee-79da-11e6-bf75-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>52.0.2743.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html">
<p>10 security fixes in this release, including:</p>
<ul>
<li>[629542] High CVE-2016-5141 Address bar spoofing. Credit to
anonymous</li>
<li>[626948] High CVE-2016-5142 Use-after-free in Blink. Credit to
anonymous</li>
<li>[625541] High CVE-2016-5139 Heap overflow in pdfium. Credit to
GiWan Go of Stealien</li>
<li>[619405] High CVE-2016-5140 Heap overflow in pdfium. Credit to
Ke Liu of Tencent's Xuanwu LAB</li>
<li>[623406] Medium CVE-2016-5145 Same origin bypass for images in
Blink. Credit to anonymous</li>
<li>[619414] Medium CVE-2016-5143 Parameter sanitization failure in
DevTools. Credit to Gregory Panakkal</li>
<li>[618333] Medium CVE-2016-5144 Parameter sanitization failure in
DevTools. Credit to Gregory Panakkal</li>
<li>[633486] CVE-2016-5146: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5139</cvename>
<cvename>CVE-2016-5140</cvename>
<cvename>CVE-2016-5141</cvename>
<cvename>CVE-2016-5142</cvename>
<cvename>CVE-2016-5143</cvename>
<cvename>CVE-2016-5144</cvename>
<cvename>CVE-2016-5145</cvename>
<cvename>CVE-2016-5146</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/08/stable-channel-update-for-desktop.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="856b88bf-7984-11e6-81e7-d050996490d0">
<topic>mysql -- Remote Root Code Execution</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.51</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.27</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.17</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.52</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.33</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.15</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.51.38.1</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.32.78.0</lt></range>
</package>
<package>
<name>percona57-server</name>
<range><lt>5.7.14.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dawid Golunski reports:</p>
<blockquote cite="http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt">
<p>An independent research has revealed multiple severe MySQL
vulnerabilities. This advisory focuses on a critical
vulnerability with a CVEID of CVE-2016-6662 which can allow
attackers to (remotely) inject malicious settings into MySQL
configuration files (my.cnf) leading to critical
consequences.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6662</cvename>
<url>http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.txt</url>
<url>https://jira.mariadb.org/browse/MDEV-10465</url>
<url>https://www.percona.com/blog/2016/09/12/percona-server-critical-update-cve-2016-6662/</url>
<url>https://www.percona.com/blog/2016/09/12/database-affected-cve-2016-6662/</url>
<url>https://www.psce.com/blog/2016/09/12/how-to-quickly-patch-mysql-server-against-cve-2016-6662/</url>
</references>
<dates>
<discovery>2016-09-12</discovery>
<entry>2016-09-13</entry>
</dates>
</vuln>
<vuln vid="331eabb3-85b1-466a-a2af-66ac864d395a">
<topic>wolfssl -- leakage of private key information</topic>
<affects>
<package>
<name>wolfssl</name>
<range><lt>3.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Florian Weimer of Redhat discovered that an optimization in
RSA signature validation can result in disclosure of the
server's private key under certain fault conditions.</p>
</body>
</description>
<references>
<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
<url>https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/</url>
<cvename>CVE-2015-7744</cvename>
</references>
<dates>
<discovery>2015-09-17</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="3d1372e1-7822-4fd8-b56e-5ee832afbd96">
<topic>wolfssl -- DDoS amplification in DTLS</topic>
<affects>
<package>
<name>wolfssl</name>
<range><lt>3.6.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Ramacher identified an error in wolfSSL's implementation
of the server side of the DTLS handshake, which could be abused
for DDoS amplification or a DoS on the DTLS server itself.</p>
</body>
</description>
<references>
<url>https://www.wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html</url>
<url>https://github.com/IAIK/wolfSSL-DoS</url>
<cvename>CVE-2015-6925</cvename>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="a0128291-7690-11e6-95a8-0011d823eebd">
<topic>gnutls -- OCSP validation issue</topic>
<affects>
<package>
<name>gnutls</name>
<range><lt>3.4.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-3">
<p>Stefan Bühler discovered an issue that affects validation
of certificates using OCSP responses, which can falsely report a
certificate as valid under certain circumstances.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2016-3</url>
</references>
<dates>
<discovery>2016-09-08</discovery>
<entry>2016-09-09</entry>
</dates>
</vuln>
<vuln vid="aa1aefe3-6e37-47db-bfda-343ef4acb1b5">
<topic>Mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>48.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.45</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.3.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.3.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox48">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0718</cvename>
<cvename>CVE-2016-2830</cvename>
<cvename>CVE-2016-2835</cvename>
<cvename>CVE-2016-2836</cvename>
<cvename>CVE-2016-2837</cvename>
<cvename>CVE-2016-2838</cvename>
<cvename>CVE-2016-2839</cvename>
<cvename>CVE-2016-5250</cvename>
<cvename>CVE-2016-5251</cvename>
<cvename>CVE-2016-5252</cvename>
<cvename>CVE-2016-5253</cvename>
<cvename>CVE-2016-5254</cvename>
<cvename>CVE-2016-5255</cvename>
<cvename>CVE-2016-5258</cvename>
<cvename>CVE-2016-5259</cvename>
<cvename>CVE-2016-5260</cvename>
<cvename>CVE-2016-5261</cvename>
<cvename>CVE-2016-5262</cvename>
<cvename>CVE-2016-5263</cvename>
<cvename>CVE-2016-5264</cvename>
<cvename>CVE-2016-5265</cvename>
<cvename>CVE-2016-5266</cvename>
<cvename>CVE-2016-5267</cvename>
<cvename>CVE-2016-5268</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-63/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-64/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-65/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-66/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-67/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-68/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-69/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-70/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-71/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-72/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-73/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-74/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-75/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-76/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-77/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-78/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-79/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-80/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-81/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-82/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-83/</url>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-84/</url>
</references>
<dates>
<discovery>2016-08-02</discovery>
<entry>2016-09-07</entry>
<modified>2016-09-20</modified>
</dates>
</vuln>
<vuln vid="5cb18881-7604-11e6-b362-001999f8d30b">
<topic>asterisk -- RTP Resource Exhaustion</topic>
<affects>
<package>
<name>asterisk11</name>
<range><lt>11.23.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>The overlap dialing feature in chan_sip allows chan_sip
to report to a device that the number that has been dialed
is incomplete and more digits are required. If this
functionality is used with a device that has performed
username/password authentication RTP resources are leaked.
This occurs because the code fails to release the old RTP
resources before allocating new ones in this scenario.
If all resources are used then RTP port exhaustion will
occur and no RTP sessions are able to be set up.</p>
<p>If overlap dialing support is not needed the "allowoverlap"
option can be set to no. This will stop any usage of the
scenario which causes the resource exhaustion.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-007.html</url>
</references>
<dates>
<discovery>2016-08-05</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="7fda7920-7603-11e6-b362-001999f8d30b">
<topic>asterisk -- Crash on ACK from unknown endpoint</topic>
<affects>
<package>
<name>asterisk13</name>
<range><ge>13.10.0</ge><lt>13.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk can be crashed remotely by sending an ACK to
it from an endpoint username that Asterisk does not
recognize. Most SIP request types result in an "artificial"
endpoint being looked up, but ACKs bypass this lookup.
The resulting NULL pointer results in a crash when
attempting to determine if ACLs should be applied.</p>
<p>This issue was introduced in the Asterisk 13.10 release
and only affects that release.</p>
<p>This issue only affects users using the PJSIP stack
with Asterisk. Those users that use chan_sip are
unaffected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-006.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-09-08</entry>
</dates>
</vuln>
<vuln vid="70c85c93-743c-11e6-a590-14dae9d210b8">
<topic>inspircd -- authentication bypass vulnerability</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>2.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam reports:</p>
<blockquote cite="http://www.inspircd.org/2016/09/03/v2023-released.html">
<p>A serious vulnerability exists in when using m_sasl in
combination with any services that support SASL EXTERNAL.
To be vulnerable you must have m_sasl loaded, and have services which
support SASL EXTERNAL authentication.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.inspircd.org/2016/09/03/v2023-released.html</url>
</references>
<dates>
<discovery>2016-09-03</discovery>
<entry>2016-09-06</entry>
</dates>
</vuln>
<vuln vid="9e50dcc3-740b-11e6-94a2-080027ef73ec">
<topic>mailman -- CSRF hardening in parts of the web interface</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The late Tokio Kikuchi reported:</p>
<blockquote cite="https://bugs.launchpad.net/mailman/+bug/775294">
<p>We may have to set lifetime for input forms because of recent
activities on cross-site request forgery (CSRF). The form lifetime
is successfully deployed in frameworks like web.py or plone etc.
Proposed branch lp:~tkikuchi/mailman/form-lifetime implement
lifetime in admin, admindb, options and edithtml interfaces.
[...]</p>
</blockquote>
<blockquote cite="https://launchpad.net/mailman/2.1/2.1.15">
<p>The web admin interface has been hardened against CSRF attacks by
adding a hidden, encrypted token with a time stamp to form submissions
and not accepting authentication by cookie if the token is missing,
invalid or older than the new mm_cfg.py setting FORM_LIFETIME which
defaults to one hour. Posthumous thanks go to Tokio Kikuchi for this implementation [...].</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.launchpad.net/mailman/+bug/775294</url>
<url>https://launchpad.net/mailman/2.1/2.1.15</url>
<cvename>CVE-2016-7123</cvename>
</references>
<dates>
<discovery>2011-05-02</discovery>
<entry>2016-09-06</entry>
</dates>
</vuln>
<vuln vid="adccefd1-7080-11e6-a2cb-c80aa9043978">
<topic>openssh -- sshd -- remote valid user discovery and PAM /bin/login attack</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.3.p1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="http://www.openssh.com/txt/release-7.3">
<p>* sshd(8): Mitigate timing differences in password authentication
that could be used to discern valid from invalid account names
when long passwords were sent and particular password hashing
algorithms are in use on the server. CVE-2016-6210, reported by
EddieEzra.Harari at verint.com
</p>
<p> * sshd(8): (portable only) Ignore PAM environment vars when
UseLogin=yes. If PAM is configured to read user-specified
environment variables and UseLogin=yes in sshd_config, then a
hostile local user may attack /bin/login via LD_PRELOAD or
similar environment variables set via PAM. CVE-2015-8325,
found by Shayan Sadigh.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.3</url>
<cvename>CVE-2016-6210</cvename>
<cvename>CVE-2015-8325</cvename>
</references>
<dates>
<discovery>2016-08-01</discovery>
<entry>2016-09-01</entry>
</dates>
</vuln>
<vuln vid="b11ab01b-6e19-11e6-ab24-080027ef73ec">
<topic>mailman -- CSRF protection enhancements</topic>
<affects>
<package>
<name>mailman</name>
<range><lt>2.1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Sapiro reports:</p>
<blockquote cite="http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668">
<p>CSRF protection has been extended to the user options page. This
was actually fixed by Tokio Kikuchi as part of the fix for LP:
#775294 and intended for Mailman 2.1.15, but that fix wasn't
completely merged at the time. The full fix also addresses the
admindb, and edithtml pages as well as the user options page and the
previously fixed admin pages. Thanks to Nishant Agarwala for reporting the issue.</p>
</blockquote>
</body>
</description>
<references>
<url>http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1668</url>
<url>https://mail.python.org/pipermail/mailman-announce/2016-August/000226.html</url>
<cvename>CVE-2016-6893</cvename>
</references>
<dates>
<discovery>2016-08-19</discovery>
<entry>2016-08-29</entry>
</dates>
</vuln>
<vuln vid="e195679d-045b-4953-bb33-be0073ba2ac6">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Veillard reports:</p>
<blockquote cite="https://mail.gnome.org/archives/xml/2016-May/msg00023.html">
<p>More format string warnings with possible format string
vulnerability (David Kilzer)</p>
<p>Avoid building recursive entities (Daniel Veillard)</p>
<p>Heap-based buffer overread in htmlCurrentChar (Pranjal Jumde)</p>
<p>Heap-based buffer-underreads due to xmlParseName (David Kilzer)</p>
<p>Heap use-after-free in xmlSAX2AttributeNs (Pranjal Jumde)</p>
<p>Heap use-after-free in htmlParsePubidLiteral and
htmlParseSystemiteral (Pranjal Jumde)</p>
<p>Fix some format string warnings with possible format string
vulnerability (David Kilzer)</p>
<p>Detect change of encoding when parsing HTML names (Hugh Davenport)</p>
<p>Fix inappropriate fetch of entities content (Daniel Veillard)</p>
<p>Bug 759398: Heap use-after-free in xmlDictComputeFastKey
(Pranjal Jumde)</p>
<p>Bug 758605: Heap-based buffer overread in xmlDictAddString
(Pranjal Jumde)</p>
<p>Bug 758588: Heap-based buffer overread in
xmlParserPrintFileContextInternal (David Kilzer)</p>
<p>Bug 757711: heap-buffer-overflow in xmlFAParsePosCharGroup
(Pranjal Jumde)</p>
<p>Add missing increments of recursion depth counter to XML parser.
(Peter Simons)</p>
<p>Fix NULL pointer deref in XPointer range-to</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/xml/2016-May/msg00023.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=759398</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758605</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758588</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=757711</url>
<url>https://git.gnome.org/browse/libxml2/patch/?id=d8083bf77955b7879c1290f0c0a24ab8cc70f7fb</url>
<cvename>CVE-2016-1762</cvename>
<cvename>CVE-2016-1833</cvename>
<cvename>CVE-2016-1834</cvename>
<cvename>CVE-2016-1835</cvename>
<cvename>CVE-2016-1836</cvename>
<cvename>CVE-2016-1837</cvename>
<cvename>CVE-2016-1838</cvename>
<cvename>CVE-2016-1839</cvename>
<cvename>CVE-2016-1840</cvename>
<cvename>CVE-2016-3627</cvename>
<cvename>CVE-2016-3705</cvename>
<cvename>CVE-2016-4449</cvename>
<cvename>CVE-2016-4483</cvename>
</references>
<dates>
<discovery>2016-05-23</discovery>
<entry>2016-08-28</entry>
</dates>
</vuln>
<vuln vid="4472ab39-6c66-11e6-9ca5-50e549ebab6c">
<topic>kdelibs -- directory traversal vulnerability</topic>
<affects>
<package>
<name>kdelibs</name>
<range><lt>4.14.10_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>David Faure reports:</p>
<blockquote cite="https://www.kde.org/info/security/advisory-20160724-1.txt">
<p>A maliciously crafted archive (.zip or .tar.bz2) with "../" in the
file paths could be offered for download via the KNewStuff
framework (e.g. on www.kde-look.org), and upon extraction would
install files anywhere in the user's home directory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6232</cvename>
<url>https://www.kde.org/info/security/advisory-20160724-1.txt</url>
</references>
<dates>
<discovery>2016-07-24</discovery>
<entry>2016-08-27</entry>
</dates>
</vuln>
<vuln vid="f5035ead-688b-11e6-8b1d-c86000169601">
<topic>eog -- out-of-bounds write</topic>
<affects>
<package>
<name>eog</name>
<range><lt>3.18.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Felix Riemann reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html">
<p>CVE-2016-6855 out-of-bounds write in eog 3.10.2.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2016-August/msg00123.html</url>
<cvename>CVE-2016-6855</cvename>
</references>
<dates>
<discovery>2016-08-21</discovery>
<entry>2016-08-22</entry>
</dates>
</vuln>
<vuln vid="44989c29-67d1-11e6-8b1d-c86000169601">
<topic>fontconfig -- insufficiently cache file validation</topic>
<affects>
<package>
<name>fontconfig</name>
<range><lt>1.12.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian security team reports:</p>
<blockquote cite="https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html">
<p>Tobias Stoeckmann discovered that cache files are insufficiently
validated in fontconfig, a generic font configuration library. An
attacker can trigger arbitrary free() calls, which in turn allows
double free attacks and therefore arbitrary code execution. In
combination with setuid binaries using crafted cache files, this
could allow privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<url>https://packetstormsecurity.com/files/138236/Debian-Security-Advisory-3644-1.html</url>
<cvename>CVE-2016-5384</cvename>
</references>
<dates>
<discovery>2016-08-05</discovery>
<entry>2016-08-21</entry>
</dates>
</vuln>
<vuln vid="7fe7df75-6568-11e6-a590-14dae9d210b8">
<topic>End of Life Ports</topic>
<affects>
<package>
<name>python32</name>
<name>python31</name>
<name>python30</name>
<name>python26</name>
<name>python25</name>
<name>python24</name>
<name>python23</name>
<name>python22</name>
<name>python21</name>
<name>python20</name>
<name>python15</name>
<range><ge>0</ge></range>
</package>
<package>
<name>php54</name>
<name>php53</name>
<name>php52</name>
<name>php5</name>
<name>php4</name>
<range><ge>0</ge></range>
</package>
<package>
<name>perl5</name>
<range><lt>5.18</lt></range>
</package>
<package>
<name>perl5.16</name>
<name>perl5.14</name>
<name>perl5.12</name>
<name>perl</name> <!-- Perl 5.10 and earlier were called "perl" -->
<range><ge>0</ge></range>
</package>
<package>
<name>ruby</name>
<name>ruby_static</name>
<range><lt>2.1,1</lt></range>
</package>
<package>
<name>unifi2</name>
<name>unifi3</name>
<range><ge>0</ge></range>
</package>
<package>
<name>apache21</name>
<name>apache20</name>
<name>apache13</name>
<range><ge>0</ge></range>
</package>
<package>
<name>tomcat55</name>
<name>tomcat41</name>
<range><ge>0</ge></range>
</package>
<package>
<name>mysql51-client</name>
<name>mysql51-server</name>
<name>mysql50-client</name>
<name>mysql50-server</name>
<name>mysql41-client</name>
<name>mysql41-server</name>
<name>mysql40-client</name>
<name>mysql40-server</name>
<range><ge>0</ge></range>
</package>
<package>
<name>postgresql90-client</name>
<name>postgresql90-server</name>
<name>postgresql84-client</name>
<name>postgresql84-server</name>
<name>postgresql83-client</name>
<name>postgresql83-server</name>
<name>postgresql82-client</name>
<name>postgresql82-server</name>
<name>postgresql81-client</name>
<name>postgresql81-server</name>
<name>postgresql80-client</name>
<name>postgresql80-server</name>
<name>postgresql74-client</name>
<name>postgresql74-server</name>
<name>postgresql73-client</name>
<name>postgresql73-server</name>
<name>postgresql72-client</name>
<name>postgresql72-server</name>
<name>postgresql71-client</name>
<name>postgresql71-server</name>
<name>postgresql7-client</name>
<name>postgresql7-server</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>These packages have reached End of Life status and/or have
been removed from the Ports Tree. They may contain undocumented
security issues. Please take caution and find alternative
software as soon as possible.</p>
</body>
</description>
<references>
<freebsdpr>ports/211975</freebsdpr>
</references>
<dates>
<discovery>2016-08-18</discovery>
<entry>2016-08-18</entry>
<modified>2016-10-18</modified>
</dates>
</vuln>
<vuln vid="e1c71d8d-64d9-11e6-b38a-25a46b33f2ed">
<topic>gnupg -- attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output</topic>
<affects>
<package>
<name>gnupg1</name>
<range><lt>1.4.21</lt></range>
</package>
<package>
<name>libgcrypt</name>
<range><lt>1.7.3</lt></range>
</package>
<package>
<name>linux-c6-libgcrypt</name>
<range><lt>1.4.5_4</lt></range>
</package>
<package>
<name>linux-c7-libgcrypt</name>
<range><lt>1.5.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Werner Koch reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html">
<p>There was a bug in the mixing functions of Libgcrypt's random
number generator: An attacker who obtains 4640 bits from the RNG can
trivially predict the next 160 bits of output. This bug exists since
1998 in all GnuPG and Libgcrypt versions.</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html</url>
<cvename>CVE-2016-6313</cvename>
</references>
<dates>
<discovery>2016-08-17</discovery>
<entry>2016-08-18</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="ef70b201-645d-11e6-9cdc-6805ca0b3d42">
<topic>phpmyadmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpmyadmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-29/">
<p>Weakness with cookie encryption</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-30/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-31/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-32/">
<p>PHP code injection</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-33/">
<p>Full path disclosure</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-34/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-35/">
<p>Local file exposure</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-36/">
<p>Local file exposure through symlinks with
UploadDir</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-37/">
<p>Path traversal with SaveDir and UploadDir</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-38/">
<p>Multiple XSS vulnerabilities</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-39/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-40/">
<p>SQL injection attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-41/">
<p>Denial of service (DOS) attack in transformation
feature</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-42/">
<p>SQL injection attack as control user</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-43/">
<p>Unvalidated data passed to unserialize()</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-45/">
<p>DOS attack with forced persistent connections</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-46/">
<p>Denial of service (DOS) attack by for loops</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-47/">
<p>IPv6 and proxy server IP-based authentication rule
circumvention</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-48/">
<p>Detect if user is logged in</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-49/">
<p>Bypass URL redirect protection</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-50/">
<p>Referrer leak in url.php</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-51/">
<p>Reflected File Download attack</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-52/">
<p>ArbitraryServerRegexp bypass</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-53/">
<p>Denial of service (DOS) attack by changing password to a
very long string</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-54/">
<p>Remote code execution vulnerability when run as CGI</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-55/">
<h3>Summary</h3>
<p>Denial of service (DOS) attack with dbase extension</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-56/">
<p>Remote code execution vulnerability when PHP is running
with dbase extension</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-29/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-30/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-31/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-32/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-33/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-34/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-35/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-36/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-37/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-38/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-39/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-40/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-41/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-42/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-43/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-45/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-46/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-47/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-48/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-49/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-50/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-51/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-52/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-53/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-54/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-55/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-56/</url>
<cvename>CVE-2016-6606</cvename>
<cvename>CVE-2016-6607</cvename>
<cvename>CVE-2016-6608</cvename>
<cvename>CVE-2016-6609</cvename>
<cvename>CVE-2016-6610</cvename>
<cvename>CVE-2016-6611</cvename>
<cvename>CVE-2016-6612</cvename>
<cvename>CVE-2016-6613</cvename>
<cvename>CVE-2016-6614</cvename>
<cvename>CVE-2016-6615</cvename>
<cvename>CVE-2016-6616</cvename>
<cvename>CVE-2016-6617</cvename>
<cvename>CVE-2016-6618</cvename>
<cvename>CVE-2016-6619</cvename>
<cvename>CVE-2016-6620</cvename>
<cvename>CVE-2016-6622</cvename>
<cvename>CVE-2016-6623</cvename>
<cvename>CVE-2016-6624</cvename>
<cvename>CVE-2016-6625</cvename>
<cvename>CVE-2016-6626</cvename>
<cvename>CVE-2016-6627</cvename>
<cvename>CVE-2016-6628</cvename>
<cvename>CVE-2016-6629</cvename>
<cvename>CVE-2016-6630</cvename>
<cvename>CVE-2016-6631</cvename>
<cvename>CVE-2016-6632</cvename>
<cvename>CVE-2016-6633</cvename>
</references>
<dates>
<discovery>2016-08-17</discovery>
<entry>2016-08-17</entry>
</dates>
</vuln>
<vuln vid="f7dd2d09-625e-11e6-828b-fcaa14edc6a6">
<topic>TeamSpeak Server 3 -- Multiple vulnerabilities including Remote Code Execution</topic>
<affects>
<package>
<name>teamspeak3-server</name>
<range><le>3.0.13_1,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanz Jenson audit report:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2016/Aug/61">
<p>I found 10 vulnerabilities. Some of these are critical and allow remote code
execution. For the average user, that means that these vulnerabilities can be
exploited by a malicious attacker in order to take over any Teamspeak server,
not only becoming serveradmin, but getting a shell on the affected machine.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/fulldisclosure/2016/Aug/61</url>
</references>
<dates>
<discovery>2016-08-12</discovery>
<entry>2016-08-14</entry>
</dates>
</vuln>
<vuln vid="df502a2f-61f6-11e6-a461-643150d3111d">
<topic>puppet-agent MCollective plugin -- Remote Code Execution vulnerability</topic>
<affects>
<package>
<name>mcollective-puppet-agent</name>
<range><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Puppet reports:</p>
<blockquote cite="https://puppet.com/security/cve/cve-2015-7331">
<p>Puppet Enterprise previously included a puppet-agent MCollective plugin that allowed you to pass the `--server` argument to MCollective. This insecure argument enabled remote code execution via connection to an untrusted host. The puppet-agent MCollective version included in PE 2016.2.1, this option is disabled by default.</p>
</blockquote>
</body>
</description>
<references>
<url>https://puppet.com/security/cve/cve-2015-7331</url>
<cvename>CVE-2015-7331</cvename>
</references>
<dates>
<discovery>2016-08-09</discovery>
<entry>2016-08-15</entry>
</dates>
</vuln>
<vuln vid="7d4f4955-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Heap vulnerability in bspatch</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_6</lt></range>
<range><ge>10.2</ge><lt>10.2_20</lt></range>
<range><ge>10.1</ge><lt>10.1_37</lt></range>
<range><ge>9.3</ge><lt>9.3_45</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of bspatch does not check for a
negative value on numbers of bytes read from the diff and
extra streams, allowing an attacker who can control the
patch file to write at arbitrary locations in the heap.</p>
<p>This issue was first discovered by The Chromium Project
and reported independently by Lu Tung-Pin to the FreeBSD
project.</p>
<h1>Impact:</h1>
<p>An attacker who can control the patch file can cause a
crash or run arbitrary code under the credentials of the
user who runs bspatch, in many cases, root.</p>
</body>
</description>
<references>
<cvename>CVE-2014-9862</cvename>
<freebsdsa>SA-16:25.bspatch</freebsdsa>
</references>
<dates>
<discovery>2016-07-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7cfcea05-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple ntp vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_5</lt></range>
<range><ge>10.2</ge><lt>10.2_19</lt></range>
<range><ge>10.1</ge><lt>10.1_36</lt></range>
<range><ge>9.3</ge><lt>9.3_44</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple vulnerabilities have been discovered in the NTP
suite:</p>
<p>The fix for Sec 3007 in ntp-4.2.8p7 contained a bug that
could cause ntpd to crash. [CVE-2016-4957, Reported by
Nicolas Edet of Cisco]</p>
<p>An attacker who knows the origin timestamp and can send
a spoofed packet containing a CRYPTO-NAK to an ephemeral
peer target before any other response is sent can demobilize
that association. [CVE-2016-4953, Reported by Miroslav
Lichvar of Red Hat]</p>
<p>An attacker who is able to spoof packets with correct
origin timestamps from enough servers before the expected
response packets arrive at the target machine can affect
some peer variables and, for example, cause a false leap
indication to be set. [CVE-2016-4954, Reported by Jakub
Prokes of Red Hat]</p>
<p>An attacker who is able to spoof a packet with a correct
origin timestamp before the expected response packet arrives
at the target machine can send a CRYPTO_NAK or a bad MAC
and cause the association's peer variables to be cleared.
If this can be done often enough, it will prevent that
association from working. [CVE-2016-4955, Reported by
Miroslav Lichvar of Red Hat]</p>
<p>The fix for NtpBug2978 does not cover broadcast associations,
so broadcast clients can be triggered to flip into interleave
mode. [CVE-2016-4956, Reported by Miroslav Lichvar of Red
Hat.]</p>
<h1>Impact:</h1>
<p>Malicious remote attackers may be able to break time
synchronization, or cause the ntpd(8) daemon to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2016-4953</cvename>
<cvename>CVE-2016-4954</cvename>
<cvename>CVE-2016-4955</cvename>
<cvename>CVE-2016-4956</cvename>
<cvename>CVE-2016-4957</cvename>
<freebsdsa>SA-16:24.ntp</freebsdsa>
</references>
<dates>
<discovery>2016-06-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7cad4795-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of historic stat(2) system call does
not clear the output struct before copying it out to
userland.</p>
<h1>Impact:</h1>
<p>An unprivileged user can read a portion of uninitialised
kernel stack data, which may contain sensitive information,
such as the stack guard, portions of the file cache or
terminal buffers, which an attacker might leverage to obtain
elevated privileges.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:21.43bsd</freebsdsa>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7c5d64dd-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in Linux compatibility layer</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The implementation of the TIOCGSERIAL ioctl(2) does not
clear the output struct before copying it out to userland.</p>
<p>The implementation of the Linux sysinfo() system call
does not clear the output struct before copying it out to
userland.</p>
<h1>Impact:</h1>
<p>An unprivileged user can read a portion of uninitialised
kernel stack data, which may contain sensitive information,
such as the stack guard, portions of the file cache or
terminal buffers, which an attacker might leverage to obtain
elevated privileges.</p>
</body>
</description>
<references>
<freebsdsa>SA-16:20.linux</freebsdsa>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7c0bac69-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect argument handling in sendmsg(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_3</lt></range>
<range><ge>10.2</ge><lt>10.2_17</lt></range>
<range><ge>10.1</ge><lt>10.1_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incorrect argument handling in the socket code allows
malicious local user to overwrite large portion of the
kernel memory.</p>
<h1>Impact:</h1>
<p>Malicious local user may crash kernel or execute arbitrary
code in the kernel, potentially gaining superuser privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1887</cvename>
<freebsdsa>SA-16:19.sendmsg</freebsdsa>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7bbc0e8c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Buffer overflow in keyboard driver</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.3</ge><lt>10.3_3</lt></range>
<range><ge>10.2</ge><lt>10.2_17</lt></range>
<range><ge>10.1</ge><lt>10.1_34</lt></range>
<range><ge>9.3</ge><lt>9.3_42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Incorrect signedness comparison in the ioctl(2) handler
allows a malicious local user to overwrite a portion of the
kernel memory.</p>
<h1>Impact:</h1>
<p>A local user may crash the kernel, read a portion of
kernel memory and execute arbitrary code in kernel context.
The result of executing an arbitrary kernel code is privilege
escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1886</cvename>
<freebsdsa>SA-16:18.atkbd</freebsdsa>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7b6a11b5-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect argument validation in sysarch(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>11.0</ge><lt>11.0_2</lt></range>
<range><ge>10.3</ge><lt>10.3_11</lt></range>
<range><ge>10.2</ge><lt>10.2_24</lt></range>
<range><ge>10.1</ge><lt>10.1_41</lt></range>
<range><ge>9.3</ge><lt>9.3_49</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A special combination of sysarch(2) arguments, specify
a request to uninstall a set of descriptors from the LDT.
The start descriptor is cleared and the number of descriptors
are provided. Due to lack of sufficient bounds checking
during argument validity verification, unbound zero'ing of
the process LDT and adjacent memory can be initiated from
usermode.</p>
<h1>Impact:</h1>
<p>This vulnerability could cause the kernel to panic. In
addition it is possible to perform a local Denial of Service
against the system by unprivileged processes.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1885</cvename>
<freebsdsa>SA-16:15.sysarch</freebsdsa>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-08-11</entry>
<modified>2016-10-25</modified>
</dates>
</vuln>
<vuln vid="7b1a4a27-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple OpenSSL vulnerabilities</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_13</lt></range>
<range><ge>10.1</ge><lt>10.1_30</lt></range>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A cross-protocol attack was discovered that could lead
to decryption of TLS sessions by using a server supporting
SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA
padding oracle. Note that traffic between clients and
non-vulnerable servers can be decrypted provided another
server supporting SSLv2 and EXPORT ciphers (even with a
different protocol such as SMTP, IMAP or POP3) shares the
RSA keys of the non-vulnerable server. This vulnerability
is known as DROWN. [CVE-2016-0800]</p>
<p>A double free bug was discovered when OpenSSL parses
malformed DSA private keys and could lead to a DoS attack
or memory corruption for applications that receive DSA
private keys from untrusted sources. This scenario is
considered rare. [CVE-2016-0705]</p>
<p>The SRP user database lookup method SRP_VBASE_get_by_user
had confusing memory management semantics; the returned
pointer was sometimes newly allocated, and sometimes owned
by the callee. The calling code has no way of distinguishing
these two cases. [CVE-2016-0798]</p>
<p>In the BN_hex2bn function, the number of hex digits is
calculated using an int value |i|. Later |bn_expand| is
called with a value of |i * 4|. For large values of |i|
this can result in |bn_expand| not allocating any memory
because |i * 4| is negative. This can leave the internal
BIGNUM data field as NULL leading to a subsequent NULL
pointer dereference. For very large values of |i|, the
calculation |i * 4| could be a positive value smaller than
|i|. In this case memory is allocated to the internal BIGNUM
data field, but it is insufficiently sized leading to heap
corruption. A similar issue exists in BN_dec2bn. This could
have security consequences if BN_hex2bn/BN_dec2bn is ever
called by user applications with very large untrusted hex/dec
data. This is anticipated to be a rare occurrence.
[CVE-2016-0797]</p>
<p>The internal |fmtstr| function used in processing a "%s"
formatted string in the BIO_*printf functions could overflow
while calculating the length of a string and cause an
out-of-bounds read when printing very long strings.
[CVE-2016-0799]</p>
<p>A side-channel attack was found which makes use of
cache-bank conflicts on the Intel Sandy-Bridge microarchitecture
which could lead to the recovery of RSA keys. [CVE-2016-0702]</p>
<p>s2_srvr.c did not enforce that clear-key-length is 0 for
non-export ciphers. If clear-key bytes are present for these
ciphers, they displace encrypted-key bytes. [CVE-2016-0703]</p>
<p>s2_srvr.c overwrites the wrong bytes in the master key
when applying Bleichenbacher protection for export cipher
suites. [CVE-2016-0704]</p>
<h1>Impact:</h1>
<p>Servers that have SSLv2 protocol enabled are vulnerable
to the "DROWN" attack which allows a remote attacker to
fast attack many recorded TLS connections made to the server,
even when the client did not make any SSLv2 connections
themselves.</p>
<p>An attacker who can supply malformed DSA private keys
to OpenSSL applications may be able to cause memory corruption
which would lead to a Denial of Service condition.
[CVE-2016-0705]</p>
<p>An attacker connecting with an invalid username can cause
memory leak, which could eventually lead to a Denial of
Service condition. [CVE-2016-0798]</p>
<p>An attacker who can inject malformed data into an
application may be able to cause memory corruption which
would lead to a Denial of Service condition. [CVE-2016-0797,
CVE-2016-0799]</p>
<p>A local attacker who has control of code in a thread
running on the same hyper-threaded core as the victim thread
which is performing decryptions could recover RSA keys.
[CVE-2016-0702]</p>
<p>An eavesdropper who can intercept SSLv2 handshake can
conduct an efficient divide-and-conquer key recovery attack
and use the server as an oracle to determine the SSLv2
master-key, using only 16 connections to the server and
negligible computation. [CVE-2016-0703]</p>
<p>An attacker can use the Bleichenbacher oracle, which
enables more efficient variant of the DROWN attack.
[CVE-2016-0704]</p>
</body>
</description>
<references>
<cvename>CVE-2016-0702</cvename>
<cvename>CVE-2016-0703</cvename>
<cvename>CVE-2016-0704</cvename>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0797</cvename>
<cvename>CVE-2016-0798</cvename>
<cvename>CVE-2016-0799</cvename>
<cvename>CVE-2016-0800</cvename>
<freebsdsa>SA-16:12.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7ac28df1-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer issetugid(2) system call</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_11</lt></range>
<range><ge>10.1</ge><lt>10.1_28</lt></range>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the Linux compatibility layer
could cause the issetugid(2) system call to return incorrect
information.</p>
<h1>Impact:</h1>
<p>If an application relies on output of the issetugid(2)
system call and that information is incorrect, this could
lead to a privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1883</cvename>
<freebsdsa>SA-16:10.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7a31dfba-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Insecure default snmpd.config permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The SNMP protocol supports an authentication model called
USM, which relies on a shared secret. The default permission
of the snmpd configuration file, /etc/snmpd.config, is
weak and does not provide adequate protection against local
unprivileged users.</p>
<h1>Impact:</h1>
<p>A local user may be able to read the shared secret, if
configured and used by the system administrator.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5677</cvename>
<freebsdsa>SA-16:06.bsnmpd</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="79dfc135-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- TCP MD5 signature denial of service</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in processing a TCP connection with
both TCP_MD5SIG and TCP_NOOPT socket options may lead to
kernel crash.</p>
<h1>Impact:</h1>
<p>A local attacker can crash the kernel, resulting in a
denial-of-service.</p>
<p>A remote attack is theoretically possible, if server has
a listening socket with TCP_NOOPT set, and server is either
out of SYN cache entries, or SYN cache is disabled by
configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1882</cvename>
<freebsdsa>SA-16:05.tcp</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="798f63e0-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer setgroups(2) system call</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the Linux compatibility layer
setgroups(2) system call can lead to an unexpected results,
such as overwriting random kernel memory contents.</p>
<h1>Impact:</h1>
<p>It is possible for a local attacker to overwrite portions
of kernel memory, which may result in a privilege escalation
or cause a system panic.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1881</cvename>
<freebsdsa>SA-16:04.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="793fb19c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Linux compatibility layer incorrect futex handling</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the handling of Linux futex robust
lists may result in incorrect memory locations being
accessed.</p>
<h1>Impact:</h1>
<p>It is possible for a local attacker to read portions of
kernel memory, which may result in a privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1880</cvename>
<freebsdsa>SA-16:03.linux</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="78f06a6c-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP ICMPv6 error message vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A lack of proper input checks in the ICMPv6 processing
in the SCTP stack can lead to either a failed kernel assertion
or to a NULL pointer dereference. In either case, a kernel
panic will follow.</p>
<h1>Impact:</h1>
<p>A remote, unauthenticated attacker can reliably trigger
a kernel panic in a vulnerable system running IPv6. Any
kernel compiled with both IPv6 and SCTP support is vulnerable.
There is no requirement to have an SCTP socket open.</p>
<p>IPv4 ICMP processing is not impacted by this vulnerability.</p>
</body>
</description>
<references>
<cvename>CVE-2016-1879</cvename>
<freebsdsa>SA-16:01.sctp</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0e5d6969-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- rpcbind(8) remote denial of service [REVISED]</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_5</lt></range>
<range><ge>10.1</ge><lt>10.1_22</lt></range>
<range><ge>9.3</ge><lt>9.3_28</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>In rpcbind(8), netbuf structures are copied directly,
which would result in two netbuf structures that reference
to one shared address buffer. When one of the two netbuf
structures is freed, access to the other netbuf structure
would result in an undefined result that may crash the
rpcbind(8) daemon.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send specifically crafted
packets to the rpcbind(8) daemon can cause it to crash,
resulting in a denial of service condition.</p>
</body>
</description>
<references>
<cvename>CVE-2015-7236</cvename>
<freebsdsa>SA-15:24.rpcbind</freebsdsa>
</references>
<dates>
<discovery>2015-09-29</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0dfa5dde-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Local privilege escalation in IRET handler</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_19</lt></range>
<range><ge>9.3</ge><lt>9.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>If the kernel-mode IRET instruction generates an #SS or
#NP exception, but the exception handler does not properly
ensure that the right GS register base for kernel is reloaded,
the userland GS segment may be used in the context of the
kernel exception handler.</p>
<h1>Impact:</h1>
<p>By causing an IRET with #SS or #NP exceptions, a local
attacker can cause the kernel to use an arbitrary GS base,
which may allow escalated privileges or panic the system.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5675</cvename>
<freebsdsa>SA-15:21.amd64</freebsdsa>
</references>
<dates>
<discovery>2015-08-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0da8a68e-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple integer overflows in expat (libbsdxml) XML parser</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_18</lt></range>
<range><ge>10.2</ge><lt>10.2_1</lt></range>
<range><ge>9.3</ge><lt>9.3_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Multiple integer overflows have been discovered in the
XML_GetBuffer() function in the expat library.</p>
<h1>Impact:</h1>
<p>The integer overflows may be exploited by using specifically
crafted XML data and lead to infinite loop, or a heap buffer
overflow, which results in a Denial of Service condition,
or enables remote attackers to execute arbitrary code.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1283</cvename>
<freebsdsa>SA-15:20.expat</freebsdsa>
</references>
<dates>
<discovery>2015-08-18</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0d584493-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_17</lt></range>
<range><ge>9.3</ge><lt>9.3_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input path in routed(8) will accept queries from any
source and attempt to answer them. However, the output path
assumes that the destination address for the response is
on a directly connected network.</p>
<h1>Impact:</h1>
<p>Upon receipt of a query from a source which is not on a
directly connected network, routed(8) will trigger an
assertion and terminate. The affected system's routing table
will no longer be updated. If the affected system is a
router, its routes will eventually expire from other routers'
routing tables, and its networks will no longer be reachable
unless they are also connected to another router.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5674</cvename>
<freebsdsa>SA-15:19.routed</freebsdsa>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0d090952-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient sanitization of the input patch
stream, it is possible for a patch file to cause patch(1)
to pass certain ed(1) scripts to the ed(1) editor, which
would run commands.</p>
<h1>Impact:</h1>
<p>This issue could be exploited to execute arbitrary
commands as the user invoking patch(1) against a specially
crafted patch file, which could be leveraged to obtain
elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1418</cvename>
<freebsdsa>SA-15:18.bsdpatch</freebsdsa>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0cb9d5bb-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Resource exhaustion in TCP reassembly</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
<range><ge>9.3</ge><lt>9.3_21</lt></range>
<range><ge>8.4</ge><lt>8.4_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a mistake with the introduction of VNET, which
converted the global limit on the number of segments that
could belong to reassembly queues into a per-VNET limit.
Because mbufs are allocated from a global pool, in the
presence of a sufficient number of VNETs, the total number
of mbufs attached to reassembly queues can grow to the total
number of mbufs in the system, at which point all network
traffic would cease.</p>
<h1>Impact:</h1>
<p>An attacker who can establish concurrent TCP connections
across a sufficient number of VNETs and manipulate the
inbound packet streams such that the maximum number of mbufs
are enqueued on each reassembly queue can cause mbuf cluster
exhaustion on the target system, resulting in a Denial of
Service condition.</p>
<p>As the default per-VNET limit on the number of segments
that can belong to reassembly queues is 1/16 of the total
number of mbuf clusters in the system, only systems that
have 16 or more VNET instances are vulnerable.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1417</cvename>
<freebsdsa>SA-15:15.tcp</freebsdsa>
</references>
<dates>
<discovery>2015-07-28</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0c6759dd-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- shell injection vulnerability in patch(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient sanitization of the input patch
stream, it is possible for a patch file to cause patch(1)
to run commands in addition to the desired SCCS or RCS
commands.</p>
<h1>Impact:</h1>
<p>This issue could be exploited to execute arbitrary
commands as the user invoking patch(1) against a specially
crafted patch file, which could be leveraged to obtain
elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1416</cvename>
<freebsdsa>SA-15:14.bsdpatch</freebsdsa>
</references>
<dates>
<discovery>2015-07-28</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0c064c43-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_15</lt></range>
<range><ge>9.3</ge><lt>9.3_20</lt></range>
<range><ge>8.4</ge><lt>8.4_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>TCP connections transitioning to the LAST_ACK state can
become permanently stuck due to mishandling of protocol
state in certain situations, which in turn can lead to
accumulated consumption and eventual exhaustion of system
resources, such as mbufs and sockets.</p>
<h1>Impact:</h1>
<p>An attacker who can repeatedly establish TCP connections
to a victim system (for instance, a Web server) could create
many TCP connections that are stuck in LAST_ACK state and
cause resource exhaustion, resulting in a denial of service
condition. This may also happen in normal operation where
no intentional attack is conducted, but an attacker who can
send specifically crafted packets can trigger this more
reliably.</p>
</body>
</description>
<references>
<cvename>CVE-2015-5358</cvename>
<freebsdsa>SA-15:13.tcp</freebsdsa>
</references>
<dates>
<discovery>2015-07-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0bb55a18-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of Service with IPv6 Router Advertisements</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The Neighbor Discover Protocol allows a local router to
advertise a suggested Current Hop Limit value of a link,
which will replace Current Hop Limit on an interface connected
to the link on the FreeBSD system.</p>
<h1>Impact:</h1>
<p>When the Current Hop Limit (similar to IPv4's TTL) is
small, IPv6 packets may get dropped before they reached
their destinations.</p>
<p>By sending specifically crafted Router Advertisement
packets, an attacker on the local network can cause the
FreeBSD system to lose the ability to communicate with
another IPv6 node on a different network.</p>
</body>
</description>
<references>
<cvename>CVE-2015-2923</cvename>
<freebsdsa>SA-15:09.ipv6</freebsdsa>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0b65f297-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Insecure default GELI keyfile permissions</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The default permission set by bsdinstall(8) installer
when configuring full disk encrypted ZFS is too open.</p>
<h1>Impact:</h1>
<p>A local attacker may be able to get a copy of the geli(8)
provider's keyfile which is located at a fixed location.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1415</cvename>
<freebsdsa>SA-15:08.bsdinstall</freebsdsa>
</references>
<dates>
<discovery>2015-04-07</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0afe8b29-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Integer overflow in IGMP protocol</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_9</lt></range>
<range><ge>9.3</ge><lt>9.3_13</lt></range>
<range><ge>8.4</ge><lt>8.4_27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>An integer overflow in computing the size of IGMPv3 data
buffer can result in a buffer which is too small for the
requested operation.</p>
<h1>Impact:</h1>
<p>An attacker who can send specifically crafted IGMP packets
could cause a denial of service situation by causing the
kernel to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-1414</cvename>
<freebsdsa>SA-15:04.igmp</freebsdsa>
</references>
<dates>
<discovery>2015-02-25</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0aad3ce5-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP stream reset vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_5</lt></range>
<range><ge>10.0</ge><lt>10.0_17</lt></range>
<range><ge>9.3</ge><lt>9.3_9</lt></range>
<range><ge>8.4</ge><lt>8.4_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input validation of received SCTP RE_CONFIG chunks
is insufficient, and can result in a NULL pointer deference
later.</p>
<h1>Impact:</h1>
<p>A remote attacker who can send a malformed SCTP packet
to a FreeBSD system that serves SCTP can cause a kernel
panic, resulting in a Denial of Service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8613</cvename>
<freebsdsa>SA-15:03.sctp</freebsdsa>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="0a5cf6d8-600a-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- SCTP SCTP_SS_VALUE kernel memory corruption and disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.1</ge><lt>10.1_5</lt></range>
<range><ge>10.0</ge><lt>10.0_17</lt></range>
<range><ge>9.3</ge><lt>9.3_9</lt></range>
<range><ge>8.4</ge><lt>8.4_23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to insufficient validation of the SCTP stream ID,
which serves as an array index, a local unprivileged attacker
can read or write 16-bits of kernel memory.</p>
<h1>Impact:</h1>
<p>An unprivileged process can read or modify 16-bits of
memory which belongs to the kernel. This may lead to
exposure of sensitive information or allow privilege
escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8612</cvename>
<freebsdsa>SA-15:02.kmem</freebsdsa>
</references>
<dates>
<discovery>2015-01-27</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="74ded00e-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Buffer overflow in stdio</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.1</ge><lt>10.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A programming error in the standard I/O library's
__sflush() function could erroneously adjust the buffered
stream's internal state even when no write actually occurred
in the case when write(2) system call returns an error.</p>
<h1>Impact:</h1>
<p>The accounting mismatch would accumulate, if the caller
does not check for stream status and will eventually lead
to a heap buffer overflow.</p>
<p>Such overflows may lead to data corruption or the execution
of arbitrary code at the privilege level of the calling
program.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8611</cvename>
<freebsdsa>SA-14:27.stdio</freebsdsa>
</references>
<dates>
<discovery>2014-12-10</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7488378d-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Remote command execution in ftp(1)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.3</ge><lt>9.3_5</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
<range><ge>8.4</ge><lt>8.4_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A malicious HTTP server could cause ftp(1) to execute
arbitrary commands.</p>
<h1>Impact:</h1>
<p>When operating on HTTP URIs, the ftp(1) client follows
HTTP redirects, and uses the part of the path after the
last '/' from the last resource it accesses as the output
filename if '-o' is not specified.</p>
<p>If the output file name provided by the server begins
with a pipe ('|'), the output is passed to popen(3), which
might be used to execute arbitrary commands on the ftp(1)
client machine.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8517</cvename>
<freebsdsa>SA-14:26.ftp</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="74389f22-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel stack disclosure in setlogin(2) / getlogin(2)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.3</ge><lt>9.3_5</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
<range><ge>8.4</ge><lt>8.4_19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When setlogin(2) is called while setting up a new login
session, the login name is copied into an uninitialized
stack buffer, which is then copied into a buffer of the
same size in the session structure. The getlogin(2) system
call returns the entire buffer rather than just the portion
occupied by the login name associated with the session.</p>
<h1>Impact:</h1>
<p>An unprivileged user can access this memory by calling
getlogin(2) and reading beyond the terminating NUL character
of the resulting string. Up to 16 (FreeBSD 8) or 32 (FreeBSD
9 and 10) bytes of kernel memory may be leaked in this
manner for each invocation of setlogin(2).</p>
<p>This memory may contain sensitive information, such as
portions of the file cache or terminal buffers, which an
attacker might leverage to obtain elevated privileges.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8476</cvename>
<freebsdsa>SA-14:25.setlogin</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="73e9a137-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of service attack against sshd(8)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_12</lt></range>
<range><ge>9.2</ge><lt>9.2_15</lt></range>
<range><ge>9.1</ge><lt>9.1_22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Although OpenSSH is not multithreaded, when OpenSSH is
compiled with Kerberos support, the Heimdal libraries bring
in the POSIX thread library as a dependency. Due to incorrect
library ordering while linking sshd(8), symbols in the C
library which are shadowed by the POSIX thread library may
not be resolved correctly at run time.</p>
<p>Note that this problem is specific to the FreeBSD build
system and does not affect other operating systems or the
version of OpenSSH available from the FreeBSD ports tree.</p>
<h1>Impact:</h1>
<p>An incorrectly linked sshd(8) child process may deadlock
while handling an incoming connection. The connection may
then time out or be interrupted by the client, leaving the
deadlocked sshd(8) child process behind. Eventually, the
sshd(8) parent process stops accepting new connections.</p>
<p>An attacker may take advantage of this by repeatedly
connecting and then dropping the connection after having
begun, but not completed, the authentication process.</p>
</body>
</description>
<references>
<cvename>CVE-2014-8475</cvename>
<freebsdsa>SA-14:24.sshd</freebsdsa>
</references>
<dates>
<discovery>2014-11-04</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="73964eac-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- memory leak in sandboxed namei lookup</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The namei facility will leak a small amount of kernel
memory every time a sandboxed process looks up a nonexistent
path name.</p>
<h1>Impact:</h1>
<p>A remote attacker that can cause a sandboxed process
(for instance, a web server) to look up a large number of
nonexistent path names can cause memory exhaustion.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3711</cvename>
<freebsdsa>SA-14:22.namei</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="734233f4-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- routed(8) remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
<range><ge>8.4</ge><lt>8.4_17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The input path in routed(8) will accept queries from any
source and attempt to answer them. However, the output path
assumes that the destination address for the response is
on a directly connected network.</p>
<h1>Impact:</h1>
<p>Upon receipt of a query from a source which is not on a
directly connected network, routed(8) will trigger an
assertion and terminate. The affected system's routing table
will no longer be updated. If the affected system is a
router, its routes will eventually expire from other routers'
routing tables, and its networks will no longer be reachable
unless they are also connected to another router.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3955</cvename>
<freebsdsa>SA-14:21.routed</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="72ee7111-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- rtsold(8) remote buffer overflow vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_10</lt></range>
<range><ge>9.3</ge><lt>9.3_3</lt></range>
<range><ge>9.2</ge><lt>9.2_13</lt></range>
<range><ge>9.1</ge><lt>9.1_20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to a missing length check in the code that handles
DNS parameters, a malformed router advertisement message
can result in a stack buffer overflow in rtsold(8).</p>
<h1>Impact:</h1>
<p>Receipt of a router advertisement message with a malformed
DNSSL option, for instance from a compromised host on the
same network, can cause rtsold(8) to crash.</p>
<p>While it is theoretically possible to inject code into
rtsold(8) through malformed router advertisement messages,
it is normally compiled with stack protection enabled,
rendering such an attack extremely difficult.</p>
<p>When rtsold(8) crashes, the existing DNS configuration
will remain in force, and the kernel will continue to receive
and process periodic router advertisements.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3954</cvename>
<freebsdsa>SA-14:20.rtsold</freebsdsa>
</references>
<dates>
<discovery>2014-10-21</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="729c4a9f-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Denial of Service in TCP packet processing</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_9</lt></range>
<range><ge>9.3</ge><lt>9.3_2</lt></range>
<range><ge>9.2</ge><lt>9.2_12</lt></range>
<range><ge>9.1</ge><lt>9.1_19</lt></range>
<range><ge>8.4</ge><lt>8.4_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>When a segment with the SYN flag for an already existing
connection arrives, the TCP stack tears down the connection,
bypassing a check that the sequence number in the segment
is in the expected window.</p>
<h1>Impact:</h1>
<p>An attacker who has the ability to spoof IP traffic can
tear down a TCP connection by sending only 2 packets, if
they know both TCP port numbers. In case one of the two
port numbers is unknown, a successful attack requires less
than 2**17 packets spoofed, which can be generated within
less than a second on a decent connection to the Internet.</p>
</body>
</description>
<references>
<cvename>CVE-2004-0230</cvename>
<freebsdsa>SA-14:19.tcp</freebsdsa>
</references>
<dates>
<discovery>2014-09-16</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="7240de58-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel memory disclosure in control messages and SCTP</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_7</lt></range>
<range><ge>9.2</ge><lt>9.2_10</lt></range>
<range><ge>9.1</ge><lt>9.1_17</lt></range>
<range><ge>8.4</ge><lt>8.4_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Buffer between control message header and data may not
be completely initialized before being copied to userland.
[CVE-2014-3952]</p>
<p>Three SCTP cmsgs, SCTP_SNDRCV, SCTP_EXTRCV and SCTP_RCVINFO,
have implicit padding that may not be completely initialized
before being copied to userland. In addition, three SCTP
notifications, SCTP_PEER_ADDR_CHANGE, SCTP_REMOTE_ERROR and
SCTP_AUTHENTICATION_EVENT, have padding in the returning
data structure that may not be completely initialized before
being copied to userland. [CVE-2014-3953]</p>
<h1>Impact:</h1>
<p>An unprivileged local process may be able to retrieve
portion of kernel memory.</p>
<p>For the generic control message, the process may be able
to retrieve a maximum of 4 bytes of kernel memory.</p>
<p>For SCTP, the process may be able to retrieve 2 bytes
of kernel memory for all three control messages, plus 92
bytes for SCTP_SNDRCV and 76 bytes for SCTP_EXTRCV. If the
local process is permitted to receive SCTP notification, a
maximum of 112 bytes of kernel memory may be returned to
userland.</p>
<p>This information might be directly useful, or it might
be leveraged to obtain elevated privileges in some way. For
example, a terminal buffer might include a user-entered
password.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3952</cvename>
<cvename>CVE-2014-3953</cvename>
<freebsdsa>SA-14:17.kmem</freebsdsa>
</references>
<dates>
<discovery>2014-07-08</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="70140f20-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Multiple vulnerabilities in file(1) and libmagic(3)</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_6</lt></range>
<range><ge>9.2</ge><lt>9.2_9</lt></range>
<range><ge>9.1</ge><lt>9.1_16</lt></range>
<range><ge>8.4</ge><lt>8.4_13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A specifically crafted Composite Document File (CDF)
file can trigger an out-of-bounds read or an invalid pointer
dereference. [CVE-2012-1571]</p>
<p>A flaw in regular expression in the awk script detector
makes use of multiple wildcards with unlimited repetitions.
[CVE-2013-7345]</p>
<p>A malicious input file could trigger infinite recursion
in libmagic(3). [CVE-2014-1943]</p>
<p>A specifically crafted Portable Executable (PE) can
trigger out-of-bounds read. [CVE-2014-2270]</p>
<h1>Impact:</h1>
<p>An attacker who can cause file(1) or any other applications
using the libmagic(3) library to be run on a maliciously
constructed input can the application to crash or consume
excessive CPU resources, resulting in a denial-of-service.</p>
</body>
</description>
<references>
<cvename>CVE-2012-1571</cvename>
<cvename>CVE-2013-7345</cvename>
<cvename>CVE-2014-1943</cvename>
<cvename>CVE-2014-2270</cvename>
<freebsdsa>SA-14:16.file</freebsdsa>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6f91a709-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- iconv(3) NULL pointer dereference and out-of-bounds array access</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>A NULL pointer dereference in the initialization code
of the HZ module and an out of bounds array access in the
initialization code of the VIQR module make iconv_open(3)
calls involving HZ or VIQR result in an application crash.</p>
<h1>Impact:</h1>
<p>Services where an attacker can control the arguments of
an iconv_open(3) call can be caused to crash resulting in
a denial-of-service. For example, an email encoded in HZ
may cause an email delivery service to crash if it converts
emails to a more generic encoding like UTF-8 before applying
filtering rules.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3951</cvename>
<freebsdsa>SA-14:15.iconv</freebsdsa>
</references>
<dates>
<discovery>2014-06-24</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6e8f9003-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect error handling in PAM policy parser</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>10.0</ge><lt>10.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The OpenPAM library searches for policy definitions in
several locations. While doing so, the absence of a policy
file is a soft failure (handled by searching in the next
location) while the presence of an invalid file is a hard
failure (handled by returning an error to the caller).</p>
<p>The policy parser returns the same error code (ENOENT)
when a syntactically valid policy references a non-existent
module as when the requested policy file does not exist.
The search loop regards this as a soft failure and looks
for the next similarly-named policy, without discarding the
partially-loaded configuration.</p>
<p>A similar issue can arise if a policy contains an include
directive that refers to a non-existent policy.</p>
<h1>Impact:</h1>
<p>If a module is removed, or the name of a module is
misspelled in the policy file, the PAM library will proceed
with a partially loaded configuration. Depending on the
exact circumstances, this may result in a fail-open scenario
where users are allowed to log in without a password, or
with an incorrect password.</p>
<p>In particular, if a policy references a module installed
by a package or port, and that package or port is being
reinstalled or upgraded, there is a brief window of time
during which the module is absent and policies that use it
may fail open. This can be especially damaging to Internet-facing
SSH servers, which are regularly subjected to brute-force
scans.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3879</cvename>
<freebsdsa>SA-14:13.pam</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6e04048b-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- ktrace kernel memory disclosure</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>9.1</ge><lt>9.1_14</lt></range>
<range><ge>8.4</ge><lt>8.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>Due to an overlooked merge to -STABLE branches, the size
for page fault kernel trace entries was set incorrectly.</p>
<h1>Impact:</h1>
<p>A user who can enable kernel process tracing could end
up reading the contents of kernel memory.</p>
<p>Such memory might contain sensitive information, such
as portions of the file cache or terminal buffers. This
information might be directly useful, or it might be leveraged
to obtain elevated privileges in some way; for example, a
terminal buffer might include a user-entered password.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3873</cvename>
<freebsdsa>SA-14:12.ktrace</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6d9eadaf-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- sendmail improper close-on-exec flag handling</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_4</lt></range>
<range><ge>9.2</ge><lt>9.2_7</lt></range>
<range><ge>9.1</ge><lt>9.1_14</lt></range>
<range><ge>8.4</ge><lt>8.4_11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>There is a programming error in sendmail(8) that prevented
open file descriptors have close-on-exec properly set.
Consequently a subprocess will be able to access all open
files that the parent process have open.</p>
<h1>Impact:</h1>
<p>A local user who can execute their own program for mail
delivery will be able to interfere with an open SMTP
connection.</p>
</body>
</description>
<references>
<freebsdsa>SA-14:11.sendmail</freebsdsa>
</references>
<dates>
<discovery>2014-06-03</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6d472244-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- TCP reassembly vulnerability</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>8.4</ge><lt>8.4_9</lt></range>
<range><ge>8.3</ge><lt>8.3_16</lt></range>
<range><ge>9.2</ge><lt>9.2_5</lt></range>
<range><ge>9.1</ge><lt>9.1_12</lt></range>
<range><ge>10.0</ge><lt>10.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>FreeBSD may add a reassemble queue entry on the stack
into the segment list when the reassembly queue reaches its
limit. The memory from the stack is undefined after the
function returns. Subsequent iterations of the reassembly
function will attempt to access this entry.</p>
<h1>Impact:</h1>
<p>An attacker who can send a series of specifically crafted
packets with a connection could cause a denial of service
situation by causing the kernel to crash.</p>
<p>Additionally, because the undefined on stack memory may
be overwritten by other kernel threads, while extremely
difficult, it may be possible for an attacker to construct
a carefully crafted attack to obtain portion of kernel
memory via a connected socket. This may result in the
disclosure of sensitive information such as login credentials,
etc. before or even without crashing the system.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3000</cvename>
<freebsdsa>SA-14:08.tcp</freebsdsa>
</references>
<dates>
<discovery>2014-04-30</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6b6ca5b6-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- devfs rules not applied by default for jails</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>10.0</ge><lt>10.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The default devfs rulesets are not loaded on boot, even
when jails are used. Device nodes will be created in the
jail with their normal default access permissions, while
most of them should be hidden and inaccessible.</p>
<h1>Impact:</h1>
<p>Jailed processes can get access to restricted resources
on the host system. For jailed processes running with
superuser privileges this implies access to all devices on
the system. This level of access could lead to information
leakage and privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2014-3001</cvename>
<freebsdsa>SA-14:07.devfs</freebsdsa>
</references>
<dates>
<discovery>2014-04-30</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="6a384960-6007-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Deadlock in the NFS server</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>10.0</ge><lt>10.0_1</lt></range>
<range><ge>9.2</ge><lt>9.2_4</lt></range>
<range><ge>9.1</ge><lt>9.1_11</lt></range>
<range><ge>8.4</ge><lt>8.4_8</lt></range>
<range><ge>8.3</ge><lt>8.3_15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<h1>Problem Description:</h1>
<p>The kernel holds a lock over the source directory vnode
while trying to convert the target directory file handle
to a vnode, which needs to be returned with the lock held,
too. This order may be in violation of normal lock order,
which in conjunction with other threads that grab locks in
the right order, constitutes a deadlock condition because
no thread can proceed.</p>
<h1>Impact:</h1>
<p>An attacker on a trusted client could cause the NFS
server become deadlocked, resulting in a denial of service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-1453</cvename>
<freebsdsa>SA-14:05.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2014-04-08</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="4c96ecf2-5fd9-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- bsnmpd remote denial of service vulnerability</topic>
<affects>
<package>
<name>FreeBSD</name>
<range><ge>9.2</ge><lt>9.2_3</lt></range>
<range><ge>9.1</ge><lt>9.1_10</lt></range>
<range><ge>8.4</ge><lt>8.4_7</lt></range>
<range><ge>8.3</ge><lt>8.3_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The bsnmpd(8) daemon is prone to a stack-based
buffer-overflow when it has received a specifically crafted
GETBULK PDU request.</p>
<p>Impact:</p>
<p>This issue could be exploited to execute arbitrary code in
the context of the service daemon, or crash the service daemon, causing
a denial-of-service.</p>
</body>
</description>
<references>
<cvename>CVE-2014-1452</cvename>
<freebsdsa>SA-14:01.bsnmpd</freebsdsa>
</references>
<dates>
<discovery>2014-01-14</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="ca16fd0b-5fd1-11e6-a6f2-6cc21735f730">
<topic>PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities</topic>
<affects>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.23</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.18</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.9</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1688/">
<p>
Security Fixes nested CASE expressions +
database and role names with embedded special characters
</p>
<ul>
<li>CVE-2016-5423: certain nested CASE expressions can cause the
server to crash.
</li>
<li>CVE-2016-5424: database and role names with embedded special
characters can allow code injection during administrative operations
like pg_dumpall.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5423</cvename>
<cvename>CVE-2016-5424</cvename>
</references>
<dates>
<discovery>2016-08-11</discovery>
<entry>2016-08-11</entry>
</dates>
</vuln>
<vuln vid="28bf62ef-5e2c-11e6-a15f-00248c0c745d">
<topic>piwik -- XSS vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.16.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik reports:</p>
<blockquote cite="https://piwik.org/changelog/piwik-2-16-2/">
<p>We have identified and fixed several XSS security issues in this release.</p>
</blockquote>
</body>
</description>
<references>
<url>We have identified and fixed several XSS security issues in this release.</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="7d08e608-5e95-11e6-b334-002590263bf5">
<topic>BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers</topic>
<affects>
<package>
<name>bind99</name>
<range><le>9.9.9P2</le></range>
</package>
<package>
<name>bind910</name>
<range><le>9.10.4P2</le></range>
</package>
<package>
<name>bind911</name>
<range><le>9.11.0.b2</le></range>
</package>
<package>
<name>bind9-devel</name>
<range><le>9.12.0.a.2016.11.02</le></range>
</package>
<package>
<name>knot</name>
<name>knot1</name>
<range><lt>1.6.8</lt></range>
</package>
<package>
<name>knot2</name>
<range><lt>2.3.0</lt></range>
</package>
<package>
<name>nsd</name>
<range><lt>4.1.11</lt></range>
</package>
<package>
<name>powerdns</name>
<range><lt>4.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01390">
<p>DNS protocols were designed with the assumption that a certain
amount of trust could be presumed between the operators of primary
and secondary servers for a given zone. However, in current
practice some organizations have scenarios which require them to
accept zone data from sources that are not fully trusted (for
example: providers of secondary name service). A party who is
allowed to feed data into a zone (e.g. by AXFR, IXFR, or Dynamic DNS
updates) can overwhelm the server which is accepting data by
intentionally or accidentally exhausting that server's memory.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6170</cvename>
<cvename>CVE-2016-6171</cvename>
<cvename>CVE-2016-6172</cvename>
<cvename>CVE-2016-6173</cvename>
<url>https://kb.isc.org/article/AA-01390</url>
<mlist>http://www.openwall.com/lists/oss-security/2016/07/06/4</mlist>
</references>
<dates>
<discovery>2016-07-06</discovery>
<entry>2016-08-10</entry>
<modified>2017-04-24</modified>
</dates>
</vuln>
<vuln vid="dd48d9b9-5e7e-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Kernel memory disclosure in sctp(4)</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_6</lt></range>
<range><ge>8.4</ge><lt>8.4_3</lt></range>
<range><ge>8.3</ge><lt>8.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>When initializing the SCTP state cookie being sent in INIT-ACK chunks,
a buffer allocated from the kernel stack is not completely initialized.</p>
<p>Impact:</p>
<p>Fragments of kernel memory may be included in SCTP packets and
transmitted over the network. For each SCTP session, there are two
separate instances in which a 4-byte fragment may be transmitted.</p>
<p>This memory might contain sensitive information, such as portions of the
file cache or terminal buffers. This information might be directly
useful, or it might be leveraged to obtain elevated privileges in
some way. For example, a terminal buffer might include a user-entered
password.</p>
</body>
</description>
<references>
<freebsdsa>SA-13:10.sctp</freebsdsa>
<cvename>CVE-2013-5209</cvename>
</references>
<dates>
<discovery>2013-08-22</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="0844632f-5e78-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- integer overflow in IP_MSFILTER</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_6</lt></range>
<range><ge>8.4</ge><lt>8.4_3</lt></range>
<range><ge>8.3</ge><lt>8.3_10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>An integer overflow in computing the size of a temporary
buffer can result in a buffer which is too small for the requested
operation.</p>
<p>Impact:</p>
<p>An unprivileged process can read or write pages of memory
which belong to the kernel. These may lead to exposure of sensitive
information or allow privilege escalation.</p>
</body>
</description>
<references>
<cvename>CVE-2013-3077</cvename>
<freebsdsa>SA-13:09.ip_multicast</freebsdsa>
</references>
<dates>
<discovery>2013-08-22</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="e5d2442d-5e76-11e6-a6c3-14dae9d210b8">
<topic>FreeBSD -- Incorrect privilege validation in the NFS server</topic>
<affects>
<package>
<name>FreeBSD-kernel</name>
<range><ge>9.1</ge><lt>9.1_5</lt></range>
<range><ge>8.3</ge><lt>8.3_9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Problem Description:</p>
<p>The kernel incorrectly uses client supplied credentials
instead of the one configured in exports(5) when filling out the
anonymous credential for a NFS export, when -network or -host
restrictions are used at the same time.</p>
<p>Impact:</p>
<p>The remote client may supply privileged credentials (e.g. the
root user) when accessing a file under the NFS share, which will bypass
the normal access checks.</p>
</body>
</description>
<references>
<cvename>CVE-2013-4851</cvename>
<freebsdsa>SA-13:08.nfsserver</freebsdsa>
</references>
<dates>
<discovery>2013-07-06</discovery>
<entry>2016-08-09</entry>
</dates>
</vuln>
<vuln vid="6da45e38-5b55-11e6-8859-000c292ee6b8">
<topic>collectd -- Network plugin heap overflow</topic>
<affects>
<package>
<name>collectd5</name>
<range><lt>5.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The collectd Project reports:</p>
<blockquote cite="http://collectd.org/news.shtml#news98">
<p>Emilien Gaspar has identified a heap overflow in collectd's
network plugin which can be triggered remotely and is potentially
exploitable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6254</cvename>
<url>http://collectd.org/news.shtml#news98</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-05</entry>
</dates>
</vuln>
<vuln vid="3ddcb42b-5b78-11e6-b334-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><le>2.8.12</le></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.7</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.5</lt></range>
</package>
<package>
<name>moodle31</name>
<range><lt>3.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0019: Glossary search displays entries without
checking user permissions to view them</p></li>
<li><p>MSA-16-0020: Text injection in email headers</p></li>
<li><p>MSA-16-0021: Unenrolled user still receives event monitor
notifications even though they can no longer access course</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5012</cvename>
<cvename>CVE-2016-5013</cvename>
<cvename>CVE-2016-5014</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-07-19</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="7a31e0de-5b6d-11e6-b334-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.9P2</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.4P2</lt></range>
</package>
<package>
<name>bind911</name>
<range><lt>9.11.0.b2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.12.0.a.2016.07.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01393">
<p>A query name which is too long can cause a segmentation fault in
lwresd.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2775</cvename>
<url>https://kb.isc.org/article/AA-01393</url>
</references>
<dates>
<discovery>2016-07-18</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="610101ea-5b6a-11e6-b334-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-41</p>
<p>PacketBB crash. (Bug 12577)</p></li>
<li><p>wnpa-sec-2016-42</p>
<p>WSP infinite loop. (Bug 12594)</p></li>
<li><p>wnpa-sec-2016-44</p>
<p>RLC long loop. (Bug 12660)</p></li>
<li><p>wnpa-sec-2016-45</p>
<p>LDSS dissector crash. (Bug 12662)</p></li>
<li><p>wnpa-sec-2016-46</p>
<p>RLC dissector crash. (Bug 12664)</p></li>
<li><p>wnpa-sec-2016-47</p>
<p>OpenFlow long loop. (Bug 12659)</p></li>
<li><p>wnpa-sec-2016-48</p>
<p>MMSE, WAP, WBXML, and WSP infinite loop. (Bug 12661)</p></li>
<li><p>wnpa-sec-2016-49</p>
<p>WBXML crash. (Bug 12663)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6505</cvename>
<cvename>CVE-2016-6506</cvename>
<cvename>CVE-2016-6508</cvename>
<cvename>CVE-2016-6509</cvename>
<cvename>CVE-2016-6510</cvename>
<cvename>CVE-2016-6511</cvename>
<cvename>CVE-2016-6512</cvename>
<cvename>CVE-2016-6513</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.5.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/08/01/4</url>
</references>
<dates>
<discovery>2016-07-27</discovery>
<entry>2016-08-06</entry>
</dates>
</vuln>
<vuln vid="3e08047f-5a6c-11e6-a6c3-14dae9d210b8">
<topic>p5-XSLoader -- local arbitrary code execution</topic>
<affects>
<package>
<name>p5-XSLoader</name>
<range><lt>0.22</lt></range>
</package>
<package>
<name>perl5</name>
<name>perl5.18</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5.24</name>
<name>perl5-devel</name>
<range><lt>5.18.4_24</lt></range>
<range><ge>5.20</ge><lt>5.20.3_15</lt></range>
<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
<range><ge>5.25</ge><lt>5.25.2.87</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Wilk reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578">
<p>XSLoader tries to load code from a subdirectory in the cwd when
called inside a string eval</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829578</url>
<cvename>CVE-2016-6185</cvename>
</references>
<dates>
<discovery>2016-06-30</discovery>
<entry>2016-08-04</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="72bfbb09-5a6a-11e6-a6c3-14dae9d210b8">
<topic>perl -- local arbitrary code execution</topic>
<affects>
<package>
<name>perl5</name>
<name>perl5.18</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5.24</name>
<name>perl5-devel</name>
<range><lt>5.18.4_23</lt></range>
<range><ge>5.20</ge><lt>5.20.3_14</lt></range>
<range><ge>5.21</ge><lt>5.22.3.r2</lt></range>
<range><ge>5.23</ge><lt>5.24.1.r2</lt></range>
<range><ge>5.25</ge><lt>5.25.3.18</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sawyer X reports:</p>
<blockquote cite="http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html">
<p>Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do
not properly remove . (period) characters from the end of the includes
directory array, which might allow local users to gain privileges via a
Trojan horse module under the current working directory.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html</url>
<cvename>CVE-2016-1238</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-08-04</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="556d2286-5a51-11e6-a6c3-14dae9d210b8">
<topic>gd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gd</name>
<range><lt>2.2.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pierre Joye reports:</p>
<blockquote cite="https://github.com/libgd/libgd/releases/tag/gd-2.2.3">
<ul>
<li><p>fix php bug 72339, Integer Overflow in _gd2GetHeader
(CVE-2016-5766)</p></li>
<li><p>gd: Buffer over-read issue when parsing crafted TGA
file (CVE-2016-6132)</p></li>
<li><p>Integer overflow error within _gdContributionsAlloc()
(CVE-2016-6207)</p></li>
<li><p>fix php bug 72494, invalid color index not handled, can
lead to crash ( CVE-2016-6128)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/libgd/libgd/releases/tag/gd-2.2.3</url>
<cvename>CVE-2016-5766</cvename>
<cvename>CVE-2016-6132</cvename>
<cvename>CVE-2016-6207</cvename>
<cvename>CVE-2016-6128</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-08-04</entry>
</dates>
</vuln>
<vuln vid="e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1">
<topic>Vulnerabilities in Curl</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.32.0</ge><lt>7.50.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Curl security team reports:</p>
<blockquote cite="https://curl.haxx.se/docs/security.html">
<p>CVE-2016-5419 - TLS session resumption client cert bypass</p>
<p>CVE-2016-5420 - Re-using connections with wrong client cert</p>
<p>CVE-2016-5421 - use of connection struct after free</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5419</cvename>
<cvename>CVE-2016-5420</cvename>
<cvename>CVE-2016-5421</cvename>
<url>https://curl.haxx.se/docs/adv_20160803A.html</url>
<url>https://curl.haxx.se/docs/adv_20160803B.html</url>
<url>https://curl.haxx.se/docs/adv_20160803C.html</url>
</references>
<dates>
<discovery>2016-08-03</discovery>
<entry>2016-08-04</entry>
</dates>
</vuln>
<vuln vid="ef0033ad-5823-11e6-80cc-001517f335e2">
<topic>lighttpd - multiple vulnerabilities</topic>
<affects>
<package>
<name>lighttpd</name>
<range><lt>1.4.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Lighttpd Project reports:</p>
<blockquote cite="http://www.lighttpd.net/2016/7/31/1.4.41/">
<p>Security fixes for Lighttpd:</p>
<ul>
<li><p>security: encode quoting chars in HTML and XML</p></li>
<li><p>security: ensure gid != 0 if server.username is set, but not server.groupname</p></li>
<li><p>security: disable stat_cache if server.follow-symlink = “disable”</p></li>
<li><p>security: httpoxy defense: do not emit HTTP_PROXY to CGI env</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.lighttpd.net/2016/7/31/1.4.41/</url>
<freebsdpr>ports/211495</freebsdpr>
</references>
<dates>
<discovery>2016-07-31</discovery>
<entry>2016-08-03</entry>
</dates>
</vuln>
<vuln vid="06574c62-5854-11e6-b334-002590263bf5">
<topic>xen-tools -- virtio: unbounded memory allocation issue</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-184.html">
<p>A guest can submit virtio requests without bothering to wait for
completion and is therefore not bound by virtqueue size...</p>
<p>A malicious guest administrator can cause unbounded memory
allocation in QEMU, which can cause an Out-of-Memory condition
in the domain running qemu. Thus, a malicious guest administrator
can cause a denial of service affecting the whole host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5403</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-184.html</url>
</references>
<dates>
<discovery>2016-07-27</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="04cf89e3-5854-11e6-b334-002590263bf5">
<topic>xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><gt>4.5</gt><lt>4.7.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-183.html">
<p>Supervisor Mode Access Prevention is a hardware feature designed
to make an Operating System more robust, by raising a pagefault
rather than accidentally following a pointer into userspace.
However, legitimate accesses into userspace require whitelisting,
and the exception delivery mechanism for 32bit PV guests wasn't
whitelisted.</p>
<p>A malicious 32-bit PV guest kernel can trigger a safety check,
crashing the hypervisor and causing a denial of service to other
VMs on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6259</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-183.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="032aa524-5854-11e6-b334-002590263bf5">
<topic>xen-kernel -- x86: Privilege escalation in PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.0_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-182.html">
<p>The PV pagetable code has fast-paths for making updates to
pre-existing pagetable entries, to skip expensive re-validation
in safe cases (e.g. clearing only Access/Dirty bits). The bits
considered safe were too broad, and not actually safe.</p>
<p>A malicious PV guest administrator can escalate their privilege to
that of the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6258</cvename>
<freebsdpr>ports/211482</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-182.html</url>
</references>
<dates>
<discovery>2016-07-26</discovery>
<entry>2016-08-02</entry>
</dates>
</vuln>
<vuln vid="cb5189eb-572f-11e6-b334-002590263bf5">
<topic>libidn -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libidn</name>
<range><lt>1.33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon Josefsson reports:</p>
<blockquote cite="https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html">
<p>libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.</p>
<p>idn: Solve out-of-bounds-read when reading one zero byte as input.
Also replaced fgets with getline.</p>
<p>libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was
always documented to only accept UTF-8 data, but now it doesn't
crash when presented with such data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6261</cvename>
<cvename>CVE-2015-8948</cvename>
<cvename>CVE-2016-6262</cvename>
<cvename>CVE-2016-6263</cvename>
<url>https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/07/21/4</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-31</entry>
</dates>
</vuln>
<vuln vid="6fb8a90f-c9d5-4d14-b940-aed3d63c2edc">
<topic>The GIMP -- Use after Free vulnerability</topic>
<affects>
<package>
<name>gimp-app</name>
<range><lt>2.8.18,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The GIMP team reports:</p>
<blockquote cite="https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html">
<p>A Use-after-free vulnerability was found in the xcf_load_image function.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/gimp-developer-list/2016-July/msg00020.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=767873</url>
<cvename>CVE-2016-4994</cvename>
</references>
<dates>
<discovery>2016-06-20</discovery>
<entry>2016-07-19</entry>
</dates>
</vuln>
<vuln vid="cb09a7aa-5344-11e6-a7bd-14dae9d210b8">
<topic>xercesi-c3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xerces-c3</name>
<range><lt>3.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache reports:</p>
<blockquote cite="https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt">
<p>The Xerces-C XML parser fails to successfully parse a
DTD that is deeply nested, and this causes a stack overflow, which
makes a denial of service attack against many applications possible
by an unauthenticated attacker.</p>
<p>Also, CVE-2016-2099: Use-after-free vulnerability in
validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier
allows context-dependent attackers to have unspecified impact via an
invalid character in an XML document.</p>
</blockquote>
</body>
</description>
<references>
<url>https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/09/7</url>
<cvename>CVE-2016-2099</cvename>
<cvename>CVE-2016-4463</cvename>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-07-26</entry>
</dates>
</vuln>
<vuln vid="b6402385-533b-11e6-a7bd-14dae9d210b8">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php70-curl</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-bz2</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-bz2</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-bz2</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-exif</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-exif</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-exif</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-gd</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-gd</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-gd</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php70-mcrypt</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-odbc</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-odbc</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-odbc</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-snmp</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-snmp</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-snmp</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-xmlrpc</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-xmlrpc</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-xmlrpc</name>
<range><lt>7.0.9</lt></range>
</package>
<package>
<name>php55-zip</name>
<range><lt>5.5.38</lt></range>
</package>
<package>
<name>php56-zip</name>
<range><lt>5.6.24</lt></range>
</package>
<package>
<name>php70-zip</name>
<range><lt>7.0.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.38">
<ul>
<li><p>Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)</p></li>
<li><p>Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).</p></li>
<li><p>Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).</p></li>
<li><p>Fixed bug #72519 (imagegif/output out-of-bounds access).</p></li>
<li><p>Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).</p></li>
<li><p>Fixed bug #72533 (locale_accept_from_http out-of-bounds access).</p></li>
<li><p>Fixed bug #72541 (size_t overflow lead to heap corruption).</p></li>
<li><p>Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).</p></li>
<li><p>Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).</p></li>
<li><p>Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).</p></li>
<li><p>Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).</p></li>
<li><p>Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).</p></li>
<li><p>Fixed bug #72613 (Inadequate error handling in bzread()).</p></li>
<li><p>Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/ChangeLog-5.php#5.5.38</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.24</url>
<url>http://www.php.net/ChangeLog-7.php#7.0.8</url>
<url>http://seclists.org/oss-sec/2016/q3/121</url>
<cvename>CVE-2015-8879</cvename>
<cvename>CVE-2016-5385</cvename>
<cvename>CVE-2016-5399</cvename>
<cvename>CVE-2016-6288</cvename>
<cvename>CVE-2016-6289</cvename>
<cvename>CVE-2016-6290</cvename>
<cvename>CVE-2016-6291</cvename>
<cvename>CVE-2016-6292</cvename>
<cvename>CVE-2016-6294</cvename>
<cvename>CVE-2016-6295</cvename>
<cvename>CVE-2016-6296</cvename>
<cvename>CVE-2016-6297</cvename>
</references>
<dates>
<discovery>2016-07-21</discovery>
<entry>2016-07-26</entry>
</dates>
</vuln>
<vuln vid="6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>52.0.2743.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html">
<p>48 security fixes in this release, including:</p>
<ul>
<li>[610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to
Pinkie Pie xisigr of Tencent's Xuanwu Lab</li>
<li>[613949] High CVE-2016-1708: Use-after-free in Extensions.
Credit to Adam Varsan</li>
<li>[614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly.
Credit to ChenQin of Topsec Security Team</li>
<li>[616907] High CVE-2016-1710: Same-origin bypass in Blink.
Credit to Mariusz Mlynski</li>
<li>[617495] High CVE-2016-1711: Same-origin bypass in Blink.
Credit to Mariusz Mlynski</li>
<li>[618237] High CVE-2016-5127: Use-after-free in Blink. Credit
to cloudfuzzer</li>
<li>[619166] High CVE-2016-5128: Same-origin bypass in V8. Credit
to Anonymous</li>
<li>[620553] High CVE-2016-5129: Memory corruption in V8. Credit to
Jeonghoon Shin</li>
<li>[623319] High CVE-2016-5130: URL spoofing. Credit to Wadih
Matar</li>
<li>[623378] High CVE-2016-5131: Use-after-free in libxml. Credit
to Nick Wellnhofer</li>
<li>[607543] Medium CVE-2016-5132: Limited same-origin bypass in
Service Workers. Credit to Ben Kelly</li>
<li>[613626] Medium CVE-2016-5133: Origin confusion in proxy
authentication. Credit to Patch Eudor</li>
<li>[593759] Medium CVE-2016-5134: URL leakage via PAC script.
Credit to Paul Stone</li>
<li>[605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
Credit to kingxwy</li>
<li>[625393] Medium CVE-2016-5136: Use after free in extensions.
Credit to Rob Wu</li>
<li>[625945] Medium CVE-2016-5137: History sniffing with HSTS and
CSP. Credit to Xiaoyin Liu</li>
<li>[629852] CVE-2016-1705: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1705</cvename>
<cvename>CVE-2016-1706</cvename>
<cvename>CVE-2016-1708</cvename>
<cvename>CVE-2016-1709</cvename>
<cvename>CVE-2016-1710</cvename>
<cvename>CVE-2016-1711</cvename>
<cvename>CVE-2016-5127</cvename>
<cvename>CVE-2016-5128</cvename>
<cvename>CVE-2016-5129</cvename>
<cvename>CVE-2016-5130</cvename>
<cvename>CVE-2016-5131</cvename>
<cvename>CVE-2016-5132</cvename>
<cvename>CVE-2016-5133</cvename>
<cvename>CVE-2016-5134</cvename>
<cvename>CVE-2016-5135</cvename>
<cvename>CVE-2016-5136</cvename>
<cvename>CVE-2016-5137</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-22</entry>
</dates>
</vuln>
<vuln vid="62d45229-4fa0-11e6-9d13-206a8a720317">
<topic>krb5 -- KDC denial of service vulnerability</topic>
<affects>
<package>
<name>krb5-113</name>
<range><lt>1.13.6</lt></range>
</package>
<package>
<name>krb5-114</name>
<range><lt>1.14.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Major changes in krb5 1.14.3 and krb5 1.13.6:</p>
<blockquote cite="http://web.mit.edu/kerberos/krb5-1.14/">
<p>Fix a rare KDC denial of service vulnerability when anonymous
client principals are restricted to obtaining TGTs only
[CVE-2016-3120] .</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3120</cvename>
<url>http://web.mit.edu/kerberos/krb5-1.14/</url>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-21</entry>
<modified>2016-07-26</modified>
</dates>
</vuln>
<vuln vid="72f71e26-4f69-11e6-ac37-ac9e174be3af">
<topic>Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations)</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.2_8</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1753426,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2016-1513.html">
<p>An OpenDocument Presentation .ODP or Presentation Template
.OTP file can contain invalid presentation elements that lead
to memory corruption when the document is loaded in Apache
OpenOffice Impress. The defect may cause the document to appear
as corrupted and OpenOffice may crash in a recovery-stuck mode
requiring manual intervention. A crafted exploitation of the
defect can allow an attacker to cause denial of service
(memory corruption and application crash) and possible
execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1513</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
</references>
<dates>
<discovery>2016-07-17</discovery>
<entry>2016-07-21</entry>
</dates>
</vuln>
<vuln vid="ca5cb202-4f51-11e6-b2ec-b499baebfeaf">
<topic>MySQL -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>mariadb100-server</name>
<range><le>10.0.25</le></range>
</package>
<package>
<name>mariadb101-server</name>
<range><le>10.1.14</le></range>
</package>
<package>
<name>mysql55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.12_1</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><le>5.5.49</le></range>
</package>
<package>
<name>percona56-server</name>
<range><le>5.6.30</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL">
<p>The quarterly Critical Patch Update contains 22 new security fixes for
Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html#AppendixMSQL</url>
<cvename>CVE-2016-3477</cvename>
<cvename>CVE-2016-3440</cvename>
<cvename>CVE-2016-2105</cvename>
<cvename>CVE-2016-3471</cvename>
<cvename>CVE-2016-3486</cvename>
<cvename>CVE-2016-3501</cvename>
<cvename>CVE-2016-3518</cvename>
<cvename>CVE-2016-3521</cvename>
<cvename>CVE-2016-3588</cvename>
<cvename>CVE-2016-3615</cvename>
<cvename>CVE-2016-3614</cvename>
<cvename>CVE-2016-5436</cvename>
<cvename>CVE-2016-3459</cvename>
<cvename>CVE-2016-5437</cvename>
<cvename>CVE-2016-3424</cvename>
<cvename>CVE-2016-5439</cvename>
<cvename>CVE-2016-5440</cvename>
<cvename>CVE-2016-5441</cvename>
<cvename>CVE-2016-5442</cvename>
<cvename>CVE-2016-5443</cvename>
<cvename>CVE-2016-5444</cvename>
<cvename>CVE-2016-3452</cvename>
</references>
<dates>
<discovery>2016-07-20</discovery>
<entry>2016-07-21</entry>
<modified>2016-08-08</modified>
</dates>
</vuln>
<vuln vid="3caf4e6c-4cef-11e6-a15f-00248c0c745d">
<topic>typo3 -- Missing access check in Extbase</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>7.6.8</lt></range>
</package>
<package>
<name>typo3-lts</name>
<range><lt>6.2.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 reports:</p>
<blockquote cite="https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/">
<p>Extbase request handling fails to implement a proper access check for
requested controller/ action combinations, which makes it possible for an
attacker to execute arbitrary Extbase actions by crafting a special request. To
successfully exploit this vulnerability, an attacker must have access to at
least one Extbase plugin or module action in a TYPO3 installation. The missing
access check inevitably leads to information disclosure or remote code
execution, depending on the action that an attacker is able to execute.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5091</cvename>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/</url>
<url>https://wiki.typo3.org/TYPO3_CMS_7.6.8</url>
<url>https://wiki.typo3.org/TYPO3_CMS_6.2.24</url>
</references>
<dates>
<discovery>2016-05-24</discovery>
<entry>2016-07-18</entry>
</dates>
</vuln>
<vuln vid="cf0b5668-4d1b-11e6-b2ec-b499baebfeaf">
<cancelled/>
</vuln>
<vuln vid="00cb1469-4afc-11e6-97ea-002590263bf5">
<topic>atutor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atutor</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ATutor reports:</p>
<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2">
<p>Security Fixes: Added a new layer of security over all php
superglobals, fixed several XSS, CSRF, and SQL injection
vulnerabilities.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_2</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="ffa8ca79-4afb-11e6-97ea-002590263bf5">
<topic>atutor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>atutor</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ATutor reports:</p>
<blockquote cite="https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1">
<p>Security Fixes: A number of minor XSS vulnerabilities discovered in
the previous version of ATutor have been corrected.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/atutor/ATutor/releases/tag/atutor_2_2_1</url>
</references>
<dates>
<discovery>2016-01-30</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="a522d6ac-4aed-11e6-97ea-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.632</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-25.htmL">
<p>These updates resolve a race condition vulnerability that could
lead to information disclosure (CVE-2016-4247).</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-4223, CVE-2016-4224,
CVE-2016-4225).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222,
CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).</p>
<p>These updates resolve a heap buffer overflow vulnerability that
could lead to code execution (CVE-2016-4249).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179,
CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183,
CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217,
CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221,
CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236,
CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244,
CVE-2016-4245, CVE-2016-4246).</p>
<p>These updates resolve a memory leak vulnerability (CVE-2016-4232).
</p>
<p>These updates resolve stack corruption vulnerabilities that could
lead to code execution (CVE-2016-4176, CVE-2016-4177).</p>
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2016-4178).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4172</cvename>
<cvename>CVE-2016-4173</cvename>
<cvename>CVE-2016-4174</cvename>
<cvename>CVE-2016-4175</cvename>
<cvename>CVE-2016-4176</cvename>
<cvename>CVE-2016-4177</cvename>
<cvename>CVE-2016-4178</cvename>
<cvename>CVE-2016-4179</cvename>
<cvename>CVE-2016-4180</cvename>
<cvename>CVE-2016-4181</cvename>
<cvename>CVE-2016-4182</cvename>
<cvename>CVE-2016-4183</cvename>
<cvename>CVE-2016-4184</cvename>
<cvename>CVE-2016-4185</cvename>
<cvename>CVE-2016-4186</cvename>
<cvename>CVE-2016-4187</cvename>
<cvename>CVE-2016-4188</cvename>
<cvename>CVE-2016-4189</cvename>
<cvename>CVE-2016-4190</cvename>
<cvename>CVE-2016-4217</cvename>
<cvename>CVE-2016-4218</cvename>
<cvename>CVE-2016-4219</cvename>
<cvename>CVE-2016-4220</cvename>
<cvename>CVE-2016-4221</cvename>
<cvename>CVE-2016-4222</cvename>
<cvename>CVE-2016-4223</cvename>
<cvename>CVE-2016-4224</cvename>
<cvename>CVE-2016-4225</cvename>
<cvename>CVE-2016-4226</cvename>
<cvename>CVE-2016-4227</cvename>
<cvename>CVE-2016-4228</cvename>
<cvename>CVE-2016-4229</cvename>
<cvename>CVE-2016-4230</cvename>
<cvename>CVE-2016-4231</cvename>
<cvename>CVE-2016-4232</cvename>
<cvename>CVE-2016-4233</cvename>
<cvename>CVE-2016-4234</cvename>
<cvename>CVE-2016-4235</cvename>
<cvename>CVE-2016-4236</cvename>
<cvename>CVE-2016-4237</cvename>
<cvename>CVE-2016-4238</cvename>
<cvename>CVE-2016-4239</cvename>
<cvename>CVE-2016-4240</cvename>
<cvename>CVE-2016-4241</cvename>
<cvename>CVE-2016-4242</cvename>
<cvename>CVE-2016-4243</cvename>
<cvename>CVE-2016-4244</cvename>
<cvename>CVE-2016-4245</cvename>
<cvename>CVE-2016-4246</cvename>
<cvename>CVE-2016-4247</cvename>
<cvename>CVE-2016-4248</cvename>
<cvename>CVE-2016-4249</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-25.html</url>
</references>
<dates>
<discovery>2016-07-12</discovery>
<entry>2016-07-16</entry>
</dates>
</vuln>
<vuln vid="61b8c359-4aab-11e6-a7bd-14dae9d210b8">
<cancelled superseded="cbceeb49-3bc7-11e6-8e82-002590263bf5"/>
</vuln>
<vuln vid="3159cd70-4aaa-11e6-a7bd-14dae9d210b8">
<topic>libreoffice -- use-after-free vulnerability</topic>
<affects>
<package>
<name>libreoffice</name>
<range><lt>5.1.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0126/">
<p>An exploitable Use After Free vulnerability exists in the
RTF parser LibreOffice. A specially crafted file can cause a use after
free resulting in a possible arbitrary code execution. To exploit the
vulnerability a malicious file needs to be opened by the user via
vulnerable application.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.talosintelligence.com/reports/TALOS-2016-0126/</url>
<url>http://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/</url>
<cvename>CVE-2016-4324</cvename>
</references>
<dates>
<discovery>2016-06-27</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="c17fe91d-4aa6-11e6-a7bd-14dae9d210b8">
<cancelled/>
</vuln>
<vuln vid="0ab66088-4aa5-11e6-a7bd-14dae9d210b8">
<topic>tiff -- buffer overflow</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_2</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mathias Svensson reports:</p>
<blockquote cite="https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2">
<p>potential buffer write overrun in PixarLogDecode() on
corrupted/unexpected images</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2</url>
<cvename>CVE-2016-5314</cvename>
<cvename>CVE-2016-5320</cvename>
<cvename>CVE-2016-5875</cvename>
</references>
<dates>
<discovery>2016-06-28</discovery>
<entry>2016-07-15</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="42ecf370-4aa4-11e6-a7bd-14dae9d210b8">
<cancelled/>
</vuln>
<vuln vid="d706a3a3-4a7c-11e6-97f7-5453ed2e2b49">
<topic>p7zip -- out-of-bounds read vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0094/">
<p>An out-of-bounds read vulnerability exists in the way 7-Zip
handles Universal Disk Format (UDF) files.</p>
<p>Central to 7-Zip’s processing of UDF files is the
CInArchive::ReadFileItem method. Because volumes can have more than
one partition map, their objects are kept in an object vector. To
start looking for an item, this method tries to reference the proper
object using the partition map’s object vector and the "PartitionRef"
field from the Long Allocation Descriptor. Lack of checking whether
the "PartitionRef" field is bigger than the available amount of
partition map objects causes a read out-of-bounds and can lead, in
some circumstances, to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2335</cvename>
<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="a9bcaf57-4a7b-11e6-97f7-5453ed2e2b49">
<topic>p7zip -- heap overflow vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>15.14_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cisco Talos reports:</p>
<blockquote cite="http://www.talosintelligence.com/reports/TALOS-2016-0093/">
<p>An exploitable heap overflow vulnerability exists in the
NArchive::NHfs::CHandler::ExtractZlibFile method functionality of
7zip that can lead to arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2334</cvename>
<url>http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-07-15</entry>
</dates>
</vuln>
<vuln vid="4729c849-4897-11e6-b704-000c292e4fd8">
<topic>samba -- client side SMB2/3 required signing can be downgraded</topic>
<affects>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.14</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.11</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/security/CVE-2016-2119.html">
<p>A man in the middle attack can disable client signing over
SMB2/3, even if enforced by configuration parameters.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2119</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2119.html</url>
</references>
<dates>
<discovery>2016-07-07</discovery>
<entry>2016-07-13</entry>
</dates>
</vuln>
<vuln vid="3fcd52b2-4510-11e6-a15f-00248c0c745d">
<topic>ruby-saml -- XML signature wrapping attack</topic>
<affects>
<package>
<name>rubygem-ruby-saml</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RubySec reports:</p>
<blockquote cite="http://rubysec.com/advisories/CVE-2016-5697/">
<p>ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack
in the specific scenario where there was a signature that referenced at the same
time 2 elements (but past the scheme validator process since 1 of the element was
inside the encrypted assertion).</p>
<p>ruby-saml users must update to 1.3.0, which implements 3 extra validations to
mitigate this kind of attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5697</cvename>
<url>http://rubysec.com/advisories/CVE-2016-5697/</url>
<url>https://github.com/onelogin/ruby-saml/commit/a571f52171e6bfd87db59822d1d9e8c38fb3b995</url>
</references>
<dates>
<discovery>2016-06-24</discovery>
<entry>2016-07-08</entry>
</dates>
</vuln>
<vuln vid="7d64d00c-43e3-11e6-ab34-002590263bf5">
<topic>quassel -- remote denial of service</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4414">
<p>The onReadyRead function in core/coreauthhandler.cpp in Quassel
before 0.12.4 allows remote attackers to cause a denial of service
(NULL pointer dereference and crash) via invalid handshake data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4414</cvename>
<url>http://quassel-irc.org/node/129</url>
<url>https://github.com/quassel/quassel/commit/e678873</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/30/2</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/30/4</url>
</references>
<dates>
<discovery>2016-04-24</discovery>
<entry>2016-07-07</entry>
</dates>
</vuln>
<vuln vid="e9d1e040-42c9-11e6-9608-20cf30e32f6d">
<topic>apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used</topic>
<affects>
<package>
<name>apache24</name>
<range><ge>2.4.18</ge><lt>2.4.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="INSERT URL HERE">
<p>The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509
client certificate correctly when experimental module for the HTTP/2
protocol is used to access a resource.</p>
<p>The net result is that a resource that should require a valid client
certificate in order to get access can be accessed without that credential.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4979</cvename>
<url>http://mail-archives.apache.org/mod_mbox/httpd-announce/201607.mbox/CVE-2016-4979-68283</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-05</entry>
</dates>
</vuln>
<vuln vid="e800cd4b-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unrestricted qemu logging</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-180.html">
<p>When the libxl toolstack launches qemu for HVM guests, it pipes the
output of stderr to a file in /var/log/xen. This output is not
rate-limited in any way. The guest can easily cause qemu to print
messages to stderr, causing this file to become arbitrarily large.
</p>
<p>The disk containing the logfile can be exhausted, possibly causing a
denial-of-service (DoS).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-3672</cvename>
<url>http://xenbits.xen.org/xsa/advisory-180.html</url>
</references>
<dates>
<discovery>2016-05-23</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e6ce6f50-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-179.html">
<p>Qemu VGA module allows banked access to video memory using the
window at 0xa00000 and it supports different access modes with
different address calculations.</p>
<p>Qemu VGA module allows guest to edit certain registers in 'vbe'
and 'vga' modes.</p>
<p>A privileged guest user could use CVE-2016-3710 to exceed the bank
address window and write beyond the said memory area, potentially
leading to arbitrary code execution with privileges of the Qemu
process. If the system is not using stubdomains, this will be in
domain 0.</p>
<p>A privileged guest user could use CVE-2016-3712 to cause potential
integer overflow or OOB read access issues in Qemu, resulting in a DoS
of the guest itself. More dangerous effect, such as data leakage or
code execution, are not known but cannot be ruled out.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3710</cvename>
<cvename>CVE-2016-3712</cvename>
<url>http://xenbits.xen.org/xsa/advisory-179.html</url>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e589ae90-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unsanitised driver domain input in libxl device handling</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-178.html">
<p>libxl's device-handling code freely uses and trusts information
from the backend directories in xenstore.</p>
<p>A malicious driver domain can deny service to management tools.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4963</cvename>
<url>http://xenbits.xen.org/xsa/advisory-178.html</url>
</references>
<dates>
<discovery>2016-06-02</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e43b210a-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-kernel -- x86 software guest page walk PS bit handling flaw</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-176.html">
<p>The Page Size (PS) page table entry bit exists at all page table
levels other than L1. Its meaning is reserved in L4, and
conditionally reserved in L3 and L2 (depending on hardware
capabilities). The software page table walker in the hypervisor,
however, so far ignored that bit in L4 and (on respective hardware)
L3 entries, resulting in pages to be treated as page tables which
the guest OS may not have designated as such. If the page in
question is writable by an unprivileged user, then that user will
be able to map arbitrary guest memory.</p>
<p>On vulnerable OSes, guest user mode code may be able to establish
mappings of arbitrary memory inside the guest, allowing it to
elevate its privileges inside the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4480</cvename>
<url>http://xenbits.xen.org/xsa/advisory-176.html</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="e2fca11b-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-tools -- Unsanitised guest input in libxl device handling code</topic>
<affects>
<package>
<name>xen-tools</name>
<range><lt>4.7.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-175.html">
<p>Various parts of libxl device-handling code inappropriately use
information from (partially) guest controlled areas of xenstore.</p>
<p>A malicious guest administrator can cause denial of service by
resource exhaustion.</p>
<p>A malicious guest administrator can confuse and/or deny service to
management facilities.</p>
<p>A malicious guest administrator of a guest configured with channel
devices may be able to escalate their privilege to that of the
backend domain (i.e., normally, to that of the host).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4962</cvename>
<url>http://xenbits.xen.org/xsa/advisory-175.html</url>
</references>
<dates>
<discovery>2016-06-02</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="d51ced72-4212-11e6-942d-bc5ff45d0f28">
<topic>xen-kernel -- x86 shadow pagetables: address width overflow</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-173.html">
<p>In the x86 shadow pagetable code, the guest frame number of a
superpage mapping is stored in a 32-bit field. If a shadowed guest
can cause a superpage mapping of a guest-physical address at or
above 2^44 to be shadowed, the top bits of the address will be lost,
causing an assertion failure or NULL dereference later on, in code
that removes the shadow.</p>
<p>A HVM guest using shadow pagetables can cause the host to crash.
</p>
<p>A PV guest using shadow pagetables (i.e. being migrated) with PV
superpages enabled (which is not the default) can crash the host, or
corrupt hypervisor memory, and so a privilege escalation cannot be
ruled out.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3960</cvename>
<url>http://xenbits.xen.org/xsa/advisory-173.html</url>
</references>
<dates>
<discovery>2016-04-18</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="313e9557-41e8-11e6-ab34-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-29</p>
<p>The SPOOLS dissector could go into an infinite loop. Discovered
by the CESG.</p></li>
<li><p>wnpa-sec-2016-30</p>
<p>The IEEE 802.11 dissector could crash. (Bug 11585)</p></li>
<li><p>wnpa-sec-2016-31</p>
<p>The IEEE 802.11 dissector could crash. Discovered by Mateusz
Jurczyk. (Bug 12175)</p></li>
<li><p>wnpa-sec-2016-32</p>
<p>The UMTS FP dissector could crash. (Bug 12191)</p></li>
<li><p>wnpa-sec-2016-33</p>
<p>Some USB dissectors could crash. Discovered by Mateusz
Jurczyk. (Bug 12356)</p></li>
<li><p>wnpa-sec-2016-34</p>
<p>The Toshiba file parser could crash. Discovered by iDefense
Labs. (Bug 12394)</p></li>
<li><p>wnpa-sec-2016-35</p>
<p>The CoSine file parser could crash. Discovered by iDefense
Labs. (Bug 12395)</p></li>
<li><p>wnpa-sec-2016-36</p>
<p>The NetScreen file parser could crash. Discovered by iDefense
Labs. (Bug 12396)</p></li>
<li><p>wnpa-sec-2016-37</p>
<p>The Ethernet dissector could crash. (Bug 12440)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5350</cvename>
<cvename>CVE-2016-5351</cvename>
<cvename>CVE-2016-5352</cvename>
<cvename>CVE-2016-5353</cvename>
<cvename>CVE-2016-5354</cvename>
<cvename>CVE-2016-5355</cvename>
<cvename>CVE-2016-5356</cvename>
<cvename>CVE-2016-5357</cvename>
<cvename>CVE-2016-5358</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.4.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/09/4</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-07-04</entry>
</dates>
</vuln>
<vuln vid="8656cf5f-4170-11e6-8dfe-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.12</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.6</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0013: Users are able to change profile fields that
were locked by the administrator.</p></li>
<li><p>MSA-16-0015: Information disclosure of hidden forum names
and sub-names.</p></li>
<li><p>MSA-16-0016: User can view badges of other users without
proper permissions.</p></li>
<li><p>MSA-16-0017: Course idnumber not protected from teacher
restore.</p></li>
<li><p>MSA-16-0018: CSRF in script marking forum posts as read.</p>
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3729</cvename>
<cvename>CVE-2016-3731</cvename>
<cvename>CVE-2016-3732</cvename>
<cvename>CVE-2016-3733</cvename>
<cvename>CVE-2016-3734</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-05-18</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="ad9b77f6-4163-11e6-b05b-14dae9d210b8">
<topic>icingaweb2 -- remote code execution</topic>
<affects>
<package>
<name>icingaweb2</name>
<range><lt>2.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Eric Lippmann reports:</p>
<blockquote cite="https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/">
<p>Possibility of remote code execution via the remote command
transport.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.icinga.org/2016/06/23/icinga-web-2-v2-3-4-v2-2-2-and-v2-1-4-releases/</url>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="a5c204b5-4153-11e6-8dfe-002590263bf5">
<topic>hive -- authorization logic vulnerability</topic>
<affects>
<package>
<name>hive</name>
<range><lt>2.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sushanth Sowmyan reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E">
<p>Some partition-level operations exist that do not explicitly also
authorize privileges of the parent table. This can lead to issues when
the parent table would have denied the operation, but no denial occurs
because the partition-level privilege is not checked by the
authorization framework, which defines authorization entities only
from the table level upwards.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7521</cvename>
<url>http://mail-archives.apache.org/mod_mbox/hive-user/201601.mbox/%3C20160128205008.2154F185EB%40minotaur.apache.org%3E</url>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="546deeea-3fc6-11e6-a671-60a44ce6887b">
<topic>SQLite3 -- Tempdir Selection Vulnerability</topic>
<affects>
<package>
<name>sqlite3</name>
<range><lt>3.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>KoreLogic security reports:</p>
<blockquote cite="https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt">
<p>Affected versions of SQLite reject potential tempdir locations if
they are not readable, falling back to '.'. Thus, SQLite will favor
e.g. using cwd for tempfiles on such a system, even if cwd is an
unsafe location. Notably, SQLite also checks the permissions of
'.', but ignores the results of that check.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6153</cvename>
<freebsdpr>ports/209827</freebsdpr>
<url>https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt</url>
<url>http://openwall.com/lists/oss-security/2016/07/01/2</url>
<url>http://www.sqlite.org/cgi/src/info/67985761aa93fb61</url>
<url>http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3</url>
<url>http://www.sqlite.org/cgi/src/info/614bb709d34e1148</url>
</references>
<dates>
<discovery>2016-07-01</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="8d5368ef-40fe-11e6-b2ec-b499baebfeaf">
<topic>Python -- smtplib StartTLS stripping vulnerability</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.12</lt></range>
</package>
<package>
<name>python33</name>
<range><gt>0</gt></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.5</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Red Hat reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772">
<p>A vulnerability in smtplib allowing MITM attacker to perform a
startTLS stripping attack. smtplib does not seem to raise an exception
when the remote end (smtp server) is capable of negotiating starttls but
fails to respond with 220 (ok) to an explicit call of SMTP.starttls().
This may allow a malicious MITM to perform a startTLS stripping attack
if the client code does not explicitly check the response code for startTLS.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0772</url>
<cvename>CVE-2016-0772</cvename>
</references>
<dates>
<discovery>2016-06-14</discovery>
<entry>2016-07-03</entry>
</dates>
</vuln>
<vuln vid="e7028e1d-3f9b-11e6-81f9-6805ca0b3d42">
<topic>phpMyAdmin -- multiple vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-17/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-18/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-19/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-20/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-21/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-22/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-23/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-24/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-25/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-26/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-27/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-28/</url>
<cvename>CVE-2016-5701</cvename>
<cvename>CVE-2016-5702</cvename>
<cvename>CVE-2016-5703</cvename>
<cvename>CVE-2016-5704</cvename>
<cvename>CVE-2016-5705</cvename>
<cvename>CVE-2016-5706</cvename>
<cvename>CVE-2016-5730</cvename>
<cvename>CVE-2016-5731</cvename>
<cvename>CVE-2016-5732</cvename>
<cvename>CVE-2016-5733</cvename>
<cvename>CVE-2016-5734</cvename>
<cvename>CVE-2016-5739</cvename>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-07-01</entry>
</dates>
</vuln>
<vuln vid="f1c219ba-3f14-11e6-b3c8-14dae9d210b8">
<topic>haproxy -- denial of service</topic>
<affects>
<package>
<name>haproxy</name>
<range><ge>1.6.0</ge><lt>1.6.5_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>HAproxy reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/06/09/5">
<p>HAproxy 1.6.x before 1.6.6, when a deny comes from a
reqdeny rule, allows remote attackers to cause a denial of service
(uninitialized memory access and crash) or possibly have unspecified
other impact via unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/06/09/5</url>
<cvename>CVE-2016-5360</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="093584f2-3f14-11e6-b3c8-14dae9d210b8">
<topic>libtorrent-rasterbar -- denial of service</topic>
<affects>
<package>
<name>libtorrent-rasterbar</name>
<range><lt>1.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Brandon Perry reports:</p>
<blockquote cite="https://github.com/arvidn/libtorrent/issues/780">
<p>The parse_chunk_header function in libtorrent before 1.1.1
allows remote attackers to cause a denial of service (crash) via a
crafted (1) HTTP response or possibly a (2) UPnP broadcast.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/arvidn/libtorrent/issues/780</url>
<cvename>CVE-2016-5301</cvename>
</references>
<dates>
<discovery>2016-06-03</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="ff76f0e0-3f11-11e6-b3c8-14dae9d210b8">
<topic>expat2 -- denial of service</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1344251">
<p>It was found that original patch for issues CVE-2015-1283
and CVE-2015-2716 used overflow checks that could be optimized out by
some compilers applying certain optimization settings, which can cause
the vulnerability to remain even after applying the patch.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1344251</url>
<cvename>CVE-2016-4472</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-30</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="875e4cf8-3f0e-11e6-b3c8-14dae9d210b8">
<topic>dnsmasq -- denial of service</topic>
<affects>
<package>
<name>dnsmasq</name>
<range><lt>2.76,1</lt></range>
</package>
<package>
<name>dnsmasq-devel</name>
<range><lt>2.76.0test1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p> reports:</p>
<blockquote cite="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html">
<p>Dnsmasq before 2.76 allows remote servers to cause a denial
of service (crash) via a reply with an empty DNS address that has an (1)
A or (2) AAAA record defined locally.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/03/7</url>
<cvename>CVE-2015-8899</cvename>
</references>
<dates>
<discovery>2016-04-18</discovery>
<entry>2016-06-30</entry>
<modified>2016-06-30</modified>
</dates>
</vuln>
<vuln vid="a61374fc-3a4d-11e6-a671-60a44ce6887b">
<topic>Python -- HTTP Header Injection in Python urllib</topic>
<affects>
<package>
<name>python27</name>
<range><lt>2.7.10</lt></range>
</package>
<package>
<name>python33</name>
<range><ge>0</ge></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.4</lt></range>
</package>
<package>
<name>python35</name>
<range><lt>3.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guido Vranken reports:</p>
<blockquote cite="https://bugs.python.org/issue22928">
<p>HTTP header injection in urrlib2/urllib/httplib/http.client with
newlines in header values, where newlines have a semantic consequence of
denoting the start of an additional header line.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.python.org/issue22928</url>
<url>http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/14/7</url>
<cvename>CVE-2016-5699</cvename>
</references>
<dates>
<discovery>2014-11-24</discovery>
<entry>2016-06-30</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="0ca24682-3f03-11e6-b3c8-14dae9d210b8">
<topic>openssl -- denial of service</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177">
<p>OpenSSL through 1.0.2h incorrectly uses pointer arithmetic
for heap-buffer boundary checks, which might allow remote attackers to
cause a denial of service (integer overflow and application crash) or
possibly have unspecified other impact by leveraging unexpected malloc
behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.</p>
</blockquote>
</body>
</description>
<references>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177</url>
<url>ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705</url>
<url>https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/</url>
<cvename>CVE-2016-2177</cvename>
</references>
<dates>
<discovery>2016-06-01</discovery>
<entry>2016-06-30</entry>
</dates>
</vuln>
<vuln vid="cbceeb49-3bc7-11e6-8e82-002590263bf5">
<topic>Apache Commons FileUpload -- denial of service (DoS) vulnerability</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.70</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.36</lt></range>
</package>
<package>
<name>apache-struts</name>
<range><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E">
<p>CVE-2016-3092 is a denial of service vulnerability that has been
corrected in the Apache Commons FileUpload component. It occurred
when the length of the multipart boundary was just below the size of
the buffer (4096 bytes) used to read the uploaded file. This caused
the file upload process to take several orders of magnitude longer
than if the boundary length was the typical tens of bytes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3092</cvename>
<freebsdpr>ports/209669</freebsdpr>
<url>http://tomcat.apache.org/security-7.html</url>
<url>http://tomcat.apache.org/security-8.html</url>
<url>http://mail-archives.apache.org/mod_mbox/tomcat-announce/201606.mbox/%3C6223ece6-2b41-ef4f-22f9-d3481e492832%40apache.org%3E</url>
<url>http://jvn.jp/en/jp/JVN89379547/index.html</url>
</references>
<dates>
<discovery>2016-06-20</discovery>
<entry>2016-06-26</entry>
<modified>2017-08-10</modified>
</dates>
</vuln>
<vuln vid="bfcc23b6-3b27-11e6-8e82-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.5.3,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Silverstein reports:</p>
<blockquote cite="https://wordpress.org/news/2016/06/wordpress-4-5-3/">
<p>WordPress 4.5.3 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.5.2 and earlier are affected by several
security issues: redirect bypass in the customizer, reported by
Yassine Aboukir; two different XSS problems via attachment names,
reported by Jouko Pynnönenand Divyesh Prajapati; revision history
information disclosure, reported independently by John Blackbourn
from the WordPress security team and by Dan Moen from the Wordfence
Research Team; oEmbed denial of service reported by Jennifer Dodd
from Automattic; unauthorized category removal from a post, reported
by David Herrera from Alley Interactive; password change via stolen
cookie, reported by Michael Adams from the WordPress security team;
and some less secure sanitize_file_name edge cases reported by Peter
Westwood of the WordPress security team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5832</cvename>
<cvename>CVE-2016-5833</cvename>
<cvename>CVE-2016-5834</cvename>
<cvename>CVE-2016-5835</cvename>
<cvename>CVE-2016-5836</cvename>
<cvename>CVE-2016-5837</cvename>
<cvename>CVE-2016-5838</cvename>
<cvename>CVE-2016-5839</cvename>
<freebsdpr>ports/210480</freebsdpr>
<freebsdpr>ports/210581</freebsdpr>
<url>https://wordpress.org/news/2016/06/wordpress-4-5-3/</url>
<url>http://www.openwall.com/lists/oss-security/2016/06/23/9</url>
</references>
<dates>
<discovery>2016-06-18</discovery>
<entry>2016-06-25</entry>
</dates>
</vuln>
<vuln vid="66d77c58-3b1d-11e6-8e82-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-mbstring</name>
<name>php55-wddx</name>
<name>php55-zip</name>
<range><lt>5.5.37</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<name>php56-mbstring</name>
<name>php56-phar</name>
<name>php56-wddx</name>
<name>php56-zip</name>
<range><lt>5.6.23</lt></range>
</package>
<package>
<name>php70</name>
<name>php70-gd</name>
<name>php70-mbstring</name>
<name>php70-phar</name>
<name>php70-wddx</name>
<name>php70-zip</name>
<range><lt>7.0.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.37">
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8874</cvename>
<cvename>CVE-2016-5766</cvename>
<cvename>CVE-2016-5767</cvename>
<cvename>CVE-2016-5768</cvename>
<cvename>CVE-2016-5769</cvename>
<cvename>CVE-2016-5770</cvename>
<cvename>CVE-2016-5771</cvename>
<cvename>CVE-2016-5772</cvename>
<cvename>CVE-2016-5773</cvename>
<freebsdpr>ports/210491</freebsdpr>
<freebsdpr>ports/210502</freebsdpr>
<url>http://php.net/ChangeLog-5.php#5.5.37</url>
<url>http://php.net/ChangeLog-5.php#5.6.23</url>
<url>http://php.net/ChangeLog-7.php#7.0.8</url>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-06-25</entry>
</dates>
</vuln>
<vuln vid="4a0d9b53-395d-11e6-b3c8-14dae9d210b8">
<topic>libarchive -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Bock and Cisco Talos report:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2016/06/23/6">
<ul>
<li><p>Out of bounds heap read in RAR parser</p></li>
<li><p>Signed integer overflow in ISO parser</p></li>
<li><p>TALOS-2016-0152 [CVE-2016-4300]: 7-Zip
read_SubStreamsInfo Integer Overflow</p></li>
<li><p>TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack
Based Buffer Overflow</p></li>
<li><p>TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel
Heap Overflow</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://openwall.com/lists/oss-security/2016/06/23/6</url>
<url>https://github.com/libarchive/libarchive/issues/521</url>
<url>https://github.com/libarchive/libarchive/issues/717#event-697151157</url>
<url>http://blog.talosintel.com/2016/06/the-poisoned-archives.html</url>
<cvename>CVE-2015-8934</cvename>
<cvename>CVE-2016-4300</cvename>
<cvename>CVE-2016-4301</cvename>
<cvename>CVE-2016-4302</cvename>
</references>
<dates>
<discovery>2016-06-23</discovery>
<entry>2016-06-23</entry>
</dates>
</vuln>
<vuln vid="22775cdd-395a-11e6-b3c8-14dae9d210b8">
<topic>piwik -- XSS vulnerability</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.16.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik reports:</p>
<blockquote cite="http://piwik.org/changelog/piwik-2-16-1/">
<p>The Piwik Security team is grateful for the responsible
disclosures by our security researchers: Egidio Romano (granted a
critical security bounty), James Kettle and Paweł Bartunek (XSS) and
Emanuel Bronshtein (limited XSS).</p>
</blockquote>
</body>
</description>
<references>
<url>http://piwik.org/changelog/piwik-2-16-1/</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-06-23</entry>
</dates>
</vuln>
<vuln vid="6df56c60-3738-11e6-a671-60a44ce6887b">
<topic>wget -- HTTP to FTP redirection file name confusion vulnerability</topic>
<affects>
<package>
<name>wget</name>
<range><lt>1.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Giuseppe Scrivano reports:</p>
<blockquote cite="http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html">
<p>On a server redirect from HTTP to a FTP resource, wget would trust the
HTTP server and uses the name in the redirected URL as the destination
filename.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html</url>
<cvename>CVE-2016-4971</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-21</entry>
</dates>
</vuln>
<vuln vid="1a2aa04f-3718-11e6-b3c8-14dae9d210b8">
<topic>libxslt -- Denial of Service</topic>
<affects>
<package>
<name>libxslt</name>
<range><lt>1.1.29</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2016/Jun/81">
<ul>
<li>[583156] Medium CVE-2016-1683: Out-of-bounds access in libxslt.
Credit to Nicolas Gregoire.</li>
<li>[583171] Medium CVE-2016-1684: Integer overflow in libxslt.
Credit to Nicolas Gregoire.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html</url>
<cvename>CVE-2016-1683</cvename>
<cvename>CVE-2016-1684</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-06-20</entry>
</dates>
</vuln>
<vuln vid="0e3dfdde-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.626</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-18.html">
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-4144, CVE-2016-4149).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-4142, CVE-2016-4143, CVE-2016-4145,
CVE-2016-4146, CVE-2016-4147, CVE-2016-4148).</p>
<p>These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2016-4135, CVE-2016-4136,
CVE-2016-4138).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-4122, CVE-2016-4123, CVE-2016-4124,
CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129,
CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133,
CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150,
CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154,
CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-4140).</p>
<p>These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2016-4139).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4122</cvename>
<cvename>CVE-2016-4123</cvename>
<cvename>CVE-2016-4124</cvename>
<cvename>CVE-2016-4125</cvename>
<cvename>CVE-2016-4127</cvename>
<cvename>CVE-2016-4128</cvename>
<cvename>CVE-2016-4129</cvename>
<cvename>CVE-2016-4130</cvename>
<cvename>CVE-2016-4131</cvename>
<cvename>CVE-2016-4132</cvename>
<cvename>CVE-2016-4133</cvename>
<cvename>CVE-2016-4134</cvename>
<cvename>CVE-2016-4135</cvename>
<cvename>CVE-2016-4136</cvename>
<cvename>CVE-2016-4137</cvename>
<cvename>CVE-2016-4138</cvename>
<cvename>CVE-2016-4139</cvename>
<cvename>CVE-2016-4140</cvename>
<cvename>CVE-2016-4141</cvename>
<cvename>CVE-2016-4142</cvename>
<cvename>CVE-2016-4143</cvename>
<cvename>CVE-2016-4144</cvename>
<cvename>CVE-2016-4145</cvename>
<cvename>CVE-2016-4146</cvename>
<cvename>CVE-2016-4147</cvename>
<cvename>CVE-2016-4148</cvename>
<cvename>CVE-2016-4149</cvename>
<cvename>CVE-2016-4150</cvename>
<cvename>CVE-2016-4151</cvename>
<cvename>CVE-2016-4152</cvename>
<cvename>CVE-2016-4153</cvename>
<cvename>CVE-2016-4154</cvename>
<cvename>CVE-2016-4155</cvename>
<cvename>CVE-2016-4156</cvename>
<cvename>CVE-2016-4166</cvename>
<cvename>CVE-2016-4171</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-18.html</url>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="0c6b008d-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.621</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-15.html">
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-1105, CVE-2016-4117).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107,
CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,
CVE-2016-4110, CVE-2016-4121).</p>
<p>These updates resolve a heap buffer overflow vulnerability that
could lead to code execution (CVE-2016-1101).</p>
<p>These updates resolve a buffer overflow vulnerability that could
lead to code execution (CVE-2016-1103).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099,
CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,
CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,
CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161,
CVE-2016-4162, CVE-2016-4163).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-4116).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1096</cvename>
<cvename>CVE-2016-1097</cvename>
<cvename>CVE-2016-1098</cvename>
<cvename>CVE-2016-1099</cvename>
<cvename>CVE-2016-1100</cvename>
<cvename>CVE-2016-1101</cvename>
<cvename>CVE-2016-1102</cvename>
<cvename>CVE-2016-1103</cvename>
<cvename>CVE-2016-1104</cvename>
<cvename>CVE-2016-1105</cvename>
<cvename>CVE-2016-1106</cvename>
<cvename>CVE-2016-1107</cvename>
<cvename>CVE-2016-1108</cvename>
<cvename>CVE-2016-1109</cvename>
<cvename>CVE-2016-1110</cvename>
<cvename>CVE-2016-4108</cvename>
<cvename>CVE-2016-4109</cvename>
<cvename>CVE-2016-4110</cvename>
<cvename>CVE-2016-4111</cvename>
<cvename>CVE-2016-4112</cvename>
<cvename>CVE-2016-4113</cvename>
<cvename>CVE-2016-4114</cvename>
<cvename>CVE-2016-4115</cvename>
<cvename>CVE-2016-4116</cvename>
<cvename>CVE-2016-4117</cvename>
<cvename>CVE-2016-4120</cvename>
<cvename>CVE-2016-4121</cvename>
<cvename>CVE-2016-4160</cvename>
<cvename>CVE-2016-4161</cvename>
<cvename>CVE-2016-4162</cvename>
<cvename>CVE-2016-4163</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-15.html</url>
</references>
<dates>
<discovery>2016-05-12</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="07888b49-35c4-11e6-8e82-002590263bf5">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<name>linux-f10-flashplugin</name>
<range><lt>11.2r202.616</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-10.html">
<p>These updates harden a mitigation against JIT spraying attacks that
could be used to bypass memory layout randomization mitigations
(CVE-2016-1006).</p>
<p>These updates resolve type confusion vulnerabilities that could
lead to code execution (CVE-2016-1015, CVE-2016-1019).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016,
CVE-2016-1017, CVE-2016-1031).</p>
<p>These updates resolve memory corruption vulnerabilities that could
lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021,
CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025,
CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,
CVE-2016-1032, CVE-2016-1033).</p>
<p>These updates resolve a stack overflow vulnerability that could
lead to code execution (CVE-2016-1018).</p>
<p>These updates resolve a security bypass vulnerability
(CVE-2016-1030).</p>
<p>These updates resolve a vulnerability in the directory search path
used to find resources that could lead to code execution
(CVE-2016-1014).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1006</cvename>
<cvename>CVE-2016-1011</cvename>
<cvename>CVE-2016-1012</cvename>
<cvename>CVE-2016-1013</cvename>
<cvename>CVE-2016-1014</cvename>
<cvename>CVE-2016-1015</cvename>
<cvename>CVE-2016-1016</cvename>
<cvename>CVE-2016-1017</cvename>
<cvename>CVE-2016-1018</cvename>
<cvename>CVE-2016-1019</cvename>
<cvename>CVE-2016-1020</cvename>
<cvename>CVE-2016-1021</cvename>
<cvename>CVE-2016-1022</cvename>
<cvename>CVE-2016-1023</cvename>
<cvename>CVE-2016-1024</cvename>
<cvename>CVE-2016-1025</cvename>
<cvename>CVE-2016-1026</cvename>
<cvename>CVE-2016-1027</cvename>
<cvename>CVE-2016-1028</cvename>
<cvename>CVE-2016-1029</cvename>
<cvename>CVE-2016-1030</cvename>
<cvename>CVE-2016-1031</cvename>
<cvename>CVE-2016-1032</cvename>
<cvename>CVE-2016-1033</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-10.html</url>
</references>
<dates>
<discovery>2016-04-07</discovery>
<entry>2016-06-19</entry>
</dates>
</vuln>
<vuln vid="d59ebed4-34be-11e6-be25-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.103</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html">
<p>3 security fixes in this release, including:</p>
<ul>
<li>[620742] CVE-2016-1704: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1704</cvename>
<url>https://googlechromereleases.blogspot.nl/2016/06/stable-channel-update_16.html</url>
</references>
<dates>
<discovery>2016-06-16</discovery>
<entry>2016-06-17</entry>
</dates>
</vuln>
<vuln vid="1d0f6852-33d8-11e6-a671-60a44ce6887b">
<topic>Python -- Integer overflow in zipimport module</topic>
<affects>
<package>
<name>python35</name>
<range><lt>3.5.1_3</lt></range>
</package>
<package>
<name>python34</name>
<range><lt>3.4.4_3</lt></range>
</package>
<package>
<name>python33</name>
<range><lt>3.3.6_5</lt></range>
</package>
<package>
<name>python27</name>
<range><lt>2.7.11_3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Python reports:</p>
<blockquote cite="http://bugs.python.org/issue26171">
<p>Possible integer overflow and heap corruption in
zipimporter.get_data()</p>
</blockquote>
</body>
</description>
<references>
<url>http://bugs.python.org/issue26171</url>
<cvename>CVE-2016-5636</cvename>
</references>
<dates>
<discovery>2016-01-21</discovery>
<entry>2016-06-17</entry>
</dates>
</vuln>
<vuln vid="7932548e-3427-11e6-8e82-002590263bf5">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.44</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-002">
<ul>
<li><p>Saving user accounts can sometimes grant the user all roles
(User module - Drupal 7 - Moderately Critical)</p></li>
<li><p>Views can allow unauthorized users to see Statistics
information (Views module - Drupal 8 - Less Critical)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-6211</cvename>
<cvename>CVE-2016-6212</cvename>
<url>https://www.drupal.org/SA-CORE-2016-002</url>
<url>http://www.openwall.com/lists/oss-security/2016/07/13/7</url>
</references>
<dates>
<discovery>2016-06-15</discovery>
<entry>2016-06-17</entry>
<modified>2016-07-16</modified>
</dates>
</vuln>
<vuln vid="ac0900df-31d0-11e6-8e82-002590263bf5">
<topic>botan -- multiple vulnerabilities</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jack Lloyd reports:</p>
<blockquote cite="https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html">
<p>Botan 1.10.13 has been released backporting some side channel
protections for ECDSA signatures (CVE-2016-2849) and PKCS #1 RSA
decryption (CVE-2015-7827).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2849</cvename>
<cvename>CVE-2015-7827</cvename>
<url>https://lists.randombit.net/pipermail/botan-devel/2016-April/002101.html</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-06-14</entry>
</dates>
</vuln>
<vuln vid="f771880c-31cf-11e6-8e82-002590263bf5">
<topic>botan -- cryptographic vulnerability</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9742">
<p>The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x
before 1.11.9 improperly uses a single random base, which makes it
easier for remote attackers to defeat cryptographic protection
mechanisms via a DH group.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9742</cvename>
</references>
<dates>
<discovery>2014-04-11</discovery>
<entry>2016-06-14</entry>
</dates>
</vuln>
<vuln vid="6d402857-2fba-11e6-9f31-5404a68ad561">
<topic>VLC -- Possibly remote code execution via crafted file</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.4,4</lt></range>
</package>
<package>
<name>vlc-qt4</name>
<range><lt>2.2.4,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The VLC project reports:</p>
<blockquote cite="https://www.videolan.org/developers/vlc-branch/NEWS">
<p>Fix out-of-bound write in adpcm QT IMA codec (CVE-2016-5108)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5108</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-06-11</entry>
</dates>
</vuln>
<vuln vid="97e86d10-2ea7-11e6-ae88-002590263bf5">
<topic>roundcube -- XSS vulnerability</topic>
<affects>
<package>
<name>roundcube</name>
<range><lt>1.1.5_1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Roundcube reports:</p>
<blockquote cite="https://github.com/roundcube/roundcubemail/wiki/Changelog">
<p>Fix XSS issue in href attribute on area tag (#5240).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5103</cvename>
<freebsdpr>ports/209841</freebsdpr>
<url>https://github.com/roundcube/roundcubemail/issues/5240</url>
<url>http://seclists.org/oss-sec/2016/q2/414</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-06-10</entry>
</dates>
</vuln>
<vuln vid="6f0529e2-2e82-11e6-b2ec-b499baebfeaf">
<topic>OpenSSL -- vulnerability in DSA signing</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_13</lt></range>
</package>
<package>
<name>libressl</name>
<range><lt>2.2.9</lt></range>
<range><ge>2.3.0</ge><lt>2.3.6</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSL team reports:</p>
<blockquote cite="https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2">
<p>Operations in the DSA signing algorithm should run in constant time
in order to avoid side channel attacks. A flaw in the OpenSSL DSA
implementation means that a non-constant time codepath is followed for
certain operations. This has been demonstrated through a cache-timing
attack to be sufficient for an attacker to recover the private DSA key.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2</url>
<cvename>CVE-2016-2178</cvename>
</references>
<dates>
<discovery>2016-06-09</discovery>
<entry>2016-06-09</entry>
<modified>2016-12-20</modified>
</dates>
</vuln>
<vuln vid="c9c252f5-2def-11e6-ae88-002590263bf5">
<topic>expat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastian Pipping reports:</p>
<blockquote cite="https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/">
<p>CVE-2012-6702 -- Resolve troublesome internal call to srand that
was introduced with Expat 2.1.0 when addressing CVE-2012-0876
(issue #496)</p>
<p>CVE-2016-5300 -- Use more entropy for hash initialization than the
original fix to CVE-2012-0876.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-6702</cvename>
<cvename>CVE-2016-5300</cvename>
<freebsdpr>ports/210155</freebsdpr>
<url>https://sourceforge.net/p/expat/code_git/ci/07cc2fcacf81b32b2e06aa918df51756525240c0/</url>
<url>http://www.openwall.com/lists/oss-security/2016/03/18/3</url>
</references>
<dates>
<discovery>2016-03-18</discovery>
<entry>2016-06-09</entry>
<modified>2016-11-06</modified>
</dates>
</vuln>
<vuln vid="d6bbf2d8-2cfc-11e6-800b-080027468580">
<topic>iperf3 -- buffer overflow</topic>
<affects>
<package>
<name>iperf3</name>
<range><ge>3.1</ge><lt>3.1.3</lt></range>
<range><ge>3.0</ge><lt>3.0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ESnet reports:</p>
<blockquote cite="https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc">
<p>A malicious process can connect to an iperf3 server and,
by sending a malformed message on the control channel,
corrupt the server process's heap area. This can lead to a
crash (and a denial of service), or theoretically a remote
code execution as the user running the iperf3 server. A
malicious iperf3 server could potentially mount a similar
attack on an iperf3 client.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4303</cvename>
<url>https://raw.githubusercontent.com/esnet/security/master/cve-2016-4303/esnet-secadv-2016-0001.txt.asc</url>
</references>
<dates>
<discovery>2016-06-08</discovery>
<entry>2016-06-08</entry>
</dates>
</vuln>
<vuln vid="9c196cfd-2ccc-11e6-94b0-0011d823eebd">
<topic>gnutls -- file overwrite by setuid programs</topic>
<affects>
<package>
<name>gnutls</name>
<range><ge>3.4.12</ge><lt>3.4.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>gnutls.org reports:</p>
<blockquote cite="https://gnutls.org/security.html#GNUTLS-SA-2016-1">
<p>Setuid programs using GnuTLS 3.4.12 could potentially allow an
attacker to overwrite and corrupt arbitrary files in the
filesystem.</p>
</blockquote>
</body>
</description>
<references>
<url>https://gnutls.org/security.html#GNUTLS-SA-2016-1</url>
</references>
<dates>
<discovery>2016-06-06</discovery>
<entry>2016-06-07</entry>
</dates>
</vuln>
<vuln vid="32166082-53fa-41fa-b081-207e7a989a0a">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<range><lt>3.23</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<name>linux-c7-nss</name>
<range><lt>3.21.3</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.44</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-61/">
<p>Mozilla has updated the version of Network Security
Services (NSS) library used in Firefox to NSS 3.23. This
addresses four moderate rated networking security issues
reported by Mozilla engineers Tyson Smith and Jed Davis.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2834</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-61/</url>
<url>https://hg.mozilla.org/projects/nss/rev/1ba7cd83c672</url>
<url>https://hg.mozilla.org/projects/nss/rev/8d78a5ae260a</url>
<url>https://hg.mozilla.org/projects/nss/rev/5fde729fdbff</url>
<url>https://hg.mozilla.org/projects/nss/rev/329932eb1700</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-06-07</entry>
<modified>2016-11-23</modified>
</dates>
</vuln>
<vuln vid="8065d37b-8e7c-4707-a608-1b0a2b8509c3">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>47.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.44</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>45.2.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.2.0,2</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>45.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox47">
<p>MFSA 2016-49 Miscellaneous memory safety hazards (rv:47.0 /
rv:45.2)</p>
<p>MFSA 2016-50 Buffer overflow parsing HTML5 fragments</p>
<p>MFSA 2016-51 Use-after-free deleting tables from a
contenteditable document</p>
<p>MFSA 2016-52 Addressbar spoofing though the SELECT element</p>
<p>MFSA 2016-54 Partial same-origin-policy through setting
location.host through data URI</p>
<p>MFSA 2016-56 Use-after-free when textures are used in WebGL
operations after recycle pool destruction</p>
<p>MFSA 2016-57 Incorrect icon displayed on permissions
notifications</p>
<p>MFSA 2016-58 Entering fullscreen and persistent pointerlock
without user permission</p>
<p>MFSA 2016-59 Information disclosure of disabled plugins
through CSS pseudo-classes</p>
<p>MFSA 2016-60 Java applets bypass CSP protections</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2815</cvename>
<cvename>CVE-2016-2818</cvename>
<cvename>CVE-2016-2819</cvename>
<cvename>CVE-2016-2821</cvename>
<cvename>CVE-2016-2822</cvename>
<cvename>CVE-2016-2825</cvename>
<cvename>CVE-2016-2828</cvename>
<cvename>CVE-2016-2829</cvename>
<cvename>CVE-2016-2831</cvename>
<cvename>CVE-2016-2832</cvename>
<cvename>CVE-2016-2833</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-49/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-50/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-51/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-52/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-54/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-56/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-57/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-58/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-59/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-60/</url>
</references>
<dates>
<discovery>2016-06-07</discovery>
<entry>2016-06-07</entry>
</dates>
</vuln>
<vuln vid="c039a761-2c29-11e6-8912-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.79</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html">
<p>15 security fixes in this release, including:</p>
<ul>
<li>601073] High CVE-2016-1696: Cross-origin bypass in Extension
bindings. Credit to anonymous.</li>
<li>[613266] High CVE-2016-1697: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[603725] Medium CVE-2016-1698: Information leak in Extension
bindings. Credit to Rob Wu.</li>
<li>[607939] Medium CVE-2016-1699: Parameter sanitization failure
in DevTools. Credit to Gregory Panakkal.</li>
<li>[608104] Medium CVE-2016-1700: Use-after-free in Extensions.
Credit to Rob Wu.</li>
<li>[608101] Medium CVE-2016-1701: Use-after-free in Autofill.
Credit to Rob Wu.</li>
<li>[609260] Medium CVE-2016-1702: Out-of-bounds read in Skia.
Credit to cloudfuzzer.</li>
<li>[616539] CVE-2016-1703: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1695</cvename>
<cvename>CVE-2016-1696</cvename>
<cvename>CVE-2016-1697</cvename>
<cvename>CVE-2016-1698</cvename>
<cvename>CVE-2016-1699</cvename>
<cvename>CVE-2016-1700</cvename>
<cvename>CVE-2016-1701</cvename>
<cvename>CVE-2016-1702</cvename>
<cvename>CVE-2016-1703</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/06/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-06-01</discovery>
<entry>2016-06-06</entry>
</dates>
</vuln>
<vuln vid="bcbd3fe0-2b46-11e6-ae88-002590263bf5">
<topic>openafs -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt">
<p>Foreign users can bypass access controls to create groups as
system:administrators, including in the user namespace and the
system: namespace.</p>
</blockquote>
<blockquote cite="http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt">
<p>The contents of uninitialized memory are sent on the wire when
clients perform certain RPCs. Depending on the RPC, the information
leaked may come from kernel memory or userspace.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2860</cvename>
<cvename>CVE-2016-4536</cvename>
<freebsdpr>ports/209534</freebsdpr>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt</url>
<url>http://www.openafs.org/pages/security/OPENAFS-SA-2016-002.txt</url>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="2e8fe57e-2b46-11e6-ae88-002590263bf5">
<topic>openafs -- local DoS vulnerability</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16">
<p>Avoid a potential denial of service issue, by fixing a bug in
pioctl logic that allowed a local user to overrun a kernel buffer
with a single NUL byte.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8312</cvename>
<url>https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16</url>
</references>
<dates>
<discovery>2016-03-16</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="0297b260-2b3b-11e6-ae88-002590263bf5">
<topic>ikiwiki -- XSS vulnerability</topic>
<affects>
<package>
<name>ikiwiki</name>
<range><lt>3.20160509</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4561">
<p>Cross-site scripting (XSS) vulnerability in the cgierror function
in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers
to inject arbitrary web script or HTML via unspecified vectors
involving an error message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4561</cvename>
<freebsdpr>ports/209593</freebsdpr>
</references>
<dates>
<discovery>2016-05-04</discovery>
<entry>2016-06-05</entry>
</dates>
</vuln>
<vuln vid="65bb1858-27de-11e6-b714-74d02b9a84d5">
<topic>h2o -- use after free on premature connection close</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Newsha reports:</p>
<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
<p>When H2O tries to disconnect a premature HTTP/2 connection, it
calls free(3) to release memory allocated for the connection and
immediately after then touches the memory. No malloc-related
operation is performed by the same thread between the time it calls
free and the time the memory is touched. Fixed by Frederik
Deweerdt.</p>
</blockquote>
</body>
</description>
<references>
<url>https://h2o.examp1e.net/vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-06-01</entry>
</dates>
</vuln>
<vuln vid="36cf7670-2774-11e6-af29-f0def16c5c1b">
<topic>nginx -- a specially crafted request might result in worker process crash</topic>
<affects>
<package>
<name>nginx</name>
<range><ge>1.4.0</ge><lt>1.8.1_3,2</lt></range>
<range><ge>1.10.0,2</ge><lt>1.10.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><ge>1.3.9</ge><lt>1.9.15_1</lt></range>
<range><ge>1.10.0</ge><lt>1.11.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html">
<p>A problem was identified in nginx code responsible for saving
client request body to a temporary file. A specially crafted
request might result in worker process crash due to a NULL
pointer dereference while writing client request body to a
temporary file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html</url>
<cvename>CVE-2016-4450</cvename>
</references>
<dates>
<discovery>2016-05-31</discovery>
<entry>2016-05-31</entry>
<modified>2016-06-05</modified>
</dates>
</vuln>
<vuln vid="6167b341-250c-11e6-a6fb-003048f2e514">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8h</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8h.php">
<p>Changelog</p>
<ul>
<li>bug:0002667: Cacti SQL Injection Vulnerability</li>
<li>bug:0002673: CVE-2016-3659 - Cacti graph_view.php SQL Injection
Vulnerability</li>
<li>bug:0002656: Authentication using web authentication as a user
not in the cacti database allows complete access (regression)</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3659</cvename>
<url>http://www.cacti.net/release_notes_0_8_8h.php</url>
<url>http://bugs.cacti.net/view.php?id=2673</url>
<url>http://seclists.org/fulldisclosure/2016/Apr/4</url>
<url>http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html</url>
</references>
<dates>
<discovery>2016-04-04</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="b53bbf58-257f-11e6-9f4d-20cf30e32f6d">
<topic>openvswitch -- MPLS buffer overflow</topic>
<affects>
<package>
<name>openvswitch</name>
<range><ge>2.2.0</ge><lt>2.3.3</lt></range>
<range><ge>2.4.0</ge><lt>2.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Open vSwitch reports:</p>
<blockquote cite="http://openvswitch.org/pipermail/announce/2016-March/000082.html">
<p>Multiple versions of Open vSwitch are vulnerable to remote buffer
overflow attacks, in which crafted MPLS packets could overflow the
buffer reserved for MPLS labels in an OVS internal data structure.
The MPLS packets that trigger the vulnerability and the potential for
exploitation vary depending on version:</p>
<p>Open vSwitch 2.1.x and earlier are not vulnerable.</p>
<p>In Open vSwitch 2.2.x and 2.3.x, the MPLS buffer overflow can be
exploited for arbitrary remote code execution.</p>
<p>In Open vSwitch 2.4.x, the MPLS buffer overflow does not obviously lead
to a remote code execution exploit, but testing shows that it can allow a
remote denial of service. See the mitigation section for details.</p>
<p>Open vSwitch 2.5.x is not vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2074</cvename>
<url>http://openvswitch.org/pipermail/announce/2016-March/000082.html</url>
<url>http://openvswitch.org/pipermail/announce/2016-March/000083.html</url>
</references>
<dates>
<discovery>2016-03-28</discovery>
<entry>2016-05-29</entry>
<modified>2016-07-03</modified>
</dates>
</vuln>
<vuln vid="1a6bbb95-24b8-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>51.0.2704.63</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html">
<p>42 security fixes in this release</p>
<p>Please reference CVE/URL list for details</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1672</cvename>
<cvename>CVE-2016-1673</cvename>
<cvename>CVE-2016-1674</cvename>
<cvename>CVE-2016-1675</cvename>
<cvename>CVE-2016-1672</cvename>
<cvename>CVE-2016-1677</cvename>
<cvename>CVE-2016-1678</cvename>
<cvename>CVE-2016-1679</cvename>
<cvename>CVE-2016-1680</cvename>
<cvename>CVE-2016-1681</cvename>
<cvename>CVE-2016-1682</cvename>
<cvename>CVE-2016-1685</cvename>
<cvename>CVE-2016-1686</cvename>
<cvename>CVE-2016-1687</cvename>
<cvename>CVE-2016-1688</cvename>
<cvename>CVE-2016-1689</cvename>
<cvename>CVE-2016-1690</cvename>
<cvename>CVE-2016-1691</cvename>
<cvename>CVE-2016-1692</cvename>
<cvename>CVE-2016-1693</cvename>
<cvename>CVE-2016-1694</cvename>
<cvename>CVE-2016-1695</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update_25.html</url>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-05-28</entry>
<modified>2016-06-20</modified>
</dates>
</vuln>
<vuln vid="4dfafa16-24ba-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.102</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html">
<p>5 security fixes in this release, including:</p>
<ul>
<li>[605766] High CVE-2016-1667: Same origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[605910] High CVE-2016-1668: Same origin bypass in Blink V8
bindings. Credit to Mariusz Mlynski.</li>
<li>[606115] High CVE-2016-1669: Buffer overflow in V8. Credit to
Choongwoo Han.</li>
<li>[578882] Medium CVE-2016-1670: Race condition in loader. Credit
to anonymous.</li>
<li>[586657] Medium CVE-2016-1671: Directory traversal using the
file scheme on Android. Credit to Jann Horn.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1667</cvename>
<cvename>CVE-2016-1668</cvename>
<cvename>CVE-2016-1669</cvename>
<cvename>CVE-2016-1670</cvename>
<cvename>CVE-2016-1671</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/05/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="7da1da96-24bb-11e6-bd31-3065ec8fd3ec">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.94</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html">
<p>9 security fixes in this release, including:</p>
<ul>
<li>[574802] High CVE-2016-1660: Out-of-bounds write in Blink.
Credit to Atte Kettunen of OUSPG.</li>
<li>[601629] High CVE-2016-1661: Memory corruption in cross-process
frames. Credit to Wadih Matar.</li>
<li>[603732] High CVE-2016-1662: Use-after-free in extensions.
Credit to Rob Wu.</li>
<li>[603987] High CVE-2016-1663: Use-after-free in Blink's V8
bindings. Credit to anonymous.</li>
<li>[597322] Medium CVE-2016-1664: Address bar spoofing. Credit to
Wadih Matar.</li>
<li>[606181] Medium CVE-2016-1665: Information leak in V8. Credit
to HyungSeok Han.</li>
<li>[607652] CVE-2016-1666: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1660</cvename>
<cvename>CVE-2016-1661</cvename>
<cvename>CVE-2016-1662</cvename>
<cvename>CVE-2016-1663</cvename>
<cvename>CVE-2016-1664</cvename>
<cvename>CVE-2016-1665</cvename>
<cvename>CVE-2016-1666</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_28.html</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="6b110175-246d-11e6-8dd3-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70-gd</name>
<name>php70-intl</name>
<range><lt>7.0.7</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<range><lt>5.6.22</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-phar</name>
<range><lt>5.5.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.36">
<ul><li>Core:
<ul>
<li>Fixed bug #72114 (Integer underflow / arbitrary null write in
fread/gzread). (CVE-2016-5096) (PHP 5.5/5.6 only)</li>
<li>Fixed bug #72135 (Integer Overflow in php_html_entities).
(CVE-2016-5094) (PHP 5.5/5.6 only)</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #72227 (imagescale out-of-bounds read).
(CVE-2013-7456)</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed bug #72241 (get_icu_value_internal out-of-bounds read).
(CVE-2016-5093)</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71331 (Uninitialized pointer in
phar_make_dirstream()). (CVE-2016-4343) (PHP 5.5 only)</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-5096</cvename>
<cvename>CVE-2016-5094</cvename>
<cvename>CVE-2013-7456</cvename>
<cvename>CVE-2016-5093</cvename>
<cvename>CVE-2016-4343</cvename>
<freebsdpr>ports/209779</freebsdpr>
<url>http://php.net/ChangeLog-7.php#7.0.7</url>
<url>http://php.net/ChangeLog-5.php#5.6.22</url>
<url>http://php.net/ChangeLog-5.php#5.5.36</url>
</references>
<dates>
<discovery>2016-05-26</discovery>
<entry>2016-05-28</entry>
</dates>
</vuln>
<vuln vid="00ec1be1-22bb-11e6-9ead-6805ca0b3d42">
<topic>phpmyadmin -- XSS and sensitive data leakage</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.6.0</ge><lt>4.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpmyadmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-14/">
<h2>Description</h2>
<p>Because user SQL queries are part of the URL, sensitive
information made as part of a user query can be exposed by
clicking on external links to attackers monitoring user GET
query parameters or included in the webserver logs.</p>
<h2>Severity</h2>
<p>We consider this to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-16/">
<h2>Description</h2>
<p>A specially crafted attack could allow for special HTML
characters to be passed as URL encoded values and displayed
back as special characters in the page.</p>
<h2>Severity</h2>
<p>We consider this to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-14/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-16/</url>
<cvename>CVE-2016-5097</cvename>
<cvename>CVE-2016-5099</cvename>
</references>
<dates>
<discovery>2016-05-25</discovery>
<entry>2016-05-25</entry>
<modified>2016-05-26</modified>
</dates>
</vuln>
<vuln vid="b50f53ce-2151-11e6-8dd3-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.14</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><le>1.24.6</le></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.6</lt></range>
</package>
<package>
<name>mediawiki126</name>
<range><lt>1.26.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mediawiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html">
<p>Security fixes:</p>
<p>T122056: Old tokens are remaining valid within a new session</p>
<p>T127114: Login throttle can be tricked using non-canonicalized
usernames</p>
<p>T123653: Cross-domain policy regexp is too narrow</p>
<p>T123071: Incorrectly identifying http link in a's href
attributes, due to m modifier in regex</p>
<p>T129506: MediaWiki:Gadget-popups.js isn't renderable</p>
<p>T125283: Users occasionally logged in as different users after
SessionManager deployment</p>
<p>T103239: Patrol allows click catching and patrolling of any
page</p>
<p>T122807: [tracking] Check php crypto primatives</p>
<p>T98313: Graphs can leak tokens, leading to CSRF</p>
<p>T130947: Diff generation should use PoolCounter</p>
<p>T133507: Careless use of $wgExternalLinkTarget is insecure</p>
<p>T132874: API action=move is not rate limited</p>
</blockquote>
</body>
</description>
<references>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-May/000188.html</url>
</references>
<dates>
<discovery>2016-05-20</discovery>
<entry>2016-05-24</entry>
</dates>
</vuln>
<vuln vid="967b852b-1e28-11e6-8dd3-002590263bf5">
<topic>hostapd and wpa_supplicant -- psk configuration parameter update allowing arbitrary data to be written</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.5_2</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2016-1/psk-parameter-config-update.txt">
<p>psk configuration parameter update allowing arbitrary data to be
written (2016-1 - CVE-2016-4476/CVE-2016-4477).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4476</cvename>
<cvename>CVE-2016-4477</cvename>
<freebsdpr>ports/209564</freebsdpr>
<url>http://w1.fi/security/2016-1/psk-parameter-config-update.txt</url>
</references>
<dates>
<discovery>2016-05-02</discovery>
<entry>2016-05-20</entry>
<modified>2017-03-22</modified>
</dates>
</vuln>
<vuln vid="57b3aba7-1e25-11e6-8dd3-002590263bf5">
<topic>expat -- denial of service vulnerability on malformed input</topic>
<affects>
<package>
<name>expat</name>
<range><lt>2.1.1</lt></range>
</package>
<package>
<name>linux-c6-expat</name>
<range><lt>2.0.1_3</lt></range>
</package>
<package>
<name>linux-c7-expat</name>
<range><lt>2.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/17/12">
<p>The Expat XML parser mishandles certain kinds of malformed input
documents, resulting in buffer overflows during processing and error
reporting. The overflows can manifest as a segmentation fault or as
memory corruption during a parse operation. The bugs allow for a
denial of service attack in many applications by an unauthenticated
attacker, and could conceivably result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0718</cvename>
<freebsdpr>ports/209360</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2016/05/17/12</url>
</references>
<dates>
<discovery>2016-05-17</discovery>
<entry>2016-05-20</entry>
<modified>2016-11-30</modified>
</dates>
</vuln>
<vuln vid="036d6c38-1c5b-11e6-b9e0-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.12</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.4.11/">
<p>A specially crafted bug summary could trigger XSS in dependency graphs.
Due to an incorrect parsing of the image map generated by the dot script,
a specially crafted bug summary could trigger XSS in dependency graphs.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2803</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1253263</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-05-17</entry>
</dates>
</vuln>
<vuln vid="0dc8be9e-19af-11e6-8de0-080027ef73ec">
<topic>OpenVPN -- Buffer overflow in PAM authentication and DoS through port sharing</topic>
<affects>
<package>
<name>openvpn</name>
<range><lt>2.3.11</lt></range>
</package>
<package>
<name>openvpn-polarssl</name>
<range><lt>2.3.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuli Seppänen reports:</p>
<blockquote cite="https://sourceforge.net/p/openvpn/mailman/message/35076507/">
<p>OpenVPN 2.3.11 [...] fixes two vulnerabilities: a port-share bug
with DoS potential and a buffer overflow by user supplied data when
using pam authentication.[...]</p>
</blockquote>
</body>
</description>
<references>
<url>https://sourceforge.net/p/openvpn/mailman/message/35076507/</url>
<url>https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-05-14</entry>
</dates>
</vuln>
<vuln vid="82b702e0-1907-11e6-857b-00221503d280">
<topic>imagemagick -- buffer overflow</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.4.1,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ImageMagick reports:</p>
<blockquote cite="http://legacy.imagemagick.org/script/changelog.php">
<p>Fix a buffer overflow in magick/drag.c/DrawStrokePolygon().</p>
</blockquote>
</body>
</description>
<references>
<url>http://legacy.imagemagick.org/script/changelog.php</url>
</references>
<dates>
<discovery>2016-05-09</discovery>
<entry>2016-05-13</entry>
</dates>
</vuln>
<vuln vid="e387834a-17ef-11e6-9947-7054d2909b71">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>2.2</le></range>
</package>
<package>
<name>jenkins2</name>
<range><le>2.2</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.651.1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11">
<h1>Description</h1>
<h5>SECURITY-170 / CVE-2016-3721</h5>
<p>Arbitrary build parameters are passed to build scripts as environment variables</p>
<h5>SECURITY-243 / CVE-2016-3722</h5>
<p>Malicious users with multiple user accounts can prevent other users from logging in</p>
<h5>SECURITY-250 / CVE-2016-3723</h5>
<p>Information on installed plugins exposed via API</p>
<h5>SECURITY-266 / CVE-2016-3724</h5>
<p>Encrypted secrets (e.g. passwords) were leaked to users with permission to read configuration</p>
<h5>SECURITY-273 / CVE-2016-3725</h5>
<p>Regular users can trigger download of update site metadata</p>
<h5>SECURITY-276 / CVE-2016-3726</h5>
<p>Open redirect to scheme-relative URLs</p>
<h5>SECURITY-281 / CVE-2016-3727</h5>
<p>Granting the permission to read node configurations allows access to overall system configuration</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3721</cvename>
<cvename>CVE-2016-3722</cvename>
<cvename>CVE-2016-3723</cvename>
<cvename>CVE-2016-3724</cvename>
<cvename>CVE-2016-3725</cvename>
<cvename>CVE-2016-3726</cvename>
<cvename>CVE-2016-3727</cvename>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11</url>
</references>
<dates>
<discovery>2016-05-11</discovery>
<entry>2016-05-12</entry>
</dates>
</vuln>
<vuln vid="d9f99491-1656-11e6-94fa-002590263bf5">
<topic>perl5 -- taint mechanism bypass vulnerability</topic>
<affects>
<package>
<name>perl5</name>
<range><lt>5.18.4_21</lt></range>
<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
</package>
<package>
<name>perl5.18</name>
<range><ge>5.18.0</ge><lt>5.18.4_21</lt></range>
</package>
<package>
<name>perl5.20</name>
<range><ge>5.20.0</ge><lt>5.20.3_12</lt></range>
</package>
<package>
<name>perl5.22</name>
<range><ge>5.22.0</ge><lt>5.22.1_8</lt></range>
</package>
<package>
<name>perl</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2381">
<p>Perl might allow context-dependent attackers to bypass the taint
protection mechanism in a child process via duplicate environment
variables in envp.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2381</cvename>
<freebsdpr>ports/208879</freebsdpr>
</references>
<dates>
<discovery>2016-04-08</discovery>
<entry>2016-05-10</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="3686917b-164d-11e6-94fa-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.5.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Helen Hou-Sandi reports:</p>
<blockquote cite="https://wordpress.org/news/2016/05/wordpress-4-5-2/">
<p>WordPress 4.5.2 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.5.1 and earlier are affected by a SOME
vulnerability through Plupload, the third-party library WordPress
uses for uploading files. WordPress versions 4.2 through 4.5.1 are
vulnerable to reflected XSS using specially crafted URIs through
MediaElement.js, the third-party library used for media players.
MediaElement.js and Plupload have also released updates fixing
these issues.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4566</cvename>
<cvename>CVE-2016-4567</cvename>
<url>https://wordpress.org/news/2016/05/wordpress-4-5-2/</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/07/7</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-05-10</entry>
</dates>
</vuln>
<vuln vid="2b4c8e1f-1609-11e6-b55e-b499baebfeaf">
<topic>libarchive -- RCE vulnerability</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.2.0,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The libarchive project reports:</p>
<blockquote cite="https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7">
<p>Heap-based buffer overflow in the zip_read_mac_metadata function
in archive_read_support_format_zip.c in libarchive before 3.2.0
allows remote attackers to execute arbitrary code via crafted
entry-size values in a ZIP archive.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1541</cvename>
<url>https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7</url>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-09</entry>
<modified>2016-05-10</modified>
</dates>
</vuln>
<vuln vid="25e5205b-1447-11e6-9ead-6805ca0b3d42">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.0.0</ge><lt>3.5.18</lt></range>
</package>
<package>
<name>squid-devel</name>
<range><ge>4.0.0</ge><lt>4.0.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The squid development team reports:</p>
<p>Please reference CVE/URL list for details</p>
</body>
</description>
<references>
<cvename>CVE-2016-4553</cvename>
<cvename>CVE-2016-4554</cvename>
<cvename>CVE-2016-4555</cvename>
<cvename>CVE-2016-4556</cvename>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_7.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_8.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_9.txt</url>
</references>
<dates>
<discovery>2016-05-06</discovery>
<entry>2016-05-07</entry>
<modified>2016-05-09</modified>
</dates>
</vuln>
<vuln vid="0d724b05-687f-4527-9c03-af34d3b094ec">
<topic>ImageMagick -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ImageMagick</name>
<name>ImageMagick-nox11</name>
<range><lt>6.9.3.9_1,1</lt></range>
</package>
<package>
<name>ImageMagick7</name>
<name>ImageMagick7-nox11</name>
<range><ge>7.0.0.0.b20150715</ge><lt>7.0.1.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Openwall reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/03/18">
<p>Insufficient filtering for filename passed to delegate's command
allows remote code execution during conversion of several file
formats. Any service which uses ImageMagick to process user
supplied images and uses default delegates.xml / policy.xml,
may be vulnerable to this issue.</p>
<p>It is possible to make ImageMagick perform a HTTP GET or FTP
request</p>
<p>It is possible to delete files by using ImageMagick's 'ephemeral'
pseudo protocol which deletes files after reading.</p>
<p>It is possible to move image files to file with any extension
in any folder by using ImageMagick's 'msl' pseudo protocol.
msl.txt and image.gif should exist in known location - /tmp/
for PoC (in real life it may be web service written in PHP,
which allows to upload raw txt files and process images with
ImageMagick).</p>
<p>It is possible to get content of the files from the server
by using ImageMagick's 'label' pseudo protocol.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3714</cvename>
<cvename>CVE-2016-3715</cvename>
<cvename>CVE-2016-3716</cvename>
<cvename>CVE-2016-3717</cvename>
<cvename>CVE-2016-3718</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/05/03/18</url>
<url>https://imagetragick.com/</url>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2016-05-06</entry>
<modified>2016-05-07</modified>
</dates>
</vuln>
<vuln vid="a6cd01fa-11bd-11e6-bb3c-9cb654ea3e1c">
<topic>jansson -- local denial of service vulnerabilities</topic>
<affects>
<package>
<name>jansson</name>
<range><lt>2.7_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>QuickFuzz reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/05/01/5">
<p>A crash caused by stack exhaustion parsing a JSON was found.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/05/01/5</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/02/1</url>
<cvename>CVE-2016-4425</cvename>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-04</entry>
</dates>
</vuln>
<vuln vid="01d729ca-1143-11e6-b55e-b499baebfeaf">
<topic>OpenSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_11</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_8</lt></range>
</package>
<package>
<name>libressl</name>
<range><ge>2.3.0</ge><lt>2.3.4</lt></range>
<range><lt>2.2.7</lt></range>
</package>
<package>
<name>libressl-devel</name>
<range><lt>2.3.4</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_2</lt></range>
<range><ge>10.2</ge><lt>10.2_16</lt></range>
<range><ge>10.1</ge><lt>10.1_33</lt></range>
<range><ge>9.3</ge><lt>9.3_41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160503.txt">
<p>Memory corruption in the ASN.1 encoder</p>
<p>Padding oracle in AES-NI CBC MAC check</p>
<p>EVP_EncodeUpdate overflow</p>
<p>EVP_EncryptUpdate overflow</p>
<p>ASN.1 BIO excessive memory allocation</p>
<p>EBCDIC overread (OpenSSL only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.openssl.org/news/secadv/20160503.txt</url>
<url>https://marc.info/?l=openbsd-tech&m=146228598730414</url>
<cvename>CVE-2016-2105</cvename>
<cvename>CVE-2016-2106</cvename>
<cvename>CVE-2016-2107</cvename>
<cvename>CVE-2016-2108</cvename>
<cvename>CVE-2016-2109</cvename>
<cvename>CVE-2016-2176</cvename>
<freebsdsa>SA-16:17.openssl</freebsdsa>
</references>
<dates>
<discovery>2016-05-03</discovery>
<entry>2016-05-03</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="95564990-1138-11e6-b55e-b499baebfeaf">
<cancelled superseded="01d729ca-1143-11e6-b55e-b499baebfeaf"/>
</vuln>
<vuln vid="be72e773-1131-11e6-94fa-002590263bf5">
<topic>gitlab -- privilege escalation via "impersonate" feature</topic>
<affects>
<package>
<name>gitlab</name>
<range><ge>8.2.0</ge><lt>8.2.5</lt></range>
<range><ge>8.3.0</ge><lt>8.3.9</lt></range>
<range><ge>8.4.0</ge><lt>8.4.10</lt></range>
<range><ge>8.5.0</ge><lt>8.5.12</lt></range>
<range><ge>8.6.0</ge><lt>8.6.8</lt></range>
<range><ge>8.7.0</ge><lt>8.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GitLab reports:</p>
<blockquote cite="https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/">
<p>During an internal code review, we discovered a critical security
flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2,
this feature was intended to allow an administrator to simulate
being logged in as any other user.</p>
<p>A part of this feature was not properly secured and it was possible
for any authenticated user, administrator or not, to "log in" as any
other user, including administrators. Please see the issue for more
details.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4340</cvename>
<freebsdpr>ports/209225</freebsdpr>
<url>https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/</url>
<url>https://gitlab.com/gitlab-org/gitlab-ce/issues/15548</url>
</references>
<dates>
<discovery>2016-05-02</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="5764c634-10d2-11e6-94fa-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-bcmath</name>
<name>php70-exif</name>
<name>php70-gd</name>
<name>php70-xml</name>
<range><lt>7.0.6</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-bcmath</name>
<name>php56-exif</name>
<name>php56-gd</name>
<name>php56-xml</name>
<range><lt>5.6.21</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-bcmath</name>
<name>php55-exif</name>
<name>php55-gd</name>
<name>php55-xml</name>
<range><lt>5.5.35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.35">
<ul><li>BCMath:
<ul>
<li>Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
_one_ definition).</li>
</ul></li>
<li>Exif:
<ul>
<li>Fixed bug #72094 (Out of bounds heap read access in exif header
processing).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #71912 (libgd: signedness vulnerability).
(CVE-2016-3074)</li>
</ul></li>
<li>Intl:
<ul>
<li>Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos
with negative offset).</li>
</ul></li>
<li>XML:
<ul>
<li>Fixed bug #72099 (xml_parse_into_struct segmentation fault).
</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3074</cvename>
<freebsdpr>ports/209145</freebsdpr>
<url>http://www.php.net/ChangeLog-7.php#7.0.6</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.21</url>
<url>http://www.php.net/ChangeLog-5.php#5.5.35</url>
</references>
<dates>
<discovery>2016-04-28</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="a1134048-10c6-11e6-94fa-002590263bf5">
<topic>libksba -- local denial of service vulnerabilities</topic>
<affects>
<package>
<name>libksba</name>
<range><lt>1.3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Prpic, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/29/5">
<p>Denial of Service due to stack overflow in src/ber-decoder.c.</p>
<p>Integer overflow in the BER decoder src/ber-decoder.c.</p>
<p>Integer overflow in the DN decoder src/dn.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4353</cvename>
<cvename>CVE-2016-4354</cvename>
<cvename>CVE-2016-4355</cvename>
<cvename>CVE-2016-4356</cvename>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a</url>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887</url>
<url>http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3</url>
<url>https://security.gentoo.org/glsa/201604-04</url>
<mlist>http://www.openwall.com/lists/oss-security/2016/04/29/5</mlist>
</references>
<dates>
<discovery>2015-04-08</discovery>
<entry>2016-05-03</entry>
</dates>
</vuln>
<vuln vid="7e36c369-10c0-11e6-94fa-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-19</p>
<p>The NCP dissector could crash. (Bug 11591)</p></li>
<li><p>wnpa-sec-2016-20</p>
<p>TShark could crash due to a packet reassembly bug. (Bug 11799)
</p></li>
<li><p>wnpa-sec-2016-21</p>
<p>The IEEE 802.11 dissector could crash. (Bug 11824, Bug 12187)
</p></li>
<li><p>wnpa-sec-2016-22</p>
<p>The PKTC dissector could crash. (Bug 12206)</p></li>
<li><p>wnpa-sec-2016-23</p>
<p>The PKTC dissector could crash. (Bug 12242)</p></li>
<li><p>wnpa-sec-2016-24</p>
<p>The IAX2 dissector could go into an infinite loop. (Bug
12260)</p></li>
<li><p>wnpa-sec-2016-25</p>
<p>Wireshark and TShark could exhaust the stack. (Bug 12268)</p>
</li>
<li><p>wnpa-sec-2016-26</p>
<p>The GSM CBCH dissector could crash. (Bug 12278)</p></li>
<li><p>wnpa-sec-2016-27</p>
<p>MS-WSP dissector crash. (Bug 12341)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4076</cvename>
<cvename>CVE-2016-4077</cvename>
<cvename>CVE-2016-4078</cvename>
<cvename>CVE-2016-4079</cvename>
<cvename>CVE-2016-4080</cvename>
<cvename>CVE-2016-4081</cvename>
<cvename>CVE-2016-4006</cvename>
<cvename>CVE-2016-4082</cvename>
<cvename>CVE-2016-4083</cvename>
<cvename>CVE-2016-4084</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.3.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/04/25/2</url>
</references>
<dates>
<discovery>2016-04-22</discovery>
<entry>2016-05-02</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="78abc022-0fee-11e6-9a1c-0014a5a57822">
<topic>mercurial -- arbitrary code execution vulnerability</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>3.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial reports:</p>
<blockquote cite="https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29">
<p>CVE-2016-3105: Arbitrary code execution when converting
Git repos</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3105</cvename>
<url>https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29</url>
</references>
<dates>
<discovery>2016-05-01</discovery>
<entry>2016-05-01</entry>
</dates>
</vuln>
<vuln vid="8c2b2f11-0ebe-11e6-b55e-b499baebfeaf">
<topic>MySQL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.25</lt></range>
</package>
<package>
<name>mariadb101-server</name>
<range><lt>10.1.12</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.30</lt></range>
</package>
<package>
<name>mysql57-server</name>
<range><lt>5.7.12</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.49</lt></range>
</package>
<package>
<name>percona-server</name>
<range><lt>5.6.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL">
<p>Critical Patch Update contains 31 new security fixes for Oracle MySQL
5.5.48, 5.6.29, 5.7.11 and earlier</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html#AppendixMSQL</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/</url>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0639</cvename>
<cvename>CVE-2015-3194</cvename>
<cvename>CVE-2016-0640</cvename>
<cvename>CVE-2016-0641</cvename>
<cvename>CVE-2016-3461</cvename>
<cvename>CVE-2016-2047</cvename>
<cvename>CVE-2016-0642</cvename>
<cvename>CVE-2016-0643</cvename>
<cvename>CVE-2016-0644</cvename>
<cvename>CVE-2016-0646</cvename>
<cvename>CVE-2016-0647</cvename>
<cvename>CVE-2016-0648</cvename>
<cvename>CVE-2016-0649</cvename>
<cvename>CVE-2016-0650</cvename>
<cvename>CVE-2016-0652</cvename>
<cvename>CVE-2016-0653</cvename>
<cvename>CVE-2016-0654</cvename>
<cvename>CVE-2016-0655</cvename>
<cvename>CVE-2016-0656</cvename>
<cvename>CVE-2016-0657</cvename>
<cvename>CVE-2016-0658</cvename>
<cvename>CVE-2016-0651</cvename>
<cvename>CVE-2016-0659</cvename>
<cvename>CVE-2016-0661</cvename>
<cvename>CVE-2016-0662</cvename>
<cvename>CVE-2016-0663</cvename>
<cvename>CVE-2016-0665</cvename>
<cvename>CVE-2016-0666</cvename>
<cvename>CVE-2016-0667</cvename>
<cvename>CVE-2016-0668</cvename>
</references>
<dates>
<discovery>2016-04-19</discovery>
<entry>2016-04-30</entry>
</dates>
</vuln>
<vuln vid="f2d4f879-0d7c-11e6-925f-6805ca0b3d42">
<topic>logstash -- password disclosure vulnerability</topic>
<affects>
<package>
<name>logstash</name>
<range><ge>2.1.0</ge><lt>2.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Logstash developers report:</p>
<blockquote cite="https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18">
<h2>Passwords Printed in Log Files under Some Conditions</h2>
<p>It was discovered that, in Logstash 2.1.0+, log messages
generated by a stalled pipeline during shutdown will print
plaintext contents of password fields. While investigating
this issue we also discovered that debug logging has
included this data for quite some time. Our latest releases
fix both leaks. You will want to scrub old log files if this
is of particular concern to you. This was fixed in issue
#4965</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.elastic.co/blog/logstash-2.3.1-and-2.2.4-released#Passwords_Printed_in_Log_Files_under_Some_Conditions_18</url>
<url>https://github.com/elastic/logstash/pull/4965</url>
</references>
<dates>
<discovery>2016-04-01</discovery>
<entry>2016-04-28</entry>
</dates>
</vuln>
<vuln vid="c8174b63-0d3a-11e6-b06e-d43d7eed0ce2">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.4</lt></range>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.0.0</ge><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion project reports:</p>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2167-advisory.txt">
<p>svnserve, the svn:// protocol server, can optionally use the Cyrus
SASL library for authentication, integrity protection, and encryption.
Due to a programming oversight, authentication against Cyrus SASL
would permit the remote user to specify a realm string which is
a prefix of the expected realm string.</p>
</blockquote>
<blockquote cite="http://subversion.apache.org/security/CVE-2016-2168-advisory.txt">
<p>Subversion's httpd servers are vulnerable to a remotely triggerable crash
in the mod_authz_svn module. The crash can occur during an authorization
check for a COPY or MOVE request with a specially crafted header value.</p>
<p>This allows remote attackers to cause a denial of service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2167</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2167-advisory.txt</url>
<cvename>CVE-2016-2168</cvename>
<url>http://subversion.apache.org/security/CVE-2016-2168-advisory.txt</url>
</references>
<dates>
<discovery>2016-04-21</discovery>
<entry>2016-04-28</entry>
</dates>
</vuln>
<vuln vid="b2487d9a-0c30-11e6-acd0-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p7</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.92</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_1</lt></range>
<range><ge>10.2</ge><lt>10.2_15</lt></range>
<range><ge>10.1</ge><lt>10.1_32</lt></range>
<range><ge>9.3</ge><lt>9.3_40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p7, released on Tuesday, 26 April 2016:</p>
<ul>
<li>Bug 3020 / CVE-2016-1551: Refclock impersonation
vulnerability, AKA: refclock-peering. Reported by
Matt Street and others of Cisco ASIG</li>
<li>Bug 3012 / CVE-2016-1549: Sybil vulnerability:
ephemeral association attack, AKA: ntp-sybil -
MITIGATION ONLY. Reported by Matthew Van Gundy
of Cisco ASIG</li>
<li>Bug 3011 / CVE-2016-2516: Duplicate IPs on
unconfig directives will cause an assertion botch.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3010 / CVE-2016-2517: Remote configuration
trustedkey/requestkey values are not properly
validated. Reported by Yihan Lian of the Cloud
Security Team, Qihoo 360</li>
<li>Bug 3009 / CVE-2016-2518: Crafted addpeer with
hmode > 7 causes array wraparound with MATCH_ASSOC.
Reported by Yihan Lian of the Cloud Security Team,
Qihoo 360</li>
<li>Bug 3008 / CVE-2016-2519: ctl_getitem() return
value not always checked. Reported by Yihan Lian
of the Cloud Security Team, Qihoo 360</li>
<li>Bug 3007 / CVE-2016-1547: Validate crypto-NAKs,
AKA: nak-dos. Reported by Stephen Gray and
Matthew Van Gundy of Cisco ASIG</li>
<li>Bug 2978 / CVE-2016-1548: Interleave-pivot -
MITIGATION ONLY. Reported by Miroslav Lichvar of
RedHat and separately by Jonathan Gardner of
Cisco ASIG.</li>
<li>Bug 2952 / CVE-2015-7704: KoD fix: peer
associations were broken by the fix for
NtpBug2901, AKA: Symmetric active/passive mode
is broken. Reported by Michael Tatarinov,
NTP Project Developer Volunteer</li>
<li>Bug 2945 / Bug 2901 / CVE-2015-8138: Zero
Origin Timestamp Bypass, AKA: Additional KoD Checks.
Reported by Jonathan Gardner of Cisco ASIG</li>
<li>Bug 2879 / CVE-2016-1550: Improve NTP security
against buffer comparison timing attacks,
authdecrypt-timing, AKA: authdecrypt-timing.
Reported independently by Loganaden Velvindron,
and Matthew Van Gundy and Stephen Gray of
Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:16.ntp</freebsdsa>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2016-1547</cvename>
<cvename>CVE-2016-1548</cvename>
<cvename>CVE-2016-1549</cvename>
<cvename>CVE-2016-1550</cvename>
<cvename>CVE-2016-1551</cvename>
<cvename>CVE-2016-2516</cvename>
<cvename>CVE-2016-2517</cvename>
<cvename>CVE-2016-2518</cvename>
<cvename>CVE-2016-2519</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-27</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="92d44f83-a7bf-41cf-91ee-3d1b8ecf579f">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>46.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.43</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><ge>39.0,1</ge><lt>45.1.0,1</lt></range>
<range><lt>38.8.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><ge>39.0</ge><lt>45.1.0</lt></range>
<range><lt>38.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox46">
<p>MFSA 2016-39 Miscellaneous memory safety hazards (rv:46.0 /
rv:45.1 / rv:38.8)</p>
<p>MFSA 2016-42 Use-after-free and buffer overflow
in Service Workers</p>
<p>MFSA 2016-44 Buffer overflow in libstagefright with
CENC offsets</p>
<p>MFSA 2016-45 CSP not applied to pages sent with
multipart/x-mixed-replace</p>
<p>MFSA 2016-46 Elevation of privilege with
chrome.tabs.update API in web extensions</p>
<p>MFSA 2016-47 Write to invalid HashMap entry through
JavaScript.watch()</p>
<p>MFSA 2016-48 Firefox Health Reports could accept events
from untrusted domains</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2804</cvename>
<cvename>CVE-2016-2805</cvename>
<cvename>CVE-2016-2806</cvename>
<cvename>CVE-2016-2807</cvename>
<cvename>CVE-2016-2808</cvename>
<cvename>CVE-2016-2811</cvename>
<cvename>CVE-2016-2812</cvename>
<cvename>CVE-2016-2814</cvename>
<cvename>CVE-2016-2816</cvename>
<cvename>CVE-2016-2817</cvename>
<cvename>CVE-2016-2820</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-39/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-42/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-44/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-45/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-46/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-47/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-48/</url>
</references>
<dates>
<discovery>2016-04-26</discovery>
<entry>2016-04-26</entry>
</dates>
</vuln>
<vuln vid="f87a9376-0943-11e6-8fc4-00a0986f28c4">
<topic>phpmyfaq -- cross-site request forgery vulnerability</topic>
<affects>
<package>
<name>phpmyfaq</name>
<range><lt>2.8.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyFAQ team reports:</p>
<blockquote cite="http://www.phpmyfaq.de/security/advisory-2016-04-11">
<p>The vulnerability exists due to application does not properly
verify origin of HTTP requests in "Interface Translation"
functionality.: A remote unauthenticated attacker can create
a specially crafted malicious web page with CSRF exploit, trick
a logged-in administrator to visit the page, spoof the HTTP
request, as if it was coming from the legitimate user, inject
and execute arbitrary PHP code on the target system with privileges
of the webserver.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.phpmyfaq.de/security/advisory-2016-04-11</url>
<url>https://www.htbridge.com/advisory/HTB23300</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-23</entry>
</dates>
</vuln>
<vuln vid="1b0d2938-0766-11e6-94fa-002590263bf5">
<topic>libtasn1 -- denial of service parsing malicious DER certificates</topic>
<affects>
<package>
<name>libtasn1</name>
<range><lt>4.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GNU Libtasn1 NEWS reports:</p>
<blockquote cite="http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37">
<p>Fixes to avoid an infinite recursion when decoding without the
ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4008</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/13/3</url>
<url>http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=blob_plain;f=NEWS;hb=e9bcdc86b920d72c9cffc2570d14eea2f6365b37</url>
</references>
<dates>
<discovery>2016-04-11</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="e05bfc92-0763-11e6-94fa-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:5 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_5.txt">
<p>Due to incorrect buffer management Squid cachemgr.cgi tool is
vulnerable to a buffer overflow when processing remotely supplied
inputs relayed to it from Squid.</p>
<p>This problem allows any client to seed the Squid manager reports
with data that will cause a buffer overflow when processed by the
cachemgr.cgi tool. However, this does require manual administrator
actions to take place. Which greatly reduces the impact and
possible uses.</p>
</blockquote>
<p>Squid security advisory 2016:6 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_6.txt">
<p>Due to buffer overflow issues Squid is vulnerable to a denial of
service attack when processing ESI responses. Due to incorrect input
validation Squid is vulnerable to public information disclosure of
the server stack layout when processing ESI responses. Due to
incorrect input validation and buffer overflow Squid is vulnerable
to remote code execution when processing ESI responses.</p>
<p>These problems allow ESI components to be used to perform a denial
of service attack on the Squid service and all other services on the
same machine. Under certain build conditions these problems allow
remote clients to view large sections of the server memory. However,
the bugs are exploitable only if you have built and configured the
ESI features to be used by a reverse-proxy and if the ESI components
being processed by Squid can be controlled by an attacker.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-4051</cvename>
<cvename>CVE-2016-4052</cvename>
<cvename>CVE-2016-4053</cvename>
<cvename>CVE-2016-4054</cvename>
<freebsdpr>ports/208939</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_5.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_6.txt</url>
</references>
<dates>
<discovery>2016-04-20</discovery>
<entry>2016-04-21</entry>
</dates>
</vuln>
<vuln vid="253c6889-06f0-11e6-925f-6805ca0b3d42">
<topic>ansible -- use of predictable paths in lxc_container</topic>
<affects>
<package>
<name>ansible</name>
<range><ge>2.0.0.0</ge><lt>2.0.2.0</lt></range>
</package>
<package>
<name>ansible1</name>
<range><lt>1.9.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ansible developers report:</p>
<blockquote cite="https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4">
<p>CVE-2016-3096: do not use predictable paths in lxc_container</p>
<ul>
<li>do not use a predictable filename for the LXC attach
script</li>
<li>don't use predictable filenames for LXC attach script
logging</li>
<li>don't set a predictable archive_path</li>
</ul>
<p>this should prevent symlink attacks which could result
in</p>
<ul>
<li>data corruption</li>
<li>data leakage</li>
<li>privilege escalation</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3096</cvename>
<url>https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1322925</url>
</references>
<dates>
<discovery>2016-04-02</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="a733b5ca-06eb-11e6-817f-3085a9a4510d">
<topic>proftpd -- vulnerability in mod_tls</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.5b</lt></range>
<range><eq>1.3.6.r1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3125">
<p>The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before
1.3.6rc2 does not properly handle the TLSDHParamFile directive, which
might cause a weaker than intended Diffie-Hellman (DH) key to be used
and consequently allow attackers to have unspecified impact via
unknown vectors.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3125</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-04-20</entry>
</dates>
</vuln>
<vuln vid="6d8505f0-0614-11e6-b39c-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>50.0.2661.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html">
<p>20 security fixes in this release, including:</p>
<ul>
<li>[590275] High CVE-2016-1652: Universal XSS in extension
bindings. Credit to anonymous.</li>
<li>[589792] High CVE-2016-1653: Out-of-bounds write in V8. Credit
to Choongwoo Han.</li>
<li>[591785] Medium CVE-2016-1651: Out-of-bounds read in Pdfium
JPEG2000 decoding. Credit to kdot working with HP's Zero Day
Initiative.</li>
<li>[589512] Medium CVE-2016-1654: Uninitialized memory read in
media. Credit to Atte Kettunen of OUSPG.</li>
<li>[582008] Medium CVE-2016-1655: Use-after-free related to
extensions. Credit to Rob Wu.</li>
<li>[570750] Medium CVE-2016-1656: Android downloaded file path
restriction bypass. Credit to Dzmitry Lukyanenko.</li>
<li>[567445] Medium CVE-2016-1657: Address bar spoofing. Credit to
Luan Herrera.</li>
<li>[573317] Low CVE-2016-1658: Potential leak of sensitive
information to malicious extensions. Credit to Antonio Sanso
(@asanso) of Adobe.</li>
<li>[602697] CVE-2016-1659: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1651</cvename>
<cvename>CVE-2016-1652</cvename>
<cvename>CVE-2016-1653</cvename>
<cvename>CVE-2016-1654</cvename>
<cvename>CVE-2016-1655</cvename>
<cvename>CVE-2016-1656</cvename>
<cvename>CVE-2016-1657</cvename>
<cvename>CVE-2016-1658</cvename>
<cvename>CVE-2016-1659</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/04/stable-channel-update_13.html</url>
</references>
<dates>
<discovery>2016-04-13</discovery>
<entry>2016-04-19</entry>
</dates>
</vuln>
<vuln vid="976567f6-05c5-11e6-94fa-002590263bf5">
<topic>hostapd and wpa_supplicant -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wpa_supplicant</name>
<range><lt>2.5_1</lt></range>
</package>
<package>
<name>hostapd</name>
<range><lt>2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jouni Malinen reports:</p>
<blockquote cite="http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt">
<p>wpa_supplicant unauthorized WNM Sleep Mode GTK control. (2015-6 -
CVE-2015-5310)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt">
<p>EAP-pwd missing last fragment length validation. (2015-7 -
CVE-2015-5315)</p>
</blockquote>
<blockquote cite="http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt">
<p>EAP-pwd peer error path failure on unexpected Confirm message.
(2015-8 - CVE-2015-5316)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5310</cvename>
<cvename>CVE-2015-5315</cvename>
<cvename>CVE-2015-5316</cvename>
<freebsdpr>ports/208482</freebsdpr>
<url>http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt</url>
<url>http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt</url>
<url>http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2016-04-19</entry>
<modified>2017-03-22</modified>
</dates>
</vuln>
<vuln vid="092156c9-04d7-11e6-b1ce-002590263bf5">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.9.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7912">
<p>The get_option function in dhcp.c in dhcpcd before 6.2.0, as used
in dhcpcd 5.x in Android before 5.1 and other products, does not
validate the relationship between length fields and the amount of
data, which allows remote DHCP servers to execute arbitrary code or
cause a denial of service (memory corruption) via a large length
value of an option in a DHCPACK message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7912</cvename>
<url>http://roy.marples.name/projects/dhcpcd/info/d71cfd8aa203bffe</url>
</references>
<dates>
<discovery>2015-06-19</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1">
<topic>dhcpcd -- remote code execution/denial of service</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7913">
<p>The print_option function in dhcp-common.c in dhcpcd through 6.9.1,
as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other
products, misinterprets the return value of the snprintf function,
which allows remote DHCP servers to execute arbitrary code or cause
a denial of service (memory corruption) via a crafted message.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7913</cvename>
<freebsdpr>ports/208702</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/528541c4c619520e</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-04-17</entry>
</dates>
</vuln>
<vuln vid="e21474c6-031a-11e6-aa86-001999f8d30b">
<topic>PJSIP -- TCP denial of service in PJProject</topic>
<affects>
<package>
<name>pjsip</name>
<range><le>2.4.5</le></range>
</package>
<package>
<name>pjsip-extsrtp</name>
<range><le>2.4.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>PJProject has a limit on the number of TCP connections
that it can accept. Furthermore, PJProject does not close
TCP connections it accepts. By default, this value is
approximately 60.</p>
<p>An attacker can deplete the number of allowed TCP
connections by opening TCP connections and sending no
data to Asterisk.</p>
<p>If PJProject has been compiled in debug mode, then
once the number of allowed TCP connections has been
depleted, the next attempted TCP connection to Asterisk
will crash due to an assertion in PJProject.</p>
<p>If PJProject has not been compiled in debug mode, then
any further TCP connection attempts will be rejected.
This makes Asterisk unable to process TCP SIP traffic.</p>
<p>Note that this only affects TCP/TLS, since UDP is
connectionless.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-005.html</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="ee50726e-0319-11e6-aa86-001999f8d30b">
<topic>asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk</topic>
<affects>
<package>
<name>asterisk13</name>
<range><lt>13.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>Asterisk may crash when processing an incoming REGISTER
request if that REGISTER contains a Contact header with
a lengthy URI.</p>
<p>This crash will only happen for requests that pass
authentication. Unauthenticated REGISTER requests will
not result in a crash occurring.</p>
<p>This vulnerability only affects Asterisk when using
PJSIP as its SIP stack. The chan_sip module does not have
this problem.</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-004.html</url>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-04-15</entry>
</dates>
</vuln>
<vuln vid="f2217cdf-01e4-11e6-b1ce-002590263bf5">
<topic>go -- remote denial of service</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.6.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/04/05/2">
<p>Go has an infinite loop in several big integer routines that makes
Go programs vulnerable to remote denial of service attacks. Programs
using HTTPS client authentication or the Go ssh server libraries are
both exposed to this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3959</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/04/05/2</url>
<url>https://golang.org/cl/21533</url>
</references>
<dates>
<discovery>2016-04-05</discovery>
<entry>2016-04-14</entry>
</dates>
</vuln>
<vuln vid="a636fc26-00d9-11e6-b704-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><le>3.6.25_3</le></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><le>4.1.23</le></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.11</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.8</lt></range>
</package>
<package>
<name>samba44</name>
<range><ge>4.4.0</ge><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.4.2">
<p>[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service
(crashes and high cpu consumption) and man in the middle attacks.</p>
<p>[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected.
A man in the middle is able to clear even required flags, especially
NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.</p>
<p>[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote
attackers to spoof the computer name of a secure channel's endpoints, and obtain
sensitive session information, by running a crafted application and leveraging
the ability to sniff network traffic.</p>
<p>[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections
to no integrity protection.</p>
<p>[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP
connections (with ldaps://) and ncacn_http connections (with https://).</p>
<p>[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.</p>
<p>[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is
the default for most the file server related protocols) is inherited from the underlying SMB connection.</p>
<p>[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic
between a client and a server in order to impersonate the client and get the same privileges
as the authenticated user account. This is most problematic against active directory domain controllers.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5370</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5370.html</url>
<cvename>CVE-2016-2110</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2110.html</url>
<cvename>CVE-2016-2111</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2111.html</url>
<cvename>CVE-2016-2112</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2112.html</url>
<cvename>CVE-2016-2113</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2113.html</url>
<cvename>CVE-2016-2114</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2114.html</url>
<cvename>CVE-2016-2115</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2115.html</url>
<cvename>CVE-2016-2118</cvename>
<url>https://www.samba.org/samba/security/CVE-2016-2118.html</url>
</references>
<dates>
<discovery>2016-04-12</discovery>
<entry>2016-04-12</entry>
<modified>2016-04-12</modified>
</dates>
</vuln>
<vuln vid="482d40cb-f9a3-11e5-92ce-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-fileinfo</name>
<name>php70-mbstring</name>
<name>php70-phar</name>
<name>php70-snmp</name>
<range><lt>7.0.5</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-fileinfo</name>
<name>php56-mbstring</name>
<name>php56-phar</name>
<name>php56-snmp</name>
<range><lt>5.6.20</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-fileinfo</name>
<name>php55-mbstring</name>
<name>php55-phar</name>
<name>php55-snmp</name>
<range><lt>5.5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.5">
<ul><li>Fileinfo:
<ul>
<li>Fixed bug #71527 (Buffer over-write in finfo_open with
malformed magic file).</li>
</ul></li>
<li>mbstring:
<ul>
<li>Fixed bug #71906 (AddressSanitizer: negative-size-param (-1)
in mbfl_strcut).</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71860 (Invalid memory write in phar on filename with
\0 in name).</li>
</ul></li>
<li>SNMP:
<ul>
<li>Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
</li>
</ul></li>
<li>Standard:
<ul>
<li>Fixed bug #71798 (Integer Overflow in php_raw_url_encode).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/208465</freebsdpr>
<url>http://php.net/ChangeLog-7.php#7.0.5</url>
<url>http://php.net/ChangeLog-5.php#5.6.20</url>
<url>http://php.net/ChangeLog-5.php#5.5.34</url>
</references>
<dates>
<discovery>2016-03-31</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="497b82e0-f9a0-11e5-92ce-002590263bf5">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mitre reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283">
<p>The pcre_compile2 function in pcre_compile.c in PCRE 8.38
mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/
pattern and related patterns with named subgroups, which allows
remote attackers to cause a denial of service (heap-based buffer
overflow) or possibly have unspecified other impact via a crafted
regular expression, as demonstrated by a JavaScript RegExp object
encountered by Konqueror.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1283</cvename>
<freebsdpr>ports/208260</freebsdpr>
<url>https://bugs.exim.org/show_bug.cgi?id=1767</url>
</references>
<dates>
<discovery>2016-02-27</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="df328fac-f942-11e5-92ce-002590263bf5">
<topic>py-djblets -- Self-XSS vulnerability</topic>
<affects>
<package>
<name>py27-djblets</name>
<name>py32-djblets</name>
<name>py33-djblets</name>
<name>py34-djblets</name>
<name>py35-djblets</name>
<range><lt>0.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Djblets Release Notes reports:</p>
<blockquote cite="https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/">
<p>A recently-discovered vulnerability in the datagrid templates allows an
attacker to generate a URL to any datagrid page containing malicious code
in a column sorting value. If the user visits that URL and then clicks
that column, the code will execute.</p>
<p>The cause of the vulnerability was due to a template not escaping
user-provided values.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.reviewboard.org/docs/releasenotes/djblets/0.9.2/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="a430e15d-f93f-11e5-92ce-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.11</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.5</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0003: Incorrect capability check when displaying
users emails in Participants list</p></li>
<li><p>MSA-16-0004: XSS from profile fields from external db</p>
</li>
<li><p>MSA-16-0005: Reflected XSS in mod_data advanced search</p>
</li>
<li><p>MSA-16-0006: Hidden courses are shown to students in Event
Monitor</p></li>
<li><p>MSA-16-0007: Non-Editing Instructor role can edit exclude
checkbox in Single View</p></li>
<li><p>MSA-16-0008: External function get_calendar_events return
events that pertains to hidden activities</p></li>
<li><p>MSA-16-0009: CSRF in Assignment plugin management page</p>
</li>
<li><p>MSA-16-0010: Enumeration of category details possible without
authentication</p></li>
<li><p>MSA-16-0011: Add no referrer to links with _blank target
attribute</p></li>
<li><p>MSA-16-0012: External function mod_assign_save_submission
does not check due dates</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2151</cvename>
<cvename>CVE-2016-2152</cvename>
<cvename>CVE-2016-2153</cvename>
<cvename>CVE-2016-2154</cvename>
<cvename>CVE-2016-2155</cvename>
<cvename>CVE-2016-2156</cvename>
<cvename>CVE-2016-2157</cvename>
<cvename>CVE-2016-2158</cvename>
<cvename>CVE-2016-2190</cvename>
<cvename>CVE-2016-2159</cvename>
<url>https://moodle.org/security/</url>
</references>
<dates>
<discovery>2016-03-21</discovery>
<entry>2016-04-03</entry>
</dates>
</vuln>
<vuln vid="297117ba-f92d-11e5-92ce-002590263bf5">
<topic>squid -- multiple vulnerabilities</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:3 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_3.txt">
<p>Due to a buffer overrun Squid pinger binary is vulnerable to
denial of service or information leak attack when processing
ICMPv6 packets.</p>
<p>This bug also permits the server response to manipulate other
ICMP and ICMPv6 queries processing to cause information leak.</p>
<p>This bug allows any remote server to perform a denial of service
attack on the Squid service by crashing the pinger. This may
affect Squid HTTP routing decisions. In some configurations,
sub-optimal routing decisions may result in serious service
degradation or even transaction failures.</p>
<p>If the system does not contain buffer-overrun protection leading
to that crash this bug will instead allow attackers to leak
arbitrary amounts of information from the heap into Squid log
files. This is of higher importance than usual because the pinger
process operates with root priviliges.</p>
</blockquote>
<p>Squid security advisory 2016:4 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_4.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>This problem allows a malicious client script and remote server
delivering certain unusual HTTP response syntax to trigger a
denial of service for all clients accessing the Squid service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3947</cvename>
<cvename>CVE-2016-3948</cvename>
<freebsdpr>ports/208463</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_3.txt</url>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_4.txt</url>
</references>
<dates>
<discovery>2016-03-28</discovery>
<entry>2016-04-02</entry>
</dates>
</vuln>
<vuln vid="97a24d2e-f74c-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql95-server</name>
<name>postgresql95-contrib</name>
<range><ge>9.5.0</ge><lt>9.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1656/">
<p>Security Fixes for RLS, BRIN</p>
<p>
This release closes security hole CVE-2016-2193
(https://access.redhat.com/security/cve/CVE-2016-2193), where a query
plan might get reused for more than one ROLE in the same session.
This could cause the wrong set of Row Level Security (RLS) policies to
be used for the query.</p>
<p>
The update also fixes CVE-2016-3065
(https://access.redhat.com/security/cve/CVE-2016-3065), a server crash
bug triggered by using `pageinspect` with BRIN index pages. Since an
attacker might be able to expose a few bytes of server memory, this
crash is being treated as a security issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2193</cvename>
<cvename>CVE-2016-3065</cvename>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="f7b3d1eb-f738-11e5-a710-0011d823eebd">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.577</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-08.html">
<p>These updates resolve integer overflow vulnerabilities that
could lead to code execution (CVE-2016-0963, CVE-2016-0993,
CVE-2016-1010).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2016-0987, CVE-2016-0988,
CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995,
CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,
CVE-2016-1000).</p>
<p>These updates resolve a heap overflow vulnerability that could
lead to code execution (CVE-2016-1001).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2016-0960, CVE-2016-0961,
CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992,
CVE-2016-1002, CVE-2016-1005).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0960</cvename>
<cvename>CVE-2016-0961</cvename>
<cvename>CVE-2016-0962</cvename>
<cvename>CVE-2016-0963</cvename>
<cvename>CVE-2016-0986</cvename>
<cvename>CVE-2016-0987</cvename>
<cvename>CVE-2016-0988</cvename>
<cvename>CVE-2016-0989</cvename>
<cvename>CVE-2016-0990</cvename>
<cvename>CVE-2016-0991</cvename>
<cvename>CVE-2016-0992</cvename>
<cvename>CVE-2016-0993</cvename>
<cvename>CVE-2016-0994</cvename>
<cvename>CVE-2016-0995</cvename>
<cvename>CVE-2016-0996</cvename>
<cvename>CVE-2016-0997</cvename>
<cvename>CVE-2016-0998</cvename>
<cvename>CVE-2016-0999</cvename>
<cvename>CVE-2016-1000</cvename>
<cvename>CVE-2016-1001</cvename>
<cvename>CVE-2016-1002</cvename>
<cvename>CVE-2016-1005</cvename>
<cvename>CVE-2016-1010</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-08.html</url>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="4cd9b19f-f66d-11e5-b94c-001999f8d30b">
<topic>Multiple vulnerabilities in Botan</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.11</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/security.html">
<p>Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression.</p>
<p>Heap overflow on invalid ECC point - The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime.</p>
<p>The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function.</p>
<p>The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution.</p>
<p>On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmapped region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2016-2194</cvename>
<cvename>CVE-2016-2195</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="2004616d-f66c-11e5-b94c-001999f8d30b">
<topic>Botan BER Decoder vulnerabilities</topic>
<affects>
<package>
<name>botan110</name>
<range><lt>1.10.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The botan developers reports:</p>
<blockquote cite="http://botan.randombit.net/">
<p>Excess memory allocation in BER decoder - The BER decoder would allocate a fairly arbitrary amount of memory in a length field, even if there was no chance the read request would succeed. This might cause the process to run out of memory or invoke the OOM killer.</p>
<p>Crash in BER decoder - The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applications reading untrusted ASN.1 data, but does not seem exploitable for code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://botan.randombit.net/security.html</url>
<cvename>CVE-2015-5726</cvename>
<cvename>CVE-2015-5727</cvename>
</references>
<dates>
<discovery>2015-08-03</discovery>
<entry>2016-03-31</entry>
</dates>
</vuln>
<vuln vid="e1085b15-f609-11e5-a230-0014a5a57822">
<topic>mercurial -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mercurial</name>
<range><lt>2.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mercurial reports:</p>
<blockquote cite="https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html">
<p>CVE-2016-3630: Remote code execution in binary delta decoding</p>
<p>CVE-2016-3068: Arbitrary code execution with Git subrepos</p>
<p>CVE-2016-3069: Arbitrary code execution when converting
Git repos</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3630</cvename>
<cvename>CVE-2016-3068</cvename>
<cvename>CVE-2016-3069</cvename>
<url>https://www.mercurial-scm.org/pipermail/mercurial/2016-March/049452.html</url>
</references>
<dates>
<discovery>2016-03-29</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="8be8ca39-ae70-4422-bf1a-d8fae6911c5e">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.108</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html">
<p>[594574] High CVE-2016-1646: Out-of-bounds read in V8.</p>
<p>[590284] High CVE-2016-1647: Use-after-free in Navigation.</p>
<p>[590455] High CVE-2016-1648: Use-after-free in Extensions.</p>
<p>[597518] CVE-2016-1650: Various fixes from internal audits,
fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed at the tip of the
4.9 branch</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1646</cvename>
<cvename>CVE-2016-1647</cvename>
<cvename>CVE-2016-1648</cvename>
<cvename>CVE-2016-1649</cvename>
<cvename>CVE-2016-1650</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2016-03-24</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="5c288f68-c7ca-4c0d-b7dc-1ec6295200b3">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.87</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html">
<p>[589838] High CVE-2016-1643: Type confusion in Blink.</p>
<p>[590620] High CVE-2016-1644: Use-after-free in Blink.</p>
<p>[587227] High CVE-2016-1645: Out-of-bounds write in PDFium.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1643</cvename>
<cvename>CVE-2016-1644</cvename>
<cvename>CVE-2016-1645</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-29</entry>
</dates>
</vuln>
<vuln vid="cd409df7-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01351">
<p>A response containing multiple DNS cookies causes servers with
cookie support enabled to exit with an assertion failure.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2088</cvename>
<url>https://kb.isc.org/article/AA-01351</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
</dates>
</vuln>
<vuln vid="cba246d2-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01353">
<p>A problem parsing resource record signatures for DNAME resource
records can lead to an assertion failure in resolver.c or db.c</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1286</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01353</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="c9075321-f483-11e5-92ce-002590263bf5">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind98</name>
<range><le>9.8.8</le></range>
</package>
<package>
<name>bind99</name>
<range><ge>9.9.0</ge><lt>9.9.8P4</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.0</ge><lt>9.10.3P4</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20160309</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_38</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01352">
<p>An error parsing input received by the rndc control channel can
cause an assertion failure in sexpr.c or alist.c.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1285</cvename>
<freebsdsa>SA-16:13.bind</freebsdsa>
<url>https://kb.isc.org/article/AA-01352</url>
</references>
<dates>
<discovery>2016-03-09</discovery>
<entry>2016-03-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6d25c306-f3bb-11e5-92ce-002590263bf5">
<topic>salt -- Insecure configuration of PAM external authentication service</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><lt>2015.5.10</lt></range>
<range><ge>2015.8.0</ge><lt>2015.8.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html">
<p>This issue affects all Salt versions prior to 2015.8.8/2015.5.10
when PAM external authentication is enabled. This issue involves
passing an alternative PAM authentication service with a command
that is sent to LocalClient, enabling the attacker to bypass the
configured authentication service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-3176</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html</url>
</references>
<dates>
<discovery>2016-03-17</discovery>
<entry>2016-03-27</entry>
</dates>
</vuln>
<vuln vid="a258604d-f2aa-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Unsafe deserialization</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt">
<p>JMS Object messages depends on Java Serialization for
marshaling/unmashaling of the message payload. There are a couple of places
inside the broker where deserialization can occur, like web console or stomp
object message transformation. As deserialization of untrusted data can lead to
security flaws as demonstrated in various reports, this leaves the broker
vulnerable to this attack vector. Additionally, applications that consume
ObjectMessage type of messages can be vulnerable as they deserialize objects on
ObjectMessage.getObject() calls.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt</url>
<cvename>CVE-2015-5254</cvename>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="950b2d60-f2a9-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Clickjacking</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Furman reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt">
<p>The web based administration console does not set the
X-Frame-Options header in HTTP responses. This allows the console to be embedded
in a frame or iframe which could then be used to cause a user to perform an
unintended action in the console.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt</url>
<cvename>CVE-2016-0734</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="a6cc5753-f29e-11e5-b4a9-ac220bdcec59">
<topic>activemq -- Web Console Cross-Site Scripting</topic>
<affects>
<package>
<name>activemq</name>
<range><lt>5.13.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Vladimir Ivanov (Positive Technologies) reports:</p>
<blockquote cite="http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt">
<p>Several instances of cross-site scripting vulnerabilities were
identified to be present in the web based administration console as well as the
ability to trigger a Java memory dump into an arbitrary folder. The root cause
of these issues are improper user data output validation and incorrect
permissions configured on Jolokia.</p>
</blockquote>
</body>
</description>
<references>
<url>http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt</url>
<cvename>CVE-2016-0782</cvename>
</references>
<dates>
<discovery>2016-03-10</discovery>
<entry>2016-03-25</entry>
</dates>
</vuln>
<vuln vid="7033b42d-ef09-11e5-b766-14dae9d210b8">
<topic>pcre -- stack buffer overflow</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.38</lt></range>
</package>
<package>
<name>pcre2</name>
<range><lt>10.20_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Philip Hazel reports:</p>
<blockquote cite="https://bugs.exim.org/show_bug.cgi?id=1791">
<p>PCRE does not validate that handling the (*ACCEPT) verb
will occur within the bounds of the cworkspace stack buffer, leading to
a stack buffer overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.exim.org/show_bug.cgi?id=1791</url>
<cvename>CVE-2016-3191</cvename>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-03-21</entry>
<modified>2016-03-21</modified>
</dates>
</vuln>
<vuln vid="c428de09-ed69-11e5-92ce-002590263bf5">
<topic>kamailio -- SEAS Module Heap overflow</topic>
<affects>
<package>
<name>kamailio</name>
<range><lt>4.3.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stelios Tsampas reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/338">
<p>A (remotely exploitable) heap overflow vulnerability was found in
Kamailio v4.3.4.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2385</cvename>
<url>https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643</url>
<url>https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/</url>
<url>http://seclists.org/oss-sec/2016/q1/338</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
<modified>2016-04-03</modified>
</dates>
</vuln>
<vuln vid="5dd39f26-ed68-11e5-92ce-002590263bf5">
<topic>hadoop2 -- unauthorized disclosure of data vulnerability</topic>
<affects>
<package>
<name>hadoop2</name>
<range><ge>2.6</ge><lt>2.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arun Suresh reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser">
<p>RPC traffic from clients, potentially including authentication
credentials, may be intercepted by a malicious user with access to
run tasks or containers on a cluster.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1776</cvename>
<url>http://mail-archives.apache.org/mod_mbox/hadoop-general/201602.mbox/browser</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-19</entry>
</dates>
</vuln>
<vuln vid="d2a84feb-ebe0-11e5-92ce-002590263bf5">
<topic>git -- integer overflow</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.4.11</lt></range>
<range><ge>2.5.0</ge><lt>2.5.5</lt></range>
<range><ge>2.6.0</ge><lt>2.6.6</lt></range>
<range><ge>2.7.0</ge><lt>2.7.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2324">
<p>integer overflow due to a loop which adds more to "len".</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2324</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2324</url>
<url>https://github.com/git/git/commit/9831e92bfa833ee9c0ce464bbc2f941ae6c2698d</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-03-18</entry>
</dates>
</vuln>
<vuln vid="93ee802e-ebde-11e5-92ce-002590263bf5">
<topic>git -- potential code execution</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Debian reports:</p>
<blockquote cite="https://security-tracker.debian.org/tracker/CVE-2016-2315">
<p>"int" is the wrong data type for ... nlen assignment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2315</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/03/15/6</url>
<url>https://marc.info/?l=oss-security&m=145809217306686&w=2</url>
<url>https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305</url>
<url>https://security-tracker.debian.org/tracker/CVE-2016-2315</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2016-03-17</entry>
</dates>
</vuln>
<vuln vid="6d33b3e5-ea03-11e5-85be-14dae9d210b8">
<topic>node -- multiple vulnerabilities</topic>
<affects>
<package>
<name>node</name>
<range><lt>5.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jeremiah Senkpiel reports:</p>
<blockquote cite="https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac">
<ul>
<li><p>Fix a double-free defect in parsing malformed DSA keys
that may potentially be used for DoS or memory corruption attacks.</p></li>
<li><p>Fix a defect that can cause memory corruption in
certain very rare cases</p></li>
<li><p>Fix a defect that makes the CacheBleed Attack possible</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/nodejs/node/commit/805f054cc7791c447dbb960fbf3b179ea05294ac</url>
<cvename>CVE-2016-0702</cvename>
<cvename>CVE-2016-0705</cvename>
<cvename>CVE-2016-0797</cvename>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="8eb78cdc-e9ec-11e5-85be-14dae9d210b8">
<topic>dropbear -- authorized_keys command= bypass</topic>
<affects>
<package>
<name>dropbear</name>
<range><lt>2016.72</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matt Johnson reports:</p>
<blockquote cite="https://matt.ucc.asn.au/dropbear/CHANGES">
<p>Validate X11 forwarding input. Could allow bypass of
authorized_keys command= restrictions</p>
</blockquote>
</body>
</description>
<references>
<url>https://matt.ucc.asn.au/dropbear/CHANGES</url>
<cvename>CVE-2016-3116</cvename>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-14</entry>
</dates>
</vuln>
<vuln vid="77b7ffb7-e937-11e5-8bed-5404a68ad561">
<topic>jpgraph2 -- XSS vulnerability</topic>
<affects>
<package>
<name>jpgraph2</name>
<range><lt>3.0.7_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Martin Barbella reports:</p>
<blockquote cite="http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded">
<p>JpGraph is an object oriented library for PHP that can be used to create
various types of graphs which also contains support for client side
image maps.
The GetURLArguments function for the JpGraph's Graph class does not
properly sanitize the names of get and post variables, leading to a
cross site scripting vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded</url>
</references>
<dates>
<discovery>2009-12-22</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="5af511e5-e928-11e5-92ce-002590263bf5">
<topic>php7 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php70</name>
<name>php70-soap</name>
<range><lt>7.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-7.php#7.0.4">
<ul><li>Core:
<ul>
<li>Fixed bug #71637 (Multiple Heap Overflow due to integer
overflows in xml/filter_url/addcslashes).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #71610 (Type Confusion Vulnerability - SOAP /
make_http_soap_request()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-7.php#7.0.4</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e991ef79-e920-11e5-92ce-002590263bf5">
<topic>php5 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.33</lt></range>
</package>
<package>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The PHP Group reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.19">
<ul><li>Phar:
<ul>
<li>Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()).
</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71587 (Use-After-Free / Double-Free in WDDX
Deserialize).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.6.19</url>
<url>http://php.net/ChangeLog-5.php#5.5.33</url>
</references>
<dates>
<discovery>2016-03-03</discovery>
<entry>2016-03-13</entry>
</dates>
</vuln>
<vuln vid="e4644df8-e7da-11e5-829d-c80aa9043978">
<topic>openssh -- command injection when X11Forwarding is enabled</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.2.p2,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_14</lt></range>
<range><ge>10.1</ge><lt>10.1_31</lt></range>
<range><ge>9.3</ge><lt>9.3_39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenSSH project reports:</p>
<blockquote cite="http://www.openssh.com/txt/x11fwd.adv">
<p>Missing sanitisation of untrusted input allows an
authenticated user who is able to request X11 forwarding
to inject commands to xauth(1).
</p>
<p>Injection of xauth commands grants the ability to read
arbitrary files under the authenticated user's privilege,
Other xauth commands allow limited information leakage,
file overwrite, port probing and generally expose xauth(1),
which was not written with a hostile user in mind, as an
attack surface.
</p>
<p>Mitigation:</p>
<p>Set X11Forwarding=no in sshd_config. This is the default.</p>
<p>For authorized_keys that specify a "command" restriction,
also set the "restrict" (available in OpenSSH >=7.2) or
"no-x11-forwarding" restrictions.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/x11fwd.adv</url>
<cvename>CVE-2016-3115</cvename>
<freebsdsa>SA-16:14.openssh</freebsdsa>
</references>
<dates>
<discovery>2016-03-11</discovery>
<entry>2016-03-11</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="70c44cd0-e717-11e5-85be-14dae9d210b8">
<topic>quagga -- stack based buffer overflow vulnerability</topic>
<affects>
<package>
<name>quagga</name>
<range><lt>1.0.20160309</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Donald Sharp reports:</p>
<blockquote cite="https://www.kb.cert.org/vuls/id/270232">
<p>A malicious BGP peer may execute arbitrary code in
particularly configured remote bgpd hosts.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.kb.cert.org/vuls/id/270232</url>
<url>http://savannah.nongnu.org/forum/forum.php?forum_id=8476</url>
<cvename>CVE-2016-2342</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="d71831ef-e6f8-11e5-85be-14dae9d210b8">
<topic>ricochet -- information disclosure</topic>
<affects>
<package>
<name>ricochet</name>
<range><lt>1.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>special reports:</p>
<blockquote cite="https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2">
<p>By sending a nickname with some HTML tags in a contact
request, an attacker could cause Ricochet to make network requests
without Tor after the request is accepted, which would reveal the user's
IP address.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ricochet-im/ricochet/releases/tag/v1.1.2</url>
</references>
<dates>
<discovery>2016-02-15</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="77e0b631-e6cf-11e5-85be-14dae9d210b8">
<topic>pidgin-otr -- use after free</topic>
<affects>
<package>
<name>pidgin-otr</name>
<range><lt>4.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hanno Bock reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/572">
<p>The pidgin-otr plugin version 4.0.2 fixes a heap use after
free error.
The bug is triggered when a user tries to authenticate a buddy and
happens in the function create_smp_dialog.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2016/q1/572</url>
<url>https://bugs.otr.im/issues/88</url>
<url>https://bugs.otr.im/issues/128</url>
<cvename>CVE-2015-8833</cvename>
</references>
<dates>
<discovery>2015-04-04</discovery>
<entry>2016-03-10</entry>
</dates>
</vuln>
<vuln vid="c2b1652c-e647-11e5-85be-14dae9d210b8">
<topic>libotr -- integer overflow</topic>
<affects>
<package>
<name>libotr</name>
<range><lt>4.1.1</lt></range>
</package>
<package>
<name>libotr3</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>X41 D-Sec reports:</p>
<blockquote cite="https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/">
<p>A remote attacker may crash or execute arbitrary code in
libotr by sending large OTR messages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/</url>
<cvename>CVE-2016-2851</cvename>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-03-09</entry>
<modified>2016-03-09</modified>
</dates>
</vuln>
<vuln vid="1bcfd963-e483-41b8-ab8e-bad5c3ce49c9">
<topic>brotli -- buffer overflow</topic>
<affects>
<package>
<name>brotli</name>
<range><ge>0.3.0</ge><lt>0.3.0_1</lt></range>
<range><lt>0.2.0_2</lt></range>
</package>
<package>
<name>libbrotli</name>
<range><lt>0.3.0_3</lt></range>
</package>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>[583607] High CVE-2016-1624: Buffer overflow in Brotli. Credit to lukezli.</p>
</blockquote>
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-30/">
<p>Security researcher Luke Li reported a pointer underflow
bug in the Brotli library's decompression that leads to a
buffer overflow. This results in a potentially exploitable
crash when triggered.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1624</cvename>
<cvename>CVE-2016-1968</cvename>
<url>https://github.com/google/brotli/commit/37a320dd81db8d546cd24a45b4c61d87b45dcade</url>
<url>https://chromium.googlesource.com/chromium/src/+/7716418a27d561ee295a99f11fd3865580748de2%5E!/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-30/</url>
<url>https://hg.mozilla.org/releases/mozilla-release/rev/4a5d8ade4e3e</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="2225c5b4-1e5a-44fc-9920-b3201c384a15">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.7.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox45">
<p>MFSA 2016-16 Miscellaneous memory safety hazards (rv:45.0
/ rv:38.7)</p>
<p>MFSA 2016-17 Local file overwriting and potential
privilege escalation through CSP reports</p>
<p>MFSA 2016-18 CSP reports fail to strip location
information for embedded iframe pages</p>
<p>MFSA 2016-19 Linux video memory DOS with Intel
drivers</p>
<p>MFSA 2016-20 Memory leak in libstagefright when deleting
an array during MP4 processing</p>
<p>MFSA 2016-21 Displayed page address can be overridden</p>
<p>MFSA 2016-22 Service Worker Manager out-of-bounds read in
Service Worker Manager</p>
<p>MFSA 2016-23 Use-after-free in HTML5 string parser</p>
<p>MFSA 2016-24 Use-after-free in SetBody</p>
<p>MFSA 2016-25 Use-after-free when using multiple WebRTC
data channels</p>
<p>MFSA 2016-26 Memory corruption when modifying a file
being read by FileReader</p>
<p>MFSA 2016-27 Use-after-free during XML
transformations</p>
<p>MFSA 2016-28 Addressbar spoofing though history
navigation and Location protocol property</p>
<p>MFSA 2016-29 Same-origin policy violation using
perfomance.getEntries and history navigation with session
restore</p>
<p>MFSA 2016-31 Memory corruption with malicious NPAPI
plugin</p>
<p>MFSA 2016-32 WebRTC and LibVPX vulnerabilities found
through code inspection</p>
<p>MFSA 2016-33 Use-after-free in GetStaticInstance in
WebRTC</p>
<p>MFSA 2016-34 Out-of-bounds read in HTML parser following
a failed allocation</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1952</cvename>
<cvename>CVE-2016-1953</cvename>
<cvename>CVE-2016-1954</cvename>
<cvename>CVE-2016-1955</cvename>
<cvename>CVE-2016-1956</cvename>
<cvename>CVE-2016-1957</cvename>
<cvename>CVE-2016-1958</cvename>
<cvename>CVE-2016-1959</cvename>
<cvename>CVE-2016-1960</cvename>
<cvename>CVE-2016-1961</cvename>
<cvename>CVE-2016-1962</cvename>
<cvename>CVE-2016-1963</cvename>
<cvename>CVE-2016-1964</cvename>
<cvename>CVE-2016-1965</cvename>
<cvename>CVE-2016-1966</cvename>
<cvename>CVE-2016-1967</cvename>
<cvename>CVE-2016-1970</cvename>
<cvename>CVE-2016-1971</cvename>
<cvename>CVE-2016-1972</cvename>
<cvename>CVE-2016-1973</cvename>
<cvename>CVE-2016-1974</cvename>
<cvename>CVE-2016-1975</cvename>
<cvename>CVE-2016-1976</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-16/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-17/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-18/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-19/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-20/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-21/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-22/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-23/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-24/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-25/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-26/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-27/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-28/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-29/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-31/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-32/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-33/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-34/</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="adffe823-e692-4921-ae9c-0b825c218372">
<topic>graphite2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.6</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/">
<p>Security researcher Holger Fuhrmannek and Mozilla
security engineer Tyson Smith reported a number of security
vulnerabilities in the Graphite 2 library affecting version
1.3.5.
The issue reported by Holger Fuhrmannek is a mechanism to
induce stack corruption with a malicious graphite font. This
leads to a potentially exploitable crash when the font is
loaded.
Tyson Smith used the Address Sanitizer tool in concert with
a custom software fuzzer to find a series of uninitialized
memory, out-of-bounds read, and out-of-bounds write errors
when working with fuzzed graphite fonts.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-38/">
<p>Security researcher James Clawson used the Address
Sanitizer tool to discover an out-of-bounds write in the
Graphite 2 library when loading a crafted Graphite font
file. This results in a potentially exploitable crash.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/security/advisories/mfsa2016-37/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-38/</url>
<cvename>CVE-2016-1969</cvename>
<cvename>CVE-2016-1977</cvename>
<cvename>CVE-2016-2790</cvename>
<cvename>CVE-2016-2791</cvename>
<cvename>CVE-2016-2792</cvename>
<cvename>CVE-2016-2793</cvename>
<cvename>CVE-2016-2794</cvename>
<cvename>CVE-2016-2795</cvename>
<cvename>CVE-2016-2796</cvename>
<cvename>CVE-2016-2797</cvename>
<cvename>CVE-2016-2798</cvename>
<cvename>CVE-2016-2799</cvename>
<cvename>CVE-2016-2800</cvename>
<cvename>CVE-2016-2801</cvename>
<cvename>CVE-2016-2802</cvename>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-03-14</modified>
</dates>
</vuln>
<vuln vid="c4292768-5273-4f17-a267-c5fe35125ce4">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<range><ge>3.20</ge><lt>3.21.1</lt></range>
<range><lt>3.19.2.3</lt></range>
</package>
<package>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.21.0_1</lt></range>
<range><lt>3.19.2.3</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>45.0,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.7.0</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.42</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-35/">
<p>Security researcher Francis Gabriel reported a heap-based
buffer overflow in the way the Network Security Services
(NSS) libraries parsed certain ASN.1 structures. An attacker
could create a specially-crafted certificate which, when
parsed by NSS, would cause it to crash or execute arbitrary
code with the permissions of the user.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-36/">
<p>Mozilla developer Tim Taubert used the Address Sanitizer
tool and software fuzzing to discover a use-after-free
vulnerability while processing DER encoded keys in the
Network Security Services (NSS) libraries. The vulnerability
overwrites the freed memory with zeroes.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1950</cvename>
<cvename>CVE-2016-1979</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-35/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-36/</url>
<url>https://hg.mozilla.org/projects/nss/rev/b9a31471759d</url>
<url>https://hg.mozilla.org/projects/nss/rev/7033b1193c94</url>
</references>
<dates>
<discovery>2016-03-08</discovery>
<entry>2016-03-08</entry>
<modified>2016-09-05</modified>
</dates>
</vuln>
<vuln vid="75091516-6f4b-4059-9884-6727023dc366">
<topic>NSS -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><lt>3.21</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/">
<p>Security researcher Hanno Böck reported that calculations
with mp_div and mp_exptmod in Network Security Services
(NSS) can produce wrong results in some circumstances. These
functions are used within NSS for a variety of cryptographic
division functions, leading to potential cryptographic
weaknesses.</p>
</blockquote>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/">
<p>Mozilla developer Eric Rescorla reported that a failed
allocation during DHE and ECDHE handshakes would lead to a
use-after-free vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1938</cvename>
<cvename>CVE-2016-1978</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-07/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-15/</url>
<url>https://hg.mozilla.org/projects/nss/rev/a555bf0fc23a</url>
<url>https://hg.mozilla.org/projects/nss/rev/a245a4ccd354</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="f9e6c0d1-e4cc-11e5-b2bd-002590263bf5">
<topic>django -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py32-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>Malicious redirect and possible XSS attack via user-supplied
redirect URLs containing basic auth</p>
<p>User enumeration through timing difference on password hasher work
factor upgrade</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2512</cvename>
<cvename>CVE-2016-2513</cvename>
<url>https://www.djangoproject.com/weblog/2016/mar/01/security-releases/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="fef03980-e4c6-11e5-b2bd-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.2,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/">
<p>WordPress 4.4.2 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4.1 and earlier are affected by two security
issues: a possible SSRF for certain local URIs, reported by Ronni
Skansing; and an open redirection attack, reported by Shailesh
Suthar.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2221</cvename>
<cvename>CVE-2016-2222</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/04/6</url>
<url>https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="7f0fbb30-e462-11e5-a3f3-080027ef73ec">
<topic>PuTTY - old-style scp downloads may allow remote code execution</topic>
<affects>
<package>
<name>putty</name>
<range><lt>0.67</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Simon G. Tatham reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html">
<p>Many versions of PSCP prior to 0.67 have a stack corruption
vulnerability in their treatment of the 'sink' direction (i.e.
downloading from server to client) of the old-style SCP protocol.
</p>
<p>In order for this vulnerability to be exploited, the user must
connect to a malicious server and attempt to download any file.[...]
you can work around it in a vulnerable PSCP by using the -sftp
option to force the use of the newer SFTP protocol, provided your
server supports that protocol.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html</url>
<cvename>CVE-2016-2563</cvename>
<url>https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-07</entry>
</dates>
</vuln>
<vuln vid="12d1b5a6-e39d-11e5-9f77-5453ed2e2b49">
<topic>websvn -- reflected cross-site scripting</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Sebastien Delafond reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2016/msg00060.html">
<p>Jakub Palaczynski discovered that websvn, a web viewer for
Subversion repositories, does not correctly sanitize user-supplied
input, which allows a remote user to run reflected cross-site
scripting attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2511</cvename>
<url>https://lists.debian.org/debian-security-announce/2016/msg00060.html</url>
<url>http://seclists.org/fulldisclosure/2016/Feb/99</url>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f69e1f09-e39b-11e5-9f77-5453ed2e2b49">
<topic>websvn -- information disclosure</topic>
<affects>
<package>
<name>websvn</name>
<range><lt>2.3.3_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Thijs Kinkhorst reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682">
<p>James Clawson reported:</p>
<p>"Arbitrary files with a known path can be accessed in websvn by
committing a symlink to a repository and then downloading the file
(using the download link).</p>
<p>An attacker must have write access to the repo, and the download
option must have been enabled in the websvn config file."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-6892</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892</url>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682</url>
</references>
<dates>
<discovery>2015-01-18</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="5a016dd0-8aa8-490e-a596-55f4cc17e4ef">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.2</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.2</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/">
<p>Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These
contain the following important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2097</cvename>
<cvename>CVE-2016-2098</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ</url>
<url>http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/</url>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-06</entry>
</dates>
</vuln>
<vuln vid="f85fa236-e2a6-412e-b5c7-c42120892de5">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>49.0.2623.75</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html">
<p>[560011] High CVE-2016-1630: Same-origin bypass in Blink.</p>
<p>[569496] High CVE-2016-1631: Same-origin bypass in Pepper Plugin.</p>
<p>[549986] High CVE-2016-1632: Bad cast in Extensions.</p>
<p>[572537] High CVE-2016-1633: Use-after-free in Blink.</p>
<p>[559292] High CVE-2016-1634: Use-after-free in Blink.</p>
<p>[585268] High CVE-2016-1635: Use-after-free in Blink.</p>
<p>[584155] High CVE-2016-1636: SRI Validation Bypass.</p>
<p>[555544] Medium CVE-2016-1637: Information Leak in Skia.</p>
<p>[585282] Medium CVE-2016-1638: WebAPI Bypass.</p>
<p>[572224] Medium CVE-2016-1639: Use-after-free in WebRTC.</p>
<p>[550047] Medium CVE-2016-1640: Origin confusion in Extensions UI.</p>
<p>[583718] Medium CVE-2016-1641: Use-after-free in Favicon.</p>
<p>[591402] CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives.</p>
<p>Multiple vulnerabilities in V8 fixed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1630</cvename>
<cvename>CVE-2016-1631</cvename>
<cvename>CVE-2016-1632</cvename>
<cvename>CVE-2016-1633</cvename>
<cvename>CVE-2016-1634</cvename>
<cvename>CVE-2016-1635</cvename>
<cvename>CVE-2016-1636</cvename>
<cvename>CVE-2016-1637</cvename>
<cvename>CVE-2016-1638</cvename>
<cvename>CVE-2016-1639</cvename>
<cvename>CVE-2016-1640</cvename>
<cvename>CVE-2016-1641</cvename>
<cvename>CVE-2016-1642</cvename>
<url>http://googlechromereleases.blogspot.de/2016/03/stable-channel-update.html</url>
</references>
<dates>
<discovery>2016-03-02</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="6b3591ea-e2d2-11e5-a6be-5453ed2e2b49">
<topic>libssh -- weak Diffie-Hellman secret generation</topic>
<affects>
<package>
<name>libssh</name>
<range><lt>0.7.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Andreas Schneider reports:</p>
<blockquote cite="https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/">
<p>libssh versions 0.1 and above have a bits/bytes confusion bug and
generate an abnormally short ephemeral secret for the
diffie-hellman-group1 and diffie-hellman-group14 key exchange
methods. The resulting secret is 128 bits long, instead of the
recommended sizes of 1024 and 2048 bits respectively. There are
practical algorithms (Baby steps/Giant steps, Pollard’s rho) that can
solve this problem in O(2^63) operations.</p>
<p>Both client and server are are vulnerable, pre-authentication.
This vulnerability could be exploited by an eavesdropper with enough
resources to decrypt or intercept SSH sessions. The bug was found
during an internal code review by Aris Adamantiadis of the libssh
team.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0739</cvename>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739</url>
<url>https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/</url>
</references>
<dates>
<discovery>2016-02-23</discovery>
<entry>2016-03-05</entry>
</dates>
</vuln>
<vuln vid="7d09b9ee-e0ba-11e5-abc4-6fb07af136d2">
<topic>exim -- local privillege escalation</topic>
<affects>
<package>
<name>exim</name>
<range><lt>4.86.2</lt></range>
<range><lt>4.85.2</lt></range>
<range><lt>4.84.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Exim development team reports:</p>
<blockquote cite="https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html">
<p>All installations having Exim set-uid root and using 'perl_startup' are
vulnerable to a local privilege escalation. Any user who can start an
instance of Exim (and this is normally <strong>any</strong> user) can gain root
privileges. If you do not use 'perl_startup' you <strong>should</strong> be safe.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1531</cvename>
<url>https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="db3301be-e01c-11e5-b2bd-002590263bf5">
<topic>cacti -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><lt>0.8.8g</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Cacti Group, Inc. reports:</p>
<blockquote cite="http://www.cacti.net/release_notes_0_8_8g.php">
<p>Changelog</p>
<ul>
<li>bug:0002652: CVE-2015-8604: SQL injection in graphs_new.php</li>
<li>bug:0002655: CVE-2015-8377: SQL injection vulnerability in the
host_new_graphs_save function in graphs_new.php</li>
<li>bug:0002656: Authentication using web authentication as a user
not in the cacti database allows complete access</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8377</cvename>
<cvename>CVE-2015-8604</cvename>
<cvename>CVE-2016-2313</cvename>
<url>http://www.cacti.net/release_notes_0_8_8g.php</url>
<url>http://bugs.cacti.net/view.php?id=2652</url>
<url>http://bugs.cacti.net/view.php?id=2655</url>
<url>http://bugs.cacti.net/view.php?id=2656</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/09/3</url>
</references>
<dates>
<discovery>2016-02-21</discovery>
<entry>2016-03-02</entry>
</dates>
</vuln>
<vuln vid="f682a506-df7c-11e5-81e4-6805ca0b3d42">
<topic>phpmyadmin -- multiple XSS and a man-in-the-middle vulnerability</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-10/">
<p>XSS vulnerability in SQL parser.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-11/">
<p>Multiple XSS vulnerabilities.</p>
<p>By sending a specially crafted URL as part of the HOST
header, it is possible to trigger an XSS attack.</p>
<p>A weakness was found that allows an XSS attack with Internet
Explorer versions older than 8 and Safari on Windows using a
specially crafted URL.</p>
<p>Using a crafted SQL query, it is possible to trigger an XSS
attack through the SQL query page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in user accounts page.</p>
<p>Using a crafted parameter value, it is possible to trigger
an XSS attack in zoom search page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-12/">
<p>Multiple XSS vulnerabilities.</p>
<p>With a crafted table/column name it is possible to trigger
an XSS attack in the database normalization page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in the database structure page.</p>
<p>With a crafted parameter it is possible to trigger an XSS
attack in central columns page.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-13/">
<p>Vulnerability allowing man-in-the-middle attack on API
call to GitHub.</p>
<p>A vulnerability in the API call to GitHub can be exploited
to perform a man-in-the-middle attack.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-10/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-11/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-12/</url>
<url>https://www.phpmyadmin.net/security/PMASA-2016-13/</url>
<cvename>CVE-2016-2559</cvename>
<cvename>CVE-2016-2560</cvename>
<cvename>CVE-2016-2561</cvename>
<cvename>CVE-2016-2562</cvename>
</references>
<dates>
<discovery>2016-02-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="45117749-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2016-02</p>
<p>ASN.1 BER dissector crash. (Bug 11828) CVE-2016-2522</p></li>
<li><p>wnpa-sec-2016-03</p>
<p>DNP dissector infinite loop. (Bug 11938) CVE-2016-2523</p></li>
<li><p>wnpa-sec-2016-04</p>
<p>X.509AF dissector crash. (Bug 12002) CVE-2016-2524</p></li>
<li><p>wnpa-sec-2016-05</p>
<p>HTTP/2 dissector crash. (Bug 12077) CVE-2016-2525</p></li>
<li><p>wnpa-sec-2016-06</p>
<p>HiQnet dissector crash. (Bug 11983) CVE-2016-2526</p></li>
<li><p>wnpa-sec-2016-07</p>
<p>3GPP TS 32.423 Trace file parser crash. (Bug 11982)
</p>CVE-2016-2527</li>
<li><p>wnpa-sec-2016-08</p>
<p>LBMC dissector crash. (Bug 11984) CVE-2016-2528</p></li>
<li><p>wnpa-sec-2016-09</p>
<p>iSeries file parser crash. (Bug 11985) CVE-2016-2529</p></li>
<li><p>wnpa-sec-2016-10</p>
<p>RSL dissector crash. (Bug 11829) CVE-2016-2530
CVE-2016-2531</p></li>
<li><p>wnpa-sec-2016-11</p>
<p>LLRP dissector crash. (Bug 12048) CVE-2016-2532</p></li>
<li><p>wnpa-sec-2016-12</p>
<p>Ixia IxVeriWave file parser crash. (Bug 11795)</p></li>
<li><p>wnpa-sec-2016-13</p>
<p>IEEE 802.11 dissector crash. (Bug 11818)</p></li>
<li><p>wnpa-sec-2016-14</p>
<p>GSM A-bis OML dissector crash. (Bug 11825)</p></li>
<li><p>wnpa-sec-2016-15</p>
<p>ASN.1 BER dissector crash. (Bug 12106)</p></li>
<li><p>wnpa-sec-2016-16</p>
<p>SPICE dissector large loop. (Bug 12151)</p></li>
<li><p>wnpa-sec-2016-17</p>
<p>NFS dissector crash.</p></li>
<li><p>wnpa-sec-2016-18</p>
<p>ASN.1 BER dissector crash. (Bug 11822)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2522</cvename>
<cvename>CVE-2016-2523</cvename>
<cvename>CVE-2016-2524</cvename>
<cvename>CVE-2016-2525</cvename>
<cvename>CVE-2016-2526</cvename>
<cvename>CVE-2016-2527</cvename>
<cvename>CVE-2016-2528</cvename>
<cvename>CVE-2016-2529</cvename>
<cvename>CVE-2016-2530</cvename>
<cvename>CVE-2016-2531</cvename>
<cvename>CVE-2016-2532</cvename>
<cvename>CVE-2016-4415</cvename>
<cvename>CVE-2016-4416</cvename>
<cvename>CVE-2016-4417</cvename>
<cvename>CVE-2016-4418</cvename>
<cvename>CVE-2016-4419</cvename>
<cvename>CVE-2016-4420</cvename>
<cvename>CVE-2016-4421</cvename>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.2.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/05/01/1</url>
</references>
<dates>
<discovery>2016-02-26</discovery>
<entry>2016-03-01</entry>
<modified>2016-07-04</modified>
</dates>
</vuln>
<vuln vid="42c2c422-df55-11e5-b2bd-002590263bf5">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html">
<p>The following vulnerabilities have been fixed:</p>
<ul>
<li><p>wnpa-sec-2015-31</p>
<p>NBAP dissector crashes. (Bug 11602, Bug 11835, Bug 11841)</p>
</li>
<li><p>wnpa-sec-2015-37</p>
<p>NLM dissector crash.</p></li>
<li><p>wnpa-sec-2015-39</p>
<p>BER dissector crash.</p></li>
<li><p>wnpa-sec-2015-40</p>
<p>Zlib decompression crash. (Bug 11548)</p></li>
<li><p>wnpa-sec-2015-41</p>
<p>SCTP dissector crash. (Bug 11767)</p></li>
<li><p>wnpa-sec-2015-42</p>
<p>802.11 decryption crash. (Bug 11790, Bug 11826)</p></li>
<li><p>wnpa-sec-2015-43</p>
<p>DIAMETER dissector crash. (Bug 11792)</p></li>
<li><p>wnpa-sec-2015-44</p>
<p>VeriWave file parser crashes. (Bug 11789, Bug 11791)</p></li>
<li><p>wnpa-sec-2015-45</p>
<p>RSVP dissector crash. (Bug 11793)</p></li>
<li><p>wnpa-sec-2015-46</p>
<p>ANSI A and GSM A dissector crashes. (Bug 11797)</p></li>
<li><p>wnpa-sec-2015-47</p>
<p>Ascend file parser crash. (Bug 11794)</p></li>
<li><p>wnpa-sec-2015-48</p>
<p>NBAP dissector crash. (Bug 11815)</p></li>
<li><p>wnpa-sec-2015-49</p>
<p>RSL dissector crash. (Bug 11829)</p></li>
<li><p>wnpa-sec-2015-50</p>
<p>ZigBee ZCL dissector crash. (Bug 11830)</p></li>
<li><p>wnpa-sec-2015-51</p>
<p>Sniffer file parser crash. (Bug 11827)</p></li>
<li><p>wnpa-sec-2015-52</p>
<p>NWP dissector crash. (Bug 11726)</p></li>
<li><p>wnpa-sec-2015-53</p>
<p>BT ATT dissector crash. (Bug 11817)</p></li>
<li><p>wnpa-sec-2015-54</p>
<p>MP2T file parser crash. (Bug 11820)</p></li>
<li><p>wnpa-sec-2015-55</p>
<p>MP2T file parser crash. (Bug 11821)</p></li>
<li><p>wnpa-sec-2015-56</p>
<p>S7COMM dissector crash. (Bug 11823)</p></li>
<li><p>wnpa-sec-2015-57</p>
<p>IPMI dissector crash. (Bug 11831)</p></li>
<li><p>wnpa-sec-2015-58</p>
<p>TDS dissector crash. (Bug 11846)</p></li>
<li><p>wnpa-sec-2015-59</p>
<p>PPI dissector crash. (Bug 11876)</p></li>
<li><p>wnpa-sec-2015-60</p>
<p>MS-WSP dissector crash. (Bug 11931)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-2.0.1.html</url>
</references>
<dates>
<discovery>2015-12-29</discovery>
<entry>2016-03-01</entry>
</dates>
</vuln>
<vuln vid="7bbc3016-de63-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5346 Apache Tomcat Session fixation</p></li>
<li><p>CVE-2015-5351 Apache Tomcat CSRF token leak</p></li>
<li><p>CVE-2016-0763 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF7B.1010901@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEFB2.9030605@apache.org%3e</url>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2015-5351</cvename>
<cvename>CVE-2016-0763</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="1f1124fe-de5c-11e5-8fa8-14dae9d210b8">
<topic>tomcat -- multiple vulnerabilities</topic>
<affects>
<package>
<name>tomcat</name>
<range><lt>6.0.45</lt></range>
</package>
<package>
<name>tomcat7</name>
<range><lt>7.0.68</lt></range>
</package>
<package>
<name>tomcat8</name>
<range><lt>8.0.30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mark Thomas reports:</p>
<blockquote cite="http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e">
<ul>
<li><p>CVE-2015-5345 Apache Tomcat Directory disclosure</p></li>
<li><p>CVE-2016-0706 Apache Tomcat Security Manager bypass</p></li>
<li><p>CVE-2016-0714 Apache Tomcat Security Manager Bypass</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF96.7070701@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF6A.70703@apache.org%3e</url>
<url>http://mail-archives.apache.org/mod_mbox/www-announce/201602.mbox/%3c56CAEF4F.5090003@apache.org%3e</url>
<cvename>CVE-2015-5345</cvename>
<cvename>CVE-2015-5346</cvename>
<cvename>CVE-2016-0706</cvename>
<cvename>CVE-2016-0714</cvename>
</references>
<dates>
<discovery>2016-02-22</discovery>
<entry>2016-02-28</entry>
<modified>2017-03-18</modified>
</dates>
</vuln>
<vuln vid="a7f2e9c6-de20-11e5-8458-6cc21735f730">
<topic>xerces-c3 -- Parser Crashes on Malformed Input</topic>
<affects>
<package>
<name>xerces-c3</name>
<range><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache Software Foundation reports:</p>
<blockquote cite="http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt">
<p>The Xerces-C XML parser mishandles certain kinds of malformed input
documents, resulting in buffer overflows during processing and error
reporting. The overflows can manifest as a segmentation fault or as
memory corruption during a parse operation. The bugs allow for a
denial of service attack in many applications by an unauthenticated
attacker, and could conceivably result in remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0729</cvename>
<url>http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt</url>
</references>
<dates>
<discovery>2016-02-25</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6b1d8a39-ddb3-11e5-8fa8-14dae9d210b8">
<topic>django -- regression in permissions model</topic>
<affects>
<package>
<name>py27-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.2</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/">
<p>User with "change" but not "add" permission can create
objects for ModelAdmin’s with save_as=True</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/</url>
<cvename>CVE-2016-2048</cvename>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="81f9d6a4-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: guest user mode may crash guest with non-canonical RIP</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-170.html">
<p>VMX refuses attempts to enter a guest with an instruction pointer
which doesn't satisfy certain requirements. In particular, the
instruction pointer needs to be canonical when entering a guest
currently in 64-bit mode. This is the case even if the VM entry
information specifies an exception to be injected immediately (in
which case the bad instruction pointer would possibly never get used
for other than pushing onto the exception handler's stack).
Provided the guest OS allows user mode to map the virtual memory
space immediately below the canonical/non-canonical address
boundary, a non-canonical instruction pointer can result even from
normal user mode execution. VM entry failure, however, is fatal to
the guest.</p>
<p>Malicious HVM guest user mode code may be able to crash the
guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2271</cvename>
<url>http://xenbits.xen.org/xsa/advisory-170.html</url>
</references>
<dates>
<discovery>2016-02-17</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="80adc394-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- VMX: intercept issue with INVLPG on non-canonical address</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.3</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-168.html">
<p>While INVLPG does not cause a General Protection Fault when used on
a non-canonical address, INVVPID in its "individual address"
variant, which is used to back the intercepted INVLPG in certain
cases, fails in such cases. Failure of INVVPID results in a
hypervisor bug check.</p>
<p>A malicious guest can crash the host, leading to a Denial of
Service.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1571</cvename>
<url>http://xenbits.xen.org/xsa/advisory-168.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="7ed7c36f-ddaf-11e5-b2bd-002590263bf5">
<topic>xen-kernel -- PV superpage functionality missing sanity checks</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><eq>3.4.0</eq></range>
<range><eq>3.4.1</eq></range>
<range><ge>4.1</ge><lt>4.5.2_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-167.html">
<p>The PV superpage functionality lacks certain validity checks on
data being passed to the hypervisor by guests. This is the case
for the page identifier (MFN) passed to MMUEXT_MARK_SUPER and
MMUEXT_UNMARK_SUPER sub-ops of the HYPERVISOR_mmuext_op hypercall as
well as for various forms of page table updates.</p>
<p>Use of the feature, which is disabled by default, may have unknown
effects, ranging from information leaks through Denial of Service to
privilege escalation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1570</cvename>
<url>http://xenbits.xen.org/xsa/advisory-167.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="2d299950-ddb0-11e5-8fa8-14dae9d210b8">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle28</name>
<range><lt>2.8.10</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.4</lt></range>
</package>
<package>
<name>moodle30</name>
<range><lt>3.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Marina Glancy reports:</p>
<blockquote cite="https://moodle.org/security/">
<ul>
<li><p>MSA-16-0001: Two enrolment-related web services don't
check course visibility</p></li>
<li><p>MSA-16-0002: XSS Vulnerability in course management
search</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://moodle.org/security/</url>
<cvename>CVE-2016-0724</cvename>
<cvename>CVE-2016-0725</cvename>
</references>
<dates>
<discovery>2016-01-18</discovery>
<entry>2016-02-28</entry>
</dates>
</vuln>
<vuln vid="6540c8f0-dca3-11e5-8fa8-14dae9d210b8">
<topic>pitivi -- code execution</topic>
<affects>
<package>
<name>pitivi</name>
<range><lt>0.95</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/23/8">
<p>Double-clicking a file in the user's media library with a
specially-crafted path or filename allows for arbitrary code execution
with the permissions of the user running Pitivi.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/8</url>
<url>https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2</url>
<cvename>CVE-2015-0855</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="90c8385a-dc9f-11e5-8fa8-14dae9d210b8">
<topic>giflib -- heap overflow</topic>
<affects>
<package>
<name>giflib</name>
<range><lt>5.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Hans Jerry Illikainen reports:</p>
<blockquote cite="http://seclists.org/bugtraq/2015/Dec/114">
<p>A heap overflow may occur in the giffix utility included in
giflib-5.1.1 when processing records of the type
`IMAGE_DESC_RECORD_TYPE' due to the allocated size of `LineBuffer'
equaling the value of the logical screen width, `GifFileIn->SWidth',
while subsequently having `GifFileIn->Image.Width' bytes of data written
to it.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/bugtraq/2015/Dec/114</url>
<cvename>CVE-2015-7555</cvename>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-02-26</entry>
</dates>
</vuln>
<vuln vid="59a0af97-dbd4-11e5-8fa8-14dae9d210b8">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.38</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.43</lt></range>
</package>
<package>
<name>drupal8</name>
<range><lt>8.0.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal Security Team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2016-001">
<ul>
<li><p>File upload access bypass and denial of service (File
module - Drupal 7 and 8 - Moderately Critical)</p></li>
<li><p>Brute force amplification attacks via XML-RPC (XML-RPC
server - Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Open redirect via path manipulation (Base system -
Drupal 6, 7 and 8 - Moderately Critical) </p></li>
<li><p>Form API ignores access restrictions on submit buttons
(Form API - Drupal 6 - Critical)</p></li>
<li><p>HTTP header injection using line breaks (Base system -
Drupal 6 - Moderately Critical)</p></li>
<li><p>Open redirect via double-encoded 'destination'
parameter (Base system - Drupal 6 - Moderately Critical)</p></li>
<li><p>Reflected file download vulnerability (System module -
Drupal 6 and 7 - Moderately Critical)</p></li>
<li><p>Saving user accounts can sometimes grant the user all
roles (User module - Drupal 6 and 7 - Less Critical)</p></li>
<li><p>Email address can be matched to an account (User module
- Drupal 7 and 8 - Less Critical)</p></li>
<li><p>Session data truncation can lead to unserialization of
user provided data (Base system - Drupal 6 - Less Critical)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2016-001</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="7e01df39-db7e-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.650</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.642.2</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24">
<h1>Description</h1>
<h5>SECURITY-232 / CVE-2016-0788(Remote code execution vulnerability in remoting module)</h5>
<p>A vulnerability in the Jenkins remoting module allowed
unauthenticated remote attackers to open a JRMP listener on the
server hosting the Jenkins master process, which allowed arbitrary
code execution.</p>
<h5>SECURITY-238 / CVE-2016-0789(HTTP response splitting vulnerability)</h5>
<p>An HTTP response splitting vulnerability in the CLI command
documentation allowed attackers to craft Jenkins URLs that serve
malicious content.</p>
<h5>SECURITY-241 / CVE-2016-0790(Non-constant time comparison of API token)</h5>
<p>The verification of user-provided API tokens with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
API tokens using brute-force methods.</p>
<h5>SECURITY-245 / CVE-2016-0791(Non-constant time comparison of CSRF crumbs)</h5>
<p>The verification of user-provided CSRF crumbs with the expected
value did not use a constant-time comparison algorithm, potentially
allowing attackers to use statistical methods to determine valid
CSRF crumbs using brute-force methods.</p>
<h5>SECURITY-247 / CVE-2016-0792(Remote code execution through remote API)</h5>
<p>Jenkins has several API endpoints that allow low-privilege users
to POST XML files that then get deserialized by Jenkins.
Maliciously crafted XML files sent to these API endpoints could
result in arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Security+Advisory+2016-02-24</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-25</entry>
</dates>
</vuln>
<vuln vid="660ebbf5-daeb-11e5-b2bd-002590263bf5">
<topic>squid -- remote DoS in HTTP response processing</topic>
<affects>
<package>
<name>squid</name>
<range><lt>3.5.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:2 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_2.txt">
<p>Due to incorrect bounds checking Squid is vulnerable to a denial
of service attack when processing HTTP responses.</p>
<p>These problems allow remote servers delivering certain unusual
HTTP response syntax to trigger a denial of service for all
clients accessing the Squid service.</p>
<p>HTTP responses containing malformed headers that trigger this
issue are becoming common. We are not certain at this time if
that is a sign of malware or just broken server scripting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2569</cvename>
<cvename>CVE-2016-2570</cvename>
<cvename>CVE-2016-2571</cvename>
<freebsdpr>ports/207454</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_2.txt</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/24/12</url>
</references>
<dates>
<discovery>2016-02-24</discovery>
<entry>2016-02-24</entry>
<modified>2016-02-28</modified>
</dates>
</vuln>
<vuln vid="9e5bbffc-d8ac-11e5-b2bd-002590263bf5">
<topic>bsh -- remote code execution vulnerability</topic>
<affects>
<package>
<name>bsh</name>
<range><lt>2.0.b6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stian Soiland-Reyes reports:</p>
<blockquote cite="https://github.com/beanshell/beanshell/releases/tag/2.0b6">
<p>This release fixes a remote code execution vulnerability that was
identified in BeanShell by Alvaro Muñoz and Christian Schneider.
The BeanShell team would like to thank them for their help and
contributions to this fix!</p>
<p>An application that includes BeanShell on the classpath may be
vulnerable if another part of the application uses Java
serialization or XStream to deserialize data from an untrusted
source.</p>
<p>A vulnerable application could be exploited for remote code
execution, including executing arbitrary shell commands.</p>
<p>This update fixes the vulnerability in BeanShell, but it is worth
noting that applications doing such deserialization might still be
insecure through other libraries. It is recommended that application
developers take further measures such as using a restricted class
loader when deserializing. See notes on Java serialization security
XStream security and How to secure deserialization from untrusted
input without using encryption or sealing.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2510</cvename>
<freebsdpr>ports/207334</freebsdpr>
<url>https://github.com/beanshell/beanshell/releases/tag/2.0b6</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="6171eb07-d8a9-11e5-b2bd-002590263bf5">
<topic>libsrtp -- DoS via crafted RTP header vulnerability</topic>
<affects>
<package>
<name>libsrtp</name>
<range><lt>1.5.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libsrtp reports:</p>
<blockquote cite="https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2">
<p>Prevent potential DoS attack due to lack of bounds checking on RTP
header CSRC count and extension header length. Credit goes to
Randell Jesup and the Firefox team for reporting this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6360</cvename>
<freebsdpr>ports/207003</freebsdpr>
<url>https://github.com/cisco/libsrtp/releases/tag/v1.5.3</url>
<url>https://github.com/cisco/libsrtp/commit/704a31774db0dd941094fd2b47c21638b8dc3de2</url>
<url>https://github.com/cisco/libsrtp/commit/be95365fbb4788b688cab7af61c65b7989055fb4</url>
<url>https://github.com/cisco/libsrtp/commit/be06686c8e98cc7bd934e10abb6f5e971d03f8ee</url>
<url>https://github.com/cisco/libsrtp/commit/cdc69f2acde796a4152a250f869271298abc233f</url>
</references>
<dates>
<discovery>2015-11-02</discovery>
<entry>2016-02-21</entry>
</dates>
</vuln>
<vuln vid="006e3b7c-d7d7-11e5-b85f-0018fe623f2b">
<topic>jasper -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jasper</name>
<range><lt>1.900.1_16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-012.html">
<p>The library is affected by a double-free vulnerability in function
jas_iccattrval_destroy()
as well as a heap-based buffer overflow in function jp2_decode().
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-001.html">
<p>The library is affected by an off-by-one error in a buffer boundary check
in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well
as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to
stack overflow.
A specially crafted jp2 file can be used to trigger the vulnerabilities.</p>
</blockquote>
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2014-009.html">
<p>Multiple off-by-one flaws, leading to heap-based buffer overflows, were
found in the way JasPer decoded JPEG 2000 files. A specially crafted file
could cause an application using JasPer to crash or,
possibly, execute arbitrary code.</p>
</blockquote>
<p>limingxing reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2016/q1/233">
<p>A vulnerability was found in the way the JasPer's jas_matrix_clip()
function parses certain JPEG 2000 image files. A specially crafted file
could cause an application using JasPer to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2014-012.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173157</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1173162</url>
<url>http://www.ocert.org/advisories/ocert-2015-001.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1179282</url>
<url>http://www.ocert.org/advisories/ocert-2014-009.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1167537</url>
<url>http://seclists.org/oss-sec/2016/q1/233</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1302636</url>
<cvename>CVE-2014-8137</cvename>
<cvename>CVE-2014-8138</cvename>
<cvename>CVE-2014-8157</cvename>
<cvename>CVE-2014-8158</cvename>
<cvename>CVE-2014-9029</cvename>
<cvename>CVE-2016-2089</cvename>
</references>
<dates>
<discovery>2014-12-10</discovery>
<entry>2016-02-20</entry>
<modified>2016-02-24</modified>
</dates>
</vuln>
<vuln vid="368993bb-d685-11e5-8858-00262d5ed8ee">
<topic>chromium -- same origin bypass</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.116</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html">
<p>[583431] Critical CVE-2016-1629: Same-origin bypass in Blink
and Sandbox escape in Chrome. Credit to anonymous.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1629</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_18.html</url>
</references>
<dates>
<discovery>2016-02-18</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="2dd7e97e-d5e8-11e5-bcbd-bc5ff45d0f28">
<topic>glibc -- getaddrinfo stack-based buffer overflow</topic>
<affects>
<package>
<name>linux_base-c6</name>
<name>linux_base-c6_64</name>
<range><lt>6.7_1</lt></range>
</package>
<package>
<name>linux_base-f10</name>
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabio Olive Leite reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547">
<p>A stack-based buffer overflow was found in libresolv when invoked
from nss_dns, allowing specially crafted DNS responses to seize
control of EIP in the DNS client. The buffer overflow occurs in the
functions send_dg (send datagram) and send_vc (send TCP) for the
NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC
family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or
AF_INET6 in some cases) triggers the low-level resolver code to
send out two parallel queries for A and AAAA. A mismanagement of
the buffers used for those queries could result in the response of
a query writing beyond the alloca allocated buffer created by
__res_nquery.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7547</cvename>
<freebsdpr>ports/207272</freebsdpr>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7547</url>
<url>https://blog.des.no/2016/02/freebsd-and-cve-2015-7547/</url>
<url>https://googleonlinesecurity.blogspot.no/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html</url>
<url>https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="56562efb-d5e4-11e5-b2bd-002590263bf5">
<topic>squid -- SSL/TLS processing remote DoS</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.13</ge><lt>3.5.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Squid security advisory 2016:1 reports:</p>
<blockquote cite="http://www.squid-cache.org/Advisories/SQUID-2016_1.txt">
<p>Due to incorrectly handling server errors Squid is vulnerable to a
denial of service attack when connecting to TLS or SSL servers.</p>
<p>This problem allows any trusted client to perform a denial of
service attack on the Squid service regardless of whether TLS or
SSL is configured for use in the proxy.</p>
<p>Misconfigured client or server software may trigger this issue
to perform a denial of service unintentionally.</p>
<p>However, the bug is exploitable only if Squid is built using the
--with-openssl option.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<cvename>CVE-2016-2390</cvename>
<freebsdpr>ports/207294</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2016_1.txt</url>
</references>
<dates>
<discovery>2016-02-16</discovery>
<entry>2016-02-18</entry>
</dates>
</vuln>
<vuln vid="dd563930-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- remote code execution</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b">
<p>Fix remote code execution in SQLite query</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/e5352cc5acad21513bb02677e2021b80bf7e7b8b</url>
</references>
<dates>
<discovery>2016-02-06</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="18201a1c-d59a-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66">
<p>Fix XSS in indexes (non-MySQL only)</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/4be0b6655e0bf415960659db2a6dd4e60eebbd66</url>
</references>
<dates>
<discovery>2015-11-08</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="ad91ee9b-d599-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c">
<p>Fix XSS in alter table</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/596f8df373cd3efe5bcb6013858bd7a6bb5ecb2c</url>
</references>
<dates>
<discovery>2015-08-05</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="8cf54d73-d591-11e5-8fa8-14dae9d210b8">
<topic>adminer -- XSS vulnerability</topic>
<affects>
<package>
<name>adminer</name>
<range><lt>4.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jakub Vrana reports:</p>
<blockquote cite="https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5">
<p>Fix XSS in login form</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/vrana/adminer/commit/c990de3b3ee1816afb130bd0e1570577bf54a8e5</url>
<url>https://sourceforge.net/p/adminer/bugs-and-features/436/</url>
</references>
<dates>
<discovery>2015-01-30</discovery>
<entry>2016-02-17</entry>
</dates>
</vuln>
<vuln vid="95b92e3b-d451-11e5-9794-e8e0b747a45a">
<topic>libgcrypt -- side-channel attack on ECDH</topic>
<affects>
<package>
<name>libgcrypt</name>
<range><lt>1.6.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>GnuPG reports:</p>
<blockquote cite="https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html">
<p>Mitigate side-channel attack on ECDH with Weierstrass curves.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7511</cvename>
<url>https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000384.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="f1bf28c5-d447-11e5-b2bd-002590263bf5">
<topic>xdelta3 -- buffer overflow vulnerability</topic>
<affects>
<package>
<name>xdelta3</name>
<range><lt>3.0.9,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Stepan Golosunov reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/02/08/1">
<p>Buffer overflow was found and fixed in xdelta3 binary diff tool
that allows arbitrary code execution from input files at least on
some systems.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-9765</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/02/08/1</url>
<url>https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2</url>
</references>
<dates>
<discovery>2014-10-08</discovery>
<entry>2016-02-16</entry>
</dates>
</vuln>
<vuln vid="172b22cb-d3f6-11e5-ac9e-485d605f4717">
<topic>firefox -- Same-origin-policy violation using Service Workers with plugins</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>44.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44.0.2">
<p>MFSA 2016-13 Jason Pang of OneSignal reported that service workers intercept
responses to plugin network requests made through the browser. Plugins which
make security decisions based on the content of network requests can have these
decisions subverted if a service worker forges responses to those requests. For
example, a forged crossdomain.xml could allow a malicious site to violate the
same-origin policy using the Flash plugin.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1949</cvename>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/</url>
</references>
<dates>
<discovery>2016-02-11</discovery>
<entry>2016-02-15</entry>
</dates>
</vuln>
<vuln vid="07718e2b-d29d-11e5-a95f-b499baebfeaf">
<topic>nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/">
<p>Out of memory in nghttpd, nghttp, and libnghttp2_asio applications
due to unlimited incoming HTTP header fields.</p>
<p>nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage
for the incoming HTTP header field. If peer sends specially crafted HTTP/2
HEADERS frames and CONTINUATION frames, they will crash with out of memory
error.</p>
<p>Note that libnghttp2 itself is not affected by this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>http://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/</url>
<cvename>CVE-2016-1544</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-13</entry>
</dates>
</vuln>
<vuln vid="3aa8b781-d2c4-11e5-b2bd-002590263bf5">
<topic>horde -- XSS vulnerabilities</topic>
<affects>
<package>
<name>horde</name>
<range><lt>5.2.9</lt></range>
</package>
<package>
<name>pear-Horde_Core</name>
<range><lt>2.22.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Horde Team reports:</p>
<blockquote cite="http://lists.horde.org/archives/announce/2016/001149.html">
<p>Fixed XSS vulnerabilities in menu bar and form renderer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8807</cvename>
<cvename>CVE-2016-2228</cvename>
<url>https://github.com/horde/horde/commit/11d74fa5a22fe626c5e5a010b703cd46a136f253</url>
<url>https://bugs.horde.org/ticket/14213</url>
<url>https://github.com/horde/horde/commit/f03301cf6edcca57121a15e80014c4d0f29d99a0</url>
<url>https://github.com/horde/horde/commit/ab07a1b447de34e13983b4d7ceb18b58c3a358d8</url>
<url>http://www.openwall.com/lists/oss-security/2016/02/06/4</url>
<url>http://lists.horde.org/archives/announce/2016/001149.html</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-14</entry>
</dates>
</vuln>
<vuln vid="e8b6605b-d29f-11e5-8458-6cc21735f730">
<topic>PostgreSQL -- Security Fixes for Regular Expressions, PL/Java.</topic>
<affects>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.20</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.15</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.11</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.6</lt></range>
</package>
<package>
<name>postgresql95-server</name>
<range><ge>9.5.0</ge><lt>9.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1644/">
<p>
Security Fixes for Regular Expressions, PL/Java
</p>
<ul>
<li>CVE-2016-0773: This release closes security hole CVE-2016-0773,
an issue with regular expression (regex) parsing. Prior code allowed
users to pass in expressions which included out-of-range Unicode
characters, triggering a backend crash. This issue is critical for
PostgreSQL systems with untrusted users or which generate regexes
based on user input.
</li>
<li>CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege
escalation issue for users of PL/Java. Certain custom configuration
settings (GUCS) for PL/Java will now be modifiable only by the
database superuser
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0773</cvename>
<cvename>CVE-2016-0766</cvename>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-12</entry>
</dates>
</vuln>
<vuln vid="5d8e56c3-9e67-4d5b-81c9-3a409dfd705f">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.569</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-04.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2016-0985).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2016-0973, CVE-2016-0974,
CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, CVE-2016-0984).</p>
<p>These updates resolve a heap buffer overflow vulnerability
that could lead to code execution (CVE-2016-0971).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2016-0964,
CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968,
CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976,
CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980,
CVE-2016-0981).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0964</cvename>
<cvename>CVE-2016-0965</cvename>
<cvename>CVE-2016-0966</cvename>
<cvename>CVE-2016-0967</cvename>
<cvename>CVE-2016-0968</cvename>
<cvename>CVE-2016-0969</cvename>
<cvename>CVE-2016-0970</cvename>
<cvename>CVE-2016-0971</cvename>
<cvename>CVE-2016-0972</cvename>
<cvename>CVE-2016-0973</cvename>
<cvename>CVE-2016-0974</cvename>
<cvename>CVE-2016-0975</cvename>
<cvename>CVE-2016-0976</cvename>
<cvename>CVE-2016-0977</cvename>
<cvename>CVE-2016-0978</cvename>
<cvename>CVE-2016-0979</cvename>
<cvename>CVE-2016-0980</cvename>
<cvename>CVE-2016-0981</cvename>
<cvename>CVE-2016-0982</cvename>
<cvename>CVE-2016-0983</cvename>
<cvename>CVE-2016-0984</cvename>
<cvename>CVE-2016-0985</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-04.html</url>
</references>
<dates>
<discovery>2016-02-09</discovery>
<entry>2016-02-10</entry>
</dates>
</vuln>
<vuln vid="515b4327-cf8a-11e5-96d6-14dae9d210b8">
<topic>dnscrypt-proxy -- code execution</topic>
<affects>
<package>
<name>dnscrypt-proxy</name>
<range><ge>1.1.0</ge><lt>1.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Frank Denis reports:</p>
<blockquote cite="https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8">
<p>Malformed packets could lead to denial of service or code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/jedisct1/dnscrypt-proxy/blob/1d129f7d5f0d469308967cbe4eacb4a6919f1fa1/NEWS#L2-L8</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-10</entry>
<modified>2016-02-14</modified>
</dates>
</vuln>
<vuln vid="36034227-cf81-11e5-9c2b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.109</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html">
<p>6 security fixes in this release, including:</p>
<ul>
<li>[546677] High CVE-2016-1622: Same-origin bypass in Extensions.
Credit to anonymous.</li>
<li>[577105] High CVE-2016-1623: Same-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[509313] Medium CVE-2016-1625: Navigation bypass in Chrome
Instant. Credit to Jann Horn.</li>
<li>[571480] Medium CVE-2016-1626: Out-of-bounds read in PDFium.
Credit to anonymous, working with HP's Zero Day Initiative.</li>
<li>[585517] CVE-2016-1627: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1622</cvename>
<cvename>CVE-2016-1623</cvename>
<cvename>CVE-2016-1625</cvename>
<cvename>CVE-2016-1626</cvename>
<cvename>CVE-2016-1627</cvename>
<url>http://googlechromereleases.blogspot.nl/2016/02/stable-channel-update_9.html</url>
</references>
<dates>
<discovery>2016-02-08</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="8f10fa04-cf6a-11e5-96d6-14dae9d210b8">
<topic>graphite2 -- code execution vulnerability</topic>
<affects>
<package>
<name>graphite2</name>
<range><lt>1.3.5</lt></range>
</package>
<package>
<name>silgraphite</name>
<range><lt>2.3.1_4</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html">
<ul>
<li><p>An exploitable denial of service vulnerability exists
in the font handling of Libgraphite. A specially crafted font can cause
an out-of-bounds read potentially resulting in an information leak or
denial of service.</p></li>
<li><p>A specially crafted font can cause a buffer overflow
resulting in potential code execution.</p></li>
<li><p>An exploitable NULL pointer dereference exists in the
bidirectional font handling functionality of Libgraphite. A specially
crafted font can cause a NULL pointer dereference resulting in a
crash.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html</url>
<url>http://www.talosintel.com/reports/TALOS-2016-0061/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-14/</url>
<cvename>CVE-2016-1521</cvename>
<cvename>CVE-2016-1522</cvename>
<cvename>CVE-2016-1523</cvename>
<cvename>CVE-2016-1526</cvename>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="1cecd5e0-c372-11e5-96d6-14dae9d210b8">
<topic>xymon-server -- multiple vulnerabilities</topic>
<affects>
<package>
<name>xymon-server</name>
<range><lt>4.3.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>J.C. Cleaver reports:</p>
<blockquote cite="http://lists.xymon.com/pipermail/xymon/2016-February/042986.html">
<ul>
<li><p>CVE-2016-2054: Buffer overflow in xymond handling of
"config" command</p></li>
<li><p> CVE-2016-2055: Access to possibly confidential files
in the Xymon configuration directory</p></li>
<li><p>CVE-2016-2056: Shell command injection in the
"useradm" and "chpasswd" web applications</p></li>
<li><p>CVE-2016-2057: Incorrect permissions on IPC queues
used by the xymond daemon can bypass IP access filtering</p></li>
<li><p>CVE-2016-2058: Javascript injection in "detailed status
webpage" of monitoring items; XSS vulnerability via malformed
acknowledgment messages</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.xymon.com/pipermail/xymon/2016-February/042986.html</url>
<cvename>CVE-2016-2054</cvename>
<cvename>CVE-2016-2055</cvename>
<cvename>CVE-2016-2056</cvename>
<cvename>CVE-2016-2057</cvename>
<cvename>CVE-2016-2058</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="85eb4e46-cf16-11e5-840f-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-phar</name>
<name>php55-wddx</name>
<range><lt>5.5.32</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-phar</name>
<name>php56-wddx</name>
<range><lt>5.6.18</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.6.18">
<ul><li>Core:
<ul>
<li>Fixed bug #71039 (exec functions ignore length but look for NULL
termination).</li>
<li>Fixed bug #71323 (Output of stream_get_meta_data can be
falsified by its input).</li>
<li>Fixed bug #71459 (Integer overflow in iptcembed()).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Upgraded bundled PCRE library to 8.38.(CVE-2015-8383,
CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)</li>
</ul></li>
<li>Phar:
<ul>
<li>Fixed bug #71354 (Heap corruption in tar/zip/phar parser).</li>
<li>Fixed bug #71391 (NULL Pointer Dereference in
phar_tar_setupmetadata()).</li>
<li>Fixed bug #71488 (Stack overflow when decompressing tar
archives). (CVE-2016-2554)</li>
</ul></li>
<li>WDDX:
<ul>
<li>Fixed bug #71335 (Type Confusion in WDDX Packet
Deserialization).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8383</cvename>
<cvename>CVE-2015-8386</cvename>
<cvename>CVE-2015-8387</cvename>
<cvename>CVE-2015-8389</cvename>
<cvename>CVE-2015-8390</cvename>
<cvename>CVE-2015-8391</cvename>
<cvename>CVE-2015-8393</cvename>
<cvename>CVE-2015-8394</cvename>
<cvename>CVE-2016-2554</cvename>
<url>http://php.net/ChangeLog-5.php#5.6.18</url>
<url>http://php.net/ChangeLog-5.php#5.5.32</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
<modified>2016-03-13</modified>
</dates>
</vuln>
<vuln vid="a8de962a-cf15-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in PCD decoder</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, PcdDecode.c has a buffer overflow error.</p>
<p>The state.buffer for PcdDecode.c is allocated based on a 3 bytes
per pixel sizing, where PcdDecode.c wrote into the buffer assuming
4 bytes per pixel. This writes 768 bytes beyond the end of the
buffer into other Python object storage. In some cases, this causes
a segfault, in others an internal Python malloc error.</p>
</blockquote>
</body>
</description>
<references>
<mlist>http://openwall.com/lists/oss-security/2016/02/02/5</mlist>
<url>https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4</url>
<url>https://github.com/python-pillow/Pillow/issues/568</url>
</references>
<dates>
<discovery>2016-02-02</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="0519db18-cf15-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Integer overflow in Resample.c</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>If a large value was passed into the new size for an image, it is
possible to overflow an int32 value passed into malloc, leading the
malloc’d buffer to be undersized. These allocations are followed by
a loop that writes out of bounds. This can lead to corruption on
the heap of the Python process with attacker controlled float
data.</p>
<p>This issue was found by Ned Williamson.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798</url>
<url>https://github.com/python-pillow/Pillow/issues/1710</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ea60e00-cf13-11e5-805c-5453ed2e2b49">
<topic>py-imaging, py-pillow -- Buffer overflow in FLI decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
<package>
<name>py27-imaging</name>
<range><lt>1.1.7_6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, FliDecode.c has a buffer overflow error.</p>
<p>There is a memcpy error where x is added to a target buffer
address. X is used in several internal temporary variable roles,
but can take a value up to the width of the image. Im->image[y]
is a set of row pointers to segments of memory that are the size of
the row. At the max y, this will write the contents of the line off
the end of the memory buffer, causing a segfault.</p>
<p>This issue was found by Alyssa Besseling at Atlassian.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0775</cvename>
<url>https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec</url>
</references>
<dates>
<discovery>2016-02-05</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="53252879-cf11-11e5-805c-5453ed2e2b49">
<topic>py-pillow -- Buffer overflow in TIFF decoding code</topic>
<affects>
<package>
<name>py27-pillow</name>
<name>py33-pillow</name>
<name>py34-pillow</name>
<name>py35-pillow</name>
<range><lt>2.9.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Pillow maintainers report:</p>
<blockquote cite="https://pillow.readthedocs.org/en/3.1.x/releasenotes/3.1.1.html">
<p>Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on
x64 may overflow a buffer when reading a specially crafted tiff
file.</p>
<p>Specifically, libtiff >= 4.0.0 changed the return type of
TIFFScanlineSize from int32 to machine dependent int32|64. If the
scanline is sized so that it overflows an int32, it may be
interpreted as a negative number, which will then pass the size check
in TiffDecode.c line 236. To do this, the logical scanline size has
to be > 2gb, and for the test file, the allocated buffer size is 64k
against a roughly 4gb scan line size. Any image data over 64k is
written over the heap, causing a segfault.</p>
<p>This issue was found by security researcher FourOne.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-0740</cvename>
<url>https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e</url>
</references>
<dates>
<discovery>2016-02-04</discovery>
<entry>2016-02-09</entry>
</dates>
</vuln>
<vuln vid="6ac79ed8-ccc2-11e5-932b-5404a68ad561">
<topic>ffmpeg -- remote denial of service in JPEG2000 decoder</topic>
<affects>
<package>
<name>ffmpeg</name>
<range><lt>2.8.6,1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_3</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>FFmpeg security reports:</p>
<blockquote cite="https://www.ffmpeg.org/security.html">
<p>FFmpeg 2.8.6 fixes the following vulnerabilities:
CVE-2016-2213</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2213</cvename>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-02-06</entry>
</dates>
</vuln>
<vuln vid="448047e9-030e-4ce4-910b-f21a3ad5d9a0">
<topic>shotwell -- not verifying certificates</topic>
<affects>
<package>
<name>shotwell</name>
<range><lt>0.22.0.99</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Catanzaro reports:</p>
<blockquote cite="https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html">
<p>Shotwell has a serious security issue ("Shotwell does not
verify TLS certificates"). Upstream is no longer active and
I do not expect any further upstream releases unless someone
from the community steps up to maintain it.</p>
<p>What is the impact of the issue? If you ever used any of
the publish functionality (publish to Facebook, publish to
Flickr, etc.), your passwords may have been stolen; changing
them is not a bad idea.</p>
<p>What is the risk of the update? Regressions. The easiest
way to validate TLS certificates was to upgrade WebKit; it
seems to work but I don't have accounts with the online
services it supports, so I don't know if photo publishing
still works properly on all the services.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/distributor-list/2016-January/msg00000.html</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-02-05</entry>
</dates>
</vuln>
<vuln vid="1091d2d1-cb2e-11e5-b14b-bcaec565249c">
<topic>webkit -- UI spoof</topic>
<affects>
<package>
<name>webkit-gtk2</name>
<name>webkit-gtk3</name>
<range><lt>2.4.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>webkit reports:</p>
<blockquote cite="http://webkitgtk.org/security/WSA-2015-0002.html">
<p>The ScrollView::paint function in platform/scroll/ScrollView.cpp
in Blink, as used in Google Chrome before 35.0.1916.114, allows
remote attackers to spoof the UI by extending scrollbar painting
into the parent frame.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1748</cvename>
<url>http://webkitgtk.org/security/WSA-2015-0002.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="e78bfc9d-cb1e-11e5-b251-0050562a4d7b">
<topic>py-rsa -- Bleichenbacher'06 signature forgery vulnerability</topic>
<affects>
<package>
<name>py27-rsa</name>
<name>py32-rsa</name>
<name>py33-rsa</name>
<name>py34-rsa</name>
<name>py35-rsa</name>
<range><lt>3.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Filippo Valsorda reports:</p>
<blockquote cite="https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/">
<p>
python-rsa is vulnerable to a straightforward variant of the
Bleichenbacher'06 attack against RSA signature verification
with low public exponent.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1494</cvename>
<url>https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/</url>
<url>https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by</url>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/3</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/05/1</url>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-02-04</entry>
</dates>
</vuln>
<vuln vid="559f3d1b-cb1d-11e5-80a4-001999f8d30b">
<topic>asterisk -- Multiple vulnerabilities</topic>
<affects>
<package>
<name>asterisk</name>
<range><lt>1.8.32.3_5</lt></range>
</package>
<package>
<name>asterisk11</name>
<range><lt>11.21.1</lt></range>
</package>
<package>
<name>asterisk13</name>
<range><lt>13.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Asterisk project reports:</p>
<blockquote cite="http://www.asterisk.org/downloads/security-advisories">
<p>AST-2016-001 - BEAST vulnerability in HTTP server</p>
<p>AST-2016-002 - File descriptor exhaustion in chan_sip</p>
<p>AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data</p>
</blockquote>
</body>
</description>
<references>
<url>http://downloads.asterisk.org/pub/security/AST-2016-001.html</url>
<cvename>CVE-2011-3389</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-002.html</url>
<cvename>CVE-2016-2316</cvename>
<url>http://downloads.asterisk.org/pub/security/AST-2016-003.html</url>
<cvename>CVE-2016-2232</cvename>
</references>
<dates>
<discovery>2016-02-03</discovery>
<entry>2016-02-04</entry>
<modified>2016-03-07</modified>
</dates>
</vuln>
<vuln vid="0652005e-ca96-11e5-96d6-14dae9d210b8">
<topic>salt -- code execution</topic>
<affects>
<package>
<name>py27-salt</name>
<name>py32-salt</name>
<name>py33-salt</name>
<name>py34-salt</name>
<name>py35-salt</name>
<range><ge>2015.8.0</ge><lt>2015.8.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>SaltStack reports:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html">
<p>Improper handling of clear messages on the minion, which
could result in executing commands not sent by the master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.4.html</url>
<url>https://github.com/saltstack/salt/pull/30613/files</url>
<cvename>CVE-2016-1866</cvename>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-03</entry>
</dates>
</vuln>
<vuln vid="bb0ef21d-0e1b-461b-bc3d-9cba39948888">
<topic>rails -- multiple vulnerabilities</topic>
<affects>
<package>
<name>rubygem-actionpack</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-actionpack4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-actionview</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activemodel4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-activerecord</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-activerecord4</name>
<range><lt>4.2.5.1</lt></range>
</package>
<package>
<name>rubygem-rails</name>
<range><lt>3.2.22.1</lt></range>
</package>
<package>
<name>rubygem-rails-html-sanitizer</name>
<range><lt>1.0.3</lt></range>
</package>
<package>
<name>rubygem-rails4</name>
<range><lt>4.2.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby on Rails blog:</p>
<blockquote cite="http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/">
<p>Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been
released! These contain important security fixes, and it is
recommended that users upgrade as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7576</cvename>
<cvename>CVE-2015-7577</cvename>
<cvename>CVE-2015-7581</cvename>
<cvename>CVE-2016-0751</cvename>
<cvename>CVE-2016-0752</cvename>
<cvename>CVE-2016-0753</cvename>
<url>https://groups.google.com/d/msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ</url>
<url>https://groups.google.com/d/msg/rubyonrails-security/6jQVC1geukQ/8oYETcxbFQAJ</url>
<url>http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/</url>
</references>
<dates>
<discovery>2016-01-25</discovery>
<entry>2016-02-02</entry>
</dates>
</vuln>
<vuln vid="a52a7172-c92e-11e5-96d6-14dae9d210b8">
<topic>socat -- diffie hellman parameter was not prime</topic>
<affects>
<package>
<name>socat</name>
<range><ge>1.7.2.5</ge><lt>1.7.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>socat reports:</p>
<blockquote cite="http://www.dest-unreach.org/socat/contrib/socat-secadv7.html">
<p>In the OpenSSL address implementation the hard coded 1024
bit DH p parameter was not prime. The effective cryptographic strength
of a key exchange using these parameters was weaker than the one one
could get by using a prime p. Moreover, since there is no indication of
how these parameters were chosen, the existence of a trapdoor that makes
possible for an eavesdropper to recover the shared secret from a key
exchange that uses them cannot be ruled out.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.dest-unreach.org/socat/contrib/socat-secadv7.html</url>
</references>
<dates>
<discovery>2016-02-01</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="4f00dac0-1e18-4481-95af-7aaad63fd303">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<name>linux-firefox</name>
<range><lt>44.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<name>linux-seamonkey</name>
<range><lt>2.41</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.6.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<name>thunderbird</name>
<name>linux-thunderbird</name>
<range><lt>38.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mozilla Foundation reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox44">
<p>MFSA 2016-01 Miscellaneous memory safety hazards (rv:44.0
/ rv:38.6)</p>
<p>MFSA 2016-02 Out of Memory crash when parsing GIF format
images</p>
<p>MFSA 2016-03 Buffer overflow in WebGL after out of memory
allocation</p>
<p>MFSA 2016-04 Firefox allows for control characters to be
set in cookie names</p>
<p>MFSA 2016-06 Missing delay following user click events in
protocol handler dialog</p>
<p>MFSA 2016-09 Addressbar spoofing attacks</p>
<p>MFSA 2016-10 Unsafe memory manipulation found through
code inspection</p>
<p>MFSA 2016-11 Application Reputation service disabled in
Firefox 43</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2016-1930</cvename>
<cvename>CVE-2016-1931</cvename>
<cvename>CVE-2016-1933</cvename>
<cvename>CVE-2016-1935</cvename>
<cvename>CVE-2016-1937</cvename>
<cvename>CVE-2016-1939</cvename>
<cvename>CVE-2016-1942</cvename>
<cvename>CVE-2016-1943</cvename>
<cvename>CVE-2016-1944</cvename>
<cvename>CVE-2016-1945</cvename>
<cvename>CVE-2016-1946</cvename>
<cvename>CVE-2016-1947</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2016-01/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-02/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-03/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-04/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-06/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-09/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-10/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2016-11/</url>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-02-01</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="e00d8b94-c88a-11e5-b5fe-002590263bf5">
<topic>gdcm -- multiple vulnerabilities</topic>
<affects>
<package>
<name>gdcm</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CENSUS S.A. reports:</p>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an integer overflow vulnerability which leads to a buffer
overflow and potentially to remote code execution.</p>
</blockquote>
<blockquote cite="http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/">
<p>GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are
prone to an out-of-bounds read vulnerability due to missing checks.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8396</cvename>
<cvename>CVE-2015-8397</cvename>
<url>http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/</url>
<url>http://census-labs.com/news/2016/01/11/gdcm-out-bounds-read-jpeglscodec-decodeextent/</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-02-01</entry>
</dates>
</vuln>
<vuln vid="c1c18ee1-c711-11e5-96d6-14dae9d210b8">
<topic>nginx -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nginx</name>
<range><lt>1.8.1,2</lt></range>
</package>
<package>
<name>nginx-devel</name>
<range><lt>1.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Maxim Dounin reports:</p>
<blockquote cite="http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html">
<p>Several problems in nginx resolver were identified, which
might allow an attacker to cause worker process crash, or might have
potential other impact if the "resolver" directive
is used in a configuration file.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html</url>
<cvename>CVE-2016-0742</cvename>
<cvename>CVE-2016-0746</cvename>
<cvename>CVE-2016-0747</cvename>
</references>
<dates>
<discovery>2016-01-26</discovery>
<entry>2016-01-30</entry>
</dates>
</vuln>
<vuln vid="a0d77bc8-c6a7-11e5-96d6-14dae9d210b8">
<topic>typo3 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>typo3</name>
<range><lt>7.6.1</lt></range>
</package>
<package>
<name>typo3-lts</name>
<range><lt>6.2.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>TYPO3 Security Team reports:</p>
<blockquote cite="http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html">
<p>It has been discovered that TYPO3 CMS is susceptible to
Cross-Site Scripting and Cross-Site Flashing.</p>
</blockquote>
</body>
</description>
<references>
<url>http://lists.typo3.org/pipermail/typo3-announce/2015/000351.html</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-010/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/</url>
<url>https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="93eadedb-c6a6-11e5-96d6-14dae9d210b8">
<topic>nghttp2 -- use after free</topic>
<affects>
<package>
<name>nghttp2</name>
<range><lt>1.6.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>nghttp2 reports:</p>
<blockquote cite="https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/">
<p>This release fixes heap-use-after-free bug in idle stream
handling code. We strongly recommend to upgrade the older installation
to this latest version as soon as possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/</url>
<cvename>CVE-2015-8659</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="3166222b-c6a4-11e5-96d6-14dae9d210b8">
<topic>owncloud -- multiple vulnerabilities</topic>
<affects>
<package>
<name>owncloud</name>
<range><lt>8.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Owncloud reports:</p>
<blockquote cite="https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/">
<ul>
<li><p>Reflected XSS in OCS provider discovery
(oC-SA-2016-001)</p></li>
<li><p>Information Exposure Through Directory Listing in the
file scanner (oC-SA-2016-002)</p></li>
<li><p>Disclosure of files that begin with ".v" due to
unchecked return value (oC-SA-2016-003)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/blog/owncloud-8-2-2-8-1-5-8-0-10-and-7-0-12-here-with-sharing-ldap-fixes/</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-001</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-002</url>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2016-003</url>
<cvename>CVE-2016-1498</cvename>
<cvename>CVE-2016-1499</cvename>
<cvename>CVE-2016-1500</cvename>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="ff824eea-c69c-11e5-96d6-14dae9d210b8">
<topic>radicale -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-radicale</name>
<name>py32-radicale</name>
<name>py33-radicale</name>
<name>py34-radicale</name>
<range><lt>1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Radicale reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/06/4">
<p>The multifilesystem backend allows access to arbitrary
files on all platforms.</p>
<p>Prevent regex injection in rights management.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2016/01/06/4</url>
<cvename>CVE-2015-8747</cvename>
<cvename>CVE-2015-8748</cvename>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-29</entry>
</dates>
</vuln>
<vuln vid="7a59e283-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in SQL editor</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-9/">
<p>With a crafted SQL query, it is possible to trigger an
XSS attack in the SQL editor.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required
pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-9/</url>
<cvename>CVE-2016-2045</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="78b4ebfb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Full path disclosure vulnerability in SQL parser</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-8/">
<p>By calling a particular script that is part of phpMyAdmin
in an unexpected way, it is possible to trigger phpMyAdmin
to display a PHP error message which contains the full path
of the directory where phpMyAdmin is installed.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-8/</url>
<cvename>CVE-2016-2044</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="7694927f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- XSS vulnerability in normalization page</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-7/">
<p>With a crafted table name it is possible to trigger an
XSS attack in the database normalization page.</p>
<p>We consider this vulnerability to be non-critical.</p>
<p>This vulnerability can be triggered only by someone who is
logged in to phpMyAdmin, as the usual token protection
prevents non-logged-in users from accessing the required page.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-7/</url>
<cvename>CVE-2016-2043</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="740badcb-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-6/</url>
<cvename>CVE-2016-2042</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="71b24d99-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe comparison of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-5/">
<p>The comparison of the XSRF/CSRF token parameter with the
value saved in the session is vulnerable to timing
attacks. Moreover, the comparison could be bypassed if the
XSRF/CSRF token matches a particular pattern.</p>
<p>We consider this vulnerability to be serious.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-5/</url>
<cvename>CVE-2016-2041</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6f0c2d1b-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Insecure password generation in JavaScript</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-4/">
<p>Password suggestion functionality uses Math.random()
which does not provide cryptographically secure random
numbers.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-4/</url>
<cvename>CVE-2016-1927</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="6cc06eec-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-3/">
<ul>
<li>With a crafted table name it is possible to trigger
an XSS attack in the database search page.</li>
<li>With a crafted SET value or a crafted search query, it
is possible to trigger an XSS attacks in the zoom search
page.</li>
<li>With a crafted hostname header, it is possible to
trigger an XSS attacks in the home page.</li>
</ul>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>These vulnerabilities can be triggered only by someone
who is logged in to phpMyAdmin, as the usual token
protection prevents non-logged-in users from accessing the
required pages.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-3/</url>
<cvename>CVE-2016-2040</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="60ab0e93-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Unsafe generation of XSRF/CSRF token</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-2/">
<p>The XSRF/CSRF token is generated with a weak algorithm
using functions that do not return cryptographically secure
values.</p>
<p>We consider this vulnerability to be non-critical.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-2/</url>
<cvename>CVE-2016-2039</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="5d6a204f-c60b-11e5-bf36-6805ca0b3d42">
<topic>phpmyadmin -- Multiple full path disclosure vulnerabilities</topic>
<affects>
<package>
<name>phpmyadmin</name>
<range><ge>4.5.0</ge><lt>4.5.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2016-1/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2016-1/</url>
<cvename>CVE-2016-2038</cvename>
</references>
<dates>
<discovery>2016-01-28</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="50394bc9-c5fa-11e5-96a5-d93b343d1ff7">
<topic>prosody -- user impersonation vulnerability</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.10</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody team reports:</p>
<blockquote cite="https://prosody.im/security/advisory_20160127/">
<p>Adopt key generation algorithm from XEP-0185, to
prevent impersonation attacks (CVE-2016-0756)</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/206707</freebsdpr>
<cvename>CVE-2016-0756</cvename>
<url>https://prosody.im/security/advisory_20160127/</url>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-28</entry>
</dates>
</vuln>
<vuln vid="3679fd10-c5d1-11e5-b85f-0018fe623f2b">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_7</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2f</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_12</lt></range>
<range><ge>10.1</ge><lt>10.1_29</lt></range>
<range><ge>9.3</ge><lt>9.3_36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20160128.txt">
<ol>
<li>Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC 5114
support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that are
not "safe" then an attacker could use this fact to find a peer's private
DH exponent. This attack requires that the attacker complete multiple
handshakes in which the peer uses the same private DH exponent. For example
this could be used to discover a TLS server's private DH exponent if it's
reusing the private DH exponent or it's using a static DH ciphersuite.
OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
TLS. It is not on by default. If the option is not set then the server
reuses the same private DH exponent for the life of the server process and
would be vulnerable to this attack. It is believed that many popular
applications do set this option and would therefore not be at risk.
(CVE-2016-0701)</li>
<li>A malicious client can negotiate SSLv2 ciphers that have been disabled on
the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
been disabled, provided that the SSLv2 protocol was not also disabled via
SSL_OP_NO_SSLv2.
(CVE-2015-3197)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:11.openssl</freebsdsa>
<cvename>CVE-2016-0701</cvename>
<cvename>CVE-2015-3197</cvename>
<url>https://www.openssl.org/news/secadv/20160128.txt</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-28</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="8b27f1bc-c509-11e5-a95f-b499baebfeaf">
<topic>curl -- Credentials not checked</topic>
<affects>
<package>
<name>curl</name>
<range><ge>7.10.0</ge><lt>7.47.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The cURL project reports:</p>
<blockquote cite="http://curl.haxx.se/docs/adv_20160127A.html">
<p>libcurl will reuse NTLM-authenticated proxy connections
without properly making sure that the connection was
authenticated with the same credentials as set for this
transfer.</p>
</blockquote>
</body>
</description>
<references>
<url>http://curl.haxx.se/docs/adv_20160127A.html</url>
<cvename>CVE-2016-0755</cvename>
</references>
<dates>
<discovery>2016-01-27</discovery>
<entry>2016-01-27</entry>
<modified>2017-02-06</modified>
</dates>
</vuln>
<vuln vid="fb754341-c3e2-11e5-b5fe-002590263bf5">
<topic>wordpress -- XSS vulnerability</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.4.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.4.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Aaron Jorbin reports:</p>
<blockquote cite="https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/">
<p>WordPress 4.4.1 is now available. This is a security release for
all previous versions and we strongly encourage you to update your
sites immediately.</p>
<p>WordPress versions 4.4 and earlier are affected by a cross-site
scripting vulnerability that could allow a site to be compromised.
This was reported by Crtc4L.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1564</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/08/3</url>
<url>https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/</url>
</references>
<dates>
<discovery>2016-01-06</discovery>
<entry>2016-01-26</entry>
<modified>2016-03-08</modified>
</dates>
</vuln>
<vuln vid="a763a0e7-c3d9-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.24/user-manual/whatsnew.html">
<p>Prevent invalid reads in case of corrupt chunk-encoded content.
CVE-2016-1982. Bug discovered with afl-fuzz and AddressSanitizer.
</p>
<p>Remove empty Host headers in client requests. Previously they
would result in invalid reads. CVE-2016-1983. Bug discovered with
afl-fuzz and AddressSanitizer.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1982</cvename>
<cvename>CVE-2016-1983</cvename>
<freebsdpr>ports/206504</freebsdpr>
<url>http://www.privoxy.org/3.0.24/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/21/4</url>
</references>
<dates>
<discovery>2016-01-22</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="d9e1b569-c3d8-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.23/user-manual/whatsnew.html">
<p>Fixed a DoS issue in case of client requests with incorrect
chunk-encoded body. When compiled with assertions enabled (the
default) they could previously cause Privoxy to abort(). Reported
by Matthew Daley. CVE-2015-1380.</p>
<p>Fixed multiple segmentation faults and memory leaks in the pcrs
code. This fix also increases the chances that an invalid pcrs
command is rejected as such. Previously some invalid commands would
be loaded without error. Note that Privoxy's pcrs sources (action
and filter files) are considered trustworthy input and should not be
writable by untrusted third-parties. CVE-2015-1381.</p>
<p>Fixed an 'invalid read' bug which could at least theoretically
cause Privoxy to crash. So far, no crashes have been observed.
CVE-2015-1382.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1380</cvename>
<cvename>CVE-2015-1381</cvename>
<cvename>CVE-2015-1382</cvename>
<freebsdpr>ports/197089</freebsdpr>
<url>http://www.privoxy.org/3.0.23/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/26/4</url>
</references>
<dates>
<discovery>2015-01-26</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="89d4ed09-c3d7-11e5-b5fe-002590263bf5">
<topic>privoxy -- multiple vulnerabilities</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.22/user-manual/whatsnew.html">
<p>Fixed a memory leak when rejecting client connections due to the
socket limit being reached (CID 66382). This affected Privoxy 3.0.21
when compiled with IPv6 support (on most platforms this is the
default).</p>
<p>Fixed an immediate-use-after-free bug (CID 66394) and two
additional unconfirmed use-after-free complaints made by Coverity
scan (CID 66391, CID 66376).</p>
</blockquote>
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1201">
<p>Privoxy before 3.0.22 allows remote attackers to cause a denial
of service (file descriptor consumption) via unspecified vectors.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1030</cvename>
<cvename>CVE-2015-1031</cvename>
<cvename>CVE-2015-1201</cvename>
<freebsdpr>ports/195468</freebsdpr>
<url>http://www.privoxy.org/3.0.22/user-manual/whatsnew.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/1</url>
</references>
<dates>
<discovery>2015-01-10</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="ad82b0e9-c3d6-11e5-b5fe-002590263bf5">
<topic>privoxy -- malicious server spoofing as proxy vulnerability</topic>
<affects>
<package>
<name>privoxy</name>
<range><lt>3.0.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Privoxy Developers reports:</p>
<blockquote cite="http://www.privoxy.org/3.0.21/user-manual/whatsnew.html">
<p>Proxy authentication headers are removed unless the new directive
enable-proxy-authentication-forwarding is used. Forwarding the
headers potentially allows malicious sites to trick the user into
providing them with login information. Reported by Chris John Riley.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-2503</cvename>
<freebsdpr>ports/176813</freebsdpr>
<url>http://www.privoxy.org/3.0.21/user-manual/whatsnew.html</url>
</references>
<dates>
<discovery>2013-03-07</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="2e8cdd36-c3cc-11e5-b5fe-002590263bf5">
<topic>sudo -- potential privilege escalation via symlink misconfiguration</topic>
<affects>
<package>
<name>sudo</name>
<range><lt>1.8.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5602">
<p>sudoedit in Sudo before 1.8.15 allows local users to gain
privileges via a symlink attack on a file whose full path is defined
using multiple wildcards in /etc/sudoers, as demonstrated by
"/home/*/*/file.txt."</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5602</cvename>
<freebsdpr>ports/206590</freebsdpr>
<url>https://www.exploit-db.com/exploits/37710/</url>
<url>https://bugzilla.sudo.ws/show_bug.cgi?id=707</url>
<url>http://www.sudo.ws/stable.html#1.8.15</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2016-01-26</entry>
</dates>
</vuln>
<vuln vid="99d3a8a5-c13c-11e5-96d6-14dae9d210b8">
<topic>imlib2 -- denial of service vulnerabilities</topic>
<affects>
<package>
<name>imlib2</name>
<range><lt>1.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Enlightenment reports:</p>
<blockquote cite="https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog">
<p>GIF loader: Fix segv on images without colormap</p>
<p>Prevent division-by-zero crashes.</p>
<p>Fix segfault when opening input/queue/id:000007,src:000000,op:flip1,pos:51 with feh</p>
</blockquote>
</body>
</description>
<references>
<url>https://git.enlightenment.org/legacy/imlib2.git/tree/ChangeLog</url>
<url>http://seclists.org/oss-sec/2016/q1/162</url>
<cvename>CVE-2014-9762</cvename>
<cvename>CVE-2014-9763</cvename>
<cvename>CVE-2014-9764</cvename>
</references>
<dates>
<discovery>2013-12-21</discovery>
<entry>2016-01-22</entry>
</dates>
</vuln>
<vuln vid="b4578647-c12b-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01335">
<p>Specific APL data could trigger an INSIST in apl_42.c</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01335</url>
<cvename>CVE-2015-8704</cvename>
<freebsdsa>SA-16:08.bind</freebsdsa>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-22</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="371bbea9-3836-4832-9e70-e8e928727f8c">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>48.0.2564.82</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html">
<p>This update includes 37 security fixes, including:</p>
<ul>
<li>[497632] High CVE-2016-1612: Bad cast in V8.</li>
<li>[572871] High CVE-2016-1613: Use-after-free in PDFium.</li>
<li>[544691] Medium CVE-2016-1614: Information leak in Blink.</li>
<li>[468179] Medium CVE-2016-1615: Origin confusion in Omnibox.</li>
<li>[541415] Medium CVE-2016-1616: URL Spoofing.</li>
<li>[544765] Medium CVE-2016-1617: History sniffing with HSTS and
CSP.</li>
<li>[552749] Medium CVE-2016-1618: Weak random number generator in
Blink.</li>
<li>[557223] Medium CVE-2016-1619: Out-of-bounds read in
PDFium.</li>
<li>[579625] CVE-2016-1620: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.8
branch.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1612</cvename>
<cvename>CVE-2016-1613</cvename>
<cvename>CVE-2016-1614</cvename>
<cvename>CVE-2016-1615</cvename>
<cvename>CVE-2016-1616</cvename>
<cvename>CVE-2016-1617</cvename>
<cvename>CVE-2016-1618</cvename>
<cvename>CVE-2016-1619</cvename>
<cvename>CVE-2016-1620</cvename>
<url>http://googlechromereleases.blogspot.de/2016/01/stable-channel-update_20.html</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
</dates>
</vuln>
<vuln vid="5237f5d7-c020-11e5-b397-d050996490d0">
<topic>ntp -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p6</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.90</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_11</lt></range>
<range><ge>10.1</ge><lt>10.1_28</lt></range>
<range><ge>9.3</ge><lt>9.3_35</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit">
<p>NTF's NTP Project has been notified of the following low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p6, released on Tuesday, 19 January 2016:</p>
<ul>
<li>Bug 2948 / CVE-2015-8158: Potential Infinite Loop
in ntpq. Reported by Cisco ASIG.</li>
<li>Bug 2945 / CVE-2015-8138: origin: Zero Origin
Timestamp Bypass. Reported by Cisco ASIG.</li>
<li>Bug 2942 / CVE-2015-7979: Off-path Denial of
Service (DoS) attack on authenticated broadcast
mode. Reported by Cisco ASIG.</li>
<li>Bug 2940 / CVE-2015-7978: Stack exhaustion in
recursive traversal of restriction list.
Reported by Cisco ASIG.</li>
<li>Bug 2939 / CVE-2015-7977: reslist NULL pointer
dereference. Reported by Cisco ASIG.</li>
<li>Bug 2938 / CVE-2015-7976: ntpq saveconfig command
allows dangerous characters in filenames.
Reported by Cisco ASIG.</li>
<li>Bug 2937 / CVE-2015-7975: nextvar() missing length
check. Reported by Cisco ASIG.</li>
<li>Bug 2936 / CVE-2015-7974: Skeleton Key: Missing
key check allows impersonation between authenticated
peers. Reported by Cisco ASIG.</li>
<li>Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on
authenticated broadcast mode. Reported by Cisco ASIG.</li>
</ul>
<p>Additionally, mitigations are published for the following
two issues:</p>
<ul>
<li>Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay
attacks. Reported by Cisco ASIG.</li>
<li>Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc,
disclose origin. Reported by Cisco ASIG.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:09.ntp</freebsdsa>
<cvename>CVE-2015-7973</cvename>
<cvename>CVE-2015-7974</cvename>
<cvename>CVE-2015-7975</cvename>
<cvename>CVE-2015-7976</cvename>
<cvename>CVE-2015-7977</cvename>
<cvename>CVE-2015-7978</cvename>
<cvename>CVE-2015-7979</cvename>
<cvename>CVE-2015-8138</cvename>
<cvename>CVE-2015-8139</cvename>
<cvename>CVE-2015-8140</cvename>
<cvename>CVE-2015-8158</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit</url>
</references>
<dates>
<discovery>2016-01-20</discovery>
<entry>2016-01-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="62c0dbbd-bfce-11e5-b5fe-002590263bf5">
<topic>cgit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>cgit</name>
<range><lt>0.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason A. Donenfeld reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/14/6">
<p>Reflected Cross Site Scripting and Header Injection in Mimetype
Query String.</p>
<p>Stored Cross Site Scripting and Header Injection in Filename
Parameter.</p>
<p>Integer Overflow resulting in Buffer Overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1899</cvename>
<cvename>CVE-2016-1900</cvename>
<cvename>CVE-2016-1901</cvename>
<freebsdpr>ports/206417</freebsdpr>
<url>http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/14/6</url>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-20</entry>
</dates>
</vuln>
<vuln vid="314830d8-bf91-11e5-96d6-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind910</name>
<range><lt>9.10.3P3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01336">
<p>Problems converting OPT resource records and ECS options to
text format can cause BIND to terminate</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01336</url>
<cvename>CVE-2015-8705</cvename>
</references>
<dates>
<discovery>2016-01-19</discovery>
<entry>2016-01-20</entry>
<modified>2016-01-22</modified>
</dates>
</vuln>
<vuln vid="51358314-bec8-11e5-82cd-bcaec524bf84">
<topic>claws-mail -- no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc</topic>
<affects>
<package>
<name>claws-mail</name>
<range><lt>3.13.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>DrWhax reports:</p>
<blockquote cite="http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557">
<p>So in codeconv.c there is a function for Japanese character set
conversion called conv_jistoeuc(). There is no bounds checking on
the output buffer, which is created on the stack with alloca()
Bug can be triggered by sending an email to TAILS_luser@riseup.net
or whatever.
Since my C is completely rusty, you might be able to make a better
judgment on the severity of this issue. Marking critical for now.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8614</cvename>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8614</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2016-01-19</entry>
</dates>
</vuln>
<vuln vid="7c63775e-be31-11e5-b5fe-002590263bf5">
<topic>libarchive -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libarchive</name>
<range><lt>3.1.2_5,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.3</ge><lt>10.3_4</lt></range>
<range><ge>10.2</ge><lt>10.2_18</lt></range>
<range><ge>10.1</ge><lt>10.1_35</lt></range>
<range><ge>9.3</ge><lt>9.3_43</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0211">
<p>Integer signedness error in the archive_write_zip_data function in
archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when
running on 64-bit machines, allows context-dependent attackers to
cause a denial of service (crash) via unspecified vectors, which
triggers an improper conversion between unsigned and signed types,
leading to a buffer overflow.</p>
</blockquote>
<blockquote cite="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2304">
<p>Absolute path traversal vulnerability in bsdcpio in libarchive
3.1.2 and earlier allows remote attackers to write to arbitrary
files via a full pathname in an archive.</p>
</blockquote>
<p>Libarchive issue tracker reports:</p>
<blockquote cite="https://github.com/libarchive/libarchive/issues/502">
<p>Using a crafted tar file bsdtar can perform an out-of-bounds memory
read which will lead to a SEGFAULT. The issue exists when the
executable skips data in the archive. The amount of data to skip is
defined in byte offset [16-19] If ASLR is disabled, the issue can
lead to an infinite loop.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2013-0211</cvename>
<cvename>CVE-2015-2304</cvename>
<freebsdpr>ports/200176</freebsdpr>
<freebsdsa>SA-16:22.libarchive</freebsdsa>
<freebsdsa>SA-16:23.libarchive</freebsdsa>
<url>https://github.com/libarchive/libarchive/pull/110</url>
<url>https://github.com/libarchive/libarchive/commit/5935715</url>
<url>https://github.com/libarchive/libarchive/commit/2253154</url>
<url>https://github.com/libarchive/libarchive/issues/502</url>
<url>https://github.com/libarchive/libarchive/commit/3865cf2</url>
<url>https://github.com/libarchive/libarchive/commit/e6c9668</url>
<url>https://github.com/libarchive/libarchive/commit/24f5de6</url>
</references>
<dates>
<discovery>2012-12-06</discovery>
<entry>2016-01-18</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="6809c6db-bdeb-11e5-b5fe-002590263bf5">
<topic>go -- information disclosure vulnerability</topic>
<affects>
<package>
<name>go</name>
<range><ge>1.5,1</ge><lt>1.5.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/13/7">
<p>A security-related issue has been reported in Go's math/big
package. The issue was introduced in Go 1.5. We recommend that all
users upgrade to Go 1.5.3, which fixes the issue. Go programs must
be recompiled with Go 1.5.3 in order to receive the fix.</p>
<p>The Go team would like to thank Nick Craig-Wood for identifying the
issue.</p>
<p>This issue can affect RSA computations in crypto/rsa, which is used
by crypto/tls. TLS servers on 32-bit systems could plausibly leak
their RSA private key due to this issue. Other protocol
implementations that create many RSA signatures could also be
impacted in the same way.</p>
<p>Specifically, incorrect results in one part of the RSA Chinese
Remainder computation can cause the result to be incorrect in such a
way that it leaks one of the primes. While RSA blinding should
prevent an attacker from crafting specific inputs that trigger the
bug, on 32-bit systems the bug can be expected to occur at random
around one in 2^26 times. Thus collecting around 64 million
signatures (of known data) from an affected server should be enough
to extract the private key used.</p>
<p>On 64-bit systems, the frequency of the bug is so low (less than
one in 2^50) that it would be very difficult to exploit.
Nonetheless, everyone is strongly encouraged to upgrade.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8618</cvename>
<url>http://www.openwall.com/lists/oss-security/2016/01/13/7</url>
<url>https://go-review.googlesource.com/#/c/17672/</url>
<url>https://go-review.googlesource.com/#/c/18491/</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-18</entry>
</dates>
</vuln>
<vuln vid="05eeb7e9-b987-11e5-83ef-14dae9d210b8">
<topic>isc-dhcpd -- Denial of Service</topic>
<affects>
<package>
<name>isc-dhcp41-server</name>
<range><lt>4.1.e_10,2</lt></range>
</package>
<package>
<name>isc-dhcp41-client</name>
<range><lt>4.1.e_3,2</lt></range>
</package>
<package>
<name>isc-dhcp41-relay</name>
<range><lt>4.1.e_6,2</lt></range>
</package>
<package>
<name>isc-dhcp42-client</name>
<name>isc-dhcp42-server</name>
<name>isc-dhcp42-relay</name>
<range><ge>0</ge></range>
</package>
<package>
<name>isc-dhcp43-client</name>
<name>isc-dhcp43-server</name>
<name>isc-dhcp43-relay</name>
<range><lt>4.3.3.p1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01334">
<p>A badly formed packet with an invalid IPv4 UDP length field
can cause a DHCP server, client, or relay program to terminate
abnormally.</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01334</url>
<cvename>CVE-2015-8605</cvename>
</references>
<dates>
<discovery>2016-01-05</discovery>
<entry>2016-01-12</entry>
</dates>
</vuln>
<vuln vid="3b5c2362-bd07-11e5-b7ef-5453ed2e2b49">
<topic>libproxy -- stack-based buffer overflow</topic>
<affects>
<!-- libproxy-python is not affected. It only installs a .py file that
dlopen()s libproxy.so. -->
<package>
<name>libproxy</name>
<range><ge>0.4.0</ge><lt>0.4.6_1</lt></range>
</package>
<package>
<name>libproxy-gnome</name>
<range><ge>0.4.0</ge><lt>0.4.6_2</lt></range>
</package>
<package>
<name>libproxy-kde</name>
<range><ge>0.4.0</ge><lt>0.4.6_6</lt></range>
</package>
<package>
<name>libproxy-perl</name>
<range><ge>0.4.0</ge><lt>0.4.6_3</lt></range>
</package>
<package>
<name>libproxy-webkit</name>
<range><ge>0.4.0</ge><lt>0.4.6_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tomas Hoger reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=864417#c0">
<p>A buffer overflow flaw was discovered in the libproxy's
url::get_pac() used to download proxy.pac proxy auto-configuration
file. A malicious host hosting proxy.pac, or a man in the middle
attacker, could use this flaw to trigger a stack-based buffer
overflow in an application using libproxy, if proxy configuration
instructed it to download proxy.pac file from a remote HTTP
server.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-4504</cvename>
<url>https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4504</url>
<mlist>http://www.openwall.com/lists/oss-security/2012/10/12/1</mlist>
<url>https://github.com/libproxy/libproxy/commit/c440553c12836664afd24a24fb3a4d10a2facd2c</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=864417</url>
<mlist>https://groups.google.com/forum/?fromgroups=#!topic/libproxy/VxZ8No7mT0E</mlist>
</references>
<dates>
<discovery>2012-10-10</discovery>
<entry>2016-01-17</entry>
<modified>2016-01-18</modified>
</dates>
</vuln>
<vuln vid="046fedd1-bd01-11e5-bbf4-5404a68ad561">
<topic>ffmpeg -- remote attacker can access local files</topic>
<affects>
<package>
<name>ffmpeg</name>
<range>
<gt>2.0,1</gt>
<lt>2.8.5,1</lt>
</range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<range>
<lt>1.2.r20151219_2</lt>
</range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Arch Linux reports:</p>
<blockquote cite="https://bugs.archlinux.org/task/47738">
<p>ffmpeg has a vulnerability in the current version that allows the
attacker to create a specially crafted video file, downloading which
will send files from a user PC to a remote attacker server. The
attack does not even require the user to open that file — for
example, KDE Dolphin thumbnail generation is enough.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1897</cvename>
<cvename>CVE-2016-1898</cvename>
<freebsdpr>ports/206282</freebsdpr>
<url>https://www.ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-17</entry>
</dates>
</vuln>
<vuln vid="6c808811-bb9a-11e5-a65c-485d605f4717">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo OKU reports:</p>
<blockquote cite="http://h2o.examp1e.net/vulnerabilities.html">
<p>When redirect directive is used, this flaw allows a remote
attacker to inject response headers into an HTTP redirect response.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1133</cvename>
<url>https://h2o.examp1e.net/vulnerabilities.html</url>
</references>
<dates>
<discovery>2016-01-13</discovery>
<entry>2016-01-15</entry>
</dates>
</vuln>
<vuln vid="dfe0cdc1-baf2-11e5-863a-b499baebfeaf">
<topic>openssh -- information disclosure</topic>
<affects>
<package>
<name>openssh-portable</name>
<range>
<gt>5.4.p0,1</gt>
<lt>7.1.p2,1</lt>
</range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_10</lt></range>
<range><ge>10.1</ge><lt>10.1_27</lt></range>
<range><ge>9.3</ge><lt>9.3_34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSH reports:</p>
<blockquote cite="http://www.openssh.com/security.html">
<p>OpenSSH clients between versions 5.4 and 7.1 are vulnerable to
information disclosure that may allow a malicious server to retrieve
information including under some circumstances, user's private keys.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/security.html</url>
<cvename>CVE-2016-0777</cvename>
<cvename>CVE-2016-0778</cvename>
<freebsdsa>SA-16:07</freebsdsa>
</references>
<dates>
<discovery>2016-01-14</discovery>
<entry>2016-01-14</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="842cd117-ba54-11e5-9728-002590263bf5">
<topic>prosody -- multiple vulnerabilities</topic>
<affects>
<package>
<name>prosody</name>
<range><lt>0.9.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Prosody Team reports:</p>
<blockquote cite="http://blog.prosody.im/prosody-0-9-9-security-release/">
<p>Fix path traversal vulnerability in mod_http_files
(CVE-2016-1231)</p>
<p>Fix use of weak PRNG in generation of dialback secrets
(CVE-2016-1232)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1231</cvename>
<cvename>CVE-2016-1232</cvename>
<freebsdpr>ports/206150</freebsdpr>
<url>http://blog.prosody.im/prosody-0-9-9-security-release/</url>
</references>
<dates>
<discovery>2016-01-08</discovery>
<entry>2016-01-14</entry>
</dates>
</vuln>
<vuln vid="a7a4e96c-ba50-11e5-9728-002590263bf5">
<topic>kibana4 -- XSS vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><lt>4.1.4</lt></range>
</package>
<package>
<name>kibana42</name>
<range><lt>4.2.2</lt></range>
</package>
<package>
<name>kibana43</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4">
<p>Fixes XSS vulnerability (CVE pending) - Thanks to Vladimir Ivanov
for responsibly reporting.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205961</freebsdpr>
<freebsdpr>ports/205962</freebsdpr>
<freebsdpr>ports/205963</freebsdpr>
<url>https://www.elastic.co/blog/kibana-4-3-1-and-4-2-2-and-4-1-4</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-13</entry>
</dates>
</vuln>
<vuln vid="333f655a-b93a-11e5-9efa-5453ed2e2b49">
<topic>p5-PathTools -- File::Spec::canonpath loses taint</topic>
<affects>
<package>
<name>p5-PathTools</name>
<range>
<gt>3.4000</gt>
<lt>3.6200</lt>
</range>
</package>
<package>
<name>perl5</name>
<name>perl5.20</name>
<name>perl5.22</name>
<name>perl5-devel</name>
<range><ge>5.19.9</ge><lt>5.20.2</lt></range>
<range><ge>5.21.0</ge><lt>5.22.2</lt></range>
<range><ge>5.23.0</ge><lt>5.23.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ricardo Signes reports:</p>
<blockquote>
<p>Beginning in PathTools 3.47 and/or perl 5.20.0, the
File::Spec::canonpath() routine returned untained strings even if
passed tainted input. This defect undermines the guarantee of taint
propagation, which is sometimes used to ensure that unvalidated
user input does not reach sensitive code.</p>
<p>This defect was found and reported by David Golden of MongoDB.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8607</cvename>
<url>https://rt.perl.org/Public/Bug/Display.html?id=126862</url>
</references>
<dates>
<discovery>2016-01-11</discovery>
<entry>2016-01-12</entry>
<modified>2016-08-22</modified>
</dates>
</vuln>
<vuln vid="6b771fe2-b84e-11e5-92f9-485d605f4717">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php55</name>
<name>php55-gd</name>
<name>php55-wddx</name>
<name>php55-xmlrpc</name>
<range><lt>5.5.31</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-gd</name>
<name>php56-soap</name>
<name>php56-wddx</name>
<name>php56-xmlrpc</name>
<range><lt>5.6.17</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://www.php.net/ChangeLog-5.php#5.5.31">
<ul><li>Core:
<ul>
<li>Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).</li>
</ul></li>
<li>GD:
<ul>
<li>Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array
Index Out of Bounds).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70900 (SoapClient systematic out of memory error).</li>
</ul></li>
<li>Wddx
<ul>
<li>Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
Deserialization).</li>
<li>Fixed bug #70741 (Session WDDX Packet Deserialization Type
Confusion Vulnerability).</li>
</ul></li>
<li>XMLRPC:
<ul>
<li>Fixed bug #70728 (Type Confusion Vulnerability in
PHP_to_XMLRPC_worker()).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://www.php.net/ChangeLog-5.php#5.5.31</url>
<url>http://www.php.net/ChangeLog-5.php#5.6.17</url>
</references>
<dates>
<discovery>2016-01-07</discovery>
<entry>2016-01-11</entry>
</dates>
</vuln>
<vuln vid="5f276780-b6ce-11e5-9731-5453ed2e2b49">
<topic>pygments -- shell injection vulnerability</topic>
<affects>
<package>
<name>py27-pygments</name>
<name>py32-pygments</name>
<name>py33-pygments</name>
<name>py34-pygments</name>
<name>py35-pygments</name>
<range><lt>2.0.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8557">
<p>The FontManager._get_nix_font_path function in formatters/img.py
in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute
arbitrary commands via shell metacharacters in a font name.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8557</cvename>
<mlist>http://seclists.org/fulldisclosure/2015/Oct/4</mlist>
<url>https://bitbucket.org/birkenfeld/pygments-main/commits/0036ab1c99e256298094505e5e92fdacdfc5b0a8</url>
</references>
<dates>
<discovery>2015-09-28</discovery>
<entry>2016-01-09</entry>
</dates>
</vuln>
<vuln vid="631fc042-b636-11e5-83ef-14dae9d210b8">
<topic>polkit -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polkit</name>
<range><lt>0.113</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Walters reports:</p>
<blockquote cite="http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html">
<ul>
<li><p>Integer overflow in the
authentication_agent_new_cookie function in PolicyKit (aka polkit)
before 0.113 allows local users to gain privileges by creating a large
number of connections, which triggers the issuance of a duplicate cookie
value.</p></li>
<li><p>The authentication_agent_new function in
polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka
polkit) before 0.113 allows local users to cause a denial of service
(NULL pointer dereference and polkitd daemon crash) by calling
RegisterAuthenticationAgent with an invalid object path.</p></li>
<li><p>The polkit_backend_action_pool_init function in
polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before
0.113 might allow local users to gain privileges via duplicate action
IDs in action descriptions.</p></li>
<li><p>PolicyKit (aka polkit) before 0.113 allows local
users to cause a denial of service (memory corruption and polkitd daemon
crash) and possibly gain privileges via unspecified vectors, related to
"javascript rule evaluation."</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://lists.freedesktop.org/archives/polkit-devel/2015-June/000425.html</url>
<cvename>CVE-2015-4625</cvename>
<cvename>CVE-2015-3218</cvename>
<cvename>CVE-2015-3255</cvename>
<cvename>CVE-2015-3256</cvename>
</references>
<dates>
<discovery>2015-06-03</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="b22b016b-b633-11e5-83ef-14dae9d210b8">
<topic>librsync -- collision vulnerability</topic>
<affects>
<package>
<name>librsync</name>
<range><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Michael Samuel reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2014/07/28/1">
<p>librsync before 1.0.0 uses a truncated MD4 checksum to
match blocks, which makes it easier for remote attackers to modify
transmitted data via a birthday attack.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2014/07/28/1</url>
<cvename>CVE-2014-8242</cvename>
</references>
<dates>
<discovery>2014-07-28</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4eae4f46-b5ce-11e5-8a2b-d050996490d0">
<topic>ntp -- denial of service vulnerability</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p5</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.78</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_9</lt></range>
<range><ge>10.1</ge><lt>10.1_26</lt></range>
<range><ge>9.3</ge><lt>9.3_33</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Network Time Foundation reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit">
<p>NTF's NTP Project has been notified of the following
1 medium-severity vulnerability that is fixed in
ntp-4.2.8p5, released on Thursday, 7 January 2016:</p>
<p>NtpBug2956: Small-step/Big-step CVE-2015-5300</p>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-16:02.ntp</freebsdsa>
<cvename>CVE-2015-5300</cvename>
<url>https://www.cs.bu.edu/~goldbe/NTPattack.html</url>
<url>http://support.ntp.org/bin/view/Main/NtpBug2956</url>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2016-01-08</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="df587aa2-b5a5-11e5-9728-002590263bf5">
<topic>dhcpcd -- multiple vulnerabilities</topic>
<affects>
<package>
<name>dhcpcd</name>
<range><lt>6.10.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Nico Golde reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2016/01/07/3">
<p>heap overflow via malformed dhcp responses later in print_option
(via dhcp_envoption1) due to incorrect option length values.
Exploitation is non-trivial, but I'd love to be proven wrong.</p>
<p>invalid read/crash via malformed dhcp responses. not exploitable
beyond DoS as far as I can judge.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-1503</cvename>
<cvename>CVE-2016-1504</cvename>
<freebsdpr>ports/206015</freebsdpr>
<url>http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30</url>
<url>http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403</url>
<url>http://www.openwall.com/lists/oss-security/2016/01/07/3</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-08</entry>
</dates>
</vuln>
<vuln vid="4084168e-b531-11e5-a98c-0011d823eebd">
<topic>mbedTLS/PolarSSL -- SLOTH attack on TLS 1.2 server authentication</topic>
<affects>
<package>
<name>polarssl13</name>
<range><lt>1.3.16</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released">
<p>MD5 handshake signatures in TLS 1.2 are vulnerable to the SLOTH attack
on TLS 1.2 server authentication. They have been disabled by default.
Other attacks from the SLOTH paper do not apply to any version of mbed
TLS or PolarSSL.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released</url>
</references>
<dates>
<discovery>2016-01-04</discovery>
<entry>2016-01-07</entry>
</dates>
</vuln>
<vuln vid="6aa2d135-b40e-11e5-9728-002590263bf5">
<topic>xen-kernel -- ioreq handling possibly susceptible to multiple read issue</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-166.html">
<p>Single memory accesses in source code can be translated to multiple
ones in machine code by the compiler, requiring special caution when
accessing shared memory. Such precaution was missing from the
hypervisor code inspecting the state of I/O requests sent to the
device model for assistance.</p>
<p>Due to the offending field being a bitfield, it is however believed
that there is no issue in practice, since compilers, at least when
optimizing (which is always the case for non-debug builds), should find
it more expensive to extract the bit field value twice than to keep the
calculated value in a register.</p>
<p>This vulnerability is exposed to malicious device models. In
conventional Xen systems this means the qemu which service an HVM
domain. On such systems this vulnerability can only be exploited if
the attacker has gained control of the device model qemu via another
vulnerability.</p>
<p>Privilege escalation, host crash (Denial of Service), and leaked
information all cannot be excluded.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-166.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="e839ca04-b40d-11e5-9728-002590263bf5">
<topic>xen-kernel -- information leak in legacy x86 FPU/XMM initialization</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-165.html">
<p>When XSAVE/XRSTOR are not in use by Xen to manage guest extended
register state, the initial values in the FPU stack and XMM
registers seen by the guest upon first use are those left there by
the previous user of those registers.</p>
<p>A malicious domain may be able to leverage this to obtain sensitive
information such as cryptographic keys from another domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8555</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-165.html</url>
</references>
<dates>
<discovery>2015-12-17</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="5d1d4473-b40d-11e5-9728-002590263bf5">
<topic>xen-tools -- libxl leak of pv kernel and initrd on error</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-160.html">
<p>When constructing a guest which is configured to use a PV
bootloader which runs as a userspace process in the toolstack domain
(e.g. pygrub) libxl creates a mapping of the files to be used as
kernel and initial ramdisk when building the guest domain.</p>
<p>However if building the domain subsequently fails these mappings
would not be released leading to a leak of virtual address space in
the calling process, as well as preventing the recovery of the
temporary disk files containing the kernel and initial ramdisk.</p>
<p>For toolstacks which manage multiple domains within the same
process, an attacker who is able to repeatedly start a suitable
domain (or many such domains) can cause an out-of-memory condition in the
toolstack process, leading to a denial of service.</p>
<p>Under the same circumstances an attacker can also cause files to
accumulate on the toolstack domain filesystem (usually under /var in
dom0) used to temporarily store the kernel and initial ramdisk,
perhaps leading to a denial of service against arbitrary other
services using that filesystem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8341</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-160.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="bcad3faa-b40c-11e5-9728-002590263bf5">
<topic>xen-kernel -- XENMEM_exchange error handling issues</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-159.html">
<p>Error handling in the operation may involve handing back pages to
the domain. This operation may fail when in parallel the domain gets
torn down. So far this failure unconditionally resulted in the host
being brought down due to an internal error being assumed. This is
CVE-2015-8339.</p>
<p>Furthermore error handling so far wrongly included the release of a
lock. That lock, however, was either not acquired or already released
on all paths leading to the error handling sequence. This is
CVE-2015-8340.</p>
<p>A malicious guest administrator may be able to deny service by
crashing the host or causing a deadlock.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8339</cvename>
<cvename>CVE-2015-8340</cvename>
<freebsdpr>ports/205841</freebsdpr>
<url>http://xenbits.xen.org/xsa/advisory-159.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-06</entry>
</dates>
</vuln>
<vuln vid="b65e4914-b3bc-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in CIE Lab image format</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_1</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>zzf of Alibaba discovered an out-of-bounds vulnerability in the code
processing the LogLUV and CIE Lab image format files. An attacker
could create a specially-crafted TIFF file that could cause libtiff
to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8683</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/25/2</mlist>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2016-01-05</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="bd349f7a-b3b9-11e5-8255-5453ed2e2b49">
<topic>tiff -- out-of-bounds read in tif_getimage.c</topic>
<affects>
<package>
<name>tiff</name>
<range><lt>4.0.6_1</lt></range>
</package>
<package>
<name>linux-c6-tiff</name>
<range><lt>3.9.4_2</lt></range>
</package>
<package>
<name>linux-f10-tiff</name>
<range><ge>*</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>LMX of Qihoo 360 Codesafe Team discovered an out-of-bounds read in
tif_getimage.c. An attacker could create a specially-crafted TIFF
file that could cause libtiff to crash.</p>
</body>
</description>
<references>
<cvename>CVE-2015-8665</cvename>
<mlist>http://www.openwall.com/lists/oss-security/2015/12/24/2</mlist>
</references>
<dates>
<discovery>2015-12-24</discovery>
<entry>2016-01-05</entry>
<modified>2016-09-06</modified>
</dates>
</vuln>
<vuln vid="86c3c66e-b2f5-11e5-863a-b499baebfeaf">
<topic>unzip -- multiple vulnerabilities</topic>
<affects>
<package>
<name>unzip</name>
<range><lt>6.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/07/4">
<p>Two issues were found in unzip 6.0:</p>
<p> * A heap overflow triggered by unzipping a file with password
(e.g unzip -p -P x sigsegv.zip).</p>
<p> * A denegation of service with a file that never finishes unzipping
(e.g. unzip sigxcpu.zip).</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/09/07/4</url>
<freebsdpr>ports/204413</freebsdpr>
<cvename>CVE-2015-7696</cvename>
<cvename>CVE-2015-7697</cvename>
</references>
<dates>
<discovery>2015-09-26</discovery>
<entry>2016-01-04</entry>
</dates>
</vuln>
<vuln vid="bb961ff3-b3a4-11e5-8255-5453ed2e2b49">
<topic>cacti -- SQL injection vulnerabilities</topic>
<affects>
<package>
<name>cacti</name>
<range><le>0.8.8f_1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8369">
<p>SQL injection vulnerability in include/top_graph_header.php in
Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary
SQL commands via the rra_id parameter in a properties action to
graph.php.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8369</cvename>
<url>http://bugs.cacti.net/view.php?id=2646</url>
<url>http://svn.cacti.net/viewvc?view=rev&revision=7767</url>
<mlist>http://seclists.org/fulldisclosure/2015/Dec/8</mlist>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2016-01-05</entry>
</dates>
</vuln>
<vuln vid="59e7eb28-b309-11e5-af83-80ee73b5dcf5">
<topic>kea -- unexpected termination while handling a malformed packet</topic>
<affects>
<package>
<name>kea</name>
<range><ge>0.9.2</ge><lt>1.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC Support reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html">
<p>ISC Kea may terminate unexpectedly (crash) while handling
a malformed client packet. Related defects in the kea-dhcp4
and kea-dhcp6 servers can cause the server to crash during
option processing if a client sends a malformed packet.
An attacker sending a crafted malformed packet can cause
an ISC Kea server providing DHCP services to IPv4 or IPv6
clients to exit unexpectedly.</p>
<ul>
<li><p>The kea-dhcp4 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when logging
at debug level 40 or higher. Servers running kea-dhcp4
versions 0.9.1 or lower, and servers which are not
logging or are logging at debug level 39 or below are
not vulnerable.</p></li>
<li><p>The kea-dhcp6 server is vulnerable only in versions
0.9.2 and 1.0.0-beta, and furthermore only when
logging at debug level 45 or higher. Servers running
kea-dhcp6 versions 0.9.1 or lower, and servers
which are not logging or are logging at debug level 44
or below are not vulnerable.</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8373</cvename>
<url>https://kb.isc.org/article/AA-01318/0/CVE-2015-8373-ISC-Kea%3A-unexpected-termination-while-handling-a-malformed-packet.html</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-04</entry>
<modified>2016-01-05</modified>
</dates>
</vuln>
<vuln vid="84dc49b0-b267-11e5-8a5b-00262d5ed8ee">
<topic>mini_httpd -- buffer overflow via snprintf</topic>
<affects>
<package>
<name>mini_httpd</name>
<range><lt>1.23</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ACME Updates reports:</p>
<blockquote cite="https://cxsecurity.com/acveshow/CVE-2015-1548">
<p>mini_httpd 1.21 and earlier allows remote attackers to obtain
sensitive information from process memory via an HTTP request with
a long protocol string, which triggers an incorrect response size
calculation and an out-of-bounds read.</p>
<p>(rene) ACME, the author, claims that the vulnerability is fixed
*after* version 1.22, released on 2015-12-28</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1548</cvename>
<url>https://cxsecurity.com/cveshow/CVE-2015-1548</url>
<url>http://acme.com/updates/archive/192.html</url>
</references>
<dates>
<discovery>2015-02-10</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="1384f2fd-b1be-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Rocker switch emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/28/6">
<p>Qemu emulator built with the Rocker switch emulation support is
vulnerable to an off-by-one error. It happens while processing
transmit(tx) descriptors in 'tx_consume' routine, if a descriptor
was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.
</p>
<p>A privileged user inside guest could use this flaw to cause memory
leakage on the host or crash the Qemu process instance resulting in
DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8701</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/28/6</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/007cd223de527b5f41278f2d886c1a4beb3e67aa</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="152acff3-b1bd-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Q35 chipset emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/24/1">
<p>Qemu emulator built with the Q35 chipset based pc system emulator
is vulnerable to a heap based buffer overflow. It occurs during VM
guest migration, as more(16 bytes) data is moved into allocated
(8 bytes) memory area.</p>
<p>A privileged guest user could use this issue to corrupt the VM
guest image, potentially leading to a DoS. This issue affects q35
machine types.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8666</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/24/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb</url>
</references>
<dates>
<discovery>2015-11-19</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="62ab8707-b1bc-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in Human Monitor Interface support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/22/8">
<p>Qemu emulator built with the Human Monitor Interface(HMP) support
is vulnerable to an OOB write issue. It occurs while processing
'sendkey' command in hmp_sendkey routine, if the command argument is
longer than the 'keyname_buf' buffer size.</p>
<p>A user/process could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8619</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/22/8</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02930.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=64ffbe04eaafebf4045a3ace52a360c14959d196</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/64ffbe04eaafebf4045a3ace52a360c14959d196</url>
</references>
<dates>
<discovery>2015-12-23</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="b3f9f8ef-b1bb-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/7">
<p>Qemu emulator built with the SCSI MegaRAID SAS HBA emulation
support is vulnerable to a stack buffer overflow issue. It occurs
while processing the SCSI controller's CTRL_GET_INFO command. A
privileged guest user could use this flaw to crash the Qemu process
instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8613</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/7</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=36fef36b91f7ec0435215860f1458b5342ce2811</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/36fef36b91f7ec0435215860f1458b5342ce2811</url>
</references>
<dates>
<discovery>2015-12-21</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="9ad8993e-b1ba-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VMWARE VMXNET3 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/15/4">
<p>Qemu emulator built with a VMWARE VMXNET3 paravirtual NIC emulator
support is vulnerable to a memory leakage flaw. It occurs when a
guest repeatedly tries to activate the vmxnet3 device.</p>
<p>A privileged guest user could use this flaw to leak host memory,
resulting in DoS on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8567</cvename>
<cvename>CVE-2015-8568</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/15/4</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/aa4a3dce1c88ed51b616806b8214b7c8428b7470</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="60cb2055-b1b8-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in USB EHCI emulation support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/9">
<p>Qemu emulator built with the USB EHCI emulation support is
vulnerable to an infinite loop issue. It occurs during communication
between host controller interface(EHCI) and a respective device
driver. These two communicate via a isochronous transfer descriptor
list(iTD) and an infinite loop unfolds if there is a closed loop in
this list.</p>
<p>A privileges user inside guest could use this flaw to consume
excessive CPU cycles & resources on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8558</cvename>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/9</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/156a2e4dbffa85997636a7a39ef12da6f1b40254</url>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="3fb06284-b1b7-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in MSI-X support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/2">
<p>Qemu emulator built with the PCI MSI-X support is vulnerable to
null pointer dereference issue. It occurs when the controller
attempts to write to the pending bit array(PBA) memory region.
Because the MSI-X MMIO support did not define the .write method.</p>
<p>A privileges used inside guest could use this flaw to crash the
Qemu process resulting in DoS issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7549</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/2</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=43b11a91dd861a946b231b89b7542856ade23d1b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/43b11a91dd861a946b231b89b7542856ade23d1b</url>
</references>
<dates>
<discovery>2015-06-26</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="67feba97-b1b5-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/08/4">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to an arithmetic exception flaw. It occurs on the VNC
server side while processing the 'SetPixelFormat' messages from a
client.</p>
<p>A privileged remote client could use this flaw to crash the guest
resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8504</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/08/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/4c65fed8bdf96780735dbdb92a8bd0d6b6526cc3</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2016-01-03</entry>
</dates>
</vuln>
<vuln vid="405446f4-b1b3-11e5-9728-002590263bf5">
<topic>qemu and xen-tools -- denial of service vulnerabilities in AMD PC-Net II NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
<package>
<name>xen-tools</name>
<range><lt>4.5.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/2">
<p>Qemu emulator built with the AMD PC-Net II Ethernet Controller
support is vulnerable to a heap buffer overflow flaw. While
receiving packets in the loopback mode, it appends CRC code to the
receive buffer. If the data size given is same as the receive buffer
size, the appended CRC code overwrites 4 bytes beyond this
's->buffer' array.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS or potentially execute
arbitrary code with privileges of the Qemu process on the host.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/3">
<p>The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets
from a remote host(non-loopback mode), fails to validate the
received data size, thus resulting in a buffer overflow issue. It
could potentially lead to arbitrary code execution on the host, with
privileges of the Qemu process. It requires the guest NIC to have
larger MTU limit.</p>
<p>A remote user could use this flaw to crash the guest instance
resulting in DoS or potentially execute arbitrary code on a remote
host with privileges of the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7504</cvename>
<cvename>CVE-2015-7512</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/837f21aacf5a714c23ddaadbbc5212f9b661e3f7</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/8b98a2f07175d46c3f7217639bd5e03f2ec56343</url>
<url>http://xenbits.xen.org/xsa/advisory-162.html</url>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2016-01-03</entry>
<modified>2016-01-06</modified>
</dates>
</vuln>
<vuln vid="b56fe6bb-b1b1-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in eepro100 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.5.50</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20160213</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/25/3">
<p>Qemu emulator built with the i8255x (PRO100) emulation support is
vulnerable to an infinite loop issue. It could occur while
processing a chain of commands located in the Command Block List
(CBL). Each Command Block(CB) points to the next command in the
list. An infinite loop unfolds if the link to the next CB points
to the same block or there is a closed loop in the chain.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8345</cvename>
<freebsdpr>ports/205813</freebsdpr>
<freebsdpr>ports/205814</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/3</url>
<url>https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=00837731d254908a841d69298a4f9f077babaf24</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/00837731d254908a841d69298a4f9f077babaf24</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2016-01-03</entry>
<modified>2016-07-06</modified>
</dates>
</vuln>
<vuln vid="42cbd1e8-b152-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in virtio-net support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/5">
<p>Qemu emulator built with the Virtual Network Device(virtio-net)
support is vulnerable to a DoS issue. It could occur while receiving
large packets over the tuntap/macvtap interfaces and when guest's
virtio-net driver did not support big/mergeable receive buffers.</p>
<p>An attacker on the local network could use this flaw to disable
guest's networking by sending a large number of jumbo frames to the
guest, exhausting all receive buffers and thus leading to a DoS
situation.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7295</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=696317f1895e836d53b670c7b77b7be93302ba08</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/0cf33fb6b49a19de32859e2cdc6021334f448fb3</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="6aa3322f-b150-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerabilities in NE2000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/2">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur when receiving
packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/15/3">
<p>Qemu emulator built with the NE2000 NIC emulation support is
vulnerable to a heap buffer overflow issue. It could occur when
receiving packets over the network.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance or potentially execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5278</cvename>
<cvename>CVE-2015-5279</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/15/3</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=5a1ccdfe44946e726b4c6fda8a4493b3931a68c1</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/737d2b3c41d59eb8f94ab7eb419b957938f24943</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/9bbdbc66e5765068dce76e9269dce4547afd8ad4</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="bbc97005-b14e-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in IDE disk/CD/DVD-ROM emulation</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/10/1">
<p>Qemu emulator built with the IDE disk and CD/DVD-ROM emulation
support is vulnerable to a divide by zero issue. It could occur
while executing an IDE command WIN_READ_NATIVE_MAX to determine
the maximum size of a drive.</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6855</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/10/1</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=63d761388d6fea994ca498c6e7a210851a99ad93</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d9033e1d3aa666c5071580617a57bd853c5d794a</url>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="10bf8eed-b14d-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in e1000 NIC support</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.5.50.g20151224</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/04/4">
<p>Qemu emulator built with the e1000 NIC emulation support is
vulnerable to an infinite loop issue. It could occur while
processing transmit descriptor data when sending a network packet.
</p>
<p>A privileged user inside guest could use this flaw to crash the
Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6815</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/4</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=3a56af1fbc17ff453f6e90fb08ce0c0e6fd0b61b</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/b947ac2bf26479e710489739c465c8af336599e7</url>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="8a560bcf-b14b-11e5-9728-002590263bf5">
<topic>qemu -- denial of service vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.1.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.2.50.g20141230</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/7">
<p>Qemu emulator built with the VNC display driver is vulnerable to an
infinite loop issue. It could occur while processing a
CLIENT_CUT_TEXT message with specially crafted payload message.</p>
<p>A privileged guest user could use this flaw to crash the Qemu
process on the host, resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5239</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/7</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d</url>
</references>
<dates>
<discovery>2014-06-30</discovery>
<entry>2016-01-02</entry>
</dates>
</vuln>
<vuln vid="2b3b4c27-b0c7-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in VNC</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0.1</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20151011</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/21/6">
<p>Qemu emulator built with the VNC display driver support is
vulnerable to a buffer overflow flaw leading to a heap memory
corruption issue. It could occur while refreshing the server
display surface via routine vnc_refresh_server_surface().</p>
<p>A privileged guest user could use this flaw to corrupt the heap
memory and crash the Qemu process instance OR potentially use it
to execute arbitrary code on the host.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5225</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/21/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=efec4dcd2552e85ed57f276b58f09fc385727450</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/eb8934b0418b3b1d125edddc4fc334a54334a49b</url>
</references>
<dates>
<discovery>2015-08-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="21e5abe3-b0c6-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- buffer overflow vulnerability in virtio-serial message exchanges</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/06/3">
<p>Qemu emulator built with the virtio-serial vmchannel support is
vulnerable to a buffer overflow issue. It could occur while
exchanging virtio control messages between guest and the host.</p>
<p>A malicious guest could use this flaw to corrupt few bytes of Qemu
memory area, potentially crashing the Qemu process.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5745</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/06/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=7882080388be5088e72c425b02223c02e6cb4295</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/7882080388be5088e72c425b02223c02e6cb4295</url>
</references>
<dates>
<discovery>2015-08-06</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="a267cd6c-b0c4-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- stack buffer overflow while parsing SCSI commands</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Prasad J Pandit, Red Hat Product Security Team, reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/07/23/6">
<p>Qemu emulator built with the SCSI device emulation support is
vulnerable to a stack buffer overflow issue. It could occur while
parsing SCSI command descriptor block with an invalid operation
code.</p>
<p>A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw
to crash the Qemu instance resulting in DoS.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5158</cvename>
<url>http://openwall.com/lists/oss-security/2015/07/23/6</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/c170aad8b057223b1139d72e5ce7acceafab4fa9</url>
</references>
<dates>
<discovery>2015-07-23</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="aea8d90e-b0c1-11e5-8d13-bc5ff45d0f28">
<topic>qemu -- code execution on host machine</topic>
<affects>
<package>
<name>qemu</name>
<name>qemu-devel</name>
<range><lt>2.4.0</lt></range>
</package>
<package>
<name>qemu-sbruno</name>
<name>qemu-user-static</name>
<range><lt>2.4.50.g20150814</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Matousek of Red Hat Inc. reports:</p>
<blockquote cite="http://openwall.com/lists/oss-security/2015/06/17/5">
<p>Due converting PIO to the new memory read/write api we no longer
provide separate I/O region lenghts for read and write operations.
As a result, reading from PIT Mode/Command register will end with
accessing pit->channels with invalid index and potentially cause
memory corruption and/or minor information leak.</p>
<p>A privileged guest user in a guest with QEMU PIT emulation enabled
could potentially (tough unlikely) use this flaw to execute
arbitrary code on the host with the privileges of the hosting QEMU
process.</p>
<p>Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT
emulation and are thus not vulnerable to this issue.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3214</cvename>
<url>http://openwall.com/lists/oss-security/2015/06/17/5</url>
<url>http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
<url>https://github.com/seanbruno/qemu-bsd-user/commit/d4862a87e31a51de9eb260f25c9e99a75efe3235</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2016-01-01</entry>
</dates>
</vuln>
<vuln vid="4b3a7e70-afce-11e5-b864-14dae9d210b8">
<topic>mono -- DoS and code execution</topic>
<affects>
<package>
<name>mono</name>
<range><lt>4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NCC Group reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q4/543">
<p>An attacker who can cause a carefully-chosen string to be
converted to a floating-point number can cause a crash and potentially
induce arbitrary code execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q4/543</url>
<cvename>CVE-2009-0689</cvename>
</references>
<dates>
<discovery>2015-12-19</discovery>
<entry>2015-12-31</entry>
</dates>
</vuln>
<vuln vid="84c7ea88-bf04-4bdc-973b-36744bf540ab">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.559</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb16-01.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8644).</p>
<p>These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8651).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8634, CVE-2015-8635,
CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641,
CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647,
CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).</p>
<p>These updates resolve memory corruption vulnerabilities
that could lead to code execution (CVE-2015-8459,
CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8459</cvename>
<cvename>CVE-2015-8460</cvename>
<cvename>CVE-2015-8634</cvename>
<cvename>CVE-2015-8636</cvename>
<cvename>CVE-2015-8638</cvename>
<cvename>CVE-2015-8639</cvename>
<cvename>CVE-2015-8640</cvename>
<cvename>CVE-2015-8641</cvename>
<cvename>CVE-2015-8642</cvename>
<cvename>CVE-2015-8643</cvename>
<cvename>CVE-2015-8644</cvename>
<cvename>CVE-2015-8645</cvename>
<cvename>CVE-2015-8646</cvename>
<cvename>CVE-2015-8647</cvename>
<cvename>CVE-2015-8648</cvename>
<cvename>CVE-2015-8649</cvename>
<cvename>CVE-2015-8650</cvename>
<cvename>CVE-2015-8651</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb16-01.html</url>
</references>
<dates>
<discovery>2015-12-28</discovery>
<entry>2015-12-29</entry>
</dates>
</vuln>
<vuln vid="b808c3a8-ae30-11e5-b864-14dae9d210b8">
<topic>inspircd -- DoS</topic>
<affects>
<package>
<name>inspircd</name>
<range><lt>2.0.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Inspircd reports:</p>
<blockquote cite="http://www.inspircd.org/2015/04/16/v2019-released.html">
<p>This release fixes the issues discovered since 2.0.18,
containing multiple important stability and correctness related
improvements, including a fix for a bug which allowed malformed DNS
records to cause netsplits on a network.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.inspircd.org/2015/04/16/v2019-released.html</url>
<url>https://github.com/inspircd/inspircd/commit/6058483d9fbc1b904d5ae7cfea47bfcde5c5b559</url>
<url>http://comments.gmane.org/gmane.comp.security.oss.general/18464</url>
<cvename>CVE-2015-8702</cvename>
</references>
<dates>
<discovery>2015-04-16</discovery>
<entry>2015-12-29</entry>
<modified>2015-12-29</modified>
</dates>
</vuln>
<vuln vid="4bae544d-06a3-4352-938c-b3bcbca89298">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.4,1</lt></range>
<range><lt>2.7.4,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.6</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.2.r20151219 has ffmpeg-2.8.3 -->
<range><lt>1.2.r20151219_1</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8662">
<p>The ff_dwt_decode function in libavcodec/jpeg2000dwt.c in
FFmpeg before 2.8.4 does not validate the number of
decomposition levels before proceeding with Discrete Wavelet
Transform decoding, which allows remote attackers to cause a
denial of service (out-of-bounds array access) or possibly
have unspecified other impact via crafted JPEG 2000
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8663">
<p>The ff_get_buffer function in libavcodec/utils.c in
FFmpeg before 2.8.4 preserves width and height values after
a failure, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via a crafted .mov file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8662</cvename>
<cvename>CVE-2015-8663</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75422280fbcdfbe9dc56bde5525b4d8b280f1bc5</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=abee0a1c60612e8638640a8a3738fffb65e16dbf</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-12-20</discovery>
<entry>2015-12-28</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="10f7bc76-0335-4a88-b391-0b05b3a8ce1c">
<topic>NSS -- MD5 downgrade in TLS 1.2 signatures</topic>
<affects>
<package>
<name>nss</name>
<name>linux-c6-nss</name>
<range><ge>3.20</ge><lt>3.20.2</lt></range>
<range><lt>3.19.2.2</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0.2,1</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.1</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/">
<p>Security researcher Karthikeyan Bhargavan reported an
issue in Network Security Services (NSS) where MD5
signatures in the server signature within the TLS 1.2
ServerKeyExchange message are still accepted. This is an
issue since NSS has officially disallowed the accepting MD5
as a hash algorithm in signatures since 2011. This issues
exposes NSS based clients such as Firefox to theoretical
collision-based forgery attacks.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7575</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-150/</url>
<url>https://hg.mozilla.org/projects/nss/rev/94e1157f3fbb</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-28</entry>
</dates>
</vuln>
<vuln vid="88f75070-abcf-11e5-83d3-6805ca0b3d42">
<topic>phpMyAdmin -- path disclosure vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.5.0</ge><lt>4.5.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-6/">
<p>By calling some scripts that are part of phpMyAdmin in an
unexpected way, it is possible to trigger phpMyAdmin to
display a PHP error message which contains the full path of
the directory where phpMyAdmin is installed.</p>
<p>We consider these vulnerabilities to be non-critical.</p>
<p>This path disclosure is possible on servers where the
recommended setting of the PHP configuration directive
display_errors is set to on, which is against the
recommendations given in the PHP manual for a production
server.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-6/</url>
<cvename>CVE-2015-8669</cvename>
</references>
<dates>
<discovery>2015-12-25</discovery>
<entry>2015-12-26</entry>
</dates>
</vuln>
<vuln vid="876768aa-ab1e-11e5-8a30-5453ed2e2b49">
<topic>dpkg -- stack-based buffer overflow</topic>
<affects>
<package>
<name>dpkg</name>
<range><lt>1.16.17</lt></range>
<range><lt>1.17.26</lt></range>
<range><lt>1.18.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="https://lists.debian.org/debian-security-announce/2015/msg00312.html">
<p>Hanno Boeck discovered a stack-based buffer overflow in the
dpkg-deb component of dpkg, the Debian package management system.
This flaw could potentially lead to arbitrary code execution if a
user or an automated system were tricked into processing a specially
crafted Debian binary package (.deb) in the old style Debian binary
package format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0860</cvename>
<url>http://openwall.com/lists/oss-security/2015/11/26/3</url>
<url>https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=f1aac7d933819569bf6f347c3c0d5a64a90bbce0</url>
</references>
<dates>
<discovery>2015-11-26</discovery>
<entry>2015-12-25</entry>
</dates>
</vuln>
<vuln vid="e1b5318c-aa4d-11e5-8f5c-002590263bf5">
<topic>mantis -- information disclosure vulnerability</topic>
<affects>
<package>
<name>mantis</name>
<range><lt>1.2.19_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mantis reports:</p>
<blockquote cite="https://mantisbt.org/bugs/view.php?id=19873">
<p>CVE-2015-5059: documentation in private projects can be seen by
every user</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5059</cvename>
<freebsdpr>ports/201106</freebsdpr>
<url>https://mantisbt.org/bugs/view.php?id=19873</url>
<url>http://openwall.com/lists/oss-security/2015/06/25/3</url>
</references>
<dates>
<discovery>2015-06-23</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="f36bbd66-aa44-11e5-8f5c-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.12</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.5</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.4</lt></range>
</package>
<package>
<name>mediawiki126</name>
<range><lt>1.26.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html">
<p>(T117899) SECURITY: $wgArticlePath can no longer be set to relative
paths that do not begin with a slash. This enabled trivial XSS
attacks. Configuration values such as "http://my.wiki.com/wiki/$1"
are fine, as are "/wiki/$1". A value such as "$1" or "wiki/$1" is
not and will now throw an error.</p>
<p>(T119309) SECURITY: Use hash_compare() for edit token comparison.
</p>
<p>(T118032) SECURITY: Don't allow cURL to interpret POST parameters
starting with '@' as file uploads.</p>
<p>(T115522) SECURITY: Passwords generated by User::randomPassword()
can no longer be shorter than $wgMinimalPasswordLength.</p>
<p>(T97897) SECURITY: Improve IP parsing and trimming. Previous
behavior could result in improper blocks being issued.</p>
<p>(T109724) SECURITY: Special:MyPage, Special:MyTalk,
Special:MyContributions and related pages no longer use HTTP
redirects and are now redirected by MediaWiki.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8622</cvename>
<cvename>CVE-2015-8623</cvename>
<cvename>CVE-2015-8624</cvename>
<cvename>CVE-2015-8625</cvename>
<cvename>CVE-2015-8626</cvename>
<cvename>CVE-2015-8627</cvename>
<cvename>CVE-2015-8628</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html</url>
<url>https://phabricator.wikimedia.org/T117899</url>
<url>https://phabricator.wikimedia.org/T119309</url>
<url>https://phabricator.wikimedia.org/T118032</url>
<url>https://phabricator.wikimedia.org/T115522</url>
<url>https://phabricator.wikimedia.org/T97897</url>
<url>https://phabricator.wikimedia.org/T109724</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/23/7</url>
</references>
<dates>
<discovery>2015-12-18</discovery>
<entry>2015-12-24</entry>
</dates>
</vuln>
<vuln vid="3b50881d-1860-4721-aab1-503290e23f6c">
<topic>Ruby -- unsafe tainted string vulnerability</topic>
<affects>
<package>
<name>ruby</name>
<range><ge>2.0.0,1</ge><lt>2.0.0.648,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.8,1</lt></range>
<range><ge>2.2.0,1</ge><lt>2.2.4,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ruby developer reports:</p>
<blockquote cite="https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/">
<p>There is an unsafe tainted string vulnerability in Fiddle and DL.
This issue was originally reported and fixed with CVE-2009-5147 in
DL, but reappeared after DL was reimplemented using Fiddle and
libffi.</p>
<p>And, about DL, CVE-2009-5147 was fixed at Ruby 1.9.1, but not
fixed at other branches, then rubies which bundled DL except Ruby
1.9.1 are still vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/</url>
<cvename>CVE-2015-7551</cvename>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="54075861-a95a-11e5-8b40-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.11</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.15/">
<p>During the generation of a dependency graph, the code for
the HTML image map is generated locally if a local dot
installation is used. With escaped HTML characters in a bug
summary, it is possible to inject unfiltered HTML code in
the map file which the CreateImagemap function generates.
This could be used for a cross-site scripting attack.</p>
<p>If an external HTML page contains a <script> element with
its src attribute pointing to a buglist in CSV format, some
web browsers incorrectly try to parse the CSV file as valid
JavaScript code. As the buglist is generated based on the
privileges of the user logged into Bugzilla, the external
page could collect confidential data contained in the CSV
file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8508</cvename>
<cvename>CVE-2015-8509</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1221518</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1232785</url>
</references>
<dates>
<discovery>2015-12-22</discovery>
<entry>2015-12-23</entry>
</dates>
</vuln>
<vuln vid="d6c51737-a84b-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7558: Stack exhaustion due to cyclic dependency causing to
crash an application was found in librsvg2 while parsing SVG file.
It has been fixed in 2.40.12 by many commits that has rewritten the
checks for cyclic references.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7558</cvename>
<freebsdpr>ports/205502</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://bugzilla.redhat.com/1268243</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="da634091-a84a-11e5-8f5c-002590263bf5">
<topic>librsvg2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>librsvg2</name>
<range><lt>2.40.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adam Maris, Red Hat Product Security, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/21/5">
<p>CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when
parsing SVG file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7557</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/12/21/5</url>
<url>https://git.gnome.org/browse/librsvg/commit/rsvg-shapes.c?id=40af93e6eb1c94b90c3b9a0b87e0840e126bb8df</url>
</references>
<dates>
<discovery>2015-02-06</discovery>
<entry>2015-12-22</entry>
</dates>
</vuln>
<vuln vid="9e7306b9-a5c3-11e5-b864-14dae9d210b8">
<topic>quassel -- remote denial of service</topic>
<affects>
<package>
<name>quassel</name>
<range><lt>0.12.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pierre Schweitzer reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/12/1">
<p>Any client sending the command "/op *" in a query will
cause the Quassel core to crash.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/12/1</url>
<cvename>CVE-2015-8547</cvename>
</references>
<dates>
<discovery>2015-11-22</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="f714b4c9-a6c1-11e5-88d7-047d7b492d07">
<topic>libvirt -- ACL bypass using ../ to access beyond storage pool</topic>
<affects>
<package>
<name>libvirt</name>
<range><ge>1.1.0</ge><lt>1.2.19_2</lt></range>
<range><ge>1.2.20</ge><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Libvit development team reports:</p>
<blockquote cite="http://security.libvirt.org/2015/0004.html">
<p>Various virStorageVol* API operate on user-supplied volume names by
concatenating the volume name to the pool location. Note that the
virStoragePoolListVolumes API, when used on a storage pool backed by
a directory in a file system, will only list volumes immediately in
that directory (there is no traversal into subdirectories). However,
other APIs such as virStorageVolCreateXML were not checking if a
potential volume name represented one of the volumes that could be
returned by virStoragePoolListVolumes; because they were not rejecting
the use of '/' in a volume name.</p>
<p>Because no checking was done on volume names, a user could supply
a potential volume name of something like '../../../etc/passwd' to
attempt to access a file not belonging to the storage pool. When
fine-grained Access Control Lists (ACL) are in effect, a user with
storage_vol:create ACL permission but lacking domain:write permission
could thus abuse virStorageVolCreateXML and similar APIs to gain
access to files not normally permitted to that user. Fortunately, it
appears that the only APIs that could leak information or corrupt
files require read-write connection to libvirtd; and when ACLs are not
in use (the default without any further configuration), a user with
read-write access can already be considered to have full access to the
machine, and without an escalation of privilege there is no security
problem.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5313</cvename>
<url>http://security.libvirt.org/2015/0004.html</url>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-20</entry>
</dates>
</vuln>
<vuln vid="ef434839-a6a4-11e5-8275-000c292e4fd8">
<topic>samba -- multiple vulnerabilities</topic>
<affects>
<package>
<name>samba36</name>
<range><ge>3.6.0</ge><lt>3.6.25_2</lt></range>
</package>
<package>
<name>samba4</name>
<range><ge>4.0.0</ge><le>4.0.26</le></range>
</package>
<package>
<name>samba41</name>
<range><ge>4.1.0</ge><lt>4.1.22</lt></range>
</package>
<package>
<name>samba42</name>
<range><ge>4.2.0</ge><lt>4.2.7</lt></range>
</package>
<package>
<name>samba43</name>
<range><ge>4.3.0</ge><lt>4.3.3</lt></range>
</package>
<package>
<name>ldb</name>
<range><ge>1.0.0</ge><lt>1.1.24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samba team reports:</p>
<blockquote cite="https://www.samba.org/samba/latest_news.html#4.3.3">
<p>[CVE-2015-3223] Malicious request can cause Samba LDAP server to hang, spinning using CPU.</p>
<p>[CVE-2015-5330] Malicious request can cause Samba LDAP server
to return uninitialized memory that should not be part of the reply.</p>
<p>[CVE-2015-5296] Requesting encryption should also request
signing when setting up the connection to protect against man-in-the-middle attacks.</p>
<p>[CVE-2015-5299] A missing access control check in the VFS
shadow_copy2 module could allow unauthorized users to access snapshots.</p>
<p>[CVE-2015-7540] Malicious request can cause Samba LDAP server to return crash.</p>
<p>[CVE-2015-8467] Samba can expose Windows DCs to MS15-096
Denial of service via the creation of multiple machine accounts(The Microsoft issue is CVE-2015-2535).</p>
<p>[CVE-2015-5252] Insufficient symlink verification could allow data access outside share path.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3223</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-3223.html</url>
<cvename>CVE-2015-5252</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5252.html</url>
<cvename>CVE-2015-5296</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5296.html</url>
<cvename>CVE-2015-5299</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5299.html</url>
<cvename>CVE-2015-5330</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-5330.html</url>
<cvename>CVE-2015-7540</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-7540.html</url>
<cvename>CVE-2015-8467</cvename>
<url>https://www.samba.org/samba/security/CVE-2015-8467.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-19</entry>
<modified>2016-02-05</modified>
</dates>
</vuln>
<vuln vid="bb7d4791-a5bf-11e5-a0e5-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.106</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html">
<p>2 security fixes in this release, including:</p>
<ul>
<li>[569486] CVE-2015-6792: Fixes from internal audits and
fuzzing.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6792</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_15.html</url>
</references>
<dates>
<discovery>2015-12-16</discovery>
<entry>2015-12-18</entry>
</dates>
</vuln>
<vuln vid="7329938b-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.4.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Till Kamppeter reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/14/13">
<p>Cups Filters/Foomatic Filters does not consider semicolon
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/14/13</url>
<cvename>CVE-2015-8560</cvename>
</references>
<dates>
<discovery>2015-12-12</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="6dbae1a8-a4e6-11e5-b864-14dae9d210b8">
<topic>cups-filters -- code execution</topic>
<affects>
<package>
<name>cups-filters</name>
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>foomatic-filters</name>
<range><lt>4.0.17_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salvatore Bonaccorso reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/12/13/2">
<p>Cups Filters/Foomatic Filters does not consider backtick
as an illegal escape character.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/12/13/2</url>
<cvename>CVE-2015-8327</cvename>
</references>
<dates>
<discovery>2015-10-30</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="1fbd6db1-a4e4-11e5-b864-14dae9d210b8">
<topic>py-amf -- input sanitization errors</topic>
<affects>
<package>
<name>py27-amf</name>
<name>py32-amf</name>
<name>py33-amf</name>
<name>py34-amf</name>
<range><lt>0.8.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="http://www.ocert.org/advisories/ocert-2015-011.html">
<p>A specially crafted AMF payload, containing malicious
references to XML external entities, can be used to trigger Denial of
Service (DoS) conditions or arbitrarily return the contents of files
that are accessible with the running application privileges.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.ocert.org/advisories/ocert-2015-011.html</url>
<cvename>CVE-2015-8549</cvename>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-17</entry>
</dates>
</vuln>
<vuln vid="a9f60ce8-a4e0-11e5-b864-14dae9d210b8">
<topic>joomla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html">
<h2>[20151201] - Core - Remote Code Execution Vulnerability</h2>
<p>Browser information is not filtered properly while saving the
session values into the database which leads to a Remote Code
Execution vulnerability.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html">
<h2>[20151202] - Core - CSRF Hardening</h2>
<p>Add additional CSRF hardening in com_templates.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html">
<h2>[20151203] - Core - Directory Traversal</h2>
<p>Failure to properly sanitize input data from the XML install file
located within an extension's package archive allows for directory
traversal.</p>
</blockquote>
<blockquote cite="https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html">
<h2>[20151204] - Core - Directory Traversal</h2>
<p>Inadequate filtering of request data leads to a Directory Traversal
vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.joomla.org/announcements/release-news/5641-joomla-3-4-6-released.html</url>
<cvename>CVE-2015-8562</cvename>
<cvename>CVE-2015-8563</cvename>
<cvename>CVE-2015-8564</cvename>
<cvename>CVE-2015-8565</cvename>
<url>https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html</url>
<url>https://developer.joomla.org/security-centre/633-20151214-core-csrf-hardening.html</url>
<url>https://developer.joomla.org/security-centre/634-20151214-core-directory-traversal.html</url>
<url>https://developer.joomla.org/security-centre/635-20151214-core-directory-traversal-2.html</url>
</references>
<dates>
<discovery>2015-12-14</discovery>
<entry>2015-12-17</entry>
<modified>2016-12-22</modified>
</dates>
</vuln>
<vuln vid="a8ec4db7-a398-11e5-85e9-14dae9d210b8">
<topic>bind -- multiple vulnerabilities</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.8P2</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.3P2</lt></range>
</package>
<package>
<name>bind9-devel</name>
<range><lt>9.11.0.a20151215</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_32</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html">
<p>Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.</p>
<p>Incorrect reference counting could result in an INSIST
failure if a socket error occurred while performing a lookup. This flaw
is disclosed in CVE-2015-8461. [RT#40945]</p>
<p>Insufficient testing when parsing a message allowed records
with an incorrect class to be be accepted, triggering a REQUIRE failure
when those records were subsequently cached. This flaw is disclosed in
CVE-2015-8000. [RT #40987]</p>
</blockquote>
</body>
</description>
<references>
<url>https://kb.isc.org/article/AA-01328/0/BIND-9.10.3-P2-Release-Notes.html</url>
<url>https://kb.isc.org/article/AA-01317/0/CVE-2015-8000%3A-Responses-with-a-malformed-class-attribute-can-trigger-an-assertion-failure-in-db.c.html</url>
<url>https://kb.isc.org/article/AA-01319/0/CVE-2015-8461%3A-A-race-condition-when-handling-socket-errors-can-lead-to-an-assertion-failure-in-resolver.c.html</url>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-8000</cvename>
<cvename>CVE-2015-8461</cvename>
<freebsdsa>SA-15:27.bind</freebsdsa>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-12-16</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="2c2d1c39-1396-459a-91f5-ca03ee7c64c6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>43.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.40</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.5.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.5.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-134 Miscellaneous memory safety hazards
(rv:43.0 / rv:38.5)</p>
<p>MFSA 2015-135 Crash with JavaScript variable assignment
with unboxed objects</p>
<p>MFSA 2015-136 Same-origin policy violation using
perfomance.getEntries and history navigation</p>
<p>MFSA 2015-137 Firefox allows for control characters to be
set in cookies</p>
<p>MFSA 2015-138 Use-after-free in WebRTC when datachannel
is used after being destroyed</p>
<p>MFSA 2015-139 Integer overflow allocating extremely large
textures</p>
<p>MFSA 2015-140 Cross-origin information leak through web
workers error events</p>
<p>MFSA 2015-141 Hash in data URI is incorrectly parsed</p>
<p>MFSA 2015-142 DOS due to malformed frames in HTTP/2</p>
<p>MFSA 2015-143 Linux file chooser crashes on malformed
images due to flaws in Jasper library</p>
<p>MFSA 2015-144 Buffer overflows found through code
inspection</p>
<p>MFSA 2015-145 Underflow through code inspection</p>
<p>MFSA 2015-146 Integer overflow in MP4 playback in 64-bit
versions</p>
<p>MFSA 2015-147 Integer underflow and buffer overflow
processing MP4 metadata in libstagefright</p>
<p>MFSA 2015-148 Privilege escalation vulnerabilities in
WebExtension APIs</p>
<p>MFSA 2015-149 Cross-site reading attack through data and
view-source URIs</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7201</cvename>
<cvename>CVE-2015-7202</cvename>
<cvename>CVE-2015-7203</cvename>
<cvename>CVE-2015-7204</cvename>
<cvename>CVE-2015-7205</cvename>
<cvename>CVE-2015-7207</cvename>
<cvename>CVE-2015-7208</cvename>
<cvename>CVE-2015-7210</cvename>
<cvename>CVE-2015-7211</cvename>
<cvename>CVE-2015-7212</cvename>
<cvename>CVE-2015-7213</cvename>
<cvename>CVE-2015-7214</cvename>
<cvename>CVE-2015-7215</cvename>
<cvename>CVE-2015-7216</cvename>
<cvename>CVE-2015-7217</cvename>
<cvename>CVE-2015-7218</cvename>
<cvename>CVE-2015-7219</cvename>
<cvename>CVE-2015-7220</cvename>
<cvename>CVE-2015-7221</cvename>
<cvename>CVE-2015-7222</cvename>
<cvename>CVE-2015-7223</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-134/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-135/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-136/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-137/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-138/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-139/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-140/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-141/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-142/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-143/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-144/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-145/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-146/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-147/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-148/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-149/</url>
</references>
<dates>
<discovery>2015-12-15</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="a5934ba8-a376-11e5-85e9-14dae9d210b8">
<topic>java -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openjdk8</name>
<name>openjdk8-jre</name>
<range><lt>8.66.17</lt></range>
</package>
<package>
<name>openjdk7</name>
<name>openjdk7-jre</name>
<range><lt>7.91.02,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA">
<p>This Critical Patch Update contains 25 new security fixes
for Oracle Java SE. 24 of these vulnerabilities may be remotely
exploitable without authentication, i.e., may be exploited over a
network without the need for a username and password.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA</url>
<cvename>CVE-2015-4835</cvename>
<cvename>CVE-2015-4881</cvename>
<cvename>CVE-2015-4843</cvename>
<cvename>CVE-2015-4883</cvename>
<cvename>CVE-2015-4860</cvename>
<cvename>CVE-2015-4805</cvename>
<cvename>CVE-2015-4844</cvename>
<cvename>CVE-2015-4901</cvename>
<cvename>CVE-2015-4868</cvename>
<cvename>CVE-2015-4810</cvename>
<cvename>CVE-2015-4806</cvename>
<cvename>CVE-2015-4871</cvename>
<cvename>CVE-2015-4902</cvename>
<cvename>CVE-2015-4840</cvename>
<cvename>CVE-2015-4882</cvename>
<cvename>CVE-2015-4842</cvename>
<cvename>CVE-2015-4734</cvename>
<cvename>CVE-2015-4903</cvename>
<cvename>CVE-2015-4803</cvename>
<cvename>CVE-2015-4893</cvename>
<cvename>CVE-2015-4911</cvename>
<cvename>CVE-2015-4872</cvename>
<cvename>CVE-2015-4906</cvename>
<cvename>CVE-2015-4916</cvename>
<cvename>CVE-2015-4908</cvename>
</references>
<dates>
<discovery>2015-10-20</discovery>
<entry>2015-12-15</entry>
<modified>2016-01-08</modified>
</dates>
</vuln>
<vuln vid="daadef86-a366-11e5-8b40-20cf30e32f6d">
<topic>subversion -- multiple vulnerabilities</topic>
<affects>
<package>
<name>subversion17</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
</package>
<package>
<name>subversion18</name>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
</package>
<package>
<name>subversion</name>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
<package>
<name>mod_dav_svn</name>
<range><ge>1.7.0</ge><lt>1.7.22_1</lt></range>
<range><ge>1.8.0</ge><lt>1.8.15</lt></range>
<range><ge>1.9.0</ge><lt>1.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Subversion Project reports:</p>
<blockquote cite="http://subversion.apache.org/security/">
<p>Remotely triggerable heap overflow and out-of-bounds read caused
by integer overflow in the svn:// protocol parser.</p>
<p>Remotely triggerable heap overflow and out-of-bounds read in
mod_dav_svn caused by integer overflow when parsing skel-encoded
request bodies.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5343</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5343-advisory.txt</url>
<cvename>CVE-2015-5259</cvename>
<url>http://subversion.apache.org/security/CVE-2015-5259-advisory.txt</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-15</entry>
</dates>
</vuln>
<vuln vid="72c145df-a1e0-11e5-8ad0-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html">
<p>7 security fixes in this release, including:</p>
<ul>
<li>[548273] High CVE-2015-6788: Type confusion in extensions.
Credit to anonymous.</li>
<li>[557981] High CVE-2015-6789: Use-after-free in Blink. Credit to
cloudfuzzer.</li>
<li>[542054] Medium CVE-2015-6790: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[567513] CVE-2015-6791: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6788</cvename>
<cvename>CVE-2015-6789</cvename>
<cvename>CVE-2015-6790</cvename>
<cvename>CVE-2015-6791</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update_8.html</url>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="33459061-a1d6-11e5-8794-bcaec565249c">
<topic>freeimage -- multiple integer overflows</topic>
<affects>
<package>
<name>freeimage</name>
<range><lt>3.16.0_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pcheng pcheng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/08/28/1">
<p>An integer overflow issue in the FreeImage project was
reported and fixed recently.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-0852</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/08/28/1</url>
</references>
<dates>
<discovery>2015-08-28</discovery>
<entry>2015-12-13</entry>
</dates>
</vuln>
<vuln vid="21bc4d71-9ed8-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.9</lt></range>
<range><ge>3.0.0</ge><lt>3.0.7</lt></range>
<range><ge>3.1.0</ge><lt>3.1.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Data disclosure in atom feed.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8537</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2015-12-05</discovery>
<entry>2015-12-10</entry>
<modified>2015-12-11</modified>
</dates>
</vuln>
<vuln vid="be63533c-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.8</lt></range>
<range><ge>3.0.0</ge><lt>3.0.6</lt></range>
<range><ge>3.1.0</ge><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential changeset message disclosure in issues API.</p>
<p>Data disclosure on the time logging form</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8346</cvename>
<cvename>CVE-2015-8473</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/25/12</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/7</url>
</references>
<dates>
<discovery>2015-11-14</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="3ec2e0bc-9ed7-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.5.1</ge><lt>2.6.7</lt></range>
<range><ge>3.0.0</ge><lt>3.0.5</lt></range>
<range><eq>3.1.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8474</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/04/1</url>
</references>
<dates>
<discovery>2015-09-20</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="939a7086-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- potential XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.6.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential XSS vulnerability when rendering some flash messages.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8477</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/05/6</url>
</references>
<dates>
<discovery>2015-02-19</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="49def4b7-9ed6-11e5-8f5c-002590263bf5">
<topic>redmine -- information leak vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.6</lt></range>
<range><ge>2.5.0</ge><lt>2.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Potential data leak (project names) in the invalid form
authenticity token error screen.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2014-07-06</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="c2efcd46-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- open redirect vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>2.4.5</lt></range>
<range><eq>2.5.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Open Redirect vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-1985</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>https://jvn.jp/en/jp/JVN93004610/index.html</url>
</references>
<dates>
<discovery>2014-03-29</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="66ba5931-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- XSS vulnerability</topic>
<affects>
<package>
<name>redmine</name>
<range><ge>2.1.0</ge><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2012-09-30</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="0e0385d1-9ed5-11e5-8f5c-002590263bf5">
<topic>redmine -- multiple vulnerabilities</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Mass-assignment vulnerability that would allow an attacker to
bypass part of the security checks.</p>
<p>Persistent XSS vulnerability</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0327</cvename>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
<url>http://jvn.jp/en/jp/JVN93406632/</url>
</references>
<dates>
<discovery>2012-03-11</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="ae377aeb-9ed4-11e5-8f5c-002590263bf5">
<topic>redmine -- CSRF protection bypass</topic>
<affects>
<package>
<name>redmine</name>
<range><lt>1.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Redmine reports:</p>
<blockquote cite="http://www.redmine.org/projects/redmine/wiki/Security_Advisories">
<p>Vulnerability that would allow an attacker to bypass the CSRF
protection.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.redmine.org/projects/redmine/wiki/Security_Advisories</url>
</references>
<dates>
<discovery>2011-12-10</discovery>
<entry>2015-12-10</entry>
</dates>
</vuln>
<vuln vid="23af0425-9eac-11e5-b937-00e0814cab4e">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>
<package>
<name>jenkins</name>
<range><le>1.641</le></range>
</package>
<package>
<name>jenkins-lts</name>
<range><le>1.625.3</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Security Advisory:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09">
<h1>Description</h1>
<h5>SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)</h5>
<p>In certain configurations, low privilege users were able to
create e.g. HTML files in workspaces and archived artifacts that
could result in XSS when accessed by other users. Jenkins now sends
Content-Security-Policy headers that enables sandboxing and
prohibits script execution by default.</p>
<h5>SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)</h5>
<p>Several administration/configuration related URLs could be
accessed using GET, which allowed attackers to circumvent CSRF
protection.</p>
<h5>SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)</h5>
<p>Malicious users were able to circumvent CSRF protection on any
URL by sending specially crafted POST requests.</p>
<h5>SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)</h5>
<p>While the Jenkins update site data is digitally signed, and the
signature verified by Jenkins, Jenkins did not verify the provided
SHA-1 checksums for the plugin files referenced in the update site
data. This enabled MITM attacks on the plugin manager, resulting
in installation of attacker-provided plugins.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09</url>
</references>
<dates>
<discovery>2015-12-09</discovery>
<entry>2015-12-09</entry>
</dates>
</vuln>
<vuln vid="c8842a84-9ddd-11e5-8c2f-c485083ca99c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.554</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-32.html">
<p>
These updates resolve heap buffer overflow vulnerabilities that
could lead to code execution (CVE-2015-8438, CVE-2015-8446).</p>
<p>
These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-8444, CVE-2015-8443,
CVE-2015-8417, CVE-2015-8416, CVE-2015-8451, CVE-2015-8047,
CVE-2015-8053, CVE-2015-8045, CVE-2015-8051, CVE-2015-8060,
CVE-2015-8419, CVE-2015-8408).</p>
<p>
These updates resolve security bypass vulnerabilities
(CVE-2015-8453, CVE-2015-8440, CVE-2015-8409).</p>
<p>
These updates resolve a stack overflow vulnerability that
could lead to code execution (CVE-2015-8407).</p>
<p>
These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-8439).</p>
<p>
These updates resolve an integer overflow vulnerability
that could lead to code execution (CVE-2015-8445).</p>
<p>
These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-8415).</p>
<p>
These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-8050, CVE-2015-8049,
CVE-2015-8437, CVE-2015-8450, CVE-2015-8449, CVE-2015-8448,
CVE-2015-8436, CVE-2015-8452, CVE-2015-8048, CVE-2015-8413,
CVE-2015-8412, CVE-2015-8410, CVE-2015-8411, CVE-2015-8424,
CVE-2015-8422, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423,
CVE-2015-8425, CVE-2015-8433, CVE-2015-8432, CVE-2015-8431,
CVE-2015-8426, CVE-2015-8430, CVE-2015-8427, CVE-2015-8428,
CVE-2015-8429, CVE-2015-8434, CVE-2015-8435, CVE-2015-8414,
CVE-2015-8052, CVE-2015-8059, CVE-2015-8058, CVE-2015-8055,
CVE-2015-8057, CVE-2015-8056, CVE-2015-8061, CVE-2015-8067,
CVE-2015-8066, CVE-2015-8062, CVE-2015-8068, CVE-2015-8064,
CVE-2015-8065, CVE-2015-8063, CVE-2015-8405, CVE-2015-8404,
CVE-2015-8402, CVE-2015-8403, CVE-2015-8071, CVE-2015-8401,
CVE-2015-8406, CVE-2015-8069, CVE-2015-8070, CVE-2015-8441,
CVE-2015-8442, CVE-2015-8447).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-32.html</url>
<cvename>CVE-2015-8045</cvename>
<cvename>CVE-2015-8047</cvename>
<cvename>CVE-2015-8048</cvename>
<cvename>CVE-2015-8049</cvename>
<cvename>CVE-2015-8050</cvename>
<cvename>CVE-2015-8051</cvename>
<cvename>CVE-2015-8052</cvename>
<cvename>CVE-2015-8053</cvename>
<cvename>CVE-2015-8054</cvename>
<cvename>CVE-2015-8055</cvename>
<cvename>CVE-2015-8056</cvename>
<cvename>CVE-2015-8057</cvename>
<cvename>CVE-2015-8058</cvename>
<cvename>CVE-2015-8059</cvename>
<cvename>CVE-2015-8060</cvename>
<cvename>CVE-2015-8061</cvename>
<cvename>CVE-2015-8062</cvename>
<cvename>CVE-2015-8063</cvename>
<cvename>CVE-2015-8064</cvename>
<cvename>CVE-2015-8065</cvename>
<cvename>CVE-2015-8066</cvename>
<cvename>CVE-2015-8067</cvename>
<cvename>CVE-2015-8068</cvename>
<cvename>CVE-2015-8069</cvename>
<cvename>CVE-2015-8070</cvename>
<cvename>CVE-2015-8071</cvename>
<cvename>CVE-2015-8401</cvename>
<cvename>CVE-2015-8402</cvename>
<cvename>CVE-2015-8403</cvename>
<cvename>CVE-2015-8404</cvename>
<cvename>CVE-2015-8405</cvename>
<cvename>CVE-2015-8406</cvename>
<cvename>CVE-2015-8407</cvename>
<cvename>CVE-2015-8408</cvename>
<cvename>CVE-2015-8409</cvename>
<cvename>CVE-2015-8410</cvename>
<cvename>CVE-2015-8411</cvename>
<cvename>CVE-2015-8412</cvename>
<cvename>CVE-2015-8413</cvename>
<cvename>CVE-2015-8414</cvename>
<cvename>CVE-2015-8415</cvename>
<cvename>CVE-2015-8416</cvename>
<cvename>CVE-2015-8417</cvename>
<cvename>CVE-2015-8419</cvename>
<cvename>CVE-2015-8420</cvename>
<cvename>CVE-2015-8421</cvename>
<cvename>CVE-2015-8422</cvename>
<cvename>CVE-2015-8423</cvename>
<cvename>CVE-2015-8424</cvename>
<cvename>CVE-2015-8425</cvename>
<cvename>CVE-2015-8426</cvename>
<cvename>CVE-2015-8427</cvename>
<cvename>CVE-2015-8428</cvename>
<cvename>CVE-2015-8429</cvename>
<cvename>CVE-2015-8430</cvename>
<cvename>CVE-2015-8431</cvename>
<cvename>CVE-2015-8432</cvename>
<cvename>CVE-2015-8433</cvename>
<cvename>CVE-2015-8434</cvename>
<cvename>CVE-2015-8435</cvename>
<cvename>CVE-2015-8436</cvename>
<cvename>CVE-2015-8437</cvename>
<cvename>CVE-2015-8438</cvename>
<cvename>CVE-2015-8439</cvename>
<cvename>CVE-2015-8440</cvename>
<cvename>CVE-2015-8441</cvename>
<cvename>CVE-2015-8442</cvename>
<cvename>CVE-2015-8443</cvename>
<cvename>CVE-2015-8444</cvename>
<cvename>CVE-2015-8445</cvename>
<cvename>CVE-2015-8446</cvename>
<cvename>CVE-2015-8447</cvename>
<cvename>CVE-2015-8448</cvename>
<cvename>CVE-2015-8449</cvename>
<cvename>CVE-2015-8450</cvename>
<cvename>CVE-2015-8451</cvename>
<cvename>CVE-2015-8452</cvename>
<cvename>CVE-2015-8453</cvename>
</references>
<dates>
<discovery>2015-12-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="215e740e-9c56-11e5-90e7-b499baebfeaf">
<topic>libressl -- NULL pointer dereference</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.5</lt></range>
<range><ge>2.3.0</ge><lt>2.3.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenBSD project reports:</p>
<blockquote cite="https://marc.info/?l=openbsd-announce&t=144920914600002">
<p>A NULL pointer deference could be triggered by a crafted
certificate sent to services configured to verify client
certificates on TLS/SSL connections.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://marc.info/?l=openbsd-announce&t=144920914600002</url>
<cvename>CVE-2015-3194</cvename>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="918a5d1f-9d40-11e5-8f5c-002590263bf5">
<topic>KeePassX -- information disclosure</topic>
<affects>
<package>
<name>KeePassX</name>
<range><lt>0.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yves-Alexis Perez reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/30/4">
<p>Starting an export (using File / Export to / KeepassX XML file) and
cancelling it leads to KeepassX saving a cleartext XML file in
~/.xml without any warning.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8378</cvename>
<freebsdpr>ports/205105</freebsdpr>
<url>http://www.openwall.com/lists/oss-security/2015/11/30/4</url>
</references>
<dates>
<discovery>2015-07-08</discovery>
<entry>2015-12-08</entry>
</dates>
</vuln>
<vuln vid="84fdd1bb-9d37-11e5-8f5c-002590263bf5">
<topic>passenger -- client controlled header overwriting</topic>
<affects>
<package>
<name>rubygem-passenger</name>
<range><ge>5.0.0</ge><lt>5.0.22</lt></range>
<range><lt>4.0.60</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Daniel Knoppel reports:</p>
<blockquote cite="https://blog.phusion.nl/2015/12/07/cve-2015-7519/">
<p>It was discovered by the SUSE security team that it was possible,
in some cases, for clients to overwrite headers set by the server,
resulting in a medium level security issue. CVE-2015-7519 has been
assigned to this issue.</p>
<p>Affected use-cases:</p>
<p>Header overwriting may occur if all of the following conditions are met:</p>
<ul>
<li>Apache integration mode, or standalone+builtin engine without
a filtering proxy</li>
<li>Ruby or Python applications only (Passenger 5); or any
application (Passenger 4)</li>
<li>The app depends on a request header containing a dash (-)</li>
<li>The header is supposed to be trusted (set by the server)</li>
<li>The client correctly guesses the header name</li>
</ul>
<p>This vulnerability has been fixed by filtering out client headers
that do not consist of alphanumeric/dash characters (Nginx already
did this, so Passenger+Nginx was not affected). If your application
depends on headers that don't conform to this, you can add a
workaround in Apache specifically for those to convert them to a
dash-based format.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7519</cvename>
<url>https://blog.phusion.nl/2015/12/07/cve-2015-7519/</url>
</references>
<dates>
<discovery>2015-12-07</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="e6b974ab-9d35-11e5-8f5c-002590263bf5">
<topic>Salt -- information disclosure</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes report:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html">
<p>CVE-2015-8034: Saving state.sls cache data to disk with insecure
permissions</p>
<p>This affects users of the state.sls function. The state run cache
on the minion was being created with incorrect permissions. This
file could potentially contain sensitive data that was inserted via
jinja into the state SLS files. The permissions for this file are
now being set correctly. Thanks to @zmalone for bringing this issue
to our attention.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8034</cvename>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.3.html</url>
</references>
<dates>
<discovery>2015-11-25</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="6bc6eed2-9cca-11e5-8c2b-c335fa8985d7">
<topic>libraw -- memory objects not properly initialized</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8367, LibRaw's phase_one_correct function does not
handle memory initialization correctly, which may cause other
problems.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/490ef94d1796f730180039e80997efe5c58db780</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8367</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="db04bf07-9cc8-11e5-8c2b-c335fa8985d7">
<topic>libraw -- index overflow in smal_decode_segment</topic>
<affects>
<package>
<name>libraw</name>
<range><lt>0.17.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ChenQin reports:</p>
<blockquote cite="http://seclists.org/fulldisclosure/2015/Nov/108">
<p>The LibRaw raw image decoder has multiple vulnerabilities that can
cause memory errors which may lead to code execution or other
problems.</p>
<p>In CVE-2015-8366, LibRaw's smal_decode_segment function does not
handle indexes carefully, which can cause an index overflow.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libraw.org/news/libraw-0-17-1</url>
<url>https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2</url>
<mlist>http://seclists.org/fulldisclosure/2015/Nov/108</mlist>
<cvename>CVE-2015-8366</cvename>
</references>
<dates>
<discovery>2015-11-30</discovery>
<entry>2015-12-07</entry>
</dates>
</vuln>
<vuln vid="4c8d1d72-9b38-11e5-aece-d050996490d0">
<topic>openssl -- multiple vulnerabilities</topic>
<affects>
<package>
<name>openssl</name>
<range><lt>1.0.2_5</lt></range>
</package>
<package>
<name>mingw32-openssl</name>
<range><ge>1.0.1</ge><lt>1.0.2e</lt></range>
</package>
<package>
<name>linux-c6-openssl</name>
<range><lt>1.0.1e_7</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_8</lt></range>
<range><ge>10.1</ge><lt>10.1_25</lt></range>
<range><ge>9.3</ge><lt>9.3_31</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSSL project reports:</p>
<blockquote cite="https://www.openssl.org/news/secadv/20151203.txt">
<ol>
<li>BN_mod_exp may produce incorrect results on x86_64
(CVE-2015-3193)</li>
<li>Certificate verify crash with missing PSS parameter
(CVE-2015-3194)</li>
<li>X509_ATTRIBUTE memory leak (CVE-2015-3195)</li>
<li>Race condition handling PSK identify hint
(CVE-2015-3196)</li>
<li>Anon DH ServerKeyExchange with 0 p parameter
(CVE-2015-1794)</li>
</ol>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:26.openssl</freebsdsa>
<cvename>CVE-2015-1794</cvename>
<cvename>CVE-2015-3193</cvename>
<cvename>CVE-2015-3194</cvename>
<cvename>CVE-2015-3195</cvename>
<cvename>CVE-2015-3196</cvename>
<url>https://www.openssl.org/news/secadv/20151203.txt</url>
</references>
<dates>
<discovery>2015-12-03</discovery>
<entry>2015-12-05</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="8a90dc87-89f9-11e5-a408-00248c0c745d">
<topic>PHPmailer -- SMTP injection vulnerability</topic>
<affects>
<package>
<name>phpmailer</name>
<range><lt>5.2.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHPMailer changelog reports:</p>
<blockquote cite="https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md">
<p>Fix vulnerability that allowed email addresses with
line breaks (valid in RFC5322) to pass to SMTP, permitting
message injection at the SMTP level. Mitigated in both
the address validator and in the lower-level SMTP class.
Thanks to Takeshi Terada.</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/PHPMailer/PHPMailer/blob/v5.2.14/changelog.md</url>
</references>
<dates>
<discovery>2015-11-05</discovery>
<entry>2015-12-03</entry>
</dates>
</vuln>
<vuln vid="b0da85af-21a3-4c15-a137-fe9e4bc86002">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.8,1</ge><lt>2.8.3,1</lt></range>
<range><lt>2.7.3,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.5</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.9</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.12</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-15.2 has ffmpeg-2.6.4 -->
<range><lt>16.0</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150822_6 has ffmpeg-2.8.2 -->
<range><lt>1.1.r20150822_7</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6761">
<p>The update_dimensions function in libavcodec/vp8.c in
FFmpeg through 2.8.1, as used in Google Chrome before
46.0.2490.71 and other products, relies on a
coefficient-partition count during multi-threaded operation,
which allows remote attackers to cause a denial of service
(race condition and memory corruption) or possibly have
unspecified other impact via a crafted WebM file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8216">
<p>The ljpeg_decode_yuv_scan function in
libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain
width and height checks, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted MJPEG
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8217">
<p>The ff_hevc_parse_sps function in libavcodec/hevc_ps.c in
FFmpeg before 2.8.2 does not validate the Chroma Format
Indicator, which allows remote attackers to cause a denial
of service (out-of-bounds array access) or possibly have
unspecified other impact via crafted High Efficiency Video
Coding (HEVC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8218">
<p>The decode_uncompressed function in libavcodec/faxcompr.c
in FFmpeg before 2.8.2 does not validate uncompressed runs,
which allows remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted CCITT FAX data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8219">
<p>The init_tile function in libavcodec/jpeg2000dec.c in
FFmpeg before 2.8.2 does not enforce minimum-value and
maximum-value constraints on tile coordinates, which allows
remote attackers to cause a denial of service (out-of-bounds
array access) or possibly have unspecified other impact via
crafted JPEG 2000 data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8363">
<p>The jpeg2000_read_main_headers function in
libavcodec/jpeg2000dec.c in FFmpeg before 2.6.5, 2.7.x
before 2.7.3, and 2.8.x through 2.8.2 does not enforce
uniqueness of the SIZ marker in a JPEG 2000 image, which
allows remote attackers to cause a denial of service
(out-of-bounds heap-memory access) or possibly have
unspecified other impact via a crafted image with two or
more of these markers.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8364">
<p>Integer overflow in the ff_ivi_init_planes function in
libavcodec/ivi.c in FFmpeg before 2.6.5, 2.7.x before 2.7.3,
and 2.8.x through 2.8.2 allows remote attackers to cause a
denial of service (out-of-bounds heap-memory access) or
possibly have unspecified other impact via crafted image
dimensions in Indeo Video Interactive data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8365">
<p>The smka_decode_frame function in libavcodec/smacker.c in
FFmpeg before 2.6.5, 2.7.x before 2.7.3, and 2.8.x through
2.8.2 does not verify that the data size is consistent with
the number of channels, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted Smacker
data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-8216</cvename>
<cvename>CVE-2015-8217</cvename>
<cvename>CVE-2015-8218</cvename>
<cvename>CVE-2015-8219</cvename>
<cvename>CVE-2015-8363</cvename>
<cvename>CVE-2015-8364</cvename>
<cvename>CVE-2015-8365</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=dabea74d0e82ea80cd344f630497cafcb3ef872c</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d24888ef19ba38b787b11d1ee091a3d94920c76a</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=93f30f825c08477fe8f76be00539e96014cc83c8</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d4a731b84a08f0f3839eaaaf82e97d8d9c67da46</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43492ff3ab68a343c1264801baa1d5a02de10167</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=44a7f17d0b20e6f8d836b2957e3e357b639f19a2</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=df91aa034b82b77a3c4e01791f4a2b2ff6c82066</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4a9af07a49295e014b059c1ab624c40345af5892</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-11-27</discovery>
<entry>2015-12-02</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="548f74bd-993c-11e5-956b-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>47.0.2526.73</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html">
<p>41 security fixes in this release, including:</p>
<ul>
<li>[558589] Critical CVE-2015-6765: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[551044] High CVE-2015-6766: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[554908] High CVE-2015-6767: Use-after-free in AppCache.
Credit to anonymous.</li>
<li>[556724] High CVE-2015-6768: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[534923] High CVE-2015-6769: Cross-origin bypass in core.
Credit to Mariusz Mlynski.</li>
<li>[541206] High CVE-2015-6770: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[544991] High CVE-2015-6771: Out of bounds access in v8.
Credit to anonymous.</li>
<li>[546545] High CVE-2015-6772: Cross-origin bypass in DOM.
Credit to Mariusz Mlynski.</li>
<li>[554946] High CVE-2015-6764: Out of bounds access in v8.
Credit to Guang Gong of Qihoo 360 via pwn2own.</li>
<li>[491660] High CVE-2015-6773: Out of bounds access in Skia.
Credit to cloudfuzzer.</li>
<li>[549251] High CVE-2015-6774: Use-after-free in Extensions.
Credit to anonymous.</li>
<li>[529012] High CVE-2015-6775: Type confusion in PDFium.
Credit to Atte Kettunen of OUSPG.</li>
<li>[457480] High CVE-2015-6776: Out of bounds access in PDFium.
Credit to Hanno Böck.</li>
<li>[544020] High CVE-2015-6777: Use-after-free in DOM.
Credit to Long Liu of Qihoo 360Vulcan Team.</li>
<li>[514891] Medium CVE-2015-6778: Out of bounds access in PDFium.
Credit to Karl Skomski.</li>
<li>[528505] Medium CVE-2015-6779: Scheme bypass in PDFium.
Credit to Til Jasper Ullrich.</li>
<li>[490492] Medium CVE-2015-6780: Use-after-free in Infobars.
Credit to Khalil Zhani.</li>
<li>[497302] Medium CVE-2015-6781: Integer overflow in Sfntly.
Credit to miaubiz.</li>
<li>[536652] Medium CVE-2015-6782: Content spoofing in Omnibox.
Credit to Luan Herrera.</li>
<li>[537205] Medium CVE-2015-6783: Signature validation issue in
Android Crazy Linker. Credit to Michal Bednarski.</li>
<li>[503217] Low CVE-2015-6784: Escaping issue in saved pages.
Credit to Inti De Ceukelaire.</li>
<li>[534542] Low CVE-2015-6785: Wildcard matching issue in CSP.
Credit to Michael Ficarra / Shape Security.</li>
<li>[534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to
Michael Ficarra / Shape Security.</li>
<li>[563930] CVE-2015-6787: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li> Multiple vulnerabilities in V8 fixed at the tip of the 4.7
branch (currently 4.7.80.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6765</cvename>
<cvename>CVE-2015-6766</cvename>
<cvename>CVE-2015-6767</cvename>
<cvename>CVE-2015-6768</cvename>
<cvename>CVE-2015-6769</cvename>
<cvename>CVE-2015-6770</cvename>
<cvename>CVE-2015-6771</cvename>
<cvename>CVE-2015-6772</cvename>
<cvename>CVE-2015-6773</cvename>
<cvename>CVE-2015-6774</cvename>
<cvename>CVE-2015-6775</cvename>
<cvename>CVE-2015-6776</cvename>
<cvename>CVE-2015-6777</cvename>
<cvename>CVE-2015-6778</cvename>
<cvename>CVE-2015-6779</cvename>
<cvename>CVE-2015-6780</cvename>
<cvename>CVE-2015-6781</cvename>
<cvename>CVE-2015-6782</cvename>
<cvename>CVE-2015-6783</cvename>
<cvename>CVE-2015-6784</cvename>
<cvename>CVE-2015-6785</cvename>
<cvename>CVE-2015-6786</cvename>
<cvename>CVE-2015-6787</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-12-01</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="11351c82-9909-11e5-a9c8-14dae9d5a9d2">
<topic>piwik -- multiple vulnerabilities</topic>
<affects>
<package>
<name>piwik</name>
<range><lt>2.15.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Piwik changelog reports:</p>
<blockquote cite="http://piwik.org/changelog/piwik-2-15-0/">
<p>This release is rated critical.
We are grateful for Security researchers who disclosed
security issues privately to the Piwik Security Response
team: Elamaran Venkatraman, Egidio Romano and Dmitriy
Shcherbatov. The following vulnerabilities were fixed:
XSS, CSRF, possible file inclusion in older PHP versions
(low impact), possible Object Injection Vulnerability
(low impact).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7815</cvename>
<cvename>CVE-2015-7816</cvename>
<url>http://piwik.org/changelog/piwik-2-15-0/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-12-02</entry>
</dates>
</vuln>
<vuln vid="d62ec98e-97d8-11e5-8c0e-080027b00c2e">
<topic>cyrus-imapd -- integer overflow in the start_octet addition</topic>
<affects>
<package>
<name>cyrus-imapd25</name>
<range><ge>2.5.0</ge><lt>2.5.7</lt></range>
</package>
<package>
<name>cyrus-imapd24</name>
<range><ge>2.4.0</ge><lt>2.4.18_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cyrus IMAP 2.5.7 Release Note states:</p>
<blockquote cite="https://docs.cyrus.foundation/imap/release-notes/2.5/x/2.5.7.html">
<p>CVE-2015-8077, CVE-2015-8078: protect against integer overflow in urlfetch range checks</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8078</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8078</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8078.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8078</url>
<cvename>CVE-2015-8077</cvename>
<url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8077</url>
<url>http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8077.html</url>
<url>https://security-tracker.debian.org/tracker/CVE-2015-8077</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-12-01</entry>
</dates>
</vuln>
<vuln vid="11c52bc6-97aa-11e5-b8df-14dae9d210b8">
<topic>django -- information leak vulnerability</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<range><lt>1.8.7</lt></range>
</package>
<package>
<name>py27-django17</name>
<name>py32-django17</name>
<name>py33-django17</name>
<name>py34-django17</name>
<range><lt>1.7.11</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>If an application allows users to specify an unvalidated
format for dates and passes this format to the date filter, e.g. {{
last_updated|date:user_date_format }}, then a malicious user could
obtain any secret in the application's settings by specifying a settings
key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/</url>
<cvename>CVE-2015-8213</cvename>
</references>
<dates>
<discovery>2015-11-24</discovery>
<entry>2015-11-30</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="fb2475c2-9125-11e5-bd18-002590263bf5">
<topic>kibana4 -- CSRF vulnerability</topic>
<affects>
<package>
<name>kibana4</name>
<name>kibana41</name>
<range><ge>4.0.0</ge><lt>4.1.3</lt></range>
</package>
<package>
<name>kibana42</name>
<range><ge>4.2.0</ge><lt>4.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Elastic reports:</p>
<blockquote cite="https://www.elastic.co/community/security/">
<p>Vulnerability Summary: Kibana versions prior to 4.1.3 and 4.2.1
are vulnerable to a CSRF attack.</p>
<p>Remediation Summary: Users should upgrade to 4.1.3 or 4.2.1.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8131</cvename>
<url>https://www.elastic.co/community/security/</url>
</references>
<dates>
<discovery>2015-11-17</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="e359051d-90bd-11e5-bd18-002590263bf5">
<topic>a2ps -- format string vulnerability</topic>
<affects>
<package>
<name>a2ps</name>
<range><lt>4.13b_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jong-Gwon Kim reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/16/4">
<p>When user runs a2ps with malicious crafted pro(a2ps prologue) file,
an attacker can execute arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8107</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/11/16/4</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-22</entry>
</dates>
</vuln>
<vuln vid="ecc268f2-8fc2-11e5-918c-bcaec565249c">
<topic>libxslt -- DoS vulnerability due to type confusing error</topic>
<affects>
<package>
<name>libsxlt</name>
<range><lt>1.1.28_8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libxslt maintainer reports:</p>
<blockquote cite="https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617">
<p>CVE-2015-7995:
http://www.openwall.com/lists/oss-security/2015/10/27/10
We need to check that the parent node is an element before
dereferencing its namespace.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7995</cvename>
<url>https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="e5423caf-8fb8-11e5-918c-bcaec565249c">
<topic>libxml2 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libxml2</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://xmlsoft.org/news.html">
<p>CVE-2015-5312 Another entity expansion issue (David Drysdale).</p>
<p>CVE-2015-7497 Avoid an heap buffer overflow in
xmlDictComputeFastQKey (David Drysdale).</p>
<p>CVE-2015-7498 Avoid processing entities after encoding
conversion failures (Daniel Veillard).</p>
<p>CVE-2015-7499 (1) Add xmlHaltParser() to stop the parser
(Daniel Veillard).</p>
<p>CVE-2015-7499 (2) Detect incoherency on GROW (Daniel
Veillard).</p>
<p>CVE-2015-7500 Fix memory access error due to incorrect
entities boundaries (Daniel Veillard).</p>
<p>CVE-2015-7941 (1) Stop parsing on entities boundaries
errors (Daniel Veillard).</p>
<p>CVE-2015-7941 (2) Cleanup conditional section error
handling (Daniel Veillard).</p>
<p>CVE-2015-7942 Another variation of overflow in
Conditional sections (Daniel Veillard).</p>
<p>CVE-2015-7942 (2) Fix an error in previous Conditional
section patch (Daniel Veillard).</p>
<p>CVE-2015-8035 Fix XZ compression support loop
(Daniel Veillard).</p>
<p>CVE-2015-8242 Buffer overead with HTML parser in push
mode (Hugh Davenport)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5312</cvename>
<cvename>CVE-2015-7497</cvename>
<cvename>CVE-2015-7498</cvename>
<cvename>CVE-2015-7499</cvename>
<cvename>CVE-2015-7500</cvename>
<cvename>CVE-2015-7941</cvename>
<cvename>CVE-2015-7942</cvename>
<cvename>CVE-2015-8035</cvename>
<cvename>CVE-2015-8241</cvename>
<cvename>CVE-2015-8242</cvename>
<url>http://xmlsoft.org/news.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/11/18/23</url>
</references>
<dates>
<discovery>2015-11-20</discovery>
<entry>2015-11-20</entry>
</dates>
</vuln>
<vuln vid="9d04936c-75f1-4a2c-9ade-4c1708be5df9">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>linux-c6-nspr</name>
<range><lt>4.10.10</lt></range>
</package>
<package>
<name>nss</name>
<range><ge>3.20</ge><lt>3.20.1</lt></range>
<range><ge>3.19.3</ge><lt>3.19.4</lt></range>
<range><lt>3.19.2.1</lt></range>
</package>
<package>
<name>firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>42.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.39</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.4.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.4.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-133 NSS and NSPR memory corruption issues</p>
<p>MFSA 2015-132 Mixed content WebSocket policy bypass
through workers</p>
<p>MFSA 2015-131 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-130 JavaScript garbage collection crash with
Java applet</p>
<p>MFSA 2015-129 Certain escaped characters in host of
Location-header are being treated as non-escaped</p>
<p>MFSA 2015-128 Memory corruption in libjar through zip
files</p>
<p>MFSA 2015-127 CORS preflight is bypassed when
non-standard Content-Type headers are received</p>
<p>MFSA 2015-126 Crash when accessing HTML tables with
accessibility tools on OS X</p>
<p>MFSA 2015-125 XSS attack through intents on Firefox for
Android</p>
<p>MFSA 2015-124 Android intents can be used on Firefox for
Android to open privileged files</p>
<p>MFSA 2015-123 Buffer overflow during image interactions
in canvas</p>
<p>MFSA 2015-122 Trailing whitespace in IP address hostnames
can bypass same-origin policy</p>
<p>MFSA 2015-121 Disabling scripts in Add-on SDK panels has
no effect</p>
<p>MFSA 2015-120 Reading sensitive profile files through
local HTML file on Android</p>
<p>MFSA 2015-119 Firefox for Android addressbar can be
removed after fullscreen mode</p>
<p>MFSA 2015-118 CSP bypass due to permissive Reader mode
whitelist</p>
<p>MFSA 2015-117 Information disclosure through NTLM
authentication</p>
<p>MFSA 2015-116 Miscellaneous memory safety hazards
(rv:42.0 / rv:38.4)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4513</cvename>
<cvename>CVE-2015-4514</cvename>
<cvename>CVE-2015-4515</cvename>
<cvename>CVE-2015-4518</cvename>
<cvename>CVE-2015-7181</cvename>
<cvename>CVE-2015-7182</cvename>
<cvename>CVE-2015-7183</cvename>
<cvename>CVE-2015-7185</cvename>
<cvename>CVE-2015-7186</cvename>
<cvename>CVE-2015-7187</cvename>
<cvename>CVE-2015-7188</cvename>
<cvename>CVE-2015-7189</cvename>
<cvename>CVE-2015-7190</cvename>
<cvename>CVE-2015-7191</cvename>
<cvename>CVE-2015-7192</cvename>
<cvename>CVE-2015-7193</cvename>
<cvename>CVE-2015-7194</cvename>
<cvename>CVE-2015-7195</cvename>
<cvename>CVE-2015-7196</cvename>
<cvename>CVE-2015-7197</cvename>
<cvename>CVE-2015-7198</cvename>
<cvename>CVE-2015-7199</cvename>
<cvename>CVE-2015-7200</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-116/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-117/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-118/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-119/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-120/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-121/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-122/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-123/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-124/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-125/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-126/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-127/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-128/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-129/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-130/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-131/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-132/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-133/</url>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-19</entry>
<modified>2016-04-13</modified>
</dates>
</vuln>
<vuln vid="68847b20-8ddc-11e5-b69c-c86000169601">
<topic>gdm -- lock screen bypass when holding escape key</topic>
<affects>
<package>
<name>gdm</name>
<range><lt>3.16.2_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ray Strode reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html">
<p>CVE-2015-7496 - lock screen bypass when holding escape key.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7496</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-November/msg00074.html</url>
<url>https://bugzilla.gnome.org/show_bug.cgi?id=758032</url>
</references>
<dates>
<discovery>2015-11-12</discovery>
<entry>2015-11-18</entry>
</dates>
</vuln>
<vuln vid="3eb0ccc2-8c6a-11e5-8519-005056ac623e">
<topic>strongswan -- authentication bypass vulnerability in the eap-mschapv2 plugin</topic>
<affects>
<package>
<name>strongswan</name>
<range><lt>5.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Strongswan Release Notes reports:</p>
<blockquote cite="https://github.com/strongswan/strongswan/blob/master/NEWS">
<p>Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin that
was caused by insufficient verification of the internal state when handling
MSCHAPv2 Success messages received by the client.
This vulnerability has been registered as CVE-2015-8023.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8023</cvename>
<url>https://github.com/strongswan/strongswan/commit/453e204ac40dfff2e0978e8f84a5f8ff0cbc45e2</url>
</references>
<dates>
<discovery>2015-11-16</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="82b3ca2a-8c07-11e5-bd18-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.11</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.9</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.9.3_release_notes">
<p>MSA-15-0037 Possible to send a message to a user who blocked
messages from non contacts</p>
<p>MSA-15-0038 DDoS possibility in Atto</p>
<p>MSA-15-0039 CSRF in site registration form</p>
<p>MSA-15-0040 Student XSS in survey</p>
<p>MSA-15-0041 XSS in flash video player</p>
<p>MSA-15-0042 CSRF in lesson login form</p>
<p>MSA-15-0043 Web service core_enrol_get_enrolled_users does not
respect course group mode</p>
<p>MSA-15-0044 Capability to view available badges is not
respected</p>
<p>MSA-15-0045 SCORM module allows to bypass access restrictions based
on date</p>
<p>MSA-15-0046 Choice module closing date can be bypassed</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.moodle.org/dev/Moodle_2.7.11_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.9_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.3_release_notes</url>
</references>
<dates>
<discovery>2015-11-09</discovery>
<entry>2015-11-16</entry>
<modified>2015-12-21</modified>
</dates>
</vuln>
<vuln vid="2cabfbab-8bfb-11e5-bd18-002590263bf5">
<topic>xen-kernel -- CPU lockup during exception delivery</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-156.html">
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant,
perhaps indefinite period. If a host watchdog (Xen or dom0) is in
use, this can lead to a watchdog timeout and consequently a reboot
of the host. If another, innocent, guest, is configured with a
watchdog, this issue can lead to a reboot of such a guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5307</cvename>
<cvename>CVE-2015-8104</cvename>
<url>http://xenbits.xen.org/xsa/advisory-156.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-16</entry>
</dates>
</vuln>
<vuln vid="1886e195-8b87-11e5-90e7-b499baebfeaf">
<topic>libpng buffer overflow in png_set_PLTE</topic>
<affects>
<package>
<name>png</name>
<range><lt>1.6.20</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>libpng reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/11/12/2">
<p>CVE for a vulnerability in libpng, all versions, in the
png_set_PLTE/png_get_PLTE functions. These functions failed to check for
an out-of-range palette when reading or writing PNG files with a bit_depth
less than 8. Some applications might read the bit depth from the IHDR
chunk and allocate memory for a 2^N entry palette, while libpng can return
a palette with up to 256 entries even when the bit depth is less than 8.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/11/12/2</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/03/6</url>
<cvename>CVE-2015-8126</cvename>
<cvename>CVE-2015-8472</cvename>
</references>
<dates>
<discovery>2015-11-15</discovery>
<entry>2015-11-15</entry>
<modified>2015-12-08</modified>
</dates>
</vuln>
<vuln vid="547fbd98-8b1f-11e5-b48b-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.548</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-28.html">
<p>These updates resolve a type confusion vulnerability that
could lead to code execution (CVE-2015-7659).</p>
<p>These updates resolve a security bypass vulnerability that
could be exploited to write arbitrary data to the file
system under user permissions (CVE-2015-7662).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7651, CVE-2015-7652,
CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656,
CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661,
CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044,
CVE-2015-8046).</p>
</blockquote>
</body>
</description>
<references>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-28.html</url>
<cvename>CVE-2015-7651</cvename>
<cvename>CVE-2015-7652</cvename>
<cvename>CVE-2015-7653</cvename>
<cvename>CVE-2015-7654</cvename>
<cvename>CVE-2015-7655</cvename>
<cvename>CVE-2015-7656</cvename>
<cvename>CVE-2015-7657</cvename>
<cvename>CVE-2015-7658</cvename>
<cvename>CVE-2015-7659</cvename>
<cvename>CVE-2015-7660</cvename>
<cvename>CVE-2015-7661</cvename>
<cvename>CVE-2015-7662</cvename>
<cvename>CVE-2015-7663</cvename>
<cvename>CVE-2015-8043</cvename>
<cvename>CVE-2015-8044</cvename>
<cvename>CVE-2015-8046</cvename>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-14</entry>
</dates>
</vuln>
<vuln vid="f0b9049f-88c4-11e5-aed7-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.86</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html">
<p>[520422] High CVE-2015-1302: Information leak in PDF viewer.
Credit to Rob Wu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1302</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/11/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="851a0eea-88aa-11e5-90e7-b499baebfeaf">
<topic>MySQL - Multiple vulnerabilities</topic>
<affects>
<package>
<name>mariadb-client</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb-server</name>
<range><lt>5.3.13</lt></range>
</package>
<package>
<name>mariadb55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mariadb100-client</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mariadb100-server</name>
<range><lt>10.0.22</lt></range>
</package>
<package>
<name>mysql55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>mysql56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>mysql56-server</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona55-client</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona55-server</name>
<range><lt>5.5.46</lt></range>
</package>
<package>
<name>percona56-client</name>
<range><lt>5.6.27</lt></range>
</package>
<package>
<name>percona56-server</name>
<range><lt>5.6.27</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Oracle reports:</p>
<blockquote cite="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">
<p>Critical Patch Update: MySQL Server, version(s) 5.5.45 and prior, 5.6.26 and prior</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html</url>
<cvename>CVE-2015-4802</cvename>
<cvename>CVE-2015-4807</cvename>
<cvename>CVE-2015-4815</cvename>
<cvename>CVE-2015-4826</cvename>
<cvename>CVE-2015-4830</cvename>
<cvename>CVE-2015-4836</cvename>
<cvename>CVE-2015-4858</cvename>
<cvename>CVE-2015-4861</cvename>
<cvename>CVE-2015-4870</cvename>
<cvename>CVE-2015-4913</cvename>
<cvename>CVE-2015-4792</cvename>
<url>https://mariadb.com/kb/en/mariadb/mariadb-5546-release-notes/</url>
<url>https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/</url>
<url>https://www.percona.com/doc/percona-server/5.5/release-notes/Percona-Server-5.5.46-37.5.html</url>
<url>https://www.percona.com/doc/percona-server/5.6/release-notes/Percona-Server-5.6.27-75.0.html</url>
</references>
<dates>
<discovery>2015-11-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="b665668a-91db-4f13-8113-9e4b5b0e47f7">
<topic>jenkins -- remote code execution via unsafe deserialization</topic>
<affects>
<package>
<name>jenkins</name>
<range><lt>1.638</lt></range>
</package>
<package>
<name>jenkins-lts</name>
<range><lt>1.625.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jenkins Developers report:</p>
<blockquote cite="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11">
<p>Unsafe deserialization allows unauthenticated remote attackers to
run arbitrary code on the Jenkins master.</p>
</blockquote>
</body>
</description>
<references>
<url>https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11</url>
<url>https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli</url>
<url>http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#thefix</url>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="71af4ded-8864-11e5-af1b-001999f8d30b">
<topic>owncloudclient -- Improper validation of certificates when using self-signed certificates</topic>
<affects>
<package>
<name>owncloudclient</name>
<range><lt>2.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>owncloud.org reports:</p>
<blockquote cite="https://owncloud.org/security/advisory/?id=oc-sa-2015-016">
<p>The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates.</p>
</blockquote>
</body>
</description>
<references>
<url>https://owncloud.org/security/advisory/?id=oc-sa-2015-016</url>
<cvename>CVE-2015-7298</cvename>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="c0e76d33-8821-11e5-ab94-002590263bf5">
<topic>xen-tools -- populate-on-demand balloon size inaccuracy can crash guests</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>3.4</ge><lt>4.5.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-153.html">
<p>Guests configured with PoD might be unstable, especially under
load. In an affected guest, an unprivileged guest user might be
able to cause a guest crash, perhaps simply by applying load so
as to cause heavy memory pressure within the guest.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7972</cvename>
<url>http://xenbits.xen.org/xsa/advisory-153.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e4848ca4-8820-11e5-ab94-002590263bf5">
<topic>xen-kernel -- some pmu and profiling hypercalls log without rate limiting</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.2</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-152.html">
<p>HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and
attempts at invalid operations. These log messages are not
rate-limited, even though they can be triggered by guests.</p>
<p>A malicious guest could cause repeated logging to the hypervisor
console, leading to a Denial of Service attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7971</cvename>
<url>http://xenbits.xen.org/xsa/advisory-152.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="e3792855-881f-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of per-domain profiling-related vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>4.0</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-151.html">
<p>A domain's xenoprofile state contains an array of per-vcpu
information... This array is leaked on domain teardown. This memory
leak could -- over time -- exhaust the host's memory.</p>
<p>The following parties can mount a denial of service attack
affecting the whole system:</p>
<ul>
<li>A malicious guest administrator via XENOPROF_get_buffer.</li>
<li>A domain given suitable privilege over another domain via
XENOPROF_set_passive (this would usually be a domain being
used to profile another domain, eg with the xenoprof tool).</li>
</ul>
<p>The ability to also restart or create suitable domains is also
required to fully exploit the issue. Without this the leak is
limited to a small multiple of the maximum number of vcpus for the
domain.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-151.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="83350009-881e-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Long latency populate-on-demand operation is not preemptible</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-150.html">
<p>When running an HVM domain in Populate-on-Demand mode, Xen would
sometimes search the domain for memory to reclaim, in response to
demands for population of other pages in the same domain. This
search runs without preemption. The guest can, by suitable
arrangement of its memory contents, create a situation where this
search is a time-consuming linear scan of the guest's address
space.</p>
<p>A malicious HVM guest administrator can cause a denial of service.
Specifically, prevent use of a physical CPU for a significant
period.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7970</cvename>
<url>http://xenbits.xen.org/xsa/advisory-150.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="fc1f8795-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- leak of main per-domain vcpu pointer array</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-149.html">
<p>A domain's primary array of vcpu pointers can be allocated by a
toolstack exactly once in the lifetime of a domain via the
XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain
teardown. This memory leak could -- over time -- exhaust the host's
memory.</p>
<p>A domain given partial management control via XEN_DOMCTL_max_vcpus
can mount a denial of service attack affecting the whole system. The
ability to also restart or create suitable domains is also required
to fully exploit the issue. Without this the leak is limited to a
small multiple of the maximum number of vcpus for the domain. The
maximum leak is 64kbytes per domain (re)boot (less on ARM).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7969</cvename>
<url>http://xenbits.xen.org/xsa/advisory-149.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="3d9f6260-881d-11e5-ab94-002590263bf5">
<topic>xen-kernel -- Uncontrolled creation of large page mappings by PV guests</topic>
<affects>
<package>
<name>xen-kernel</name>
<range><ge>3.4</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-148.html">
<p>The code to validate level 2 page table entries is bypassed when
certain conditions are satisfied. This means that a PV guest can
create writable mappings using super page mappings. Such writable
mappings can violate Xen intended invariants for pages which Xen is
supposed to keep read-only. This is possible even if the
"allowsuperpage" command line option is not used.</p>
<p>Malicious PV guest administrators can escalate privilege so as to
control the whole system.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7835</cvename>
<url>http://xenbits.xen.org/xsa/advisory-148.html</url>
</references>
<dates>
<discovery>2015-10-29</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="301b04d7-881c-11e5-ab94-002590263bf5">
<topic>xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen</topic>
<affects>
<package>
<name>xen-tools</name>
<range><ge>4.1</ge><lt>4.5.1_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Xen Project reports:</p>
<blockquote cite="http://xenbits.xen.org/xsa/advisory-142.html">
<p>Callers of libxl can specify that a disk should be read-only to the
guest. However, there is no code in libxl to pass this information
to qemu-xen (the upstream-based qemu); and indeed there is no way in
qemu to make a disk read-only.</p>
<p>The vulnerability is exploitable only via devices emulated by the
device model, not the parallel PV devices for supporting PVHVM.
Normally the PVHVM device unplug protocol renders the emulated
devices inaccessible early in boot.</p>
<p>Malicious guest administrators or (in some situations) users may be
able to write to supposedly read-only disk images.</p>
<p>CDROM devices (that is, devices specified to be presented to the
guest as CDROMs, regardless of the nature of the backing storage on
the host) are not affected.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7311</cvename>
<url>http://xenbits.xen.org/xsa/advisory-142.html</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="2f7f4db2-8819-11e5-ab94-002590263bf5">
<topic>p5-HTML-Scrubber -- XSS vulnerability</topic>
<affects>
<package>
<name>p5-HTML-Scrubber</name>
<range><lt>0.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5667">
<p>Cross-site scripting (XSS) vulnerability in the HTML-Scrubber
module before 0.15 for Perl, when the comment feature is enabled,
allows remote attackers to inject arbitrary web script or HTML via
a crafted comment.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5667</cvename>
<url>https://metacpan.org/release/HTML-Scrubber</url>
<url>http://jvndb.jvn.jp/jvndb/JVNDB-2015-000171</url>
<url>http://jvn.jp/en/jp/JVN53973084/index.html</url>
</references>
<dates>
<discovery>2015-10-10</discovery>
<entry>2015-11-11</entry>
</dates>
</vuln>
<vuln vid="6ca7eddd-d436-486a-b169-b948436bcf14">
<topic>libvpx -- buffer overflow in vp9_init_context_buffers</topic>
<affects>
<package>
<name>libvpx</name>
<range><lt>1.4.0.488_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/security/advisories/mfsa2015-101/">
<p>Security researcher Khalil Zhani reported that a
maliciously crafted vp9 format video could be used to
trigger a buffer overflow while parsing the file. This leads
to a potentially exploitable crash due to a flaw in the
libvpx library.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4506</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-11-10</entry>
</dates>
</vuln>
<vuln vid="56665ccb-8723-11e5-9b13-14dae9d210b8">
<topic>powerdns -- Denial of Service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.4</ge><lt>3.4.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/">
<p>A bug was found using afl-fuzz in our packet parsing code.
This bug, when exploited, causes an assertion error and consequent
termination of the the pdns_server process, causing a Denial of Service.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/</url>
<cvename>CVE-2015-5311</cvename>
</references>
<dates>
<discovery>2015-11-03</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="0cb0afd9-86b8-11e5-bf60-080027ef73ec">
<topic>PuTTY -- memory corruption in terminal emulator's erase character handling</topic>
<affects>
<package>
<name>putty</name>
<range><ge>0.54</ge><lt>0.66</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ben Harris reports:</p>
<blockquote cite="http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html">
<p>Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a
potentially memory-corrupting integer overflow in the handling of
the ECH (erase characters) control sequence in the terminal
emulator.</p>
<p>To exploit a vulnerability in the terminal emulator, an attacker
must be able to insert a carefully crafted escape sequence into the
terminal stream. For a PuTTY SSH session, this must be before
encryption, so the attacker likely needs access to the server you're
connecting to. For instance, an attacker on a multi-user machine
that you connect to could trick you into running cat on a file they
control containing a malicious escape sequence. (Unix write(1) is
not a vector for this, if implemented correctly.)</p>
<p>Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do
not include the terminal emulator, so cannot be exploited this
way.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflow.html</url>
<cvename>CVE-2015-5309</cvename>
</references>
<dates>
<discovery>2015-11-06</discovery>
<entry>2015-11-09</entry>
</dates>
</vuln>
<vuln vid="18b3c61b-83de-11e5-905b-ac9e174be3af">
<topic>OpenOffice 4.1.1 -- multiple vulnerabilities</topic>
<affects>
<package>
<name>apache-openoffice</name>
<range><lt>4.1.2</lt></range>
</package>
<package>
<name>apache-openoffice-devel</name>
<range><lt>4.2.1705368,3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-4551.html">
<p>A vulnerability in OpenOffice settings of OpenDocument Format
files and templates allows silent access to files that are
readable from an user account, over-riding the user's default
configuration settings. Once these files are imported into a
maliciously-crafted document, the data can be silently hidden
in the document and possibly exported to an external party
without being observed. </p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5212.html">
<p>A crafted ODF document can be used to create a buffer that is
too small for the amount of data loaded into it, allowing an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5213.html">
<p>A crafted Microsoft Word DOC file can be used to specify a
document buffer that is too small for the amount of data
provided for it. Failure to detect the discrepancy allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
<p>The Apache OpenOffice Project reports:</p>
<blockquote cite="http://www.openoffice.org/security/cves/CVE-2015-5214.html">
<p>A crafted Microsoft Word DOC can contain invalid bookmark
positions leading to memory corruption when the document is
loaded or bookmarks are manipulated. The defect allows an
attacker to cause denial of service (memory corruption and
application crash) and possible execution of arbitrary code.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4551</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-4551.html</url>
<cvename>CVE-2015-5212</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5212.html</url>
<cvename>CVE-2015-5213</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5213.html</url>
<cvename>CVE-2015-5214</cvename>
<url>http://www.openoffice.org/security/cves/CVE-2015-5214.html</url>
</references>
<dates>
<discovery>2015-11-04</discovery>
<entry>2015-11-05</entry>
<modified>2015-11-05</modified>
</dates>
</vuln>
<vuln vid="698403a7-803d-11e5-ab94-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed an XSS attack vector in Security Library method
xss_clean().</p>
<p>Changed Config Library method base_url() to fallback to
``$_SERVER['SERVER_ADDR']`` in order to avoid Host header
injections.</p>
<p>Changed CAPTCHA Helper to try to use the operating system's PRNG
first.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-31</discovery>
<entry>2015-11-01</entry>
</dates>
</vuln>
<vuln vid="017a493f-7db6-11e5-a762-14dae9d210b8">
<topic>openafs -- information disclosure</topic>
<affects>
<package>
<name>openafs</name>
<range><lt>1.6.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OpenAFS development team reports:</p>
<blockquote cite="http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt">
<p>When constructing an Rx acknowledgment (ACK) packet, Andrew-derived Rx
implementations do not initialize three octets of data that are padding
in the C language structure and were inadvertently included in the wire
protocol (CVE-2015-7762). Additionally, OpenAFS Rx in versions 1.5.75
through 1.5.78, 1.6.0 through 1.6.14, and 1.7.0 through 1.7.32 include
a variable-length padding at the end of the ACK packet, in an attempt to
detect the path MTU, but only four octets of the additional padding are
initialized (CVE-2015-7763).</p>
</blockquote>
</body>
</description>
<references>
<url>http://openafs.org/pages/security/OPENAFS-SA-2015-007.txt</url>
<cvename>CVE-2015-7762</cvename>
<cvename>CVE-2015-7763</cvename>
</references>
<dates>
<discovery>2015-10-28</discovery>
<entry>2015-10-28</entry>
</dates>
</vuln>
<vuln vid="4b9393b8-7c0c-11e5-a010-080027ddead3">
<topic>xscreensaver - lock bypass</topic>
<affects>
<package>
<name>xscreensaver</name>
<name>xscreensaver-gnome</name>
<name>xscreensaver-gnome-hacks</name>
<range><lt>5.34</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>RedHat bugzilla reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=1274452">
<p>In dual screen configurations, unplugging one screen will cause
xscreensaver to crash, leaving the screen unlocked.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.jwz.org/xscreensaver/changelog.html</url>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=1274452</url>
<cvename>CVE-2015-8025</cvename>
</references>
<dates>
<discovery>2015-10-24</discovery>
<entry>2015-10-27</entry>
<modified>2015-11-04</modified>
</dates>
</vuln>
<vuln vid="2a4a112a-7c1b-11e5-bd77-0800275369e2">
<topic>lldpd -- Buffer overflow/Denial of service</topic>
<affects>
<package>
<name>lldpd</name>
<range><ge>0.5.6</ge><lt>0.7.19</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The lldpd developer Vincent Bernat reports:</p>
<blockquote cite="https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS">
<p>A buffer overflow may allow arbitrary code execution
only if hardening was disabled.</p>
</blockquote>
<blockquote cite="https://github.com/vincentbernat/lldpd/commit/793526f8884455f43daecd0a2c46772388417a00">
<p>Malformed packets should not make lldpd crash. Ensure we can
handle them by not using assert() in this part.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8011</cvename>
<cvename>CVE-2015-8012</cvename>
<url>https://github.com/vincentbernat/lldpd/raw/0.7.19/NEWS</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/30/2</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-26</entry>
<modified>2015-11-10</modified>
</dates>
</vuln>
<vuln vid="24e4d383-7b3e-11e5-a250-68b599b52a02">
<topic>wireshark -- Pcapng file parser crash</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html">
<p>The following vulnerability has been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-30</p>
<p>Pcapng file parser crash. (Bug 11455)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.8.html</url>
<cvename>CVE-2015-7830</cvename>
</references>
<dates>
<discovery>2015-10-14</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="0ebc6e78-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - SQL Injection/ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html">
<h2>[20151001] - Core - SQL Injection</h2>
<p>Inadequate filtering of request data leads to a SQL Injection
vulnerability.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html">
<h2>[20151002] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_contenthistory provide potential read
access to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7297</cvename>
<cvename>CVE-2015-7857</cvename>
<cvename>CVE-2015-7858</cvename>
<cvename>CVE-2015-7859</cvename>
<url>http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html</url>
<url>http://developer.joomla.org/security-centre/629-20151002-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="03e54e42-7ac6-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - ACL Violation vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html">
<h2>[20151003] - Core - ACL Violations</h2>
<p>Inadequate ACL checks in com_content provide potential read access
to data which should be access restricted.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7899</cvename>
<url>http://developer.joomla.org/security-centre/630-20151003-core-acl-violations.html</url>
<url>https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html</url>
</references>
<dates>
<discovery>2015-10-22</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="f8c37915-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.4.0</ge><lt>3.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html">
<h2>[20150908] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in login module.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6939</cvename>
<url>http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5628-joomla-3-4-4-released.html</url>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="ec2d1cfd-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - CSRF Protection vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html">
<h2>[20150602] - Core - CSRF Protection</h2>
<p>Lack of CSRF checks potentially enabled uploading malicious code.
</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5397</cvename>
<url>http://developer.joomla.org/security-centre/618-20150602-core-remote-code-execution.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="deaba148-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Open Redirect vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.0.0</ge><lt>3.4.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html">
<h2>[20150601] - Core - Open Redirect</h2>
<p>Inadequate checking of the return value allowed to redirect to an
external page.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5608</cvename>
<url>http://developer.joomla.org/security-centre/617-20150601-core-open-redirect.html</url>
<url>https://www.joomla.org/announcements/release-news/5589-joomla-3-4-2-released.html</url>
</references>
<dates>
<discovery>2015-06-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="cec4d01a-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Remote File Execution/Denial of Service vulnerabilities</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.6</lt></range>
<range><ge>3.3.0</ge><lt>3.3.5</lt></range>
</package>
<package>
<name>joomla2</name>
<range><ge>2.5.4</ge><lt>2.5.26</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html">
<h2>[20140903] - Core - Remote File Inclusion</h2>
<p>Inadequate checking allowed the potential for remote files to be
executed.</p>
</blockquote>
<blockquote cite="http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html">
<h2>[20140904] - Core - Denial of Service</h2>
<p>Inadequate checking allowed the potential for a denial of service
attack.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-7228</cvename>
<cvename>CVE-2014-7229</cvename>
<url>http://developer.joomla.org/security-centre/595-20140903-core-remote-file-inclusion.html</url>
<url>http://developer.joomla.org/security-centre/596-20140904-core-denial-of-service.html</url>
<url>https://www.joomla.org/announcements/release-news/5567-joomla-3-3-5-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5566-joomla-2-5-26-released.html</url>
</references>
<dates>
<discovery>2014-09-30</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="beb3d5fc-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - Unauthorized Login vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
<package>
<name>joomla2</name>
<range><lt>2.5.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html">
<h2>[20140902] - Core - Unauthorized Logins</h2>
<p>Inadequate checking allowed unauthorized logins via LDAP
authentication.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6632</cvename>
<url>http://developer.joomla.org/security-centre/594-20140902-core-unauthorised-logins.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
<url>https://www.joomla.org/announcements/release-news/5563-joomla-2-5-25-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="adbb32d9-7ac5-11e5-b35a-002590263bf5">
<topic>Joomla! -- Core - XSS Vulnerability</topic>
<affects>
<package>
<name>joomla3</name>
<range><ge>3.2.0</ge><lt>3.2.5</lt></range>
<range><ge>3.3.0</ge><lt>3.3.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The JSST and the Joomla! Security Center report:</p>
<blockquote cite="http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html">
<h2>[20140901] - Core - XSS Vulnerability</h2>
<p>Inadequate escaping leads to XSS vulnerability in com_media.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2014-6631</cvename>
<url>http://developer.joomla.org/security-centre/593-20140901-core-xss-vulnerability.html</url>
<url>https://www.joomla.org/announcements/release-news/5564-joomla-3-3-4-released.html</url>
</references>
<dates>
<discovery>2014-09-23</discovery>
<entry>2015-10-25</entry>
</dates>
</vuln>
<vuln vid="75f39413-7a00-11e5-a2a1-002590263bf5">
<topic>drupal -- open redirect vulnerability</topic>
<affects>
<package>
<name>drupal7</name>
<range><lt>7.41</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-004">
<p>The Overlay module in Drupal core displays administrative pages
as a layer over the current page (using JavaScript), rather than
replacing the page in the browser window. The Overlay module does
not sufficiently validate URLs prior to displaying their contents,
leading to an open redirect vulnerability.</p>
<p>This vulnerability is mitigated by the fact that it can only be
used against site users who have the "Access the administrative
overlay" permission, and that the Overlay module must be enabled.
</p>
<p>An incomplete fix for this issue was released as part of
SA-CORE-2015-002.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7943</cvename>
<url>https://www.drupal.org/SA-CORE-2015-004</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/23/6</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-24</entry>
</dates>
</vuln>
<vuln vid="08d11134-79c5-11e5-8987-6805ca0b3d42">
<topic>phpMyAdmin -- Content spoofing vulnerability</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.15.1</lt></range>
<range><ge>4.5.0</ge><lt>4.5.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-5/">
<p>This vulnerability allows an attacker to perform a
content spoofing attack using the phpMyAdmin's redirection
mechanism to external sites.</p>
<p>We consider this vulnerability to be non critical since
the spoofed content is escaped and no HTML injection is
possible.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-5/</url>
<cvename>CVE-2015-7873</cvename>
</references>
<dates>
<discovery>2015-10-23</discovery>
<entry>2015-10-23</entry>
</dates>
</vuln>
<vuln vid="b973a763-7936-11e5-a2a1-002590263bf5">
<topic>mediawiki -- multiple vulnerabilities</topic>
<affects>
<package>
<name>mediawiki123</name>
<range><lt>1.23.11</lt></range>
</package>
<package>
<name>mediawiki124</name>
<range><lt>1.24.4</lt></range>
</package>
<package>
<name>mediawiki125</name>
<range><lt>1.25.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MediaWiki reports:</p>
<blockquote cite="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html">
<p>Wikipedia user RobinHood70 reported two issues in the chunked
upload API. The API failed to correctly stop adding new chunks to
the upload when the reported size was exceeded (T91203), allowing
a malicious users to upload add an infinite number of chunks for a
single file upload. Additionally, a malicious user could upload
chunks of 1 byte for very large files, potentially creating a very
large number of files on the server's filesystem (T91205).</p>
<p>Internal review discovered that it is not possible to throttle file
uploads.</p>
<p>Internal review discovered a missing authorization check when
removing suppression from a revision. This allowed users with the
'viewsuppressed' user right but not the appropriate
'suppressrevision' user right to unsuppress revisions.</p>
<p>Richard Stanway from teamliquid.net reported that thumbnails of PNG
files generated with ImageMagick contained the local file path in
the image metadata.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-8001</cvename>
<cvename>CVE-2015-8002</cvename>
<cvename>CVE-2015-8003</cvename>
<cvename>CVE-2015-8004</cvename>
<cvename>CVE-2015-8005</cvename>
<cvename>CVE-2015-8006</cvename>
<cvename>CVE-2015-8007</cvename>
<cvename>CVE-2015-8008</cvename>
<cvename>CVE-2015-8009</cvename>
<url>https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html</url>
<url>https://phabricator.wikimedia.org/T91203</url>
<url>https://phabricator.wikimedia.org/T91205</url>
<url>https://phabricator.wikimedia.org/T91850</url>
<url>https://phabricator.wikimedia.org/T95589</url>
<url>https://phabricator.wikimedia.org/T108616</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/29/14</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-23</entry>
<modified>2015-12-24</modified>
</dates>
</vuln>
<vuln vid="c4a18a12-77fc-11e5-a687-206a8a720317">
<topic>ntp -- 13 low- and medium-severity vulnerabilities</topic>
<affects>
<package>
<name>ntp</name>
<range><lt>4.2.8p4</lt></range>
</package>
<package>
<name>ntp-devel</name>
<range><lt>4.3.76</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_7</lt></range>
<range><ge>10.1</ge><lt>10.1_24</lt></range>
<range><ge>9.3</ge><lt>9.3_30</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ntp.org reports:</p>
<blockquote cite="http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities">
<p>NTF's NTP Project has been notified of the following 13 low-
and medium-severity vulnerabilities that are fixed in
ntp-4.2.8p4, released on Wednesday, 21 October 2015:</p>
<ul>
<li>Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric
association authentication bypass via crypto-NAK
(Cisco ASIG)</li>
<li>Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch
instead of returning FAIL on some bogus values (IDA)</li>
<li>Bug 2921 CVE-2015-7854 Password Length Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2920 CVE-2015-7853 Invalid length data provided by a
custom refclock driver could cause a buffer overflow.
(Cisco TALOS)</li>
<li>Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption
Vulnerability. (Cisco TALOS)</li>
<li>Bug 2918 CVE-2015-7851 saveconfig Directory Traversal
Vulnerability. (OpenVMS) (Cisco TALOS)</li>
<li>Bug 2917 CVE-2015-7850 remote config logfile-keyfile.
(Cisco TALOS)</li>
<li>Bug 2916 CVE-2015-7849 trusted key use-after-free.
(Cisco TALOS)</li>
<li>Bug 2913 CVE-2015-7848 mode 7 loop counter underrun.
(Cisco TALOS)</li>
<li>Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC.
(Tenable)</li>
<li>Bug 2902 : CVE-2015-7703 configuration directives "pidfile"
and "driftfile" should only be allowed locally. (RedHat)</li>
<li>Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that
receive a KoD should validate the origin timestamp field.
(Boston University)</li>
<li>Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
Incomplete autokey data packet length checks. (Tenable)</li>
</ul>
<p>The only generally-exploitable bug in the above list is the
crypto-NAK bug, which has a CVSS2 score of 6.4.</p>
<p>Additionally, three bugs that have already been fixed in
ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd
have a security component, but are all below 1.8 CVSS score,
so we're reporting them here:</p>
<ul>
<li>Bug 2382 : Peer precision < -31 gives division by zero</li>
<li>Bug 1774 : Segfaults if cryptostats enabled when built
without OpenSSL</li>
<li>Bug 1593 : ntpd abort in free() with logconfig syntax error</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdsa>SA-15:25.ntp</freebsdsa>
<cvename>CVE-2015-7691</cvename>
<cvename>CVE-2015-7692</cvename>
<cvename>CVE-2015-7701</cvename>
<cvename>CVE-2015-7702</cvename>
<cvename>CVE-2015-7703</cvename>
<cvename>CVE-2015-7704</cvename>
<cvename>CVE-2015-7705</cvename>
<cvename>CVE-2015-7848</cvename>
<cvename>CVE-2015-7849</cvename>
<cvename>CVE-2015-7850</cvename>
<cvename>CVE-2015-7851</cvename>
<cvename>CVE-2015-7852</cvename>
<cvename>CVE-2015-7853</cvename>
<cvename>CVE-2015-7854</cvename>
<cvename>CVE-2015-7855</cvename>
<cvename>CVE-2015-7871</cvename>
<url>http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities</url>
</references>
<dates>
<discovery>2015-10-21</discovery>
<entry>2015-10-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="95602550-76cf-11e5-a2a1-002590263bf5">
<topic>codeigniter -- multiple XSS vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Fixed a number of XSS attack vectors in Security Library method
xss_clean (thanks to Frans Rosén from Detectify.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203403</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-20</entry>
</dates>
</vuln>
<vuln vid="7f645ee5-7681-11e5-8519-005056ac623e">
<topic>Git -- Execute arbitrary code</topic>
<affects>
<package>
<name>git</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-gui</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-lite</name>
<range><lt>2.6.1</lt></range>
</package>
<package>
<name>git-subversion</name>
<range><lt>2.6.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Git release notes:</p>
<blockquote cite="https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt">
<p>Some protocols (like git-remote-ext) can execute arbitrary code
found in the URL. The URLs that submodules use may come from
arbitrary sources (e.g., .gitmodules files in a remote
repository), and can hurt those who blindly enable recursive
fetch. Restrict the allowed protocols to well known and safe
ones.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7545</cvename>
<url>https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/12/11/7</url>
</references>
<dates>
<discovery>2015-09-23</discovery>
<entry>2015-10-19</entry>
<modified>2015-12-12</modified>
</dates>
</vuln>
<vuln vid="3934cc60-f0fa-4eca-be09-c8bd7ae42871">
<topic>Salt -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-salt</name>
<range><lt>2015.8.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Salt release notes:</p>
<blockquote cite="https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html">
<p>CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log</p>
<p>Updated the Git state and execution modules to no longer display HTTPS basic
authentication credentials in loglevel debug output on the Salt master. These
credentials are now replaced with REDACTED in the debug output. Thanks to
Andreas Stieger for bringing this to our attention.</p>
<p>CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug
log</p>
<p>Updated the win_useradd module return data to no longer include the password
of the newly created user. The password is now replaced with the string
XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display
win_password and sudo_password authentication credentials. Also updated the
Linode driver to no longer display authentication credentials in debug logs.
These credentials are now replaced with REDACTED in the debug output.</p>
</blockquote>
</body>
</description>
<references>
<url>https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html</url>
<cvename>CVE-2015-6918</cvename>
<cvename>CVE-2015-6941</cvename>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-17</entry>
</dates>
</vuln>
<vuln vid="79c68ef7-c8ae-4ade-91b4-4b8221b7c72a">
<topic>firefox -- Cross-origin restriction bypass using Fetch</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Firefox Developers report:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/">
<p>Security researcher Abdulrahman Alqabandi reported that the fetch()
API did not correctly implement the Cross-Origin Resource Sharing
(CORS) specification, allowing a malicious page to access private
data from other origins. Mozilla developer Ben Kelly independently reported the
same issue.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/</url>
<cvename>CVE-2015-7184</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="84147b46-e876-486d-b746-339ee45a8bb9">
<topic>flash -- remote code execution</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.540</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-27.html">
<p>These updates resolve type confusion vulnerabilities that
could lead to code execution (CVE-2015-7645, CVE-2015-7647,
CVE-2015-7648).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7645</cvename>
<cvename>CVE-2015-7647</cvename>
<cvename>CVE-2015-7648</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-27.html</url>
</references>
<dates>
<discovery>2015-10-16</discovery>
<entry>2015-10-16</entry>
</dates>
</vuln>
<vuln vid="e75a96df-73ca-11e5-9b45-b499baebfeaf">
<topic>LibreSSL -- Memory leak and buffer overflow</topic>
<affects>
<package>
<name>libressl</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qualys reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/16/1">
<p>During the code review of OpenSMTPD a memory leak and buffer overflow
(an off-by-one, usually stack-based) were discovered in LibreSSL's
OBJ_obj2txt() function. This function is called automatically during
a TLS handshake (both client-side, unless an anonymous mode is used,
and server-side, if client authentication is requested).</p>
</blockquote>
</body>
</description>
<references>
<url>http://marc.info/?l=openbsd-announce&m=144495690528446</url>
<cvename>CVE-2015-5333</cvename>
<cvename>CVE-2015-5334</cvename>
</references>
<dates>
<discovery>2015-10-15</discovery>
<entry>2015-10-16</entry>
<modified>2015-10-26</modified>
</dates>
</vuln>
<vuln vid="07a1a76c-734b-11e5-ae81-14dae9d210b8">
<topic>mbedTLS/PolarSSL -- DoS and possible remote code execution</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.17</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.14</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01">
<p>When the client creates its ClientHello message, due to
insufficient bounds checking it can overflow the heap-based buffer
containing the message while writing some extensions. Two extensions in
particular could be used by a remote attacker to trigger the overflow:
the session ticket extension and the server name indication (SNI)
extension.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01</url>
<cvename>CVE-2015-5291</cvename>
</references>
<dates>
<discovery>2015-10-05</discovery>
<entry>2015-10-15</entry>
</dates>
</vuln>
<vuln vid="ea1d2530-72ce-11e5-a2a1-002590263bf5">
<topic>magento -- multiple vulnerabilities</topic>
<affects>
<package>
<name>magento</name>
<range><lt>1.9.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Magento, Inc. reports:</p>
<blockquote cite="https://www.magentocommerce.com/download">
<p>SUPEE-6482 - This patch addresses two issues related to APIs and
two cross-site scripting risks.</p>
<p>SUPEE-6285 - This patch provides protection against several types
of security-related issues, including information leaks, request
forgeries, and cross-site scripting.</p>
<p>SUPEE-5994 - This patch addresses multiple security
vulnerabilities in Magento Community Edition software, including
issues that can put customer information at risk.</p>
<p>SUPEE-5344 - Addresses a potential remote code execution
exploit.</p>
<p>SUPEE-1533 - Addresses two potential remote code execution
exploits.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/201709</freebsdpr>
<url>https://www.magentocommerce.com/download</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html</url>
<url>http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html</url>
</references>
<dates>
<discovery>2014-10-03</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="705b759c-7293-11e5-a371-14dae9d210b8">
<topic>pear-twig -- remote code execution</topic>
<affects>
<package>
<name>pear-twig-twig</name>
<range><lt>1.20.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Fabien Potencier reports:</p>
<blockquote cite="http://symfony.com/blog/security-release-twig-1-20-0">
<p>End users can craft valid Twig code that allows them to
execute arbitrary code (RCEs) via the _self variable, which is always
available, even in sandboxed templates.</p>
</blockquote>
</body>
</description>
<references>
<url>http://symfony.com/blog/security-release-twig-1-20-0</url>
<cvename>CVE-2015-7809</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="06fefd2f-728f-11e5-a371-14dae9d210b8">
<topic>miniupnpc -- buffer overflow</topic>
<affects>
<package>
<name>miniupnpc</name>
<range><ge>1.9.1</ge><lt>1.9.20150917</lt></range>
<range><lt>1.9_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Talos reports:</p>
<blockquote cite="http://talosintel.com/reports/TALOS-2015-0035/">
<p>An exploitable buffer overflow vulnerability exists in the
XML parser functionality of the MiniUPnP library. A specially crafted
XML response can lead to a buffer overflow on the stack resulting in
remote code execution. An attacker can set up a server on the local
network to trigger this vulnerability.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6031</cvename>
<url>http://talosintel.com/reports/TALOS-2015-0035/</url>
<url>https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-14</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="a63f2c06-726b-11e5-a12b-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.535</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-25.html">
<p>These updates resolve a vulnerability that could be exploited
to bypass the same-origin-policy and lead to information
disclosure (CVE-2015-7628).</p>
<p>These updates include a defense-in-depth feature in the Flash
broker API (CVE-2015-5569).</p>
<p>These updates resolve use-after-free vulnerabilities that
could lead to code execution (CVE-2015-7629, CVE-2015-7631,
CVE-2015-7643, CVE-2015-7644).</p>
<p>These updates resolve a buffer overflow vulnerability that
could lead to code execution (CVE-2015-7632).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-7625, CVE-2015-7626,
CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5569</cvename>
<cvename>CVE-2015-7625</cvename>
<cvename>CVE-2015-7626</cvename>
<cvename>CVE-2015-7627</cvename>
<cvename>CVE-2015-7628</cvename>
<cvename>CVE-2015-7629</cvename>
<cvename>CVE-2015-7630</cvename>
<cvename>CVE-2015-7631</cvename>
<cvename>CVE-2015-7632</cvename>
<cvename>CVE-2015-7633</cvename>
<cvename>CVE-2015-7634</cvename>
<cvename>CVE-2015-7643</cvename>
<cvename>CVE-2015-7644</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-25.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-14</entry>
</dates>
</vuln>
<vuln vid="8301c04d-71df-11e5-9fcb-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<!--pcbsd-->
<name>chromium-npapi</name>
<name>chromium-pulse</name>
<range><lt>46.0.2490.71</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html">
<p>24 security fixes in this release, including:</p>
<ul>
<li>[519558] High CVE-2015-6755: Cross-origin bypass in Blink.
Credit to Mariusz Mlynski.</li>
<li>[507316] High CVE-2015-6756: Use-after-free in PDFium. Credit
to anonymous.</li>
<li>[529520] High CVE-2015-6757: Use-after-free in ServiceWorker.
Credit to Collin Payne.</li>
<li>[522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte
Kettunen of OUSPG.</li>
<li>[514076] Medium CVE-2015-6759: Information leakage in
LocalStorage. Credit to Muneaki Nishimura (nishimunea).</li>
<li>[519642] Medium CVE-2015-6760: Improper error handling in
libANGLE. Credit to lastland.net.</li>
<li>[447860,532967] Medium CVE-2015-6761: Memory corruption in
FFMpeg. Credit to Aki Helin of OUSPG and anonymous.</li>
<li>[512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit
to Muneaki Nishimura (nishimunea).</li>
<li> [542517] CVE-2015-6763: Various fixes from internal audits,
fuzzing and other initiatives.</li>
<li>Multiple vulnerabilities in V8 fixed at the tip of the 4.6
branch (currently 4.6.85.23).</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6755</cvename>
<cvename>CVE-2015-6756</cvename>
<cvename>CVE-2015-6757</cvename>
<cvename>CVE-2015-6758</cvename>
<cvename>CVE-2015-6759</cvename>
<cvename>CVE-2015-6760</cvename>
<cvename>CVE-2015-6761</cvename>
<cvename>CVE-2015-6762</cvename>
<cvename>CVE-2015-6763</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html</url>
</references>
<dates>
<discovery>2015-10-13</discovery>
<entry>2015-10-13</entry>
</dates>
</vuln>
<vuln vid="00dadbf0-6f61-11e5-a2a1-002590263bf5">
<topic>p5-UI-Dialog -- shell command execution vulnerability</topic>
<affects>
<package>
<name>p5-UI-Dialog</name>
<range><lt>1.09_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthijs Kooijman reports:</p>
<blockquote cite="https://rt.cpan.org/Public/Bug/Display.html?id=107364">
<p>It seems that the whiptail, cdialog and kdialog backends apply
some improper escaping in their shell commands, causing special
characters present in menu item titles to be interpreted by the
shell. This includes the backtick evaluation operator, so this
constitutes a security issue, allowing execution of arbitrary
commands if an attacker has control over the text displayed in
a menu.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-7315</cvename>
<freebsdpr>ports/203667</freebsdpr>
<url>https://rt.cpan.org/Public/Bug/Display.html?id=107364</url>
<url>https://bugs.debian.org/496448</url>
<url>https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61</url>
</references>
<dates>
<discovery>2008-08-24</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="290351c9-6f5c-11e5-a2a1-002590263bf5">
<topic>devel/ipython -- multiple vulnerabilities</topic>
<affects>
<package>
<name>ipython</name>
<range><lt>3.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Bussonnier reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/02/3">
<p>Summary: Local folder name was used in HTML templates without
escaping, allowing XSS in said pages by carefully crafting folder
name and URL to access it.</p>
<p>URI with issues:</p>
<ul>
<li>GET /tree/**</li>
</ul>
</blockquote>
<p>Benjamin RK reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/16/3">
<p>Vulnerability: A maliciously forged file opened for editing can
execute javascript, specifically by being redirected to /files/ due
to a failure to treat the file as plain text.</p>
<p>URI with issues:</p>
<ul>
<li>GET /edit/**</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203668</freebsdpr>
<cvename>CVE-2015-6938</cvename>
<cvename>CVE-2015-7337</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/02/3</url>
<url>https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/16/3</url>
<url>https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-10-10</entry>
</dates>
</vuln>
<vuln vid="a0182578-6e00-11e5-a90c-0026551a22dc">
<topic>PostgreSQL -- minor security problems.</topic>
<affects>
<package>
<name>postgresql90-server</name>
<range><ge>9.0.0</ge><lt>9.0.22</lt></range>
</package>
<package>
<name>postgresql91-server</name>
<range><ge>9.1.0</ge><lt>9.1.18</lt></range>
</package>
<package>
<name>postgresql92-server</name>
<range><ge>9.2.0</ge><lt>9.2.13</lt></range>
</package>
<package>
<name>postgresql93-server</name>
<range><ge>9.3.0</ge><lt>9.3.9</lt></range>
</package>
<package>
<name>postgresql94-server</name>
<range><ge>9.4.0</ge><lt>9.4.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PostgreSQL project reports:</p>
<blockquote cite="http://www.postgresql.org/about/news/1615/">
<p>
Two security issues have been fixed in this release which affect
users of specific PostgreSQL features.
</p>
<ul>
<li>CVE-2015-5289 json or jsonb input values constructed from
arbitrary user input can crash the PostgreSQL server and cause a denial of
service.
</li>
<li>CVE-2015-5288: The crypt() function included with the optional pgCrypto
extension could be exploited to read a few additional bytes of memory.
No working exploit for this issue has been developed.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5289</cvename>
<cvename>CVE-2015-5288</cvename>
</references>
<dates>
<discovery>2015-10-08</discovery>
<entry>2015-10-08</entry>
</dates>
</vuln>
<vuln vid="d3324fdb-6bf0-11e5-bc5e-00505699053e">
<topic>ZendFramework1 -- SQL injection vulnerability</topic>
<affects>
<package>
<name>ZendFramework1</name>
<range><lt>1.12.16</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Zend Framework developers report:</p>
<blockquote cite="http://framework.zend.com/security/advisory/ZF2015-08">
<p>The PDO adapters of Zend Framework 1 do not filter null bytes values
in SQL statements. A PDO adapter can treat null bytes in a query as a
string terminator, allowing an attacker to add arbitrary SQL
following a null byte, and thus create a SQL injection.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7695</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/30/6</url>
<url>http://framework.zend.com/security/advisory/ZF2015-08</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-10-06</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="42852f72-6bd3-11e5-9909-002590263bf5">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.3.txt">
<p>fix an mda buffer truncation bug which allows a user to create
forward files that pass session checks but fail delivery later down
the chain, within the user mda</p>
<p>fix remote buffer overflow in unprivileged pony process</p>
<p>reworked offline enqueue to better protect against hardlink
attacks</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openwall.com/lists/oss-security/2015/10/04/2</url>
<url>https://www.opensmtpd.org/announces/release-5.7.3.txt</url>
</references>
<dates>
<discovery>2015-10-04</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="5d280761-6bcf-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.16</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.13</lt></range>
</package>
<package>
<name>mbedtls</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released">
<p>Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach
for PKCS#1 v1.5 signatures. These releases include countermeasures
against that attack.</p>
<p>Fabian Foerg of Gotham Digital Science found a possible client-side
NULL pointer dereference, using the AFL Fuzzer. This dereference can
only occur when misusing the API, although a fix has still been
implemented.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="953aaa57-6bce-11e5-9909-002590263bf5">
<topic>mbedTLS/PolarSSL -- multiple vulnerabilities</topic>
<affects>
<package>
<name>polarssl</name>
<range><ge>1.2.0</ge><lt>1.2.15</lt></range>
</package>
<package>
<name>polarssl13</name>
<range><ge>1.3.0</ge><lt>1.3.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ARM Limited reports:</p>
<blockquote cite="https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released">
<p>In order to strengthen the minimum requirements for connections and
to protect against the Logjam attack, the minimum size of
Diffie-Hellman parameters accepted by the client has been increased
to 1024 bits.</p>
<p>In addition the default size for the Diffie-Hellman parameters on
the server are increased to 2048 bits. This can be changed with
ssl_set_dh_params() in case this is necessary.</p>
</blockquote>
</body>
</description>
<references>
<url>https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released</url>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-10-06</entry>
</dates>
</vuln>
<vuln vid="9272a5b0-6b40-11e5-bd7f-bcaec565249c">
<topic>gdk-pixbuf2 -- head overflow and DoS</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.32.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/9">
<p>We found a heap overflow and a DoS in the gdk-pixbuf
implementation triggered by the scaling of tga file.</p>
</blockquote>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/10/02/10">
<p>We found a heap overflow in the gdk-pixbuf implementation
triggered by the scaling of gif file.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-7673</cvename>
<cvename>CVE-2015-7674</cvename>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html</url>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/9</url>
<url>http://www.openwall.com/lists/oss-security/2015/10/02/10</url>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="6b3374d4-6b0b-11e5-9909-002590263bf5">
<topic>plone -- multiple vulnerabilities</topic>
<affects>
<package>
<name>plone</name>
<range><lt>4.3.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Plone.org reports:</p>
<blockquote cite="https://plone.org/products/plone/security/advisories/20150910-announcement">
<p>Versions Affected: All current Plone versions.</p>
<p>Versions Not Affected: None.</p>
<p>Nature of vulnerability: Allows creation of members by anonymous
users on sites that have self-registration enabled, allowing bypass
of CAPTCHA and similar protections against scripted attacks.</p>
<p>The patch can be added to buildouts as Products.PloneHotfix20150910
(available from PyPI) or downloaded from Plone.org.</p>
<p>Immediate Measures You Should Take: Disable self-registration until
you have applied the patch.</p>
</blockquote>
<blockquote cite="https://plone.org/security/20150910/non-persistent-xss-in-plone">
<p>Plone's URL checking infrastructure includes a method for checking
if URLs valid and located in the Plone site. By passing HTML into
this specially crafted url, XSS can be achieved.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203255</freebsdpr>
<url>https://plone.org/products/plone-hotfix/releases/20150910</url>
<url>https://plone.org/products/plone/security/advisories/20150910-announcement</url>
<url>https://plone.org/security/20150910/non-persistent-xss-in-plone</url>
<url>https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-10-05</entry>
</dates>
</vuln>
<vuln vid="c1da8b75-6aef-11e5-9909-002590263bf5">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5-phar</name>
<range><le>5.4.45</le></range>
</package>
<package>
<name>php55-phar</name>
<range><lt>5.5.30</lt></range>
</package>
<package>
<name>php56-phar</name>
<range><lt>5.6.14</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.5.30">
<p>Phar:</p>
<ul>
<li>Fixed bug #69720 (Null pointer dereference in
phar_get_fp_offset()).</li>
<li>Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream
when zip entry filename is "/").</li>
</ul>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203541</freebsdpr>
<cvename>CVE-2015-7803</cvename>
<cvename>CVE-2015-7804</cvename>
<url>http://php.net/ChangeLog-5.php#5.5.30</url>
<url>http://php.net/ChangeLog-5.php#5.6.14</url>
</references>
<dates>
<discovery>2015-10-01</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-12</modified>
</dates>
</vuln>
<vuln vid="ee7bdf7f-11bb-4eea-b054-c692ab848c20">
<topic>OpenSMTPD -- multiple vulnerabilities</topic>
<affects>
<package>
<name>opensmtpd</name>
<range><lt>5.7.2,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>OpenSMTPD developers report:</p>
<blockquote cite="https://www.opensmtpd.org/announces/release-5.7.2.txt">
<p>an oversight in the portable version of fgetln() that allows
attackers to read and write out-of-bounds memory</p>
<p>multiple denial-of-service vulnerabilities that allow local users
to kill or hang OpenSMTPD</p>
<p>a stack-based buffer overflow that allows local users to crash
OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd
user</p>
<p>a hardlink attack (or race-conditioned symlink attack) that allows
local users to unset the chflags() of arbitrary files</p>
<p>a hardlink attack that allows local users to read the first line of
arbitrary files (for example, root's hash from /etc/master.passwd)
</p>
<p>a denial-of-service vulnerability that allows remote attackers to
fill OpenSMTPD's queue or mailbox hard-disk partition</p>
<p>an out-of-bounds memory read that allows remote attackers to crash
OpenSMTPD, or leak information and defeat the ASLR protection</p>
<p>a use-after-free vulnerability that allows remote attackers to
crash OpenSMTPD, or execute arbitrary code as the non-chrooted
_smtpd user</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.opensmtpd.org/announces/release-5.7.2.txt</url>
<cvename>CVE-2015-7687</cvename>
</references>
<dates>
<discovery>2015-10-02</discovery>
<entry>2015-10-04</entry>
<modified>2015-10-06</modified>
</dates>
</vuln>
<vuln vid="be3069c9-67e7-11e5-9909-002590263bf5">
<topic>james -- multiple vulnerabilities</topic>
<affects>
<package>
<name>james</name>
<range><lt>2.3.2.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Apache James Project reports:</p>
<blockquote cite="http://james.apache.org/download.cgi#Apache_James_Server">
<p>This release has many enhancements and bug fixes over the previous
release. See the Release Notes for a detailed list of changes. Some
of the earlier defects could turn a James mail server into an Open
Relay and allow files to be written on disk. All users of James
Server are urged to upgrade to version v2.3.2.1 as soon as
possible.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203461</freebsdpr>
<certvu>988628</certvu>
<cvename>CVE-2015-7611</cvename>
<url>http://james.apache.org/download.cgi#Apache_James_Server</url>
<url>https://blogs.apache.org/james/entry/apache_james_server_2_3</url>
</references>
<dates>
<discovery>2015-09-30</discovery>
<entry>2015-10-01</entry>
<modified>2015-10-04</modified>
</dates>
</vuln>
<vuln vid="1e7f0c11-673a-11e5-98c8-60a44c524f57">
<topic>otrs -- Scheduler Process ID File Access</topic>
<affects>
<package>
<name>otrs</name>
<range><gt>3.2.*</gt><lt>3.2.18</lt></range>
<range><gt>3.3.*</gt><lt>3.3.15</lt></range>
<range><gt>4.0.*</gt><lt>4.0.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The OTRS project reports:</p>
<blockquote cite="https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/">
<p>An attacker with valid LOCAL credentials could access and
manipulate the process ID file for bin/otrs.schduler.pl from the
CLI.</p>
<p>The Proc::Daemon module 0.14 for Perl uses world-writable
permissions for a file that stores a process ID, which allows local
users to have an unspecified impact by modifying this file.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/</url>
<cvename>CVE-2015-6842</cvename>
<cvename>CVE-2013-7135</cvename>
</references>
<dates>
<discovery>2015-09-17</discovery>
<entry>2015-09-30</entry>
</dates>
</vuln>
<vuln vid="4e3e8a50-65c1-11e5-948e-bcaec565249c">
<topic>flash -- multiple vulnerabilities</topic>
<affects>
<package>
<name>linux-c6-flashplugin</name>
<name>linux-f10-flashplugin</name>
<name>linux-c6_64-flashplugin</name>
<range><lt>11.2r202.521</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Adobe reports:</p>
<blockquote cite="https://helpx.adobe.com/security/products/flash-player/apsb15-23.html">
<p>These updates resolve a type confusion vulnerability that could
lead to code execution (CVE-2015-5573).</p>
<p>These updates resolve use-after-free vulnerabilities that could
lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).</p>
<p>These updates resolve buffer overflow vulnerabilities that could
lead to code execution (CVE-2015-6676, CVE-2015-6678).</p>
<p>These updates resolve memory corruption vulnerabilities that
could lead to code execution (CVE-2015-5575, CVE-2015-5577,
CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588,
CVE-2015-6677).</p>
<p>These updates include additional validation checks to ensure
that Flash Player rejects malicious content from vulnerable
JSONP callback APIs (CVE-2015-5571).</p>
<p>These updates resolve a memory leak vulnerability
(CVE-2015-5576).</p>
<p>These updates include further hardening to a mitigation to
defend against vector length corruptions (CVE-2015-5568).</p>
<p>These updates resolve stack corruption vulnerabilities that
could lead to code execution (CVE-2015-5567, CVE-2015-5579).</p>
<p>These updates resolve a stack overflow vulnerability that could
lead to code execution (CVE-2015-5587).</p>
<p>These updates resolve a security bypass vulnerability that could
lead to information disclosure (CVE-2015-5572).</p>
<p>These updates resolve a vulnerability that could be exploited to
bypass the same-origin-policy and lead to information disclosure
(CVE-2015-6679).</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5567</cvename>
<cvename>CVE-2015-5568</cvename>
<cvename>CVE-2015-5570</cvename>
<cvename>CVE-2015-5571</cvename>
<cvename>CVE-2015-5572</cvename>
<cvename>CVE-2015-5573</cvename>
<cvename>CVE-2015-5574</cvename>
<cvename>CVE-2015-5575</cvename>
<cvename>CVE-2015-5576</cvename>
<cvename>CVE-2015-5577</cvename>
<cvename>CVE-2015-5578</cvename>
<cvename>CVE-2015-5588</cvename>
<cvename>CVE-2015-6676</cvename>
<cvename>CVE-2015-6677</cvename>
<cvename>CVE-2015-6678</cvename>
<cvename>CVE-2015-6679</cvename>
<cvename>CVE-2015-6682</cvename>
<url>https://helpx.adobe.com/security/products/flash-player/apsb15-23.html</url>
</references>
<dates>
<discovery>2015-09-21</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="5114cd11-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Fixed an SQL injection vulnerability in Active Record
method offset().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="01bce4c6-6571-11e5-9909-002590263bf5">
<topic>codeigniter -- mysql database driver vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Removed a fallback to mysql_escape_string() in the mysql
database driver (escape_str() method) when there's no active database
connection.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-07-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="c21f4e61-6570-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: Added HTTP "Host" header character validation to prevent
cache poisoning attacks when base_url auto-detection is used.</p>
<p>Security: Added FSCommand and seekSegmentTime to the "evil
attributes" list in CI_Security::xss_clean().</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2015-04-15</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="f838dcb4-656f-11e5-9909-002590263bf5">
<topic>codeigniter -- multiple vulnerabilities</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.2.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>Security: The xor_encode() method in the Encrypt Class has been
removed. The Encrypt Class now requires the Mcrypt extension to be
installed.</p>
<p>Security: The Session Library now uses HMAC authentication instead
of a simple MD5 checksum.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/203401</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2014-06-05</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="b7d785ea-656d-11e5-9909-002590263bf5">
<topic>codeigniter -- SQL injection vulnerability</topic>
<affects>
<package>
<name>codeigniter</name>
<range><lt>2.0.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The CodeIgniter changelog reports:</p>
<blockquote cite="https://codeigniter.com/userguide2/changelog.html">
<p>An improvement was made to the MySQL and MySQLi drivers to prevent
exposing a potential vector for SQL injection on sites using
multi-byte character sets in the database client connection.</p>
<p>An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7
with mysql_set_charset() creates a situation where using multi-byte
character sets on these environments may potentially expose a SQL
injection attack vector. Latin-1, UTF-8, and other "low ASCII"
character sets are unaffected on all environments.</p>
<p>If you are running or considering running a multi-byte character
set for your database connection, please pay close attention to the
server environment you are deploying on to ensure you are not
vulnerable.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/156486</freebsdpr>
<url>https://codeigniter.com/userguide2/changelog.html</url>
</references>
<dates>
<discovery>2011-08-20</discovery>
<entry>2015-09-28</entry>
</dates>
</vuln>
<vuln vid="0e425bb7-64f2-11e5-b2fd-00262d5ed8ee">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-npapi</name>
<range><lt>45.0.2454.101</lt></range>
</package>
<package>
<!-- pcbsd -->
<name>chromium-pulse</name>
<range><lt>45.0.2454.101</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html">
<p>Two vulnerabilities were fixed in this release:</p>
<ul>
<li>[530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit
to Mariusz Mlynski.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1303</cvename>
<cvename>CVE-2015-1304</cvename>
<url>http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html</url>
</references>
<dates>
<discovery>2015-09-24</discovery>
<entry>2015-09-27</entry>
</dates>
</vuln>
<vuln vid="9770d6ac-614d-11e5-b379-14dae9d210b8">
<topic>libssh2 -- denial of service vulnerability</topic>
<affects>
<package>
<name>libssh2</name>
<range><lt>1.5.0,2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Mariusz Ziulek reports:</p>
<blockquote cite="http://www.libssh2.org/adv_20150311.html">
<p>A malicious attacker could man in the middle a real server
and cause libssh2 using clients to crash (denial of service) or
otherwise read and use completely unintended memory areas in this
process.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.libssh2.org/adv_20150311.html</url>
<url>https://trac.libssh2.org/ticket/294</url>
<cvename>CVE-2015-1782</cvename>
</references>
<dates>
<discovery>2015-01-25</discovery>
<entry>2015-09-22</entry>
<modified>2015-09-22</modified>
</dates>
</vuln>
<vuln vid="2d56c7f4-b354-428f-8f48-38150c607a05">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>41.0,1</lt></range>
</package>
<package>
<name>seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>linux-seamonkey</name>
<range><lt>2.38</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.3.0,1</lt></range>
</package>
<package>
<name>libxul</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
<package>
<name>linux-thunderbird</name>
<range><lt>38.3.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0
/ rv:38.3)</p>
<p>MFSA 2015-97 Memory leak in mozTCPSocket to servers</p>
<p>MFSA 2015-98 Out of bounds read in QCMS library with ICC
V4 profile attributes</p>
<p>MFSA 2015-99 Site attribute spoofing on Android by
pasting URL with unknown scheme</p>
<p>MFSA 2015-100 Arbitrary file manipulation by local user
through Mozilla updater</p>
<p>MFSA 2015-101 Buffer overflow in libvpx while parsing vp9
format video</p>
<p>MFSA 2015-102 Crash when using debugger with SavedStacks
in JavaScript</p>
<p>MFSA 2015-103 URL spoofing in reader mode</p>
<p>MFSA 2015-104 Use-after-free with shared workers and
IndexedDB</p>
<p>MFSA 2015-105 Buffer overflow while decoding WebM
video</p>
<p>MFSA 2015-106 Use-after-free while manipulating HTML
media content</p>
<p>MFSA 2015-107 Out-of-bounds read during 2D canvas display
on Linux 16-bit color depth systems</p>
<p>MFSA 2015-108 Scripted proxies can access inner
window</p>
<p>MFSA 2015-109 JavaScript immutable property enforcement
can be bypassed</p>
<p>MFSA 2015-110 Dragging and dropping images exposes final
URL after redirects</p>
<p>MFSA 2015-111 Errors in the handling of CORS preflight
request headers</p>
<p>MFSA 2015-112 Vulnerabilities found through code
inspection</p>
<p>MFSA 2015-113 Memory safety errors in libGLES in the
ANGLE graphics library</p>
<p>MFSA 2015-114 Information disclosure via the High
Resolution Time API</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4476</cvename>
<cvename>CVE-2015-4500</cvename>
<cvename>CVE-2015-4501</cvename>
<cvename>CVE-2015-4502</cvename>
<cvename>CVE-2015-4503</cvename>
<cvename>CVE-2015-4504</cvename>
<cvename>CVE-2015-4505</cvename>
<cvename>CVE-2015-4506</cvename>
<cvename>CVE-2015-4507</cvename>
<cvename>CVE-2015-4508</cvename>
<cvename>CVE-2015-4509</cvename>
<cvename>CVE-2015-4510</cvename>
<cvename>CVE-2015-4512</cvename>
<cvename>CVE-2015-4516</cvename>
<cvename>CVE-2015-4517</cvename>
<cvename>CVE-2015-4519</cvename>
<cvename>CVE-2015-4520</cvename>
<cvename>CVE-2015-4521</cvename>
<cvename>CVE-2015-4522</cvename>
<cvename>CVE-2015-7174</cvename>
<cvename>CVE-2015-7175</cvename>
<cvename>CVE-2015-7176</cvename>
<cvename>CVE-2015-7177</cvename>
<cvename>CVE-2015-7178</cvename>
<cvename>CVE-2015-7179</cvename>
<cvename>CVE-2015-7180</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-96/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-97/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-98/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-99/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-100/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-101/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-102/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-103/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-104/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-105/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-106/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-107/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-108/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-109/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-110/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-111/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-112/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-113/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-114/</url>
</references>
<dates>
<discovery>2015-09-22</discovery>
<entry>2015-09-22</entry>
</dates>
</vuln>
<vuln vid="3d950687-b4c9-4a86-8478-c56743547af8">
<topic>ffmpeg -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libav</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.90</lt></range>
</package>
<package>
<name>gstreamer-ffmpeg</name>
<!-- gst-ffmpeg-0.10.13 has libav-0.7.2 (0.7.7 in freebsd port) -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><lt>2.7.2,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.4</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.8</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.11</lt></range>
</package>
<package>
<name>ffmpeg-devel</name>
<name>ffmpeg23</name>
<name>ffmpeg2</name>
<name>ffmpeg1</name>
<name>ffmpeg-011</name>
<name>ffmpeg0</name>
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux2</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20150403 has ffmpeg-2.7.0+ (snapshot, c299fbb) -->
<range><lt>1.1.r20150822</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
<package>
<name>plexhometheater</name>
<!-- plexhometheater-1.4.1 has ffmpeg-0.10.2 fork -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6818">
<p>The decode_ihdr_chunk function in libavcodec/pngdec.c in
FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR
(aka image header) chunk in a PNG image, which allows remote
attackers to cause a denial of service (out-of-bounds array
access) or possibly have unspecified other impact via a
crafted image with two or more of these chunks.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6819">
<p>Multiple integer underflows in the ff_mjpeg_decode_frame
function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2
allow remote attackers to cause a denial of service
(out-of-bounds array access) or possibly have unspecified
other impact via crafted MJPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6820">
<p>The ff_sbr_apply function in libavcodec/aacsbr.c in
FFmpeg before 2.7.2 does not check for a matching AAC frame
syntax element before proceeding with Spectral Band
Replication calculations, which allows remote attackers to
cause a denial of service (out-of-bounds array access) or
possibly have unspecified other impact via crafted AAC
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6821">
<p>The ff_mpv_common_init function in libavcodec/mpegvideo.c
in FFmpeg before 2.7.2 does not properly maintain the
encoding context, which allows remote attackers to cause a
denial of service (invalid pointer access) or possibly have
unspecified other impact via crafted MPEG data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6822">
<p>The destroy_buffers function in libavcodec/sanm.c in
FFmpeg before 2.7.2 does not properly maintain height and
width values in the video context, which allows remote
attackers to cause a denial of service (segmentation
violation and application crash) or possibly have
unspecified other impact via crafted LucasArts Smush video
data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6823">
<p>The allocate_buffers function in libavcodec/alac.c in
FFmpeg before 2.7.2 does not initialize certain context
data, which allows remote attackers to cause a denial of
service (segmentation violation) or possibly have
unspecified other impact via crafted Apple Lossless Audio
Codec (ALAC) data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6824">
<p>The sws_init_context function in libswscale/utils.c in
FFmpeg before 2.7.2 does not initialize certain pixbuf data
structures, which allows remote attackers to cause a denial
of service (segmentation violation) or possibly have
unspecified other impact via crafted video data.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6825">
<p>The ff_frame_thread_init function in
libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles
certain memory-allocation failures, which allows remote
attackers to cause a denial of service (invalid pointer
access) or possibly have unspecified other impact via a
crafted file, as demonstrated by an AVI file.</p>
</blockquote>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6826">
<p>The ff_rv34_decode_init_thread_copy function in
libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize
certain structure members, which allows remote attackers to
cause a denial of service (invalid pointer access) or
possibly have unspecified other impact via crafted (1) RV30
or (2) RV40 RealVideo data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6818</cvename>
<cvename>CVE-2015-6819</cvename>
<cvename>CVE-2015-6820</cvename>
<cvename>CVE-2015-6821</cvename>
<cvename>CVE-2015-6822</cvename>
<cvename>CVE-2015-6823</cvename>
<cvename>CVE-2015-6824</cvename>
<cvename>CVE-2015-6825</cvename>
<cvename>CVE-2015-6826</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626</url>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a</url>
<url>https://ffmpeg.org/security.html</url>
</references>
<dates>
<discovery>2015-09-05</discovery>
<entry>2015-09-20</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="c2fcbec2-5daa-11e5-9909-002590263bf5">
<topic>moodle -- multiple vulnerabilities</topic>
<affects>
<package>
<name>moodle27</name>
<range><lt>2.7.10</lt></range>
</package>
<package>
<name>moodle28</name>
<range><lt>2.8.8</lt></range>
</package>
<package>
<name>moodle29</name>
<range><lt>2.9.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Moodle Release Notes report:</p>
<blockquote cite="https://docs.moodle.org/dev/Moodle_2.7.10_release_notes">
<p>MSA-15-0030: Students can re-attempt answering questions in the
lesson (CVE-2015-5264)</p>
<p>MSA-15-0031: Teacher in forum can still post to "all participants"
and groups they are not members of (CVE-2015-5272 - 2.7.10 only)</p>
<p>MSA-15-0032: Users can delete files uploaded by other users in wiki
(CVE-2015-5265)</p>
<p>MSA-15-0033: Meta course synchronization enrolls suspended students
as managers for a short period of time (CVE-2015-5266)</p>
<p>MSA-15-0034: Vulnerability in password recovery mechanism
(CVE-2015-5267)</p>
<p>MSA-15-0035: Rating component does not check separate groups
(CVE-2015-5268)</p>
<p>MSA-15-0036: XSS in grouping description (CVE-2015-5269)</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5264</cvename>
<cvename>CVE-2015-5272</cvename>
<cvename>CVE-2015-5265</cvename>
<cvename>CVE-2015-5266</cvename>
<cvename>CVE-2015-5267</cvename>
<cvename>CVE-2015-5268</cvename>
<cvename>CVE-2015-5269</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/09/21/1</url>
<url>https://docs.moodle.org/dev/Moodle_2.7.10_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.8.8_release_notes</url>
<url>https://docs.moodle.org/dev/Moodle_2.9.2_release_notes</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-18</entry>
<modified>2015-09-24</modified>
</dates>
</vuln>
<vuln vid="d3a98c2d-5da1-11e5-9909-002590263bf5">
<topic>squid -- TLS/SSL parser denial of service vulnerability</topic>
<affects>
<package>
<name>squid</name>
<range><ge>3.5.0.1</ge><lt>3.5.9</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Amos Jeffries, release manager of the Squid-3 series, reports:</p>
<blockquote cite="http://www.openwall.com/lists/oss-security/2015/09/18/1">
<p>Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are
built with OpenSSL and configured for "SSL-Bump" decryption.</p>
<p>Integer overflows can lead to invalid pointer math reading from
random memory on some CPU architectures. In the best case this leads
to wrong TLS extensions being used for the client, worst-case a
crash of the proxy terminating all active transactions.</p>
<p>Incorrect message size checks and assumptions about the existence
of TLS extensions in the SSL/TLS handshake message can lead to very
high CPU consumption (up to and including 'infinite loop'
behaviour).</p>
<p>The above can be triggered remotely. Though there is one layer of
authorization applied before this processing to check that the
client is allowed to use the proxy, that check is generally weak. MS
Skype on Windows XP is known to trigger some of these.</p>
</blockquote>
<p>The FreeBSD port does not use SSL by default and is not vulnerable
in the default configuration.</p>
</body>
</description>
<references>
<freebsdpr>ports/203186</freebsdpr>
<url>http://www.squid-cache.org/Advisories/SQUID-2015_3.txt</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/18/1</url>
</references>
<dates>
<discovery>2015-09-18</discovery>
<entry>2015-09-18</entry>
<modified>2016-02-18</modified>
</dates>
</vuln>
<vuln vid="b55ecf12-5d98-11e5-9909-002590263bf5">
<topic>remind -- buffer overflow with malicious reminder file input</topic>
<affects>
<package>
<name>remind</name>
<range><lt>3.1.15</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Dianne Skoll reports:</p>
<blockquote cite="http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html">
<p>BUG FIX: Fix a buffer overflow found by Alexander Keller.</p>
</blockquote>
<p>The bug can be manifested by an extended DUMP command using a system
variable (that is a special variable whose name begins with '$')</p>
</body>
</description>
<references>
<cvename>CVE-2015-5957</cvename>
<freebsdpr>ports/202942</freebsdpr>
<url>http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html</url>
<url>http://www.openwall.com/lists/oss-security/2015/08/07/1</url>
</references>
<dates>
<discovery>2015-07-27</discovery>
<entry>2015-09-18</entry>
</dates>
</vuln>
<vuln vid="d45ad7ae-5d56-11e5-9ad8-14dae9d210b8">
<topic>shutter -- arbitrary code execution</topic>
<affects>
<package>
<name>shutter</name>
<range><ge>0.80</ge><lt>0.93.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Luke Farone reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/541">
<p>In the "Shutter" screenshot application, I discovered that using the
"Show in folder" menu option while viewing a file with a
specially-crafted path allows for arbitrary code execution with the
permissions of the user running Shutter.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/541</url>
<url>https://bugs.launchpad.net/shutter/+bug/1495163</url>
<url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862</url>
<cvename>CVE-2015-0854</cvename>
</references>
<dates>
<discovery>2015-09-13</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="a233d51f-5d4c-11e5-9ad8-14dae9d210b8">
<topic>openjpeg -- use-after-free vulnerability</topic>
<affects>
<package>
<name>openjpeg</name>
<range><lt>2.1.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Feist Josselin reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/550">
<p>Use-after-free was found in openjpeg. The vuln is fixed in
version 2.1.1 and was located in opj_j2k_write_mco function.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/550</url>
<url>https://github.com/uclouvain/openjpeg/issues/563</url>
</references>
<dates>
<discovery>2015-08-14</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="bab05188-5d4b-11e5-9ad8-14dae9d210b8">
<topic>optipng -- use-after-free vulnerability</topic>
<affects>
<package>
<name>optipng</name>
<range><le>0.6.5</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Gustavo Grieco reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/556">
<p>We found a use-after-free causing an invalid/double free in
optipng 0.6.4.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/556</url>
<cvename>CVE-2015-7801</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
<modified>2015-10-14</modified>
</dates>
</vuln>
<vuln vid="3c259621-5d4a-11e5-9ad8-14dae9d210b8">
<topic>openslp -- denial of service vulnerability</topic>
<affects>
<package>
<name>openslp</name>
<range><lt>2.0.0</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Qinghao Tang reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/559">
<p>The function ParseExtension() in openslp 1.2.1 contains
vulnerability: an attacker can cause a denial of service
(infinite loop) via a packet with crafted "nextoffset"
value and "extid" value.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/559</url>
<cvename>CVE-2015-5155</cvename>
</references>
<dates>
<discovery>2015-09-16</discovery>
<entry>2015-09-17</entry>
</dates>
</vuln>
<vuln vid="8f5c9dd6-5cac-11e5-9ad8-14dae9d210b8">
<topic>p7zip -- directory traversal vulnerability</topic>
<affects>
<package>
<name>p7zip</name>
<range><lt>9.38.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Alexander Cherepanov reports:</p>
<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660">
<p>7z (and 7zr) is susceptible to a directory traversal vulnerability.
While extracting an archive, it will extract symlinks and then follow
them if they are referenced in further entries. This can be exploited by
a rogue archive to write files outside the current directory.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660</url>
<url>http://www.openwall.com/lists/oss-security/2015/01/11/2</url>
<url>http://sourceforge.net/p/p7zip/bugs/147/</url>
<cvename>CVE-2015-1038</cvename>
</references>
<dates>
<discovery>2015-01-05</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="31ea7f73-5c55-11e5-8607-74d02b9a84d5">
<topic>h2o -- directory traversal vulnerability</topic>
<affects>
<package>
<name>h2o</name>
<range><lt>1.4.5</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Yakuzo reports:</p>
<blockquote cite="https://h2o.examp1e.net/vulnerabilities.html">
<p>H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL
normalization logic.</p>
<p>When file.dir directive is used, this flaw
allows a remote attacker to retrieve arbitrary files that exist
outside the directory specified by the directive.</p>
<p>H2O version 1.4.5 and version 1.5.0-beta2 have been released
to address this vulnerability.</p>
<p>Users are advised to upgrade their servers immediately.</p>
<p>The vulnerability was reported by: Yusuke OSUMI.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5638</cvename>
<url>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638</url>
</references>
<dates>
<discovery>2015-09-14</discovery>
<entry>2015-09-16</entry>
</dates>
</vuln>
<vuln vid="f4ce64c2-5bd4-11e5-9040-3c970e169bc2">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wordpress</name>
<range><lt>4.3.1,1</lt></range>
</package>
<package>
<name>de-wordpress</name>
<name>ja-wordpress</name>
<name>ru-wordpress</name>
<name>zh-wordpress-zh_CN</name>
<name>zh-wordpress-zh_TW</name>
<range><lt>4.3.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Samuel Sidler reports:</p>
<blockquote cite="https://wordpress.org/news/2015/09/wordpress-4-3-1/">
<p>WordPress 4.3.1 is now available. This is a security
release for all previous versions and we strongly
encourage you to update your sites immediately.</p>
<ul>
<li>WordPress versions 4.3 and earlier are vulnerable
to a cross-site scripting vulnerability when processing
shortcode tags (CVE-2015-5714). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
<li>A separate cross-site scripting vulnerability was found
in the user list table. Reported by Ben Bidner of the
WordPress security team.</li>
<li>Finally, in certain cases, users without proper
permissions could publish private posts and make
them sticky (CVE-2015-5715). Reported by Shahar Tal
and Netanel Rubin of <a href="http://checkpoint.com/">Check Point</a>.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5714</cvename>
<cvename>CVE-2015-5715</cvename>
<cvename>CVE-2015-7989</cvename>
<url>http://www.openwall.com/lists/oss-security/2015/10/28/1</url>
<url>https://wordpress.org/news/2015/09/wordpress-4-3-1/</url>
</references>
<dates>
<discovery>2015-09-15</discovery>
<entry>2015-09-15</entry>
<modified>2015-10-29</modified>
</dates>
</vuln>
<vuln vid="ea893f06-5a92-11e5-98c0-20cf30e32f6d">
<topic>Bugzilla security issues</topic>
<affects>
<package>
<name>bugzilla44</name>
<range><lt>4.4.10</lt></range>
</package>
<package>
<name>bugzilla50</name>
<range><lt>5.0.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Bugzilla Security Advisory</p>
<blockquote cite="https://www.bugzilla.org/security/4.2.14/">
<p>Login names (usually an email address) longer than 127
characters are silently truncated in MySQL which could
cause the domain name of the email address to be
corrupted. An attacker could use this vulnerability to
create an account with an email address different from the
one originally requested. The login name could then be
automatically added to groups based on the group's regular
expression setting.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4499</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1202447</url>
</references>
<dates>
<discovery>2015-09-10</discovery>
<entry>2015-09-14</entry>
</dates>
</vuln>
<vuln vid="4910d161-58a4-11e5-9ad8-14dae9d210b8">
<topic>openldap -- denial of service vulnerability</topic>
<affects>
<package>
<name>openldap-server</name>
<range><lt>2.4.42_1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Denis Andzakovic reports:</p>
<blockquote cite="http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240">
<p>By sending a crafted packet, an attacker may cause the
OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240</url>
<url>http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629</url>
<cvename>CVE-2015-6908</cvename>
</references>
<dates>
<discovery>2015-09-09</discovery>
<entry>2015-09-12</entry>
<modified>2015-09-13</modified>
</dates>
</vuln>
<vuln vid="a35f415d-572a-11e5-b0a4-f8b156b6dcc8">
<topic>vorbis-tools, opus-tools -- multiple vulnerabilities</topic>
<affects>
<package>
<name>vorbis-tools</name>
<range><lt>1.4.0_10,3</lt></range>
</package>
<package>
<name>opus-tools</name>
<range><lt>0.1.9_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>I discovered an integer overflow issue in oggenc,
related to the number of channels in the input WAV file.
The issue triggers an out-of-bounds memory access which
causes oggenc to crash.</p>
</blockquote>
<p>Paris Zoumpouloglou reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2136">
<p>A crafted WAV file with number of channels set to 0
will cause oggenc to crash due to a division by zero
issue.</p>
</blockquote>
<p>pengsu reports:</p>
<blockquote cite="https://trac.xiph.org/ticket/2212">
<p>I discovered an buffer overflow issue in oggenc/audio.c
when it tries to open invalid aiff file.</p>
</blockquote>
</body>
</description>
<references>
<freebsdpr>ports/202941</freebsdpr>
<url>https://trac.xiph.org/ticket/2136</url>
<cvename>CVE-2014-9639</cvename>
<url>https://trac.xiph.org/ticket/2137</url>
<cvename>CVE-2014-9638</cvename>
<url>https://trac.xiph.org/ticket/2212</url>
<cvename>CVE-2015-6749</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-09-09</entry>
<modified>2015-09-09</modified>
</dates>
</vuln>
<vuln vid="d76961da-56f6-11e5-934b-002590263bf5">
<topic>pgbouncer -- failed auth_query lookup leads to connection as auth_user</topic>
<affects>
<package>
<name>pgbouncer</name>
<range><eq>1.6.0</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PgBouncer reports:</p>
<blockquote cite="http://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/">
<p>New auth_user functionality introduced in 1.6 allows login as
auth_user when client presents unknown username. It's quite likely
auth_user is superuser. Affects only setups that have enabled
auth_user in their config.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-6817</cvename>
<url>https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/</url>
<url>https://github.com/pgbouncer/pgbouncer/issues/69</url>
<url>http://www.openwall.com/lists/oss-security/2015/09/04/3</url>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-09</entry>
</dates>
</vuln>
<vuln vid="3904f759-5659-11e5-a207-6805ca0b3d42">
<topic>phpMyAdmin -- reCaptcha bypass</topic>
<affects>
<package>
<name>phpMyAdmin</name>
<range><ge>4.4.0</ge><lt>4.4.14.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The phpMyAdmin development team reports:</p>
<blockquote cite="https://www.phpmyadmin.net/security/PMASA-2015-4/">
<p>This vulnerability allows to complete the reCaptcha test
and subsequently perform a brute force attack to guess user
credentials without having to complete further reCaptcha
tests.</p>
<p>We consider this vulnerability to be non critical since
reCaptcha is an additional opt-in security measure.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.phpmyadmin.net/security/PMASA-2015-4/</url>
<cvename>CVE-2015-6830</cvename>
</references>
<dates>
<discovery>2015-09-08</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="3d675519-5654-11e5-9ad8-14dae9d210b8">
<topic>php -- multiple vulnerabilities</topic>
<affects>
<package>
<name>php5</name>
<name>php5-soap</name>
<name>php5-xsl</name>
<range><lt>5.4.45</lt></range>
</package>
<package>
<name>php55</name>
<name>php55-soap</name>
<name>php55-xsl</name>
<range><lt>5.5.29</lt></range>
</package>
<package>
<name>php56</name>
<name>php56-soap</name>
<name>php56-xsl</name>
<range><lt>5.6.13</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PHP reports:</p>
<blockquote cite="http://php.net/ChangeLog-5.php#5.4.45">
<ul><li>Core:
<ul>
<li>Fixed bug #70172 (Use After Free Vulnerability in unserialize()).</li>
<li>Fixed bug #70219 (Use after free vulnerability in session deserializer).</li>
</ul></li>
<li>EXIF:
<ul>
<li>Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).</li>
</ul></li>
<li>hash:
<ul>
<li>Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).</li>
</ul></li>
<li>PCRE:
<ul>
<li>Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).</li>
</ul></li>
<li>SOAP:
<ul>
<li>Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).</li>
</ul></li>
<li>SPL:
<ul>
<li>Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).</li>
<li>Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).</li>
</ul></li>
<li>XSLT:
<ul>
<li>Fixed bug #69782 (NULL pointer dereference).</li>
</ul></li>
<li>ZIP:
<ul>
<li>Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).</li>
</ul></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://php.net/ChangeLog-5.php#5.4.45</url>
<url>http://php.net/ChangeLog-5.php#5.5.29</url>
<url>http://php.net/ChangeLog-5.php#5.6.13</url>
<cvename>CVE-2015-6834</cvename>
<cvename>CVE-2015-6835</cvename>
<cvename>CVE-2015-6836</cvename>
<cvename>CVE-2015-6837</cvename>
<cvename>CVE-2015-6838</cvename>
</references>
<dates>
<discovery>2015-09-03</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="d68df01b-564e-11e5-9ad8-14dae9d210b8">
<topic>ganglia-webfrontend -- auth bypass</topic>
<affects>
<package>
<name>ganglia-webfrontend</name>
<range><lt>3.7.1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Ivan Novikov reports:</p>
<blockquote cite="https://github.com/ganglia/ganglia-web/issues/267">
<p>It's easy to bypass auth by using boolean serialization...</p>
</blockquote>
</body>
</description>
<references>
<url>https://github.com/ganglia/ganglia-web/issues/267</url>
<cvename>CVE-2015-6816</cvename>
</references>
<dates>
<discovery>2015-09-04</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="9bdd8eb5-564a-11e5-9ad8-14dae9d210b8">
<topic>wireshark -- multiple vulnerabilities</topic>
<affects>
<package>
<name>wireshark</name>
<name>wireshark-lite</name>
<name>wireshark-qt5</name>
<name>tshark</name>
<name>tshark-lite</name>
<range><lt>1.12.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Wireshark development team reports:</p>
<blockquote cite="https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html">
<p>The following vulnerabilities have been fixed.</p>
<ul>
<li><p>wnpa-sec-2015-21</p>
<p>Protocol tree crash. (Bug 11309)</p></li>
<li><p>wnpa-sec-2015-22</p>
<p>Memory manager crash. (Bug 11373)</p></li>
<li><p>wnpa-sec-2015-23</p>
<p>Dissector table crash. (Bug 11381)</p></li>
<li><p>wnpa-sec-2015-24</p>
<p>ZigBee crash. (Bug 11389)</p></li>
<li><p>wnpa-sec-2015-25</p>
<p>GSM RLC/MAC infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-26</p>
<p>WaveAgent crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-27</p>
<p>OpenFlow infinite loop. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-28</p>
<p>Ptvcursor crash. (Bug 11358)</p></li>
<li><p>wnpa-sec-2015-29</p>
<p>WCCP crash. (Bug 11358)</p></li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html</url>
<cvename>CVE-2015-6241</cvename>
<cvename>CVE-2015-6242</cvename>
<cvename>CVE-2015-6243</cvename>
<cvename>CVE-2015-6244</cvename>
<cvename>CVE-2015-6245</cvename>
<cvename>CVE-2015-6246</cvename>
<cvename>CVE-2015-6247</cvename>
<cvename>CVE-2015-6248</cvename>
<cvename>CVE-2015-6249</cvename>
</references>
<dates>
<discovery>2015-08-12</discovery>
<entry>2015-09-08</entry>
<modified>2015-09-08</modified>
</dates>
</vuln>
<vuln vid="98092444-5645-11e5-9ad8-14dae9d210b8">
<topic>screen -- stack overflow</topic>
<affects>
<package>
<name>screen</name>
<range><lt>4.3.1_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Kuang-che Wu reports:</p>
<blockquote cite="https://savannah.gnu.org/bugs/?45713">
<p>screen will recursively call MScrollV to depth n/256. This
is time consuming and will overflow stack if n is huge.</p>
</blockquote>
</body>
</description>
<references>
<url>https://savannah.gnu.org/bugs/?45713</url>
<cvename>CVE-2015-6806</cvename>
</references>
<dates>
<discovery>2015-08-07</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="b5e654c3-5644-11e5-9ad8-14dae9d210b8">
<topic>libvncserver -- memory corruption</topic>
<affects>
<package>
<name>libvncserver</name>
<range><lt>0.9.8</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Petr Pisar reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=706087">
<p>libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.redhat.com/show_bug.cgi?id=706087</url>
<url>https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6</url>
</references>
<dates>
<discovery>2011-05-19</discovery>
<entry>2015-09-08</entry>
</dates>
</vuln>
<vuln vid="ed0ecad5-531d-11e5-9850-bcaec565249c">
<topic>gdk-pixbuf2 -- integer overflows</topic>
<affects>
<package>
<name>gdk-pixbuf2</name>
<range><lt>2.31.7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Matthias Clasen reports:</p>
<blockquote cite="https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html">
<p>Fix several integer overflows.</p>
</blockquote>
</body>
</description>
<references>
<url>https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-04</entry>
</dates>
</vuln>
<vuln vid="2c5e7e23-5248-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><ge>9.9.7</ge><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/">
<p>An incorrect boundary check in openpgpkey_61.c can cause
named to terminate due to a REQUIRE assertion failure. This defect can
be deliberately exploited by an attacker who can provide a maliciously
constructed response in answer to a query.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/</url>
<cvename>CVE-2015-5986</cvename>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
</dates>
</vuln>
<vuln vid="eaf3b255-5245-11e5-9ad8-14dae9d210b8">
<topic>bind -- denial of service vulnerability</topic>
<affects>
<package>
<name>bind99</name>
<range><lt>9.9.7P3</lt></range>
</package>
<package>
<name>bind910</name>
<range><ge>9.10.2</ge><lt>9.10.2P4</lt></range>
</package>
<package>
<name>bind910-base</name>
<name>bind99-base</name>
<range><gt>0</gt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>9.3</ge><lt>9.3_25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>ISC reports:</p>
<blockquote cite="https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/">
<p>Parsing a malformed DNSSEC key can cause a validating
resolver to exit due to a failed assertion in buffer.c. It is possible
for a remote attacker to deliberately trigger this condition, for
example by using a query which requires a response from a zone
containing a deliberately malformed key.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/</url>
<cvename>CVE-2015-5722</cvename>
<freebsdsa>SA-15:23.bind</freebsdsa>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-09-03</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="a9350df8-5157-11e5-b5c1-e8e0b747a45a">
<topic>chromium -- multiple vulnerabilities</topic>
<affects>
<package>
<name>chromium</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-npapi</name>
<range><lt>45.0.2454.85</lt></range>
</package>
<package>
<!--pcbsd-->
<name>chromium-pulse</name>
<range><lt>45.0.2454.85</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Google Chrome Releases reports:</p>
<blockquote cite="http://googlechromereleases.blogspot.nl">
<p>29 security fixes in this release, including:</p>
<ul>
<li>[516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit
to anonymous.</li>
<li>[522791] High CVE-2015-1292: Cross-origin bypass in
ServiceWorker. Credit to Mariusz Mlynski.</li>
<li>[524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit
to Mariusz Mlynski.</li>
<li>[492263] High CVE-2015-1294: Use-after-free in Skia. Credit
to cloudfuzzer.</li>
<li>[502562] High CVE-2015-1295: Use-after-free in Printing. Credit
to anonymous.</li>
<li>[421332] High CVE-2015-1296: Character spoofing in omnibox.
Credit to zcorpan.</li>
<li>[510802] Medium CVE-2015-1297: Permission scoping error in
Webrequest. Credit to Alexander Kashev.</li>
<li>[518827] Medium CVE-2015-1298: URL validation error in
extensions. Credit to Rob Wu.</li>
<li>[416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit
to taro.suzuki.dev.</li>
<li>[511616] Medium CVE-2015-1300: Information leak in Blink. Credit
to cgvwzq.</li>
<li>[526825] CVE-2015-1301: Various fixes from internal audits,
fuzzing and other initiatives.</li>
</ul>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-1291</cvename>
<cvename>CVE-2015-1292</cvename>
<cvename>CVE-2015-1293</cvename>
<cvename>CVE-2015-1294</cvename>
<cvename>CVE-2015-1295</cvename>
<cvename>CVE-2015-1296</cvename>
<cvename>CVE-2015-1297</cvename>
<cvename>CVE-2015-1298</cvename>
<cvename>CVE-2015-1299</cvename>
<cvename>CVE-2015-1300</cvename>
<cvename>CVE-2015-1301</cvename>
<url>http://googlechromereleases.blogspot.nl</url>
</references>
<dates>
<discovery>2015-09-01</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="55c43f5b-5190-11e5-9ad8-14dae9d210b8">
<topic>powerdns -- denial of service</topic>
<affects>
<package>
<name>powerdns</name>
<range><ge>3.4.0</ge><lt>3.4.6</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>PowerDNS reports:</p>
<blockquote cite="https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/">
<p>A bug was found in our DNS packet parsing/generation code,
which, when exploited, can cause individual threads (disabling service)
or whole processes (allowing a supervisor to restart them) to crash with
just one or a few query packets.</p>
</blockquote>
</body>
</description>
<references>
<url>https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/</url>
<cvename>CVE-2015-5230</cvename>
</references>
<dates>
<discovery>2015-09-02</discovery>
<entry>2015-09-02</entry>
</dates>
</vuln>
<vuln vid="fc1f6658-4f53-11e5-934b-002590263bf5">
<topic>ghostscript -- denial of service (crash) via crafted Postscript files</topic>
<affects>
<package>
<name>ghostscript7</name>
<name>ghostscript7-nox11</name>
<name>ghostscript7-base</name>
<name>ghostscript7-x11</name>
<range><lt>7.07_32</lt></range>
</package>
<package>
<name>ghostscript8</name>
<name>ghostscript8-nox11</name>
<name>ghostscript8-base</name>
<name>ghostscript8-x11</name>
<range><lt>8.71_19</lt></range>
</package>
<package>
<name>ghostscript9</name>
<name>ghostscript9-nox11</name>
<name>ghostscript9-base</name>
<name>ghostscript9-x11</name>
<range><lt>9.06_11</lt></range>
</package>
<package>
<name>ghostscript9-agpl</name>
<name>ghostscript9-agpl-nox11</name>
<range><lt>9.15_2</lt></range>
</package>
<package>
<name>ghostscript9-agpl-base</name>
<name>ghostscript9-agpl-x11</name>
<range><lt>9.16_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>MITRE reports:</p>
<blockquote cite="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228">
<p>Integer overflow in the gs_heap_alloc_bytes function in
base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote
attackers to cause a denial of service (crash) via a crafted
Postscript (ps) file, as demonstrated by using the ps2pdf command,
which triggers an out-of-bounds read or write.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3228</cvename>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696041</url>
<url>http://bugs.ghostscript.com/show_bug.cgi?id=696070</url>
<url>http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859</url>
</references>
<dates>
<discovery>2015-06-17</discovery>
<entry>2015-09-01</entry>
<modified>2015-09-02</modified>
</dates>
</vuln>
<vuln vid="80c66af0-d1c5-449e-bd31-63b12525ff88">
<topic>ffmpeg -- out-of-bounds array access</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.1</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.15,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg26</name>
<range><lt>2.6.2</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.6</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.8</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>ffmpeg1</name>
<!-- just in case: f7e1367 wasn't cherry-picked -->
<!-- no known fixed version -->
<range><ge>0</ge></range>
</package>
<package>
<name>avidemux</name>
<name>avidemux26</name>
<!-- avidemux-2.6.10 has ffmpeg-2.6.1 -->
<range><lt>2.6.11</lt></range>
</package>
<package>
<name>kodi</name>
<!-- kodi-14.2 has ffmpeg-2.4.6 -->
<range><lt>15.1</lt></range>
</package>
<package>
<name>mplayer</name>
<name>mencoder</name>
<!-- mplayer-1.1.r20141223 has ffmpeg-2.5.1+ (snapshot, 03b84f2) -->
<range><lt>1.1.r20150403</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3395">
<p>The msrle_decode_pal4 function in msrledec.c in Libav
before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7,
2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6,
and 2.6.x before 2.6.2 allows remote attackers to have
unspecified impact via a crafted image, related to a pixel
pointer, which triggers an out-of-bounds array access.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3395</cvename>
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553</url>
<url>https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2015-04-12</discovery>
<entry>2015-09-01</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="da434a78-e342-4d9a-87e2-7497e5f117ba">
<topic>ffmpeg -- use-after-free</topic>
<affects>
<package>
<name>libav</name>
<range><ge>11.0</ge><lt>11.4</lt></range>
<range><lt>10.7</lt></range>
</package>
<package>
<name>gstreamer1-libav</name>
<!-- gst-libav-1.4.5 has libav-10.5 -->
<range><lt>1.5.0</lt></range>
</package>
<package>
<name>handbrake</name>
<!-- handbrake prior to 1.2.0 has libav-10.1 -->
<!-- backend library has been switched from libav to ffmpeg since 1.2.0 -->
<range><lt>1.2.0</lt></range>
</package>
<package>
<name>ffmpeg</name>
<range><ge>2.2.0,1</ge><lt>2.2.12,1</lt></range>
<range><ge>2.1.0,1</ge><lt>2.1.7,1</lt></range>
<range><lt>2.0.7,1</lt></range>
</package>
<package>
<name>ffmpeg25</name>
<range><lt>2.5.2</lt></range>
</package>
<package>
<name>ffmpeg24</name>
<range><lt>2.4.5</lt></range>
</package>
<package>
<name>ffmpeg23</name>
<range><lt>2.3.6</lt></range>
</package>
<package>
<name>ffmpeg1</name>
<range><lt>1.2.11</lt></range>
</package>
<package>
<name>mythtv</name>
<name>mythtv-frontend</name>
<!-- mythtv-0.27.0.20140121 has ffmpeg-1.2.2+ (snapshot, f9c8726) -->
<range><le>0.27.5,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>NVD reports:</p>
<blockquote cite="https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3417">
<p>Use-after-free vulnerability in the ff_h264_free_tables
function in libavcodec/h264.c in FFmpeg before 2.3.6 allows
remote attackers to cause a denial of service or possibly
have unspecified other impact via crafted H.264 data in an
MP4 file, as demonstrated by an HTML VIDEO element that
references H.264 data.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-3417</cvename>
<!-- ffmpeg and libav fixes are different -->
<url>https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214</url>
<url>https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e</url>
<url>https://ffmpeg.org/security.html</url>
<url>https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4</url>
</references>
<dates>
<discovery>2014-12-19</discovery>
<entry>2015-09-01</entry>
<modified>2018-03-25</modified>
</dates>
</vuln>
<vuln vid="5300711b-4e61-11e5-9ad8-14dae9d210b8">
<topic>graphviz -- format string vulnerability</topic>
<affects>
<package>
<name>graphviz</name>
<range><lt>2.38.0_7</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Joshua Rogers reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2014/q4/784">
<p>A format string vulnerability has been found in `graphviz'.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2014/q4/784</url>
<url>https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081</url>
</references>
<dates>
<discovery>2014-11-24</discovery>
<entry>2015-08-29</entry>
</dates>
</vuln>
<vuln vid="237a201c-888b-487f-84d3-7d92266381d6">
<topic>mozilla -- multiple vulnerabilities</topic>
<affects>
<package>
<name>firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>linux-firefox</name>
<range><lt>40.0.3,1</lt></range>
</package>
<package>
<name>firefox-esr</name>
<range><lt>38.2.1,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/">
<p>MFSA 2015-95 Add-on notification bypass through data URLs</p>
<p>MFSA 2015-94 Use-after-free when resizing canvas element
during restyling</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-4497</cvename>
<cvename>CVE-2015-4498</cvename>
<url>https://www.mozilla.org/security/advisories/mfsa2015-94/</url>
<url>https://www.mozilla.org/security/advisories/mfsa2015-95/</url>
</references>
<dates>
<discovery>2015-08-27</discovery>
<entry>2015-08-28</entry>
</dates>
</vuln>
<vuln vid="4464212e-4acd-11e5-934b-002590263bf5">
<topic>go -- multiple vulnerabilities</topic>
<affects>
<package>
<name>go</name>
<range><lt>1.4.3,1</lt></range>
</package>
<package>
<name>go14</name>
<range><lt>1.4.3</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Jason Buberel, Go Product Manager, reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/237">
<p>CVE-2015-5739 - "Content Length" treated as valid header</p>
<p>CVE-2015-5740 - Double content-length headers does not return 400
error</p>
<p>CVE-2015-5741 - Additional hardening, not sending Content-Length
w/Transfer-Encoding, Closing connections</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5739</cvename>
<cvename>CVE-2015-5740</cvename>
<cvename>CVE-2015-5741</cvename>
<url>https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9</url>
<url>https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e</url>
<url>https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f</url>
<url>http://seclists.org/oss-sec/2015/q3/237</url>
</references>
<dates>
<discovery>2015-07-29</discovery>
<entry>2015-08-25</entry>
</dates>
</vuln>
<vuln vid="40497e81-fee3-4e54-9d5f-175a5c633b73">
<topic>libtremor -- memory corruption</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20120120</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Mozilla Project reports:</p>
<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2012-07/">
<p>Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative the possibility of memory
corruption during the decoding of Ogg Vorbis files. This can
cause a crash during decoding and has the potential for
remote code execution.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2012-0444</cvename>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=719612</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274</url>
</references>
<dates>
<discovery>2012-01-31</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="3dac84c9-bce1-4199-9784-d68af1eb7b2e">
<topic>libtremor -- multiple vulnerabilities</topic>
<affects>
<package>
<name>libtremor</name>
<range><lt>1.2.0.s20101013</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The RedHat Project reports:</p>
<blockquote cite="https://bugzilla.redhat.com/show_bug.cgi?id=438125">
<p>Will Drewry of the Google Security Team reported multiple
issues in OGG Vorbis and Tremor libraries, that could cause
application using those libraries to crash (NULL pointer
dereference or divide by zero), enter an infinite loop or
cause heap overflow caused by integer overflow.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2008-1418</cvename>
<cvename>CVE-2008-1419</cvename>
<cvename>CVE-2008-1420</cvename>
<cvename>CVE-2008-1423</cvename>
<cvename>CVE-2008-2009</cvename>
<url>http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e</url>
<url>https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4</url>
</references>
<dates>
<discovery>2008-03-19</discovery>
<entry>2015-08-25</entry>
<modified>2015-08-25</modified>
</dates>
</vuln>
<vuln vid="6900e6f1-4a79-11e5-9ad8-14dae9d210b8">
<topic>pcre -- heap overflow vulnerability</topic>
<affects>
<package>
<name>pcre</name>
<range><lt>8.37_4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Guanxing Wen reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/295">
<p>PCRE library is prone to a vulnerability which leads to
Heap Overflow.
During the compilation of a malformed regular expression, more data is
written on the malloced block than the expected size output by
compile_regex().
The Heap Overflow vulnerability is caused by the following regular
expression.</p>
<p>/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/</p>
<p>A dry run of this particular regular expression with pcretest will
reports "double free or corruption (!prev)".
But it is actually a heap overflow problem.
The overflow only affects pcre 8.x branch, pcre2 branch is not affected.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/295</url>
<url>https://bugs.exim.org/show_bug.cgi?id=1672</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-24</entry>
</dates>
</vuln>
<vuln vid="9393213d-489b-11e5-b8c7-d050996490d0">
<topic>drupal -- multiple vulnerabilities</topic>
<affects>
<package>
<name>drupal6</name>
<range><lt>6.37</lt></range>
</package>
<package>
<name>drupal7</name>
<range><lt>7.39</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Drupal development team reports:</p>
<blockquote cite="https://www.drupal.org/SA-CORE-2015-003">
<p>This security advisory fixes multiple vulnerabilities.
See below for a list.</p>
<h3>Cross-site Scripting - Ajax system - Drupal 7</h3>
<p>A vulnerability was found that allows a malicious
user to perform a cross-site scripting attack by
invoking Drupal.ajax() on a whitelisted HTML element.</p>
<p>This vulnerability is mitigated on sites that do not
allow untrusted users to enter HTML.</p>
<h3>Cross-site Scripting - Autocomplete system - Drupal 6 and 7</h3>
<p>A cross-site scripting vulnerability was found in
the autocomplete functionality of forms. The
requested URL is not sufficiently sanitized.</p>
<p>This vulnerability is mitigated by the fact that
the malicious user must be allowed to upload files.</p>
<h3>SQL Injection - Database API - Drupal 7</h3>
<p>A vulnerability was found in the SQL comment
filtering system which could allow a user with
elevated permissions to inject malicious code in
SQL comments.</p>
<p>This vulnerability is mitigated by the fact that
only one contributed module that the security team
found uses the comment filtering system in a way
that would trigger the vulnerability. That module
requires you to have a very high level of access
in order to perform the attack.</p>
<h3>Cross-site Request Forgery - Form API - Drupal 6 and 7</h3>
<p>A vulnerability was discovered in Drupal's form API
that could allow file upload value callbacks to run
with untrusted input, due to form token validation
not being performed early enough. This vulnerability
could allow a malicious user to upload files to the
site under another user's account.</p>
<p>This vulnerability is mitigated by the fact that
the uploaded files would be temporary, and Drupal
normally deletes temporary files automatically
after 6 hours.</p>
<h3>Information Disclosure in Menu Links - Access system - Drupal 6 and 7</h3>
<p>Users without the "access content" permission
can see the titles of nodes that they do not have
access to, if the nodes are added to a menu on the
site that the users have access to.</p>
</blockquote>
</body>
</description>
<references>
<url>https://www.drupal.org/SA-CORE-2015-003</url>
</references>
<dates>
<discovery>2015-08-19</discovery>
<entry>2015-08-22</entry>
</dates>
</vuln>
<vuln vid="2920c449-4850-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PAM vulnerabilities</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><lt>7.0.p1,1</lt></range>
</package>
<package>
<name>FreeBSD</name>
<range><ge>10.2</ge><lt>10.2_2</lt></range>
<range><ge>10.1</ge><lt>10.1_19</lt></range>
<range><ge>9.3</ge><lt>9.3_24</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.0">
<p>OpenSSH 6.8 and 6.9 incorrectly set TTYs to be world-writable.
Local attackers may be able to write arbitrary messages to
logged-in users, including terminal escape sequences. Reported
by Nikolay Edigaryev.</p>
<p>Fixed a privilege separation
weakness related to PAM support. Attackers who could successfully
compromise the pre-authentication process for remote code
execution and who had valid credentials on the host could
impersonate other users.</p>
<p>Fixed a use-after-free bug
related to PAM support that was reachable by attackers who could
compromise the pre-authentication process for remote code
execution.</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.0</url>
<cvename>CVE-2015-6563</cvename>
<cvename>CVE-2015-6564</cvename>
<cvename>CVE-2015-6565</cvename>
<freebsdsa>SA-15:22.openssh</freebsdsa>
</references>
<dates>
<discovery>2015-08-11</discovery>
<entry>2015-08-21</entry>
<modified>2016-08-09</modified>
</dates>
</vuln>
<vuln vid="27fed73e-484f-11e5-825f-c80aa9043978">
<topic>OpenSSH -- PermitRootLogin may allow password connections with 'without-password'</topic>
<affects>
<package>
<name>openssh-portable</name>
<range><eq>7.0.p1,1</eq></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote cite="http://www.openssh.com/txt/release-7.1">
<p>OpenSSH 7.0 contained a logic error in PermitRootLogin=
prohibit-password/without-password that could, depending on
compile-time configuration, permit password authentication to
root while preventing other forms of authentication. This problem
was reported by Mantas Mikulenas.
</p>
</blockquote>
</body>
</description>
<references>
<url>http://www.openssh.com/txt/release-7.1</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="2fe40238-480f-11e5-adde-14dae9d210b8">
<topic>tarsnap -- buffer overflow and local DoS</topic>
<affects>
<package>
<name>tarsnap</name>
<range><lt>1.0.36</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Colin Percival reports:</p>
<blockquote cite="http://mail.tarsnap.com/tarsnap-announce/msg00032.html">
<p>1. SECURITY FIX: When constructing paths of objects being archived, a buffer
could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte
paths. Theoretically this could be exploited by an unprivileged user whose
files are being archived; I do not believe it is exploitable in practice,
but I am offering a $1000 bounty for the first person who can prove me wrong:
http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</p>
<p>2. SECURITY FIX: An attacker with a machine's write keys, or with read keys
and control of the tarsnap service, could make tarsnap allocate a large
amount of memory upon listing archives or reading an archive the attacker
created; on 32-bit machines, tarsnap can be caused to crash under the
aforementioned conditions.</p>
</blockquote>
</body>
</description>
<references>
<url>http://mail.tarsnap.com/tarsnap-announce/msg00032.html</url>
<url>http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html</url>
</references>
<dates>
<discovery>2015-08-21</discovery>
<entry>2015-08-21</entry>
</dates>
</vuln>
<vuln vid="a0a4e24c-4760-11e5-9391-3c970e169bc2">
<topic>vlc -- arbitrary pointer dereference vulnerability</topic>
<affects>
<package>
<name>vlc</name>
<range><lt>2.2.1_5,4</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>oCERT reports:</p>
<blockquote cite="https://www.ocert.org/advisories/ocert-2015-009.html">
<p>The stable VLC version suffers from an arbitrary pointer
dereference vulnerability.</p>
<p>The vulnerability affects the 3GP file format parser,
insufficient restrictions on a writable buffer can be
exploited to execute arbitrary code via the heap memory.
A specific 3GP file can be crafted to trigger the
vulnerability.</p>
<p>Credit: vulnerability reported by Loren Maggiore of
Trail of Bits.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2015-5949</cvename>
<url>https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd</url>
<url>https://www.ocert.org/advisories/ocert-2015-009.html</url>
</references>
<dates>
<discovery>2015-08-20</discovery>
<entry>2015-08-20</entry>
</dates>
</vuln>
<vuln vid="9a71953a-474a-11e5-adde-14dae9d210b8">
<topic>libpgf -- use-after-free</topic>
<affects>
<package>
<name>libpgf</name>
<range><le>6.14.12</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Pengsu Cheng reports:</p>
<blockquote cite="http://seclists.org/oss-sec/2015/q3/404">
<p>An use-after-free issue in Decoder.cpp was reported to
upstream. The problem is due to lack of validation of ColorTableSize.</p>
</blockquote>
</body>
</description>
<references>
<url>http://seclists.org/oss-sec/2015/q3/404</url>
<url>https://sourceforge.net/p/libpgf/code/147/</url>
<url>https://sourceforge.net/p/libpgf/code/148/</url>
<cvename>CVE-2015-6673</cvename>
</references>
<dates>
<discovery>2015-08-08</discovery>
<entry>2015-08-20</entry>
<modified>2015-08-26</modified>
</dates>
</vuln>