Git -- Execute arbitrary code git 2.6.1 git-gui 2.6.1 git-lite 2.6.1 git-subversion 2.6.1

Git release notes:

Some protocols (like git-remote-ext) can execute arbitrary code found in the URL. The URLs that submodules use may come from arbitrary sources (e.g., .gitmodules files in a remote repository), and can hurt those who blindly enable recursive fetch. Restrict the allowed protocols to well known and safe ones.

https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.6.1.txt 2015-09-23 2015-10-19
Salt -- multiple vulnerabilities py27-salt 2015.8.1

Salt release notes:

CVE-2015-6918 - Git modules leaking HTTPS auth credentials to debug log

Updated the Git state and execution modules to no longer display HTTPS basic authentication credentials in loglevel debug output on the Salt master. These credentials are now replaced with REDACTED in the debug output. Thanks to Andreas Stieger for bringing this to our attention.

CVE-2015-6941 - win_useradd module and salt-cloud display passwords in debug log

Updated the win_useradd module return data to no longer include the password of the newly created user. The password is now replaced with the string XXX-REDACTED-XXX. Updated the Salt Cloud debug output to no longer display win_password and sudo_password authentication credentials. Also updated the Linode driver to no longer display authentication credentials in debug logs. These credentials are now replaced with REDACTED in the debug output.

https://docs.saltstack.com/en/latest/topics/releases/2015.8.1.html CVE-2015-6918 CVE-2015-6941 2015-10-16 2015-10-17
firefox -- Cross-origin restriction bypass using Fetch firefox 41.0.2,1 linux-firefox 41.0.2,1

Firefox Developers report:

Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue.

https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/ CVE-2015-7184 2015-10-15 2015-10-16
flash -- remote code execution linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.540

Adobe reports:

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648).

CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 https://helpx.adobe.com/security/products/flash-player/apsb15-27.html 2015-10-16 2015-10-16
LibreSSL -- Memory leak and buffer overflow libressl 2.2.3

Qualys reports:

During the code review of OpenSMTPD a memory leak and buffer overflow (an off-by-one, usually stack-based) were discovered in LibreSSL's OBJ_obj2txt() function. This function is called automatically during a TLS handshake (both client-side, unless an anonymous mode is used, and server-side, if client authentication is requested).

http://marc.info/?l=openbsd-announce&m=144495690528446 CVE-2015-5333 CVE-2015-5334 2015-10-15 2015-10-16
mbedTLS/PolarSSL -- DoS and possible remote code execution polarssl 1.2.01.2.17 polarssl13 1.3.01.3.14 mbedtls 2.1.2

ARM Limited reports:

When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the session ticket extension and the server name indication (SNI) extension.

https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01 CVE-2015-5291 2015-10-05 2015-10-15
magento -- multiple vulnerabilities magento 1.9.2.1

Magento, Inc. reports:

SUPEE-6482 - This patch addresses two issues related to APIs and two cross-site scripting risks.

SUPEE-6285 - This patch provides protection against several types of security-related issues, including information leaks, request forgeries, and cross-site scripting.

SUPEE-5994 - This patch addresses multiple security vulnerabilities in Magento Community Edition software, including issues that can put customer information at risk.

SUPEE-5344 - Addresses a potential remote code execution exploit.

SUPEE-1533 - Addresses two potential remote code execution exploits.

ports/201709 https://www.magentocommerce.com/download http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.html http://merch.docs.magento.com/ce/user_guide/Magento_Community_Edition_User_Guide.html#magento/release-notes-ce-1.9.2.1.html 2014-10-03 2015-10-14
pear-twig -- remote code execution pear-twig-twig 1.20.0

Fabien Potencier reports:

End users can craft valid Twig code that allows them to execute arbitrary code (RCEs) via the _self variable, which is always available, even in sandboxed templates.

http://symfony.com/blog/security-release-twig-1-20-0 CVE-2015-7809 2015-08-12 2015-10-14
miniupnpc -- buffer overflow miniupnpc 1.9.11.9.20150917 1.9_1

Talos reports:

An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability.

CVE-2015-6031 http://talosintel.com/reports/TALOS-2015-0035/ https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78 2015-09-15 2015-10-14 2015-10-14
flash -- multiple vulnerabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.535

Adobe reports:

These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-7628).

These updates include a defense-in-depth feature in the Flash broker API (CVE-2015-5569).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-7629, CVE-2015-7631, CVE-2015-7643, CVE-2015-7644).

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-7632).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).

CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 https://helpx.adobe.com/security/products/flash-player/apsb15-25.html 2015-10-13 2015-10-14
chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 46.0.2490.71

Google Chrome Releases reports:

24 security fixes in this release, including:

  • [519558] High CVE-2015-6755: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.
  • [507316] High CVE-2015-6756: Use-after-free in PDFium. Credit to anonymous.
  • [529520] High CVE-2015-6757: Use-after-free in ServiceWorker. Credit to Collin Payne.
  • [522131] High CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG.
  • [514076] Medium CVE-2015-6759: Information leakage in LocalStorage. Credit to Muneaki Nishimura (nishimunea).
  • [519642] Medium CVE-2015-6760: Improper error handling in libANGLE. Credit to lastland.net.
  • [447860,532967] Medium CVE-2015-6761: Memory corruption in FFMpeg. Credit to Aki Helin of OUSPG and anonymous.
  • [512678] Low CVE-2015-6762: CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea).
  • [542517] CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives.
  • Multiple vulnerabilities in V8 fixed at the tip of the 4.6 branch (currently 4.6.85.23).
CVE-2015-6755 CVE-2015-6756 CVE-2015-6757 CVE-2015-6758 CVE-2015-6759 CVE-2015-6760 CVE-2015-6761 CVE-2015-6762 CVE-2015-6763 http://googlechromereleases.blogspot.nl/2015/10/stable-channel-update.html 2015-10-13 2015-10-13
p5-UI-Dialog -- shell command execution vulnerability p5-UI-Dialog 1.09_2

Matthijs Kooijman reports:

It seems that the whiptail, cdialog and kdialog backends apply some improper escaping in their shell commands, causing special characters present in menu item titles to be interpreted by the shell. This includes the backtick evaluation operator, so this constitutues a security issue, allowing execution of arbitrary commands if an attacker has control over the text displayed in a menu.

CVE-2008-7315 ports/203667 https://rt.cpan.org/Public/Bug/Display.html?id=107364 https://bugs.debian.org/496448 https://github.com/kckrinke/UI-Dialog/commit/6adc44cc636c615d76297d86835e1a997681eb61 2008-08-24 2015-10-10
devel/ipython -- multiple vulnerabilities ipython 3.2.2

Matthias Bussonnier reports:

Summary: Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it.

URI with issues:

  • GET /tree/**

Benjamin RK reports:

Vulnerability: A maliciously forged file opened for editing can execute javascript, specifically by being redirected to /files/ due to a failure to treat the file as plain text.

URI with issues:

  • GET /edit/**
ports/203668 CVE-2015-6938 CVE-2015-7337 http://www.openwall.com/lists/oss-security/2015/09/02/3 https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892 http://www.openwall.com/lists/oss-security/2015/09/16/3 https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967 2015-09-01 2015-10-10
PostgreSQL -- minor security problems. postgresql90-server 9.0.09.0.22 postgresql91-server 9.1.09.1.18 postgresql92-server 9.2.09.2.13 postgresql93-server 9.3.09.3.9 postgresql94-server 9.4.09.4.4

PostgreSQL project reports:

Two security issues have been fixed in this release which affect users of specific PostgreSQL features.

  • CVE-2015-5289 json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service.
  • CVE-2015-5288: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed.
CVE-2015-5289 CVE-2015-5288 2015-10-08 2015-10-08
ZendFramework1 -- SQL injection vulnerability ZendFramework1 1.12.16

Zend Framework developers report:

The PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.

CVE-2015-7695 http://www.openwall.com/lists/oss-security/2015/09/30/6 http://framework.zend.com/security/advisory/ZF2015-08 2015-09-15 2015-10-06 2015-10-12
OpenSMTPD -- multiple vulnerabilities opensmtpd 5.7.3,1

OpenSMTPD developers report:

fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda

fix remote buffer overflow in unprivileged pony process

reworked offline enqueue to better protect against hardlink attacks

http://www.openwall.com/lists/oss-security/2015/10/04/2 https://www.opensmtpd.org/announces/release-5.7.3.txt 2015-10-04 2015-10-06
mbedTLS/PolarSSL -- multiple vulnerabilities polarssl 1.2.01.2.16 polarssl13 1.3.01.3.13 mbedtls 2.1.1

ARM Limited reports:

Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach for PKCS#1 v1.5 signatures. These releases include countermeasures against that attack.

Fabian Foerg of Gotham Digital Science found a possible client-side NULL pointer dereference, using the AFL Fuzzer. This dereference can only occur when misusing the API, although a fix has still been implemented.

https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released 2015-09-18 2015-10-06
mbedTLS/PolarSSL -- multiple vulnerabilities polarssl 1.2.01.2.15 polarssl13 1.3.01.3.12

ARM Limited reports:

In order to strengthen the minimum requirements for connections and to protect against the Logjam attack, the minimum size of Diffie-Hellman parameters accepted by the client has been increased to 1024 bits.

In addition the default size for the Diffie-Hellman parameters on the server are increased to 2048 bits. This can be changed with ssl_set_dh_params() in case this is necessary.

https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released 2015-08-11 2015-10-06
gdk-pixbuf2 -- head overflow and DoS gdk-pixbuf2 2.32.1

reports:

We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of tga file.

We found a heap overflow in the gdk-pixbuf implementation triggered by the scaling of gif file.

CVE-2015-7673 CVE-2015-7674 https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00201.html https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00287.html http://www.openwall.com/lists/oss-security/2015/10/02/9 http://www.openwall.com/lists/oss-security/2015/10/02/10 2015-10-02 2015-10-05
plone -- multiple vulnerabilities plone 4.3.7

Plone.org reports:

Versions Affected: All current Plone versions.

Versions Not Affected: None.

Nature of vulnerability: Allows creation of members by anonymous users on sites that have self-registration enabled, allowing bypass of CAPTCHA and similar protections against scripted attacks.

The patch can be added to buildouts as Products.PloneHotfix20150910 (available from PyPI) or downloaded from Plone.org.

Immediate Measures You Should Take: Disable self-registration until you have applied the patch.

Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into this specially crafted url, XSS can be achieved.

ports/203255 https://plone.org/products/plone-hotfix/releases/20150910 https://plone.org/products/plone/security/advisories/20150910-announcement https://plone.org/security/20150910/non-persistent-xss-in-plone https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087 2015-09-10 2015-10-05
php -- multiple vulnerabilities php5-phar 5.4.45 php55-phar 5.5.30 php56-phar 5.6.14

PHP reports:

Phar:

  • Fixed bug #69720 (Null pointer dereference in phar_get_fp_offset()).
  • Fixed bug #70433 (Uninitialized pointer in phar_make_dirstream when zip entry filename is "/").
ports/203541 CVE-2015-7803 CVE-2015-7804 http://php.net/ChangeLog-5.php#5.5.30 http://php.net/ChangeLog-5.php#5.6.14 2015-10-01 2015-10-04 2015-10-12
OpenSMTPD -- multiple vulnerabilities opensmtpd 5.7.2,1

OpenSMTPD developers report:

an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory

multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD

a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user

a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files

a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash from /etc/master.passwd)

a denial-of-service vulnerability that allows remote attackers to fill OpenSMTPD's queue or mailbox hard-disk partition

an out-of-bounds memory read that allows remote attackers to crash OpenSMTPD, or leak information and defeat the ASLR protection

a use-after-free vulnerability that allows remote attackers to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user

https://www.opensmtpd.org/announces/release-5.7.2.txt CVE-2015-7687 2015-10-02 2015-10-04 2015-10-06
james -- multiple vulnerabilities james 2.3.2.1

The Apache James Project reports:

This release has many enhancements and bug fixes over the previous release. See the Release Notes for a detailed list of changes. Some of the earlier defects could turn a James mail server into an Open Relay and allow files to be written on disk. All users of James Server are urged to upgrade to version v2.3.2.1 as soon as possible.

ports/203461 988628 CVE-2015-7611 http://james.apache.org/download.cgi#Apache_James_Server https://blogs.apache.org/james/entry/apache_james_server_2_3 2015-09-30 2015-10-01 2015-10-04
otrs -- Scheduler Process ID File Access otrs 3.2.*3.2.18 3.3.*3.3.15 4.0.*4.0.13

The OTRS project reports:

An attacker with valid LOCAL credentials could access and manipulate the process ID file for bin/otrs.schduler.pl from the CLI.

The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspecified impact by modifying this file.

https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-access/ CVE-2015-6842 CVE-2013-7135 2015-09-17 2015-09-30
flash -- multiple vulnabilities linux-c6-flashplugin linux-f10-flashplugin linux-c6_64-flashplugin 11.2r202.521

Adobe reports:

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-5573).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-5570, CVE-2015-5574, CVE-2015-5581, CVE-2015-5584, CVE-2015-6682).

These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2015-6676, CVE-2015-6678).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, CVE-2015-6677).

These updates include additional validation checks to ensure that Flash Player rejects malicious content from vulnerable JSONP callback APIs (CVE-2015-5571).

These updates resolve a memory leak vulnerability (CVE-2015-5576).

These updates include further hardening to a mitigation to defend against vector length corruptions (CVE-2015-5568).

These updates resolve stack corruption vulnerabilities that could lead to code execution (CVE-2015-5567, CVE-2015-5579).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-5587).

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-5572).

These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-6679).

CVE-2015-5567 CVE-2015-5568 CVE-2015-5570 CVE-2015-5571 CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575 CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677 CVE-2015-6678 CVE-2015-6679 CVE-2015-6682 https://helpx.adobe.com/security/products/flash-player/apsb15-23.html 2015-09-21 2015-09-28
codeigniter -- SQL injection vulnerability codeigniter 2.2.4

The CodeIgniter changelog reports:

Security: Fixed an SQL injection vulnerability in Active Record method offset().

ports/203401 https://codeigniter.com/userguide2/changelog.html 2015-08-20 2015-09-28
codeigniter -- mysql database driver vulnerability codeigniter 2.2.3

The CodeIgniter changelog reports:

Security: Removed a fallback to mysql_escape_string() in the mysql database driver (escape_str() method) when there's no active database connection.

ports/203401 https://codeigniter.com/userguide2/changelog.html 2015-07-15 2015-09-28
codeigniter -- multiple vulnerabilities codeigniter 2.2.2

The CodeIgniter changelog reports:

Security: Added HTTP "Host" header character validation to prevent cache poisoning attacks when base_url auto-detection is used.

Security: Added FSCommand and seekSegmentTime to the "evil attributes" list in CI_Security::xss_clean().

ports/203401 https://codeigniter.com/userguide2/changelog.html 2015-04-15 2015-09-28
codeigniter -- multiple vulnerabilities codeigniter 2.2.0

The CodeIgniter changelog reports:

Security: The xor_encode() method in the Encrypt Class has been removed. The Encrypt Class now requires the Mcrypt extension to be installed.

Security: The Session Library now uses HMAC authentication instead of a simple MD5 checksum.

ports/203401 https://codeigniter.com/userguide2/changelog.html 2014-06-05 2015-09-28
codeigniter -- SQL injection vulnerability codeigniter 2.0.3

The CodeIgniter changelog reports:

An improvement was made to the MySQL and MySQLi drivers to prevent exposing a potential vector for SQL injection on sites using multi-byte character sets in the database client connection.

An incompatibility in PHP versions < 5.2.3 and MySQL > 5.0.7 with mysql_set_charset() creates a situation where using multi-byte character sets on these environments may potentially expose a SQL injection attack vector. Latin-1, UTF-8, and other "low ASCII" character sets are unaffected on all environments.

If you are running or considering running a multi-byte character set for your database connection, please pay close attention to the server environment you are deploying on to ensure you are not vulnerable.

ports/156486 https://codeigniter.com/userguide2/changelog.html 2011-08-20 2015-09-28
chromium -- multiple vulnerabilities chromium 45.0.2454.101 chromium-npapi 45.0.2454.101 chromium-pulse 45.0.2454.101

Google Chrome Releases reports:

Two vulnerabilities were fixed in this release:

  • [530301] High CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.
  • [531891] High CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski.
CVE-2015-1303 CVE-2015-1304 http://googlechromereleases.blogspot.nl/2015/09/stable-channel-update_24.html 2015-09-24 2015-09-27
libssh2 -- denial of service vulnerability libssh2 1.5.0,2

Mariusz Ziulek reports:

A malicious attacker could man in the middle a real server and cause libssh2 using clients to crash (denial of service) or otherwise read and use completely unintended memory areas in this process.

http://www.libssh2.org/adv_20150311.html https://trac.libssh2.org/ticket/294 CVE-2015-1782 2015-01-25 2015-09-22 2015-09-22
mozilla -- multiple vulnerabilities firefox 41.0,1 linux-firefox 41.0,1 seamonkey 2.38 linux-seamonkey 2.38 firefox-esr 38.3.0,1 libxul 38.3.0 thunderbird 38.3.0 linux-thunderbird 38.3.0

The Mozilla Project reports:

MFSA 2015-96 Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)

MFSA 2015-97 Memory leak in mozTCPSocket to servers

MFSA 2015-98 Out of bounds read in QCMS library with ICC V4 profile attributes

MFSA 2015-99 Site attribute spoofing on Android by pasting URL with unknown scheme

MFSA 2015-100 Arbitrary file manipulation by local user through Mozilla updater

MFSA 2015-101 Buffer overflow in libvpx while parsing vp9 format video

MFSA 2015-102 Crash when using debugger with SavedStacks in JavaScript

MFSA 2015-103 URL spoofing in reader mode

MFSA 2015-104 Use-after-free with shared workers and IndexedDB

MFSA 2015-105 Buffer overflow while decoding WebM video

MFSA 2015-106 Use-after-free while manipulating HTML media content

MFSA 2015-107 Out-of-bounds read during 2D canvas display on Linux 16-bit color depth systems

MFSA 2015-108 Scripted proxies can access inner window

MFSA 2015-109 JavaScript immutable property enforcement can be bypassed

MFSA 2015-110 Dragging and dropping images exposes final URL after redirects

MFSA 2015-111 Errors in the handling of CORS preflight request headers

MFSA 2015-112 Vulnerabilities found through code inspection

MFSA 2015-113 Memory safety errors in libGLES in the ANGLE graphics library

MFSA 2015-114 Information disclosure via the High Resolution Time API

CVE-2015-4476 CVE-2015-4500 CVE-2015-4501 CVE-2015-4502 CVE-2015-4503 CVE-2015-4504 CVE-2015-4505 CVE-2015-4506 CVE-2015-4507 CVE-2015-4508 CVE-2015-4509 CVE-2015-4510 CVE-2015-4512 CVE-2015-4516 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7178 CVE-2015-7179 CVE-2015-7180 https://www.mozilla.org/security/advisories/mfsa2015-96/ https://www.mozilla.org/security/advisories/mfsa2015-97/ https://www.mozilla.org/security/advisories/mfsa2015-98/ https://www.mozilla.org/security/advisories/mfsa2015-99/ https://www.mozilla.org/security/advisories/mfsa2015-100/ https://www.mozilla.org/security/advisories/mfsa2015-101/ https://www.mozilla.org/security/advisories/mfsa2015-102/ https://www.mozilla.org/security/advisories/mfsa2015-103/ https://www.mozilla.org/security/advisories/mfsa2015-104/ https://www.mozilla.org/security/advisories/mfsa2015-105/ https://www.mozilla.org/security/advisories/mfsa2015-106/ https://www.mozilla.org/security/advisories/mfsa2015-107/ https://www.mozilla.org/security/advisories/mfsa2015-108/ https://www.mozilla.org/security/advisories/mfsa2015-109/ https://www.mozilla.org/security/advisories/mfsa2015-110/ https://www.mozilla.org/security/advisories/mfsa2015-111/ https://www.mozilla.org/security/advisories/mfsa2015-112/ https://www.mozilla.org/security/advisories/mfsa2015-113/ https://www.mozilla.org/security/advisories/mfsa2015-114/ 2015-09-22 2015-09-22
ffmpeg -- multiple vulnerabilities libav 0 gstreamer1-libav 1.5.90 gstreamer-ffmpeg 0 handbrake 0 ffmpeg 2.7.2,1 ffmpeg26 2.6.4 ffmpeg25 2.5.8 ffmpeg24 2.4.11 ffmpeg-devel ffmpeg23 ffmpeg2 ffmpeg1 ffmpeg-011 ffmpeg0 0 avidemux avidemux2 avidemux26 2.6.11 kodi 15.1 mplayer mencoder 1.1.r20150822 mythtv mythtv-frontend 0 plexhometheater 0

NVD reports:

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted image with two or more of these chunks.

Multiple integer underflows in the ff_mjpeg_decode_frame function in libavcodec/mjpegdec.c in FFmpeg before 2.7.2 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted MJPEG data.

The ff_sbr_apply function in libavcodec/aacsbr.c in FFmpeg before 2.7.2 does not check for a matching AAC frame syntax element before proceeding with Spectral Band Replication calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted AAC data.

The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.

The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.

The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.

The sws_init_context function in libswscale/utils.c in FFmpeg before 2.7.2 does not initialize certain pixbuf data structures, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted video data.

The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.

The ff_rv34_decode_init_thread_copy function in libavcodec/rv34.c in FFmpeg before 2.7.2 does not initialize certain structure members, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted (1) RV30 or (2) RV40 RealVideo data.

CVE-2015-6818 CVE-2015-6819 CVE-2015-6820 CVE-2015-6821 CVE-2015-6822 CVE-2015-6823 CVE-2015-6824 CVE-2015-6825 CVE-2015-6826 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47f4e2d8960ca756ca153ab8e3e93d80449b8c91 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=84afc6b70d24fc0bf686e43138c96cf60a9445fe https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=79a98294da6cd85f8c86b34764c5e0c43b09eea3 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b160fc290cf49b516c5b6ee0730fd9da7fc623b1 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=39bbdebb1ed8eb9c9b0cd6db85afde6ba89d86e4 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7068bf277a37479aecde2832208d820682b35e6 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a5d44d5c220e12ca0cb7a4eceb0f74759cb13111 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f1a38264f20382731cf2cc75fdd98f4c9a84a626 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3197c0aa87a3b7190e17d49e6fbc7b554e4b3f0a https://ffmpeg.org/security.html 2015-09-05 2015-09-20 2015-09-20
moodle -- multiple vulnerabilities moodle27 2.7.10 moodle28 2.8.8 moodle29 2.9.2

Moodle Release Notes report:

MSA-15-0030: Students can re-attempt answering questions in the lesson (CVE-2015-5264)

MSA-15-0031: Teacher in forum can still post to "all participants" and groups they are not members of (CVE-2015-5272 - 2.7.10 only)

MSA-15-0032: Users can delete files uploaded by other users in wiki (CVE-2015-5265)

MSA-15-0033: Meta course synchronization enrolls suspended students as managers for a short period of time (CVE-2015-5266)

MSA-15-0034: Vulnerability in password recovery mechanism (CVE-2015-5267)

MSA-15-0035: Rating component does not check separate groups (CVE-2015-5268)

MSA-15-0036: XSS in grouping description (CVE-2015-5269)

CVE-2015-5264 CVE-2015-5272 CVE-2015-5265 CVE-2015-5266 CVE-2015-5267 CVE-2015-5268 CVE-2015-5269 http://www.openwall.com/lists/oss-security/2015/09/21/1 https://docs.moodle.org/dev/Moodle_2.7.10_release_notes https://docs.moodle.org/dev/Moodle_2.8.8_release_notes https://docs.moodle.org/dev/Moodle_2.9.2_release_notes 2015-09-14 2015-09-18 2015-09-24
squid -- TLS/SSL parser denial of service vulnerability squid 3.5.0.13.5.9

Amos Jeffries, release manager of the Squid-3 series, reports:

Vulnerable versions are 3.5.0.1 to 3.5.8 (inclusive), which are built with OpenSSL and configured for "SSL-Bump" decryption.

Integer overflows can lead to invalid pointer math reading from random memory on some CPU architectures. In the best case this leads to wrong TLS extensiosn being used for the client, worst-case a crash of the proxy terminating all active transactions.

Incorrect message size checks and assumptions about the existence of TLS extensions in the SSL/TLS handshake message can lead to very high CPU consumption (up to and including 'infinite loop' behaviour).

The above can be triggered remotely. Though there is one layer of authorization applied before this processing to check that the client is allowed to use the proxy, that check is generally weak. MS Skype on Windows XP is known to trigger some of these.

The FreeBSD port does not use SSL by default and is not vulnerable in the default configuration.

ports/203186 http://www.openwall.com/lists/oss-security/2015/09/18/1 2015-09-18 2015-09-18
remind -- buffer overflow with malicious reminder file input remind 3.1.15

Dianne Skoll reports:

BUG FIX: Fix a buffer overflow found by Alexander Keller.

The bug can be manifested by an extended DUMP command using a system variable (that is a special variable whose name begins with '$')

CVE-2015-5957 ports/202942 http://lists.roaringpenguin.com/pipermail/remind-fans/2015/003172.html http://www.openwall.com/lists/oss-security/2015/08/07/1 2015-07-27 2015-09-18
shutter -- arbitrary code execution shutter 0.800.93.1_2

Luke Farone reports:

In the "Shutter" screenshot application, I discovered that using the "Show in folder" menu option while viewing a file with a specially-crafted path allows for arbitrary code execution with the permissions of the user running Shutter.

http://seclists.org/oss-sec/2015/q3/541 https://bugs.launchpad.net/shutter/+bug/1495163 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798862 CVE-2015-0854 2015-09-13 2015-09-17
openjpeg -- use-after-free vulnerability openjpeg 2.1.1

Feist Josselin reports:

Use-after-free was found in openjpeg. The vuln is fixed in version 2.1.1 and was located in opj_j2k_write_mco function.

http://seclists.org/oss-sec/2015/q3/550 https://github.com/uclouvain/openjpeg/issues/563 2015-08-14 2015-09-17
optipng -- use-after-free vulnerability optipng 0.6.5

Gustavo Grieco reports:

We found a use-after-free causing an invalid/double free in optipng 0.6.4.

http://seclists.org/oss-sec/2015/q3/556 CVE-2015-7801 2015-09-16 2015-09-17 2015-10-14
openslp -- denial of service vulnerability openslp 2.0.0

Qinghao Tang reports:

The function ParseExtension() in openslp 1.2.1 exists a vulnerability , an attacher can cause a denial of service (infinite loop) via a packet with crafted "nextoffset" value and "extid" value.

http://seclists.org/oss-sec/2015/q3/559 CVE-2015-5155 2015-09-16 2015-09-17
p7zip -- directory traversal vulnerability p7zip 9.38.1_2

Alexander Cherepanov reports:

7z (and 7zr) is susceptible to a directory traversal vulnerability. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660 http://www.openwall.com/lists/oss-security/2015/01/11/2 http://sourceforge.net/p/p7zip/bugs/147/ CVE-2015-1038 2015-01-05 2015-09-16
h2o -- directory traversal vulnerability h2o 1.4.5

Yakuzo reports:

H2O (up to version 1.4.4 / 1.5.0-beta1) contains a flaw in its URL normalization logic.

When file.dir directive is used, this flaw allows a remote attacker to retrieve arbitrary files that exist outside the directory specified by the directive.

H2O version 1.4.5 and version 1.5.0-beta2 have been released to address this vulnerability.

Users are advised to upgrade their servers immediately.

The vulnerability was reported by: Yusuke OSUMI.

CVE-2015-5638 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5638 2015-09-14 2015-09-16
wordpress -- multiple vulnerabilities wordpress 4.3.1,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.3.1

Samuel Sidler reports:

WordPress 4.3.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

  • WordPress versions 4.3 and earlier are vulnerable to a cross-site scripting vulnerability when processing shortcode tags (CVE-2015-5714). Reported by Shahar Tal and Netanel Rubin of Check Point.
  • A separate cross-site scripting vulnerability was found in the user list table. Reported by Ben Bidner of the WordPress security team.
  • Finally, in certain cases, users without proper permissions could publish private posts and make them sticky (CVE-2015-5715). Reported by Shahar Tal and Netanel Rubin of Check Point.
CVE-2015-5714 CVE-2015-5715 https://wordpress.org/news/2015/09/wordpress-4-3-1/ 2015-09-15 2015-09-15 2015-09-15
Bugzilla security issues bugzilla44 4.4.10 bugzilla50 5.0.1

Bugzilla Security Advisory

Login names (usually an email address) longer than 127 characters are silently truncated in MySQL which could cause the domain name of the email address to be corrupted. An attacker could use this vulnerability to create an account with an email address different from the one originally requested. The login name could then be automatically added to groups based on the group's regular expression setting.

CVE-2015-4499 https://bugzilla.mozilla.org/show_bug.cgi?id=1202447 2015-09-10 2015-09-14
openldap -- denial of service vulnerability openldap-server 2.4.42_1

Denis Andzakovic reports:

By sending a crafted packet, an attacker may cause the OpenLDAP server to reach an assert(9 9 statement, crashing the daemon.

http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=6fe51a9ab04fd28bbc171da3cf12f1c1040d6629 CVE-2015-6908 2015-09-09 2015-09-12 2015-09-13
vorbis-tools, opus-tools -- multiple vulnerabilities vorbis-tools 1.4.0_10,3 opus-tools 0.1.9_2

Paris Zoumpouloglou reports:

I discovered an integer overflow issue in oggenc, related to the number of channels in the input WAV file. The issue triggers an out-of-bounds memory access which causes oggenc to crash.

Paris Zoumpouloglou reports:

A crafted WAV file with number of channels set to 0 will cause oggenc to crash due to a division by zero issue.

pengsu reports:

I discovered an buffer overflow issue in oggenc/audio.c when it tries to open invalid aiff file.

ports/202941 https://trac.xiph.org/ticket/2136 CVE-2014-9639 https://trac.xiph.org/ticket/2137 CVE-2014-9638 https://trac.xiph.org/ticket/2212 CVE-2015-6749 2015-08-08 2015-09-09 2015-09-09
pgbouncer -- failed auth_query lookup leads to connection as auth_user pgbouncer 1.6.0

PgBouncer reports:

New auth_user functionality introduced in 1.6 allows login as auth_user when client presents unknown username. It's quite likely auth_user is superuser. Affects only setups that have enabled auth_user in their config.

CVE-2015-6817 https://pgbouncer.github.io/2015/09/pgbouncer-1-6-1/ https://github.com/pgbouncer/pgbouncer/issues/69 http://www.openwall.com/lists/oss-security/2015/09/04/3 2015-09-03 2015-09-09
phpMyAdmin -- reCaptcha bypass phpMyAdmin 4.4.04.4.14.1

The phpMyAdmin development team reports:

This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests.

We consider this vulnerability to be non critical since reCaptcha is an additional opt-in security measure.

https://www.phpmyadmin.net/security/PMASA-2015-4/ CVE-2015-6830 2015-09-08 2015-09-08
php -- multiple vulnerabilities php5 php5-soap php5-xsl 5.4.45 php55 php55-soap php55-xsl 5.5.29 php56 php56-soap php56-xsl 5.6.13

PHP reports:

  • Core:
    • Fixed bug #70172 (Use After Free Vulnerability in unserialize()).
    • Fixed bug #70219 (Use after free vulnerability in session deserializer).
  • EXIF:
    • Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).
  • hash:
    • Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).
  • PCRE:
    • Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
  • SOAP:
    • Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).
  • SPL:
    • Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).
    • Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).
  • XSLT:
    • Fixed bug #69782 (NULL pointer dereference).
  • ZIP:
    • Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).
http://php.net/ChangeLog-5.php#5.4.45 http://php.net/ChangeLog-5.php#5.5.29 http://php.net/ChangeLog-5.php#5.6.13 CVE-2015-6834 CVE-2015-6835 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 2015-09-03 2015-09-08 2015-09-08
ganglia-webfrontend -- auth bypass ganglia-webfrontend 3.7.1

Ivan Novikov reports:

It's easy to bypass auth by using boolean serialization...

https://github.com/ganglia/ganglia-web/issues/267 CVE-2015-6816 2015-09-04 2015-09-08 2015-09-08
wireshark -- multiple vulnerabilities wireshark wireshark-lite wireshark-qt5 tshark tshark-lite 1.12.7

Wireshark development team reports:

The following vulnerabilities have been fixed.

  • wnpa-sec-2015-21

    Protocol tree crash. (Bug 11309)

  • wnpa-sec-2015-22

    Memory manager crash. (Bug 11373)

  • wnpa-sec-2015-23

    Dissector table crash. (Bug 11381)

  • wnpa-sec-2015-24

    ZigBee crash. (Bug 11389)

  • wnpa-sec-2015-25

    GSM RLC/MAC infinite loop. (Bug 11358)

  • wnpa-sec-2015-26

    WaveAgent crash. (Bug 11358)

  • wnpa-sec-2015-27

    OpenFlow infinite loop. (Bug 11358)

  • wnpa-sec-2015-28

    Ptvcursor crash. (Bug 11358)

  • wnpa-sec-2015-29

    WCCP crash. (Bug 11358)

https://www.wireshark.org/docs/relnotes/wireshark-1.12.7.html CVE-2015-6241 CVE-2015-6242 CVE-2015-6243 CVE-2015-6244 CVE-2015-6245 CVE-2015-6246 CVE-2015-6247 CVE-2015-6248 CVE-2015-6249 2015-08-12 2015-09-08 2015-09-08
screen -- stack overflow screen 4.3.1_2

Kuang-che Wu reports:

screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge.

https://savannah.gnu.org/bugs/?45713 CVE-2015-6806 2015-08-07 2015-09-08
libvncserver -- memory corruption libvncserver 0.9.8

Petr Pisar reports:

libvncserver/tight.c:rfbTightCleanup() frees a buffer without zeroing freed pointer.

https://bugzilla.redhat.com/show_bug.cgi?id=706087 https://github.com/LibVNC/libvncserver/commit/804335f9d296440bb708ca844f5d89b58b50b0c6 2011-05-19 2015-09-08
gdk-pixbuf2 -- integer overflows gdk-pixbuf2 2.31.7

Matthias Clasen reports:

Fix several integer overflows.

https://mail.gnome.org/archives/ftp-release-list/2015-September/msg00013.html 2015-09-01 2015-09-04
bind -- denial of service vulnerability bind99 9.9.79.9.7P3 bind910 9.10.2P4 bind910-base bind99-base 0

ISC reports:

An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query.

https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-trigger-a-require-assertion-failure-in-openpgpkey_61-c/ CVE-2015-5986 2015-08-19 2015-09-03
bind -- denial of service vulnerability bind99 9.9.7P3 bind910 9.10.29.10.2P4 bind910-base bind99-base 0 FreeBSD 9.39.3_25

ISC reports:

Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key.

https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bind-to-exit-due-to-a-failed-assertion-in-buffer-c/ CVE-2015-5722 2015-08-19 2015-09-03
chromium -- multiple vulnerabilities chromium 45.0.2454.85 chromium-npapi 45.0.2454.85 chromium-pulse 45.0.2454.85

Google Chrome Releases reports:

29 security fixes in this release, including:

  • [516377] High CVE-2015-1291: Cross-origin bypass in DOM. Credit to anonymous.
  • [522791] High CVE-2015-1292: Cross-origin bypass in ServiceWorker. Credit to Mariusz Mlynski.
  • [524074] High CVE-2015-1293: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.
  • [492263] High CVE-2015-1294: Use-after-free in Skia. Credit to cloudfuzzer.
  • [502562] High CVE-2015-1295: Use-after-free in Printing. Credit to anonymous.
  • [421332] High CVE-2015-1296: Character spoofing in omnibox. Credit to zcorpan.
  • [510802] Medium CVE-2015-1297: Permission scoping error in Webrequest. Credit to Alexander Kashev.
  • [518827] Medium CVE-2015-1298: URL validation error in extensions. Credit to Rob Wu.
  • [416362] Medium CVE-2015-1299: Use-after-free in Blink. Credit to taro.suzuki.dev.
  • [511616] Medium CVE-2015-1300: Information leak in Blink. Credit to cgvwzq.
  • [526825] CVE-2015-1301: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2015-1291 CVE-2015-1292 CVE-2015-1293 CVE-2015-1294 CVE-2015-1295 CVE-2015-1296 CVE-2015-1297 CVE-2015-1298 CVE-2015-1299 CVE-2015-1300 CVE-2015-1301 http://googlechromereleases.blogspot.nl 2015-09-01 2015-09-02
powerdns -- denial of service powerdns 3.4.03.4.6

PowerDNS reports:

A bug was found in our DNS packet parsing/generation code, which, when exploited, can cause individual threads (disabling service) or whole processes (allowing a supervisor to restart them) to crash with just one or a few query packets.

https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/ CVE-2015-5230 2015-09-02 2015-09-02
ghostscript -- denial of service (crash) via crafted Postscript files ghostscript7 ghostscript7-nox11 ghostscript7-base ghostscript7-x11 7.07_32 ghostscript8 ghostscript8-nox11 ghostscript8-base ghostscript8-x11 8.71_19 ghostscript9 ghostscript9-nox11 ghostscript9-base ghostscript9-x11 9.06_11 ghostscript9-agpl ghostscript9-agpl-nox11 9.15_2 ghostscript9-agpl-base ghostscript9-agpl-x11 9.16_2

MITRE reports:

Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.

CVE-2015-3228 http://bugs.ghostscript.com/show_bug.cgi?id=696041 http://bugs.ghostscript.com/show_bug.cgi?id=696070 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859 2015-06-17 2015-09-01 2015-09-02
ffmpeg -- out-of-bounds array access libav 11.011.4 10.7 gstreamer1-libav 1.5.1 handbrake 0 ffmpeg 2.2.0,12.2.15,1 2.0.7,1 ffmpeg26 2.6.2 ffmpeg25 2.5.6 ffmpeg24 2.4.8 ffmpeg23 0 ffmpeg1 0 avidemux avidemux26 2.6.11 kodi 15.1 mplayer mencoder 1.1.r20150403 mythtv mythtv-frontend 0

NVD reports:

The msrle_decode_pal4 function in msrledec.c in Libav before 10.7 and 11.x before 11.4 and FFmpeg before 2.0.7, 2.2.x before 2.2.15, 2.4.x before 2.4.8, 2.5.x before 2.5.6, and 2.6.x before 2.6.2 allows remote attackers to have unspecified impact via a crafted image, related to a pixel pointer, which triggers an out-of-bounds array access.

CVE-2015-3395 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f7e1367f58263593e6cee3c282f7277d7ee9d553 https://git.libav.org/?p=libav.git;a=commit;h=5ecabd3c54b7c802522dc338838c9a4c2dc42948 https://ffmpeg.org/security.html https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 2015-04-12 2015-09-01 2015-09-20
ffmpeg -- use-after-free libav 11.011.4 10.7 gstreamer1-libav 1.5.0 handbrake 0 ffmpeg 2.2.0,12.2.12,1 2.1.0,12.1.7,1 2.0.7,1 ffmpeg25 2.5.2 ffmpeg24 2.4.5 ffmpeg23 2.3.6 ffmpeg1 1.2.11 mythtv mythtv-frontend 0

NVD reports:

Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.

CVE-2015-3417 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e8714f6f93d1a32f4e4655209960afcf4c185214 https://git.libav.org/?p=libav.git;a=commitdiff;h=3b69f245dbe6e2016659a45c4bfe284f6c5ac57e https://ffmpeg.org/security.html https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 2014-12-19 2015-09-01
graphviz -- format string vulnerability graphviz 2.38.0_7

Joshua Rogers reports:

A format string vulnerability has been found in `graphviz'.

http://seclists.org/oss-sec/2014/q4/784 https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081 2014-11-24 2015-08-29
mozilla -- multiple vulnerabilities firefox 40.0.3,1 linux-firefox 40.0.3,1 firefox-esr 38.2.1,1

The Mozilla Project reports:

MFSA 2015-95 Add-on notification bypass through data URLs

MFSA 2015-94 Use-after-free when resizing canvas element during restyling

CVE-2015-4497 CVE-2015-4498 https://www.mozilla.org/security/advisories/mfsa2015-94/ https://www.mozilla.org/security/advisories/mfsa2015-95/ 2015-08-27 2015-08-28
go -- multiple vulnerabilities go 1.4.3,1 go14 1.4.3

Jason Buberel, Go Product Manager, reports:

CVE-2015-5739 - "Content Length" treated as valid header

CVE-2015-5740 - Double content-length headers does not return 400 error

CVE-2015-5741 - Additional hardening, not sending Content-Length w/Transfer-Encoding, Closing connections

CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9 https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f http://seclists.org/oss-sec/2015/q3/237 2015-07-29 2015-08-25
libtremor -- memory corruption libtremor 1.2.0.s20120120

The Mozilla Project reports:

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative the possibility of memory corruption during the decoding of Ogg Vorbis files. This can cause a crash during decoding and has the potential for remote code execution.

CVE-2012-0444 https://bugzilla.mozilla.org/show_bug.cgi?id=719612 https://git.xiph.org/?p=tremor.git;a=commitdiff;h=3daa274 2012-01-31 2015-08-25 2015-08-25
libtremor -- multiple vulnerabilities libtremor 1.2.0.s20101013

The RedHat Project reports:

Will Drewry of the Google Security Team reported multiple issues in OGG Vorbis and Tremor libraries, that could cause application using those libraries to crash (NULL pointer dereference or divide by zero), enter an infinite loop or cause heap overflow caused by integer overflow.

CVE-2008-1418 CVE-2008-1419 CVE-2008-1420 CVE-2008-1423 CVE-2008-2009 http://redpig.dataspill.org/2008/05/multiple-vulnerabilities-in-ogg-tremor.html https://git.xiph.org/?p=tremor.git;a=commitdiff;h=7e94eea https://git.xiph.org/?p=tremor.git;a=commitdiff;h=1d1f93e https://git.xiph.org/?p=tremor.git;a=commitdiff;h=159efc4 2008-03-19 2015-08-25 2015-08-25
pcre -- heap overflow vulnerability pcre 8.37_4

Guanxing Wen reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex(). The Heap Overflow vulnerability is caused by the following regular expression.

/(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/

A dry run of this particular regular expression with pcretest will reports "double free or corruption (!prev)". But it is actually a heap overflow problem. The overflow only affects pcre 8.x branch, pcre2 branch is not affected.

http://seclists.org/oss-sec/2015/q3/295 https://bugs.exim.org/show_bug.cgi?id=1672 2015-08-21 2015-08-24
drupal -- multiple vulnerabilities drupal6 6.37 drupal7 7.39

Drupal development team reports:

This security advisory fixes multiple vulnerabilities. See below for a list.

Cross-site Scripting - Ajax system - Drupal 7

A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax() on a whitelisted HTML element.

This vulnerability is mitigated on sites that do not allow untrusted users to enter HTML.

Cross-site Scripting - Autocomplete system - Drupal 6 and 7

A cross-site scripting vulnerability was found in the autocomplete functionality of forms. The requested URL is not sufficiently sanitized.

This vulnerability is mitigated by the fact that the malicious user must be allowed to upload files.

SQL Injection - Database API - Drupal 7

A vulnerability was found in the SQL comment filtering system which could allow a user with elevated permissions to inject malicious code in SQL comments.

This vulnerability is mitigated by the fact that only one contributed module that the security team found uses the comment filtering system in a way that would trigger the vulnerability. That module requires you to have a very high level of access in order to perform the attack.

Cross-site Request Forgery - Form API - Drupal 6 and 7

A vulnerability was discovered in Drupal's form API that could allow file upload value callbacks to run with untrusted input, due to form token validation not being performed early enough. This vulnerability could allow a malicious user to upload files to the site under another user's account.

This vulnerability is mitigated by the fact that the uploaded files would be temporary, and Drupal normally deletes temporary files automatically after 6 hours.

Information Disclosure in Menu Links - Access system - Drupal 6 and 7

Users without the "access content" permission can see the titles of nodes that they do not have access to, if the nodes are added to a menu on the site that the users have access to.

https://www.drupal.org/SA-CORE-2015-003 2015-08-19 2015-08-22
OpenSSH -- PAM vulnerabilities openssh-portable 7.0p1,1

Fixed a privilege separation weakness related to PAM support. Attackers who could successfully compromise the pre-authentication process for remote code execution and who had valid credentials on the host could impersonate other users.

Fixed a use-after-free bug related to PAM support that was reachable by attackers who could compromise the pre-authentication process for remote code execution.

http://www.openssh.com/txt/release-7.0 2015-08-11 2015-08-21
OpenSSH -- PermitRootLogin may allow password connections with 'without-password' openssh-portable 7.0.p1,1

OpenSSH 7.0 contained a logic error in PermitRootLogin= prohibit-password/without-password that could, depending on compile-time configuration, permit password authentication to root while preventing other forms of authentication. This problem was reported by Mantas Mikulenas.

http://www.openssh.com/txt/release-7.1 2015-08-20 2015-08-21
tarsnap -- buffer overflow and local DoS tarsnap 1.0.36

Colin Percival reports:

1. SECURITY FIX: When constructing paths of objects being archived, a buffer could overflow by one byte upon encountering 1024, 2048, 4096, etc. byte paths. Theoretically this could be exploited by an unprivileged user whose files are being archived; I do not believe it is exploitable in practice, but I am offering a $1000 bounty for the first person who can prove me wrong: http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html

2. SECURITY FIX: An attacker with a machine's write keys, or with read keys and control of the tarsnap service, could make tarsnap allocate a large amount of memory upon listing archives or reading an archive the attacker created; on 32-bit machines, tarsnap can be caused to crash under the aforementioned conditions.

http://mail.tarsnap.com/tarsnap-announce/msg00032.html http://www.daemonology.net/blog/2015-08-21-tarsnap-1000-exploit-bounty.html 2015-08-21 2015-08-21
vlc -- arbitrary pointer dereference vulnerability vlc 2.2.1_5,4

oCERT reports:

The stable VLC version suffers from an arbitrary pointer dereference vulnerability.

The vulnerability affects the 3GP file format parser, insufficient restrictions on a writable buffer can be exploited to execute arbitrary code via the heap memory. A specific 3GP file can be crafted to trigger the vulnerability.

Credit: vulnerability reported by Loren Maggiore of Trail of Bits.

CVE-2015-5949 https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=ce91452460a75d7424b165c4dc8db98114c3cbd9;hp=9e12195d3e4316278af1fa4bcb6a705ff27456fd https://www.ocert.org/advisories/ocert-2015-009.html 2015-08-20 2015-08-20
libpgf -- use-after-free libpgf 6.14.12

Pengsu Cheng reports:

An use-after-free issue in Decoder.cpp was reported to upstream. The problem is due to lack of validation of ColorTableSize.

http://seclists.org/oss-sec/2015/q3/404 https://sourceforge.net/p/libpgf/code/147/ https://sourceforge.net/p/libpgf/code/148/ CVE-2015-6673 2015-08-08 2015-08-20 2015-08-26
gdk-pixbuf2 -- heap overflow and DoS gdk-pixbuf2 2.31.6

Gustavo Grieco reports:

We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of a malformed bmp.

CVE-2015-4491 https://bugzilla.gnome.org/show_bug.cgi?id=752297 2015-07-12 2015-08-19
django -- multiple vulnerabilities py27-django py32-django py33-django py34-django 1.8.4 py27-django17 py32-django17 py33-django17 py34-django17 1.7.10 py27-django14 py32-django14 py33-django14 py34-django14 1.4.22 py27-django-devel py32-django-devel py33-django-devel py34-django-devel 20150709,1

Tim Graham reports:

Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.

Thanks Lin Hua Cheng for reporting the issue.

https://www.djangoproject.com/weblog/2015/aug/18/security-releases/ CVE-2015-5963 CVE-2015-5964 2015-08-18 2015-08-18
unreal -- denial of service Unreal 3.2.103.2.10.5

Unreal reports:

Summary: If SASL support is enabled in UnrealIRCd (this is not the default) and is also enabled in your services package then a malicious user with a services account can cause UnrealIRCd to crash.

https://www.unrealircd.org/txt/unrealsecadvisory.20150816.txt http://seclists.org/oss-sec/2015/q3/367 2015-08-13 2015-08-18
jasper -- multiple vulnerabilities jasper 1.900.1_14

Martin Prpic reports:

A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

Feist Josselin reports:

A new use-after-free was found in Jasper JPEG-200. The use-after-free appears in the function mif_process_cmpt of the src/libjasper/mif/mif_cod.c file.

https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0 http://seclists.org/oss-sec/2015/q3/366 http://seclists.org/oss-sec/2015/q3/408 CVE-2015-5203 CVE-2015-5221 2015-08-17 2015-08-18 2015-08-20
freexl -- integer overflow freexl 1.0.2

Stefan Cornelius reports:

There's an integer overflow in the allocate_cells() function when trying to allocate the memory for worksheet with specially crafted row/column dimensions. This can be exploited to cause a heap memory corruption. The most likely outcome of this is a crash when trying to initialize the cells later in the function.

http://www.openwall.com/lists/oss-security/2015/07/06/7 2015-07-06 2015-08-18
freexl -- multiple vulnerabilities freexl 1.0.1

Jodie Cunningham reports:

#1: A flaw was found in the way FreeXL reads sectors from the input file. A specially crafted file could possibly result in stack corruption near freexl.c:3752.

#2: A flaw was found in the function allocate_cells(). A specially crafted file with invalid workbook dimensions could possibly result in stack corruption near freexl.c:1074

#3: A flaw was found in the way FreeXL handles a premature EOF. A specially crafted input file could possibly result in stack corruption near freexl.c:1131

#4: FreeXL 1.0.0g did not properly check requests for workbook memory allocation. A specially crafted input file could cause a Denial of Service, or possibly write onto the stack.

http://www.openwall.com/lists/oss-security/2015/03/25/1 CVE-2015-2776 2015-03-24 2015-08-18
mod_jk -- information disclosure ap22-mod_jk ap24-mod_jk 1.2.41,1

NIST reports:

Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

https://www.mail-archive.com/users@tomcat.apache.org/msg118949.html http://readlist.com/lists/tomcat.apache.org/users/27/135512.html http://www.cvedetails.com/cve/CVE-2014-8111/ CVE-2014-8111 2015-01-15 2015-08-17
qemu, xen-tools -- QEMU leak of uninitialized heap memory in rtl8139 device model qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno qemu-user-static 2.4.50.g20150814 xen-tools 4.5.1

The Xen Project reports:

The QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation. This results in uninitialised memory from the QEMU process's heap being leaked to the domain as well as to the network.

A guest may be able to read sensitive host-level data relating to itself which resides in the QEMU process.

Such information may include things such as information relating to real devices backing emulated devices or passwords which the host administrator does not intend to share with the guest admin.

CVE-2015-5165 http://xenbits.xen.org/xsa/advisory-140.html http://git.qemu.org/?p=qemu.git;a=commit;h=2a3612ccc1fa9cea77bd193afbfe21c77e7e91ef 2015-08-03 2015-08-17 2015-08-19
qemu, xen-tools -- use-after-free in QEMU/Xen block unplug protocol qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno qemu-user-static 2.4.50.g20150814 xen-tools 4.5.1

The Xen Project reports:

When unplugging an emulated block device the device was not fully unplugged, meaning a second unplug attempt would attempt to unplug the device a second time using a previously freed pointer.

An HVM guest which has access to an emulated IDE disk device may be able to exploit this vulnerability in order to take over the qemu process elevating its privilege to that of the qemu process.

CVE-2015-5166 http://xenbits.xen.org/xsa/advisory-139.html http://git.qemu.org/?p=qemu.git;a=commit;h=260425ab405ea76c44dd59744d05176d4f579a52 2015-08-03 2015-08-17 2015-08-19
php5 -- multiple vulnerabilities php5 php5-openssl php5-phar php5-soap 5.4.44 php55 php55-openssl php55-phar php55-soap 5.5.28 php56 php56-openssl php56-phar php56-soap 5.6.12

The PHP project reports:

Core:

  • Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls).
  • Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref).

OpenSSL:

  • Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure).

Phar:

  • Improved fix for bug #69441.
  • Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory).

SOAP:

  • Fixed bug #70081 (SoapClient info leak / null pointer dereference via multiple type confusions).

SPL:

  • Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items).
  • Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject).
  • Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage).
  • Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList).
http://php.net/ChangeLog-5.php#5.4.44 http://php.net/ChangeLog-5.php#5.5.28 http://php.net/ChangeLog-5.php#5.6.12 CVE-2015-6831 CVE-2015-6832 CVE-2015-6833 2015-08-06 2015-08-17 2015-09-08
mediawiki -- multiple vulnerabilities mediawiki123 1.23.10 mediawiki124 1.24.3 mediawiki125 1.25.2

MediaWiki reports:

Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList.

Internal review discovered that watchlist anti-csrf tokens were not being compared in constant time, which could allow various timing attacks. This could allow an attacker to modify a user's watchlist via csrf

John Menerick reported that MediaWiki's thumb.php failed to sanitize various error messages, resulting in xss.

https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html https://phabricator.wikimedia.org/T106893 https://phabricator.wikimedia.org/T94116 https://phabricator.wikimedia.org/T97391 2015-08-10 2015-08-14
freeradius3 -- insufficient validation on packets freeradius3 3.0.8

Jouni Malinen reports:

The EAP-PWD module performed insufficient validation on packets received from an EAP peer. This module is not enabled in the default configuration. Administrators must manually enable it for their server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected.

http://freeradius.org/security.html#eap-pwd-2015 2015-04-04 2015-08-14
gnutls -- double free in certificate DN decoding gnutls 3.3.17

gnutls.org reports:

Kurt Roeckx reported that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free, which may result to a denial of service. Since the DN decoding occurs in almost all applications using certificates it is recommended to upgrade the latest GnuTLS version fixing the issue. Recommendation: Upgrade to GnuTLS 3.4.4, or 3.3.17.

http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 http://seclists.org/oss-sec/2015/q3/308 https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12 CVE-2015-6251 2015-07-20 2015-08-14 2015-08-18
gnutls -- MD5 downgrade in TLS signatures gnutls 3.3.15

Karthikeyan Bhargavan reports:

GnuTLS does not by default support MD5 signatures. Indeed the RSA-MD5 signature-hash algorithm needs to be explicitly enabled using the priority option VERIFY_ALLOW_SIGN_RSA_MD5. In the NORMAL and SECURE profiles, GnuTLS clients do not offer RSA-MD5 in the signature algorithms extension. However, we find that all GnuTLS clients still accept RSA-MD5 in the ServerKeyExchange and GnuTLS servers still accept RSA-MD5 in the ClientCertificateVerify.

http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8132 http://www.gnutls.org/security.html#GNUTLS-SA-2015-2 http://seclists.org/oss-sec/2015/q2/367 2015-04-25 2015-08-14
froxlor -- database password information leak froxlor 0.9.33.2

oss-security-list@demlak.de reports:

An unauthenticated remote attacker is able to get the database password via webaccess due to wrong file permissions of the /logs/ folder in froxlor version 0.9.33.1 and earlier. The plain SQL password and username may be stored in the /logs/sql-error.log file. This directory is publicly reachable under the default configuration/setup.

Note that froxlor 0.9.33.2 prevents future logging of passwords but does not retroactively remove passwords already logged. Michael Kaufmann, the Froxlor lead developer reports:

Removing all .log files from the directory should do the job, alternatively just use the class.ConfigIO.php from Github

CVE-2015-5959 ports/202262 http://seclists.org/oss-sec/2015/q3/238 https://forum.froxlor.org/index.php/topic/13054-important-bugfix-release-09332/ 2015-07-29 2015-08-13
RT -- two XSS vulnerabilities rt42 4.2.04.2.12 rt40 4.0.04.0.24

Best Practical reports:

RT 4.0.0 and above are vulnerable to a cross-site scripting (XSS) attack via the user and group rights management pages. This vulnerability is assigned CVE-2015-5475. It was discovered and reported by Marcin Kopec at Data Reliance Shared Service Center.

RT 4.2.0 and above are vulnerable to a cross-site scripting (XSS) attack via the cryptography interface. This vulnerability could allow an attacker with a carefully-crafted key to inject JavaScript into RT's user interface. Installations which use neither GnuPG nor S/MIME are unaffected.

CVE-2015-5475 CVE-2015-6506 http://blog.bestpractical.com/2015/08/security-vulnerabilities-in-rt.html 2015-08-12 2015-08-12 2015-08-18
py-foolscap -- local file inclusion py27-foolscap py32-foolscap py33-foolscap py34-foolscap 0.7.0

Brian Warner reports:

The "flappserver" feature was found to have a vulnerability in the service-lookup code which, when combined with an attacker who has the ability to write files to a location where the flappserver process could read them, would allow that attacker to obtain control of the flappserver process.

https://github.com/warner/foolscap/blob/a17218e18e01c05a9655863cd507b80561692c14/NEWS http://foolscap.lothar.com/trac/ticket/226 2014-09-23 2015-08-12
libvpx -- out-of-bounds write libvpx 1.4.0 firefox 33.0,1 firefox-esr 31.1.2,1 linux-firefox 33.0,1 linux-seamonkey 2.30 linux-thunderbird 31.1.2 seamonkey 2.30 thunderbird 31.1.2 libxul 31.1.2

The Mozilla Project reports:

Using the Address Sanitizer tool, security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team found an out-of-bounds write when buffering WebM format video containing frames with invalid tile sizes. This can lead to a potentially exploitable crash during WebM video playback.

CVE-2014-1578 https://www.mozilla.org/security/advisories/mfsa2014-77/ https://hg.mozilla.org/releases/mozilla-esr31/rev/6023f0b4f8ba 2014-10-14 2015-08-12
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin linux-c6_64-flashplugin 11.2r202.508 linux-f10-flashplugin 11.2r202.508

Adobe reports:

Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-5128, CVE-2015-5554, CVE-2015-5555, CVE-2015-5558, CVE-2015-5562).

These updates include further hardening to a mitigation introduced in version 18.0.0.209 to defend against vector length corruptions (CVE-2015-5125).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-5550, CVE-2015-5551, CVE-2015-3107, CVE-2015-5556, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5557, CVE-2015-5559, CVE-2015-5127, CVE-2015-5563, CVE-2015-5561, CVE-2015-5124, CVE-2015-5564).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-5129, CVE-2015-5541).

These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2015-5131, CVE-2015-5132, CVE-2015-5133).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, CVE-2015-5553).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-5560).

CVE-2015-3107 CVE-2015-5124 CVE-2015-5125 CVE-2015-5127 CVE-2015-5128 CVE-2015-5129 CVE-2015-5130 CVE-2015-5131 CVE-2015-5132 CVE-2015-5133 CVE-2015-5134 CVE-2015-5539 CVE-2015-5540 CVE-2015-5541 CVE-2015-5544 CVE-2015-5545 CVE-2015-5546 CVE-2015-5547 CVE-2015-5548 CVE-2015-5549 CVE-2015-5550 CVE-2015-5551 CVE-2015-5552 CVE-2015-5553 CVE-2015-5554 CVE-2015-5555 CVE-2015-5556 CVE-2015-5557 CVE-2015-5558 CVE-2015-5559 CVE-2015-5560 CVE-2015-5561 CVE-2015-5562 CVE-2015-5563 CVE-2015-5564 https://helpx.adobe.com/security/products/flash-player/apsb15-19.html 2015-08-11 2015-08-12
libvpx -- multiple buffer overflows libvpx 1.4.0.488 firefox 40.0,1 linux-firefox 40.0,1

The Mozilla Project reports:

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes.

CVE-2015-4485 CVE-2015-4486 https://www.mozilla.org/security/advisories/mfsa2015-89/ 2015-08-11 2015-08-11 2015-08-14
mozilla -- multiple vulnerabilities firefox 40.0,1 linux-firefox 40.0,1 seamonkey 2.362.37 2.35 linux-seamonkey 2.362.37 2.35 firefox-esr 38.2.0,1 libxul 38.2.0 thunderbird 38.2.0 linux-thunderbird 38.2.0

The Mozilla Project reports:

MFSA 2015-79 Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)

MFSA 2015-80 Out-of-bounds read with malformed MP3 file

MFSA 2015-81 Use-after-free in MediaStream playback

MFSA 2015-82 Redefinition of non-configurable JavaScript object properties

MFSA 2015-83 Overflow issues in libstagefright

MFSA 2015-84 Arbitrary file overwriting through Mozilla Maintenance Service with hard links

MFSA 2015-85 Out-of-bounds write with Updater and malicious MAR file

MFSA 2015-86 Feed protocol with POST bypasses mixed content protections

MFSA 2015-87 Crash when using shared memory in JavaScript

MFSA 2015-88 Heap overflow in gdk-pixbuf when scaling bitmap images

MFSA 2015-90 Vulnerabilities found through code inspection

MFSA 2015-91 Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification

MFSA 2015-92 Use-after-free in XMLHttpRequest with shared workers

CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4477 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4481 CVE-2015-4482 CVE-2015-4483 CVE-2015-4484 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4490 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 https://www.mozilla.org/security/advisories/mfsa2015-79/ https://www.mozilla.org/security/advisories/mfsa2015-80/ https://www.mozilla.org/security/advisories/mfsa2015-81/ https://www.mozilla.org/security/advisories/mfsa2015-82/ https://www.mozilla.org/security/advisories/mfsa2015-83/ https://www.mozilla.org/security/advisories/mfsa2015-84/ https://www.mozilla.org/security/advisories/mfsa2015-85/ https://www.mozilla.org/security/advisories/mfsa2015-86/ https://www.mozilla.org/security/advisories/mfsa2015-87/ https://www.mozilla.org/security/advisories/mfsa2015-88/ https://www.mozilla.org/security/advisories/mfsa2015-90/ https://www.mozilla.org/security/advisories/mfsa2015-91/ https://www.mozilla.org/security/advisories/mfsa2015-92/ 2015-08-11 2015-08-11 2015-08-22
lighttpd -- Log injection vulnerability in mod_auth lighttpd 1.4.36

MITRE reports:

mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.

CVE-2015-3200 http://redmine.lighttpd.net/issues/2646 2015-05-25 2015-08-10
pcre -- heap overflow vulnerability in '(?|' situations pcre 8.37_2

Venustech ADLAB reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex. Exploits with advanced Heap Fengshui techniques may allow an attacker to execute arbitrary code in the context of the user running the affected application.

Latest version of PCRE is prone to a Heap Overflow vulnerability which could caused by the following regular expression.

/(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/

ports/202209 https://bugs.exim.org/show_bug.cgi?id=1667 2015-08-05 2015-08-10
mozilla -- multiple vulnerabilities firefox 39.0.3,1 linux-firefox 39.0.3,1 firefox-esr 38.1.1,1

The Mozilla Project reports:

MFSA 2015-78 Same origin violation and local file stealing via PDF reader

CVE-2015-4495 https://www.mozilla.org/security/advisories/mfsa2015-78/ 2015-08-06 2015-08-07
wordpress -- Multiple vulnerability wordpress 4.2.4,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.2.4

Gary Pendergast reports:

WordPress 4.2.4 fixes three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise a site.

https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/ CVE-2015-2213 CVE-2015-5730 CVE-2015-5731 CVE-2015-5732 CVE-2015-5733 CVE-2015-5734 2015-08-04 2015-08-06 2015-09-15
subversion -- multiple vulnerabilities subversion 1.8.01.8.14 1.7.01.7.21

Subversion reports:

CVE-2015-3184:
Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.

CVE-2015-3187:
Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.

CVE-2015-3184 http://subversion.apache.org/security/CVE-2015-3184-advisory.txt CVE-2015-3187 http://subversion.apache.org/security/CVE-2015-3187-advisory.txt 2015-07-27 2015-08-06
elasticsearch -- directory traversal attack via snapshot API elasticsearch 1.0.01.6.1

Elastic reports:

Vulnerability Summary: Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack.

Remediation Summary: Users should upgrade to 1.6.1 or later, or constrain access to the snapshot API to trusted sources.

CVE-2015-5531 ports/201834 https://www.elastic.co/community/security 2015-07-16 2015-08-05
elasticsearch -- remote code execution via transport protocol elasticsearch 1.6.1

Elastic reports:

Vulnerability Summary: Elasticsearch versions prior to 1.6.1 are vulnerable to an attack that can result in remote code execution.

Remediation Summary: Users should upgrade to 1.6.1 or 1.7.0. Alternately, ensure that only trusted applications have access to the transport protocol port.

CVE-2015-5377 ports/201834 https://www.elastic.co/community/security 2015-07-16 2015-08-05
qemu, xen-tools -- QEMU heap overflow flaw with certain ATAPI commands qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno qemu-user-static 2.4.50.g20150814 xen-tools 4.5.0_9

The Xen Project reports:

A heap overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands.

A privileged guest user in a guest with CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.

CVE-2015-5154 http://xenbits.xen.org/xsa/advisory-138.html http://git.qemu.org/?p=qemu.git;a=commit;h=e40db4c6d391419c0039fe274c74df32a6ca1a28 2015-07-27 2015-08-04 2015-08-19
net-snmp -- snmptrapd crash net-snmp 5.7.05.7.2.1 5.6.05.6.2.1 5.5.05.5.2.1 5.4.05.4.4

Murray McAllister reports:

A remote denial-of-service flaw was found in the way snmptrapd handled certain SNMP traps when started with the "-OQ" option. If an attacker sent an SNMP trap containing a variable with a NULL type where an integer variable type was expected, it would cause snmptrapd to crash.

http://seclists.org/oss-sec/2014/q3/473 http://sourceforge.net/p/net-snmp/code/ci/7f4a7b891332899cea26e95be0337aae01648742/ https://sourceforge.net/p/net-snmp/official-patches/48/ CVE-2014-3565 2014-07-31 2015-07-31
net-snmp -- snmp_pdu_parse() function incomplete initialization net-snmp 5.7.3_7

Qinghao Tang reports:

Incompletely initialized vulnerability exists in the function ‘snmp_pdu_parse()’ of ‘snmp_api.c', and remote attackers can cause memory leak, DOS and possible command executions by sending malicious packets.

http://seclists.org/oss-sec/2015/q2/116 http://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/ https://bugzilla.redhat.com/show_bug.cgi?id=1212408 CVE-2015-5621 2015-04-11 2015-07-31
bind -- denial of service vulnerability bind910 9.10.2P3 bind99 9.9.7P2 bind910-base bind99-base 0 FreeBSD 9.39.3_20 8.48.4_34

ISC reports:

An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit.

CVE-2015-5477 https://kb.isc.org/article/AA-01272/ 2015-07-21 2015-07-28
OpenSSH -- MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices openssh-portable 6.9.p1_2,1

It was discovered that the OpenSSH sshd daemon did not check the list of keyboard-interactive authentication methods for duplicates. A remote attacker could use this flaw to bypass the MaxAuthTries limit, making it easier to perform password guessing attacks.

https://access.redhat.com/security/cve/CVE-2015-5600 CVE-2015-5600 2015-07-21 2015-07-27
logstash -- SSL/TLS vulnerability with Lumberjack input logstash 1.4.4 1.5.01.5.3

Elastic reports:

Vulnerability Summary: All Logstash versions prior to 1.5.2 that use Lumberjack input (in combination with Logstash Forwarder agent) are vulnerable to a SSL/TLS security issue called the FREAK attack. This allows an attacker to intercept communication and access secure data. Users should upgrade to 1.5.3 or 1.4.4.

Remediation Summary: Users that do not want to upgrade can address the vulnerability by disabling the Lumberjack input.

CVE-2015-5378 https://www.elastic.co/community/security 2015-07-22 2015-07-27
chromium -- multiple vulnerabilities chromium 44.0.2403.89 chromium-npapi 44.0.2403.89 chromium-pulse 44.0.2403.89

Google Chrome Releases reports:

43 security fixes in this release, including:

  • [446032] High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer.
  • [459215] High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft.
  • [461858] High CVE-2015-1274: Settings allowed executable files to run immediately after download. Credit to andrewm.bpi.
  • [462843] High CVE-2015-1275: UXSS in Chrome for Android. Credit to WangTao(neobyte) of Baidu X-Team.
  • [472614] High CVE-2015-1276: Use-after-free in IndexedDB. Credit to Collin Payne.
  • [483981] High CVE-2015-1279: Heap-buffer-overflow in pdfium. Credit to mlafon.
  • [486947] High CVE-2015-1280: Memory corruption in skia. Credit to cloudfuzzer.
  • [487155] High CVE-2015-1281: CSP bypass. Credit to Masato Kinugawa.
  • [487928] High CVE-2015-1282: Use-after-free in pdfium. Credit to Chamal de Silva.
  • [492052] High CVE-2015-1283: Heap-buffer-overflow in expat. Credit to sidhpurwala.huzaifa.
  • [493243] High CVE-2015-1284: Use-after-free in blink. Credit to Atte Kettunen of OUSPG.
  • [504011] High CVE-2015-1286: UXSS in blink. Credit to anonymous.
  • [505374] High CVE-2015-1290: Memory corruption in V8. Credit to Yongjun Liu of NSFOCUS Security Team.
  • [419383] Medium CVE-2015-1287: SOP bypass with CSS. Credit to filedescriptor.
  • [444573] Medium CVE-2015-1270: Uninitialized memory read in ICU. Credit to Atte Kettunen of OUSPG.
  • [451456] Medium CVE-2015-1272: Use-after-free related to unexpected GPU process termination. Credit to Chamal de Silva.
  • [479743] Medium CVE-2015-1277: Use-after-free in accessibility. Credit to SkyLined.
  • [482380] Medium CVE-2015-1278: URL spoofing using pdf files. Credit to Chamal de Silva.
  • [498982] Medium CVE-2015-1285: Information leak in XSS auditor. Credit to gazheyes.
  • [479162] Low CVE-2015-1288: Spell checking dictionaries fetched over HTTP. Credit to mike@michaelruddy.com.
  • [512110] CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273 CVE-2015-1274 CVE-2015-1275 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278 CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282 CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286 CVE-2015-1287 CVE-2015-1288 CVE-2015-1289 CVE-2015-1290 http://googlechromereleases.blogspot.nl/ 2015-07-21 2015-07-25
shibboleth-sp -- DoS vulnerability xmltooling 1.5.5 opensaml2 2.5.5 shibboleth-sp 2.5.5

Shibboleth consortium reports:

Shibboleth SP software crashes on well-formed but invalid XML.

The Service Provider software contains a code path with an uncaught exception that can be triggered by an unauthenticated attacker by supplying well-formed but schema-invalid XML in the form of SAML metadata or SAML protocol messages. The result is a crash and so causes a denial of service.

You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later. The easiest way to do so is to update the whole chain including shibboleth-2.5.5 an opensaml2.5.5.

http://shibboleth.net/community/advisories/secadv_20150721.txt CVE-2015-2684 2015-07-21 2015-07-23
wordpress -- XSS vulnerability wordpress 4.2.3,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.2.3

Gary Pendergast reports:

WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site. This was reported by Jon Cave and fixed by Robert Chapin, both of the WordPress security team.

https://wordpress.org/news/2015/07/wordpress-4-2-3/ CVE-2015-5622 CVE-2015-5623 2015-07-23 2015-07-23 2015-09-15
libidn -- out-of-bounds read issue with invalid UTF-8 input libidn 1.31

Simon Josefsson reports:

stringprep_utf8_to_ucs4 now rejects invalid UTF-8. This function has always been documented to not validate that the input UTF-8 string is actually valid UTF-8...

CVE-2015-2059 http://git.savannah.gnu.org/cgit/libidn.git/plain/NEWS?id=libidn-1-31 2015-02-09 2015-07-23 2015-08-03
sox -- memory corruption vulnerabilities sox 14.4.2

Michele Spagnuolo, Google Security Team, reports:

The write heap buffer overflows are related to ADPCM handling in WAV files, while the read heap buffer overflow is while opening a .VOC.

http://seclists.org/oss-sec/2015/q3/167 2015-07-22 2015-07-23
sox -- input sanitization errors sox 14.4.2

oCERT reports:

The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions start_read() and AdpcmReadBlock().

A specially crafted wav file can be used to trigger the vulnerabilities.

71774 CVE-2014-8145 http://www.ocert.org/advisories/ocert-2014-010.html 2014-11-20 2015-07-23
gdk-pixbuf2 -- heap overflow and DoS affecting Firefox and other programs gdk-pixbuf2 2.31.2_2

gustavo.grieco@imag.fr reports:

We found a heap overflow and a DoS in the gdk-pixbuf implementation triggered by the scaling of a malformed bmp.

https://bugzilla.gnome.org/show_bug.cgi?id=752297 2015-07-12 2015-07-22
pcre -- Heap Overflow Vulnerability in find_fixedlength() pcre 8.37_1

Venustech ADLAB reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During subpattern calculation of a malformed regular expression, an offset that is used as an array index is fully controlled and can be large enough so that unexpected heap memory regions are accessed.

One could at least exploit this issue to read objects nearby of the affected application's memory.

Such information disclosure may also be used to bypass memory protection method such as ASLR.

CVE-2015-5073 https://bugs.exim.org/show_bug.cgi?id=1651 http://vcs.pcre.org/pcre?view=revision&revision=1571 http://www.openwall.com/lists/oss-security/2015/06/26/1 2015-06-23 2015-06-29
cacti -- Multiple XSS and SQL injection vulnerabilities cacti 0.8.8e

The Cacti Group, Inc. reports:

Important Security Fixes

  • Multiple XSS and SQL injection vulnerabilities
  • CVE-2015-4634 - SQL injection in graphs.php

Changelog

  • bug: Fixed various SQL Injection vectors
  • bug#0002574: SQL Injection Vulnerabilities in graph items and graph template items
  • bug#0002577: CVE-2015-4634 - SQL injection in graphs.php
  • bug#0002579: SQL Injection Vulnerabilities in data sources
  • bug#0002580: SQL Injection in cdef.php
  • bug#0002582: SQL Injection in data_templates.php
  • bug#0002583: SQL Injection in graph_templates.php
  • bug#0002584: SQL Injection in host_templates.php
CVE-2015-4634 ports/201702 http://www.cacti.net/release_notes_0_8_8e.php http://seclists.org/oss-sec/2015/q3/150 2015-07-12 2015-07-20
php-phar -- multiple vulnerabilities php55-phar 5.5.27 php5-phar 5.4.43

reports:

Segfault in Phar::convertToData on invalid file.

Buffer overflow and stack smashing error in phar_fix_filepath.

http://seclists.org/oss-sec/2015/q3/141 https://bugs.php.net/bug.php?id=69958 http://git.php.net/?p=php-src.git;a=commit;h=bf58162ddf970f63502837f366930e44d6a992cf https://bugs.php.net/bug.php?id=69923 http://git.php.net/?p=php-src.git;a=commit;h=6dedeb40db13971af45276f80b5375030aa7e76f CVE-2015-5589 CVE-2015-5590 2015-06-24 2015-07-18
moodle -- multiple vulnerabilities moodle27 2.7.9 moodle28 2.8.7 moodle29 2.9.1

Marina Glancy reports:

MSA-15-0026: Possible phishing when redirecting to external site using referer header. (CVE-2015-3272)

MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not respected when using 'Post a copy to all groups' in forum (CVE-2015-3273)

MSA-15-0028: Possible XSS through custom text profile fields in Web Services (CVE-2015-3274)

MSA-15-0029: Javascript injection in SCORM module (CVE-2015-3275)

CVE-2015-3272 CVE-2015-3273 CVE-2015-3274 CVE-2015-3275 http://seclists.org/oss-sec/2015/q3/94 https://docs.moodle.org/dev/Moodle_2.7.9_release_notes https://docs.moodle.org/dev/Moodle_2.8.7_release_notes https://docs.moodle.org/dev/Moodle_2.9.1_release_notes 2015-07-06 2015-07-18 2015-07-19
apache22 -- chunk header parsing defect apache22 apache22-event-mpm apache22-itk-mpm apache22-peruser-mpm apache22-worker-mpm 2.2.29_5

Apache Foundation reports:

CVE-2015-3183 core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters.

http://www.apache.org/dist/httpd/Announcement2.2.html https://github.com/apache/httpd/commit/29779fd08c18b18efc5e640d74cbe297c7ec007e CVE-2015-3183 2015-06-24 2015-07-17
zenphoto -- multiple vulnerabilities zenphoto 1.4.9

zenphoto reports:

Fixes several SQL Injection, XSS and path traversal security issues

http://www.zenphoto.org/news/zenphoto-1.4.9 http://seclists.org/oss-sec/2015/q3/123 https://github.com/zenphoto/zenphoto/pull/935 CVE-2015-5591 CVE-2015-5592 CVE-2015-5593 CVE-2015-5594 CVE-2015-5595 2015-05-24 2015-07-16 2015-07-18
groovy -- remote execution of untrusted code groovy 1.7.02.4.4

Cédric Champeau reports:

Description

When an application has Groovy on the classpath and that it uses standard Java serialization mechanim to communicate between servers, or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.

http://seclists.org/oss-sec/2015/q3/121 http://groovy-lang.org/security.html https://issues.apache.org/jira/browse/GROOVY-7504 CVE-2015-3253 2015-07-09 2015-07-16
libav -- divide by zero libav 11.3_2

Agostino Sarubbo reports:

libav: divide-by-zero in ff_h263_decode_mba()

https://blogs.gentoo.org/ago/2015/07/16/libav-divide-by-zero-in-ff_h263_decode_mba/ https://git.libav.org/?p=libav.git;a=commitdiff;h=0a49a62f998747cfa564d98d36a459fe70d3299b;hp=6f4cd33efb5a9ec75db1677d5f7846c60337129f CVE-2015-5479 2015-06-21 2015-07-16
mozilla -- multiple vulnerabilities firefox 39.0,1 linux-firefox 39.0,1 seamonkey 2.35 linux-seamonkey 2.35 firefox-esr 31.8.0,1 38.0,138.1.0,1 libxul 31.8.0 38.038.1.0 thunderbird 31.8.0 38.038.1.0 linux-thunderbird 31.8.0 38.038.1.0

The Mozilla Project reports:

MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)

MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs

MFSA 2015-61 Type confusion in Indexed Database Manager

MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio

MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error

MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly

MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest

MFSA 2015-66 Vulnerabilities found through code inspection

MFSA 2015-67 Key pinning is ignored when overridable errors are encountered

MFSA 2015-68 OS X crash reports may contain entered key press information

MFSA 2015-69 Privilege escalation through internal workers

MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange

CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2727 CVE-2015-2728 CVE-2015-2729 CVE-2015-2730 CVE-2015-2731 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2741 CVE-2015-2742 CVE-2015-2743 CVE-2015-4000 https://www.mozilla.org/security/advisories/mfsa2015-59/ https://www.mozilla.org/security/advisories/mfsa2015-60/ https://www.mozilla.org/security/advisories/mfsa2015-61/ https://www.mozilla.org/security/advisories/mfsa2015-62/ https://www.mozilla.org/security/advisories/mfsa2015-63/ https://www.mozilla.org/security/advisories/mfsa2015-64/ https://www.mozilla.org/security/advisories/mfsa2015-65/ https://www.mozilla.org/security/advisories/mfsa2015-66/ https://www.mozilla.org/security/advisories/mfsa2015-67/ https://www.mozilla.org/security/advisories/mfsa2015-68/ https://www.mozilla.org/security/advisories/mfsa2015-69/ https://www.mozilla.org/security/advisories/mfsa2015-70/ https://www.mozilla.org/security/advisories/mfsa2015-71/ 2015-07-02 2015-07-16 2015-09-22
PolarSSL -- Security Fix Backports polarssl 1.2.14

Paul Bakker reports:

PolarSSL 1.2.14 fixes one remotely-triggerable issues that was found by the Codenomicon Defensics tool, one potential remote crash and countermeasures against the "Lucky 13 strikes back" cache-based attack.

https://tls.mbed.org/tech-updates/releases/polarssl-1.2.14-released 2015-06-26 2015-07-15
libwmf -- multiple vulnerabilities libwmf 0.2.8.4_14

Mitre reports:

Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function, a different set of vulnerabilities than CVE-2004-0990.

Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact.

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.

Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.

meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.

Use-after-free vulnerability in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) via a crafted WMF file to the (1) wmf2gd or (2) wmf2eps command.

Heap-based buffer overflow in the DecodeImage function in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted "run-length count" in an image in a WMF file.

11663 22289 24089 24651 36712 ports/201513 CVE-2004-0941 CVE-2007-0455 CVE-2007-2756 CVE-2007-3472 CVE-2007-3473 CVE-2007-3477 CVE-2009-3546 CVE-2015-0848 CVE-2015-4695 CVE-2015-4696 CVE-2015-4588 2004-10-12 2015-07-15
apache24 -- multiple vulnerabilities apache24 2.4.16

Jim Jagielski reports:

CVE-2015-3183 (cve.mitre.org) core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters.

CVE-2015-3185 (cve.mitre.org) Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook.

CVE-2015-0253 (cve.mitre.org) core: Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in 2.4.11. PR 57531.

CVE-2015-0228 (cve.mitre.org) mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash.

https://mail-archives.apache.org/mod_mbox/www-announce/201507.mbox/%3CAA5C882C-A9C3-46B9-9320-5040A2152E83@apache.org%3E CVE-2015-3183 CVE-2015-3185 CVE-2015-0253 CVE-2015-0228 2015-02-04 2015-07-15
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.491 linux-f10-flashplugin 11.2r202.491

Adobe reports:

Critical vulnerabilities (CVE-2015-5122, CVE-2015-5123) have been identified. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of reports that exploits targeting these vulnerabilities have been published publicly.

CVE-2015-5122 CVE-2015-5123 https://helpx.adobe.com/security/products/flash-player/apsb15-18.html 2015-07-10 2015-07-14 2015-07-16
php -- use-after-free vulnerability php56-sqlite3 5.6.11 php55-sqlite3 5.5.27 php5-sqlite3 5.4.43

Symeon Paraschoudis reports:

Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()

https://bugs.php.net/bug.php?id=69972 2015-06-30 2015-07-13
php -- use-after-free vulnerability php56 5.6.11 php55 5.5.27 php5 5.4.43

Symeon Paraschoudis reports:

Use-after-free vulnerability in spl_recursive_it_move_forward_ex()

https://bugs.php.net/bug.php?id=69970 2015-06-30 2015-07-13
php -- arbitrary code execution php56 5.6.11 php55 5.5.27 php5 5.4.43

cmb reports:

When delayed variable substitution is enabled (can be set in the Registry, for instance), !ENV! works similar to %ENV%, and the value of the environment variable ENV will be subsituted.

https://bugs.php.net/bug.php?id=69768 2015-06-07 2015-07-13
mysql -- SSL Downgrade php56-mysql php56-mysqli 5.6.11 php55-mysql php55-mysqli 5.5.27 php5-mysql php5-mysqli 5.4.43 mariadb55-client 5.5.44 mariadb100-client 10.0.20

Duo Security reports:

Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently.

https://bugs.php.net/bug.php?id=69669 https://www.duosecurity.com/blog/backronym-mysql-vulnerability http://www.ocert.org/advisories/ocert-2015-003.html https://mariadb.atlassian.net/browse/MDEV-7937 https://mariadb.com/kb/en/mariadb/mariadb-10020-changelog/ https://mariadb.com/kb/en/mariadb/mariadb-5544-changelog/ CVE-2015-3152 2015-03-20 2015-07-13 2015-07-18
devel/ipython -- CSRF possible remote execution vulnerability ipython 0.123.2.1

Kyle Kelley reports:

Summary: POST requests exposed via the IPython REST API are vulnerable to cross-site request forgery (CSRF). Web pages on different domains can make non-AJAX POST requests to known IPython URLs, and IPython will honor them. The user's browser will automatically send IPython cookies along with the requests. The response is blocked by the Same-Origin Policy, but the request isn't.

API paths with issues:

  • POST /api/contents/<path>/<file>
  • POST /api/contents/<path>/<file>/checkpoints
  • POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id>
  • POST /api/kernels
  • POST /api/kernels/<kernel_id>/<action>
  • POST /api/sessions
  • POST /api/clusters/<cluster_id>/<action>
CVE-2015-5607 http://seclists.org/oss-sec/2015/q3/92 http://ipython.org/ipython-doc/3/whatsnew/version3.html#ipython-3-2-1 2015-07-12 2015-07-13 2015-07-22
freeradius -- insufficent CRL application vulnerability freeradius2 2.2.8 freeradius3 3.0.9

oCERT reports:

The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates.

An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS.

Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the complete trust chain.

The FreeRADIUS project advises that the recommended configuration is to use self-signed CAs for all EAP-TLS methods.

CVE-2015-4680 ports/201058 ports/201059 http://www.ocert.org/advisories/ocert-2015-008.html http://freeradius.org/security.html 2015-06-22 2015-07-13
xen-tools -- xl command line config handling stack overflow xen-tools 4.14.5.0_8

The Xen Project reports:

The xl command line utility mishandles long configuration values when passed as command line arguments, with a buffer overrun.

A semi-trusted guest administrator or controller, who is intended to be able to partially control the configuration settings for a domain, can escalate their privileges to that of the whole host.

CVE-2015-3259 http://xenbits.xen.org/xsa/advisory-137.html 2015-07-07 2015-07-11
xen-kernel -- vulnerability in the iret hypercall handler xen-kernel 3.14.5.0_3

The Xen Project reports:

A buggy loop in Xen's compat_iret() function iterates the wrong way around a 32-bit index. Any 32-bit PV guest kernel can trigger this vulnerability by attempting a hypercall_iret with EFLAGS.VM set.

Given the use of __get/put_user(), and that the virtual addresses in question are contained within the lower canonical half, the guest cannot clobber any hypervisor data. Instead, Xen will take up to 2^33 pagefaults, in sequence, effectively hanging the host.

Malicious guest administrators can cause a denial of service affecting the whole system.

CVE-2015-4164 http://xenbits.xen.org/xsa/advisory-136.html 2015-06-11 2015-07-11
xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior xen-kernel 4.24.5.0_3

The Xen Project reports:

With the introduction of version 2 grant table operations, a version check became necessary for most grant table related hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a check. As a result, the subsequent code behaved as if version 2 was in use, when a guest issued this hypercall without a prior GNTTABOP_setup_table or GNTTABOP_set_version.

The effect is a possible NULL pointer dereferences. However, this cannot be exploited to elevate privileges of the attacking domain, as the maximum memory address that can be wrongly accessed this way is bounded to far below the start of hypervisor memory.

Malicious or buggy guest domain kernels can mount a denial of service attack which, if successful, can affect the whole system.

CVE-2015-4163 http://xenbits.xen.org/xsa/advisory-134.html 2015-06-11 2015-07-11
xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo xen-kernel 4.04.5.0_3

The Xen Project reports:

The handler for XEN_DOMCTL_gettscinfo failed to initialize a padding field subsequently copied to guest memory.

A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is being addressed here regardless of that operation being declared unsafe for disaggregation by XSA-77.

Malicious or buggy stub domain kernels or tool stacks otherwise living outside of Domain0 may be able to read sensitive data relating to the hypervisor or other guests not under the control of that domain.

CVE-2015-3340 http://xenbits.xen.org/xsa/advisory-132.html 2015-04-20 2015-07-11
xen-tools -- Unmediated PCI register access in qemu xen-tools 3.34.5.0_6

The Xen Project reports:

Qemu allows guests to not only read, but also write all parts of the PCI config space (but not extended config space) of passed through PCI devices not explicitly dealt with for (partial) emulation purposes.

Since the effect depends on the specific purpose of the the config space field, it's not possbile to give a general statement about the exact impact on the host or other guests. Privilege escalation, host crash (Denial of Service), and leaked information all cannot be excluded.

CVE-2015-4106 http://xenbits.xen.org/xsa/advisory-131.html 2015-06-02 2015-07-11
xen-tools -- Guest triggerable qemu MSI-X pass-through error messages xen-tools 3.34.5.0_6

The Xen Project reports:

Device model code dealing with guest PCI MSI-X interrupt management activities logs messages on certain (supposedly) invalid guest operations.

A buggy or malicious guest repeatedly invoking such operations may result in the host disk to fill up, possibly leading to a Denial of Service.

CVE-2015-4105 http://xenbits.xen.org/xsa/advisory-130.html 2015-06-02 2015-07-11
xen-tools -- PCI MSI mask bits inadvertently exposed to guests xen-tools 3.34.5.0_6

The Xen Project reports:

The mask bits optionally available in the PCI MSI capability structure are used by the hypervisor to occasionally suppress interrupt delivery. Unprivileged guests were, however, nevertheless allowed direct control of these bits.

Interrupts may be observed by Xen at unexpected times, which may lead to a host crash and therefore a Denial of Service.

CVE-2015-4104 http://xenbits.xen.org/xsa/advisory-129.html 2015-06-02 2015-07-11
xen-tools -- Potential unintended writes to host MSI message data field via qemu xen-tools 3.34.5.0_6

The Xen Project reports:

Logic is in place to avoid writes to certain host config space fields when the guest must nevertheless be able to access their virtual counterparts. A bug in how this logic deals with accesses spanning multiple fields allows the guest to write to the host MSI message data field.

While generally the writes write back the values previously read, their value in config space may have got changed by the host between the qemu read and write. In such a case host side interrupt handling could become confused, possibly losing interrupts or allowing spurious interrupt injection into other guests.

Certain untrusted guest administrators may be able to confuse host side interrupt handling, leading to a Denial of Service.

CVE-2015-4103 http://xenbits.xen.org/xsa/advisory-128.html 2015-06-02 2015-07-11
xen-kernel -- Certain domctl operations may be abused to lock up the host xen-kernel 4.34.5.0_3

The Xen Project reports:

XSA-77 put the majority of the domctl operations on a list excepting them from having security advisories issued for them if any effects their use might have could hamper security. Subsequently some of them got declared disaggregation safe, but for a small subset this was not really correct: Their (mis-)use may result in host lockups.

As a result, the potential security benefits of toolstack disaggregation are not always fully realised.

Domains deliberately given partial management control may be able to deny service to the entire host.

As a result, in a system designed to enhance security by radically disaggregating the management, the security may be reduced. But, the security will be no worse than a non-disaggregated design.

CVE-2015-2751 http://xenbits.xen.org/xsa/advisory-127.html 2015-03-31 2015-07-11
xen-tools -- Unmediated PCI command register access in qemu xen-tools 3.34.5.0_6

The Xen Project reports:

HVM guests are currently permitted to modify the memory and I/O decode bits in the PCI command register of devices passed through to them. Unless the device is an SR-IOV virtual function, after disabling one or both of these bits subsequent accesses to the MMIO or I/O port ranges would - on PCI Express devices - lead to Unsupported Request responses. The treatment of such errors is platform specific.

Furthermore (at least) devices under control of the Linux pciback driver in the host are handed to guests with the aforementioned bits turned off. This means that such accesses can similarly lead to Unsupported Request responses until these flags are set as needed by the guest.

In the event that the platform surfaces aforementioned UR responses as Non-Maskable Interrupts, and either the OS is configured to treat NMIs as fatal or (e.g. via ACPI's APEI) the platform tells the OS to treat these errors as fatal, the host would crash, leading to a Denial of Service.

CVE-2015-2756 http://xenbits.xen.org/xsa/advisory-126.html 2015-03-31 2015-07-11
xen-kernel and xen-tools -- Long latency MMIO mapping operations are not preemptible xen-kernel 4.5.0_3 xen-tools 4.5.0_6

The Xen Project reports:

The XEN_DOMCTL_memory_mapping hypercall allows long running operations without implementing preemption.

This hypercall is used by the device model as part of the emulation associated with configuration of PCI devices passed through to HVM guests and is therefore indirectly exposed to those guests.

This can cause a physical CPU to become busy for a significant period, leading to a host denial of service in some cases.

If a host denial of service is not triggered then it may instead be possible to deny service to the domain running the device model, e.g. domain 0.

This hypercall is also exposed more generally to all toolstacks. However the uses of it in libxl based toolstacks are not believed to open up any avenue of attack from an untrusted guest. Other toolstacks may be vulnerable however.

The vulnerability is exposed via HVM guests which have a PCI device assigned to them. A malicious HVM guest in such a configuration can mount a denial of service attack affecting the whole system via its associated device model (qemu-dm).

A guest is able to trigger this hypercall via operations which it is legitimately expected to perform, therefore running the device model as a stub domain does not offer protection against the host denial of service issue. However it does offer some protection against secondary issues such as denial of service against dom0.

CVE-2015-2752 http://xenbits.xen.org/xsa/advisory-125.html 2015-03-31 2015-07-11
xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw xen-kernel 4.5.0_3

The Xen Project reports:

Instructions with register operands ignore eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override can, however, corrupt a pointer used subsequently to store the result of the instruction.

A malicious guest might be able to read sensitive data relating to other guests, or to cause denial of service on the host. Arbitrary code execution, and therefore privilege escalation, cannot be excluded.

CVE-2015-2151 http://xenbits.xen.org/xsa/advisory-123.html 2015-03-10 2015-07-11
xen-kernel -- Information leak through version information hypercall xen-kernel 4.5.0_3

The Xen Project reports:

The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall fails to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.

A malicious guest might be able to read sensitive data relating to other guests.

CVE-2015-2045 http://xenbits.xen.org/xsa/advisory-122.html 2015-03-05 2015-07-11
xen-kernel -- Information leak via internal x86 system device emulation xen-kernel 4.5.0_3

The Xen Project reports:

Emulation routines in the hypervisor dealing with certain system devices check whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.

A malicious HVM guest might be able to read sensitive data relating to other guests.

CVE-2015-2044 http://xenbits.xen.org/xsa/advisory-121.html 2015-03-05 2015-07-11
xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends xen-tools 4.5.0_6

The Xen Project reports:

When instantiating an emulated VGA device for an x86 HVM guest qemu will by default enable a backend to expose that device, either SDL or VNC depending on the version of qemu and the build time configuration.

The libxl toolstack library does not explicitly disable these default backends when they are not enabled, leading to an unexpected backend running.

If either SDL or VNC is explicitly enabled in the guest configuration then only the expected backends will be enabled.

This affects qemu-xen and qemu-xen-traditional differently.

If qemu-xen was compiled with SDL support then this would result in an SDL window being opened if $DISPLAY is valid, or a failure to start the guest if not.

If qemu-xen was compiled without SDL support then qemu would instead start a VNC server listening on ::1 (IPv6 localhost) or 127.0.0.1 (IPv4 localhost) with IPv6 preferred if available. A VNC password will not be configured even if one is present in the guest configuration.

qemu-xen-traditional will never start a vnc backend unless explicitly configured. However by default it will start an SDL backend if it was built with SDL support and $DISPLAY is valid.

CVE-2015-2152 http://xenbits.xen.org/xsa/advisory-119.html 2015-03-13 2015-07-11
xen-kernel -- arm: vgic: incorrect rate limiting of guest triggered logging xen-kernel 4.44.5.0_3

The Xen Project reports:

On ARM systems the code which deals with virtualising the GIC distributor would, under various circumstances, log messages on a guest accessible code path without appropriate rate limiting.

A malicious guest could cause repeated logging to the hypervisor console, leading to a Denial of Service attack.

CVE-2015-1563 http://xenbits.xen.org/xsa/advisory-118.html 2015-01-29 2015-07-11
xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated xen-kernel 4.54.5.0_3

The Xen Project reports:

When decoding a guest write to a specific register in the virtual interrupt controller Xen would treat an invalid value as a critical error and crash the host.

By writing an invalid value to the GICD.SGIR register a guest can crash the host, resulting in a Denial of Service attack.

CVE-2015-0268 http://xenbits.xen.org/xsa/advisory-117.html 2015-02-12 2015-07-11
pivotx -- Multiple unrestricted file upload vulnerabilities pivotx 2.3.9

Pivotx reports:

Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

CVE-2014-0341 2014-04-15 2015-07-11
pivotx -- cross-site scripting (XSS) vulnerability pivotx 2.3.9

pivotx reports:

cross-site scripting (XSS) vulnerability in the nickname (and possibly the email) field. Mitigated by the fact that an attacker must have a PivotX account.

CVE-2014-0341 2014-04-15 2015-07-11
wpa_supplicant -- WPS_NFC option payload length validation vulnerability wpa_supplicant 2.4_4

Jouni Malinen reports:

Incomplete WPS and P2P NFC NDEF record payload length validation. (2015-5)

http://w1.fi/security/2015-5/incomplete-wps-and-p2p-nfc-ndef-record-payload-length-validation.txt 2015-07-08 2015-07-09
openssl -- alternate chains certificate forgery vulnerability openssl 1.0.2_21.0.2_4 mingw32-openssl 1.0.2b1.0.2d

OpenSSL reports:

During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate.

CVE-2015-1793 https://www.openssl.org/news/secadv_20150709.txt 2015-07-09 2015-07-09
django -- multiple vulnerabilities py27-django 1.4.01.4.21 py32-django 1.4.01.4.21 py33-django 1.4.01.4.21 py34-django 1.4.01.4.21 py27-django 1.7.01.7.9 py32-django 1.7.01.7.9 py33-django 1.7.01.7.9 py34-django 1.7.01.7.9 py27-django 1.8.01.8.3 py32-django 1.8.01.8.3 py33-django 1.8.01.8.3 py34-django 1.8.01.8.3 py27-django-devel 20150531,1 py32-django-devel 20150531,1 py33-django-devel 20150531,1 py34-django-devel 20150531,1

Tim Graham reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.

https://www.djangoproject.com/weblog/2015/jul/08/security-releases/ https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680 https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44 https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e CVE-2015-5143 CVE-2015-5144 CVE-2015-5145 2015-06-10 2015-07-09
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.481 linux-f10-flashplugin 11.2r202.481

Adobe reports:

Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit targeting CVE-2015-5119 has been publicly published.

https://helpx.adobe.com/security/products/flash-player/apsb15-16.html CVE-2015-5119 2015-07-07 2015-07-08
bind -- denial of service vulnerability bind910 9.10.2P2 bind99 9.9.7P1 bind910-base bind99-base 0 FreeBSD 9.39.3_19 8.48.4_33

ISC reports:

A very uncommon combination of zone data has been found that triggers a bug in BIND, with the result that named will exit with a "REQUIRE" failure in name.c when validating the data returned in answer to a recursive query.

A recursive resolver that is performing DNSSEC validation can be deliberately terminated by any attacker who can cause a query to be performed against a maliciously constructed zone. This will result in a denial of service to clients who rely on that resolver.

CVE-2015-4620 https://kb.isc.org/article/AA-01267/ 2015-07-07 2015-07-07 2015-07-07
haproxy -- information leak vulnerability haproxy 1.5.01.5.14

HAProxy reports:

A vulnerability was found when HTTP pipelining is used. In some cases, a client might be able to cause a buffer alignment issue and retrieve uninitialized memory contents that exhibit data from a past request or session. I want to address sincere congratulations to Charlie Smurthwaite of aTech Media for the really detailed traces he provided which made it possible to find the cause of this bug. Every user of 1.5-dev, 1.5.x or 1.6-dev must upgrade to 1.5.14 or latest 1.6-dev snapshot to fix this issue, or use the backport of the fix provided by their operating system vendors. CVE-2015-3281 was assigned to this bug.

http://www.haproxy.org/news.html http://git.haproxy.org/?p=haproxy-1.5.git;a=commit;h=7ec765568883b2d4e5a2796adbeb492a22ec9bd4 http://seclists.org/oss-sec/2015/q3/61 CVE-2015-3281 2015-07-02 2015-07-07
roundcube -- multiple vulnerabilities roundcube 1.1.0,11.1.2,1 1.0.6,1

Roundcube reports:

We just published updates to both stable versions 1.0 and 1.1 after fixing many minor bugs and adding some security improvements to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from the more recent version to ensure proper long term support especially in regards of security and compatibility.

The security-related fixes in particular are:

* XSS vulnerability in _mbox argument
* security improvement in contact photo handling
* potential info disclosure from temp directory

CVE-2015-5381 CVE-2015-5383 http://openwall.com/lists/oss-security/2015/07/06/10 https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/ 2015-05-30 2015-07-07
turnserver -- SQL injection vulnerability turnserver 4.4.5.3

Oleg Moskalenko reports:

SQL injection security hole fixed.

http://turnserver.open-sys.org/downloads/v4.4.5.3/ChangeLog https://groups.google.com/d/msg/turn-server-project-rfc5766-turn-server/Dj3MmgyZX1o/ZaFo3zvxIw0J 2015-06-20 2015-07-02
squid -- Improper Protection of Alternate Path with CONNECT requests squid 3.5.6

Squid security advisory 2015:2 reports:

Squid configured with cache_peer and operating on explicit proxy traffic does not correctly handle CONNECT method peer responses.

The bug is important because it allows remote clients to bypass security in an explicit gateway proxy.

However, the bug is exploitable only if you have configured cache_peer to receive CONNECT requests.

http://www.squid-cache.org/Advisories/SQUID-2015_2.txt CVE-2015-5400 2015-07-06 2015-07-06 2015-07-17
squid -- client-first SSL-bump does not correctly validate X509 server certificate squid 3.53.5.4 3.43.4.13 squid33 3.33.3.14 squid32 3.23.2.14

Squid security advisory 2015:1 reports:

Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields.

The bug is important because it allows remote servers to bypass client certificate validation. Some attackers may also be able to use valid certificates for one domain signed by a global Certificate Authority to abuse an unrelated domain.

However, the bug is exploitable only if you have configured Squid to perform SSL Bumping with the "client-first" or "bump" mode of operation.

Sites that do not use SSL-Bump are not vulnerable.

All Squid built without SSL support are not vulnerable to the problem.

The FreeBSD port does not use SSL by default and is not vulnerable in the default configuration.

CVE-2015-3455 http://www.squid-cache.org/Advisories/SQUID-2015_1.txt 2015-05-01 2015-07-06
ansible -- multiple vulnerabilities ansible 1.9.2

Ansible, Inc. reports:

Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2

Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2

CVE-2015-3908 CVE-2015-6240 http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/v1.9.2-1/CHANGELOG.md 2015-06-25 2015-07-02 2015-08-18
ansible -- multiple vulnerabilities ansible 1.7

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or local data when using a legacy Ansible syntax - resolved in Ansible 1.7

ansible-galaxy command when used on local tarballs (and not galaxy.ansible.com) can install a malformed tarball if so provided - resolved in Ansible 1.7

http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md 2014-08-06 2015-07-02
ansible -- code execution from compromised remote host data or untrusted local data ansible 1.6.7

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or untrusted local data - resolved in Ansible 1.6.7

CVE-2014-4966 68794 http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md 2014-07-21 2015-07-02
ansible -- remote code execution vulnerability ansible 1.6.4

Ansible, Inc. reports:

Incomplete Fix Remote Code Execution Vulnerability - Fixed in Ansible 1.6.4

CVE-2014-4678 68335 http://www.ansible.com/security https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md 2014-06-25 2015-07-02
ansible -- local symlink exploits ansible 1.2.3

MITRE reports:

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.

CVE-2013-4259 CVE-2013-4260 http://www.ansible.com/security https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg 2013-08-21 2015-07-02
ansible -- enable host key checking in paramiko connection type ansible 1.2.1

Ansible changelog reports:

Host key checking is on by default. Disable it if you like by adding host_key_checking=False in the [default] section of /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting ANSIBLE_HOST_KEY_CHECKING=False.

CVE-2013-2233 https://raw.githubusercontent.com/ansible/ansible/devel/CHANGELOG.md http://www.ansible.com/security https://github.com/ansible/ansible/issues/857 2012-08-13 2015-07-02
bitcoin -- denial of service bitcoin 0.10.2

Gregory Maxwell reports:

On July 7th I will be making public details of several serious denial of service vulnerabilities which have fixed in recent versions of Bitcoin Core, including including CVE-2015-3641. I strongly recommend anyone running production nodes exposed to inbound connections from the internet upgrade to 0.10.2 as soon as possible.

CVE-2015-3641 http://bitcoin-development.narkive.com/tO8M0R0j/upcoming-dos-vulnerability-announcements-for-bitcoin-core https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures 2015-06-27 2015-07-06
node, iojs, and v8 -- denial of service node 0.12.6 node-devel 0.12.6 iojs 2.3.3 v8 3.18.5 v8-devel 3.27.7_2

node reports:

This release of Node.js fixes a bug that triggers an out-of-band write in V8's utf-8 decoder. This bug impacts all Buffer to String conversions. This is an important security update as this bug can be used to cause a denial of service attack.

http://blog.nodejs.org/2015/07/03/node-v0-12-6-stable/ https://github.com/joyent/node/commit/78b0e30954111cfaba0edbeee85450d8cbc6fdf6 https://github.com/nodejs/io.js/commit/030f8045c706a8c3925ec7cb3184fdfae4ba8676 https://codereview.chromium.org/1226493003 CVE-2015-5380 2015-07-03 2015-07-06 2015-07-10
cups-filters -- texttopdf integer overflow cups-filters 1.0.71

Stefan Cornelius from Red Hat reports:

An integer overflow flaw leading to a heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filter processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code with the privileges of the 'lp' user.

Tim Waugh reports:

The Page allocation is moved into textcommon.c, where it does all the necessary checking: lower-bounds for CVE-2015-3258 and upper-bounds for CVE-2015-3259 due to integer overflows for the calloc() call initialising Page[0] and the memset() call in texttopdf.c's WritePage() function zeroing the entire array.

CVE-2015-3279 https://access.redhat.com/security/cve/CVE-2015-3279 http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365 http://osdir.com/ml/opensource-software-security/2015-07/msg00021.html 2015-07-03 2015-07-03 2015-07-07
libxml2 -- Enforce the reader to run in constant memory libxml2 2.9.2_3 linux-c6-libxml2 * linux-f10-libxml2 *

Daniel Veilland reports:

Enforce the reader to run in constant memory. One of the operation on the reader could resolve entities leading to the classic expansion issue. Make sure the buffer used for xmlreader operation is bounded. Introduce a new allocation type for the buffers for this effect.

CVE-2015-1819 https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9 2015-04-14 2015-07-01 2015-07-15
wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension wesnoth 1.12.4,1

Ignacio R. Morelle reports:

As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release announcements, a security vulnerability targeting add-on authors was found (bug #23504) which allowed a malicious user to obtain add-on server passphrases from the client's .pbl files and transmit them over the network, or store them in saved game files intended to be shared by the victim. This vulnerability affects all existing releases up to and including versions 1.12.2 and 1.13.0. Additionally, version 1.12.3 included only a partial fix that failed to guard users against attempts to read from .pbl files with an uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070 have been assigned to the vulnerability affecting .pbl files with a lowercase extension, and .pbl files with an uppercase or mixed-case extension, respectively.

CVE-2015-5069 CVE-2015-5070 http://forums.wesnoth.org/viewtopic.php?t=42776 http://forums.wesnoth.org/viewtopic.php?t=42775 2015-06-28 2015-07-01
cups-filters -- buffer overflow in texttopdf size allocation cups-filters 1.0.70

Stefan Cornelius from Red Hat reports:

A heap-based buffer overflow was discovered in the way the texttopdf utility of cups-filters processed print jobs with a specially crafted line size. An attacker being able to submit print jobs could exploit this flaw to crash texttopdf or, possibly, execute arbitrary code.

Till Kamppeter reports:

texttopdf: Fixed buffer overflow on size allocation of texttopdf when working with extremely small line sizes, which causes the size calculation to result in 0 (CVE-2015-3258, thanks to Stefan Cornelius from Red Hat for the patch).

CVE-2015-3258 http://www.openwall.com/lists/oss-security/2015/06/26/4 http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363 2015-06-26 2015-06-29
ntp -- control message remote Deinal of Service vulnerability ntp 4.2.8p3 ntp-devel 4.3.25

ntp.org reports:

Under limited and specific circumstances an attacker can send a crafted packet to cause a vulnerable ntpd instance to crash. This requires each of the following to be true:

  • ntpd set up to allow for remote configuration (not allowed by default), and
  • knowledge of the configuration password, and
  • access to a computer entrusted to perform remote configuration.
http://bugs.ntp.org/show_bug.cgi?id=2853 https://www.kb.cert.org/vuls/id/668167 http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi 2015-06-29 2015-06-30
qemu -- Heap overflow in QEMU PCNET controller, allowing guest to host escape (CVE-2015-3209) qemu qemu-devel 0.11.1_20 0.122.3.0_2 qemu-sbruno 2.3.50.g20150618_1 xen-tools 4.5.0_6

The QEMU security team reports:

A guest which has access to an emulated PCNET network device (e.g. with "model=pcnet" in their VIF configuration) can exploit this vulnerability to take over the qemu process elevating its privilege to that of the qemu process.

http://xenbits.xen.org/xsa/advisory-135.html CVE-2015-3209 2015-04-10 2015-06-26 2015-07-11
elasticsearch -- security fix for shared file-system repositories elasticsearch 1.0.01.6.0

Elastic reports:

Vulnerability Summary: All Elasticsearch versions from 1.0.0 to 1.5.2 are vulnerable to an attack that uses Elasticsearch to modify files read and executed by certain other applications.

Remediation Summary: Users should upgrade to 1.6.0. Alternately, ensure that other applications are not present on the system, or that Elasticsearch cannot write into areas where these applications would read.

CVE-2015-4165 ports/201008 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-6-0-released 2015-06-09 2015-06-26
elasticsearch -- directory traversal attack with site plugins elasticsearch 1.4.5 1.5.01.5.2

Elastic reports:

Vulnerability Summary: All Elasticsearch versions prior to 1.5.2 and 1.4.5 are vulnerable to a directory traversal attack that allows an attacker to retrieve files from the server running Elasticsearch when one or more site plugins are installed, or when Windows is the server OS.

Remediation Summary: Users should upgrade to 1.4.5 or 1.5.2. Users that do not want to upgrade can address the vulnerability by disabling site plugins. See the CVE description for additional options.

CVE-2015-3337 74353 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-5-2-and-1-4-5-released https://www.exploit-db.com/exploits/37054/ https://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html http://www.securityfocus.com/archive/1/535385 2015-04-27 2015-06-26
elasticsearch -- remote OS command execution via Groovy scripting engine elasticsearch 1.3.01.3.8 1.4.01.4.3

Elastic reports:

Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that were introduced in 1.3.0. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM.

Remediation Summary: Users should upgrade to 1.3.8 or 1.4.3. Users that do not want to upgrade can address the vulnerability by setting script.groovy.sandbox.enabled to false in elasticsearch.yml and restarting the node.

CVE-2015-1427 72585 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-4-3-and-1-3-8-released http://www.securityfocus.com/archive/1/archive/1/534689/100/0/threaded https://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html https://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html 2015-02-11 2015-06-26
elasticsearch -- cross site scripting vulnerability in the CORS functionality elasticsearch 1.4.0

Elastic reports:

Vulnerability Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user's browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or compromise.

Remediation Summary: Users should either set "http.cors.enabled" to false, or set "http.cors.allow-origin" to the value of the server that should be allowed access, such as localhost or a server hosting Kibana. Disabling CORS entirely with the former setting is more secure, but may not be suitable for all use cases.

CVE-2014-6439 70233 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-4-0-beta-released https://packetstormsecurity.com/files/128556/Elasticsearch-1.3.x-CORS-Issue.html http://www.securityfocus.com/archive/1/archive/1/533602/100/0/threaded 2014-10-01 2015-06-26
elasticsearch and logstash -- remote OS command execution via dynamic scripting elasticsearch 1.2.0 logstash 1.4.3

Elastic reports:

Vulnerability Summary: In Elasticsearch versions 1.1.x and prior, dynamic scripting is enabled by default. This could allow an attacker to execute OS commands.

Remediation Summary: Disable dynamic scripting.

Logstash 1.4.2 was bundled with Elasticsearch 1.1.1, which is vulnerable to CVE-2014-3120. These binaries are used in Elasticsearch output specifically when using the node protocol. Since a node client joins the Elasticsearch cluster, the attackers could use scripts to execute commands on the host OS using the node client's URL endpoint. With 1.4.3 release, we are packaging Logstash with Elasticsearch 1.5.2 binaries which by default disables the ability to run scripts. This also affects users who are using the configuration option embedded=>true in the Elasticsearch output which starts a local embedded Elasticsearch cluster. This is typically used in development environment and proof of concept deployments. Regardless of this vulnerability, we strongly recommend not using embedded in production.

Note that users of transport and http protocol are not vulnerable to this attack.

CVE-2014-3120 67731 https://www.elastic.co/community/security https://www.elastic.co/blog/elasticsearch-1-2-0-released https://www.elastic.co/blog/logstash-1-4-3-released https://www.exploit-db.com/exploits/33370/ http://bouk.co/blog/elasticsearch-rce/ http://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch 2014-05-22 2015-06-26
logstash -- Directory traversal vulnerability in the file output plugin logstash 1.4.3

Elastic reports:

An attacker could use the File output plugin with dynamic field references in the path option to traverse paths outside of Logstash directory. This technique could also be used to overwrite any files which can be accessed with permissions associated with Logstash user. This release sandboxes the paths which can be traversed using the configuration. We have also disallowed use of dynamic field references if the path options is pointing to an absolute path.

We have added this vulnerability to our CVE page and are working on filling out the CVE. We would like to thank Colin Coghill for reporting the issue and working with us on the resolution.

CVE-2015-4152 https://www.elastic.co/blog/logstash-1-4-3-released https://www.elastic.co/community/security 2015-06-09 2015-06-24
logstash -- Remote command execution in Logstash zabbix and nagios_nsca outputs logstash 1.4.2

Elastic reports:

The vulnerability impacts deployments that use the either the zabbix or the nagios_nsca outputs. In these cases, an attacker with an ability to send crafted events to any source of data for Logstash could execute operating system commands with the permissions of the Logstash process.

Deployments that do not use the zabbix or the nagios_nsca outputs are not vulnerable and do not need to upgrade for this reason.

We have added this vulnerability to our CVE page and are working on filling out the CVE.

We would like to thank Jan Karwowski and Danila Borisiuk for reporting the issue and working with us on the resolution.

CVE-2014-4326 https://www.elastic.co/blog/logstash-1-4-2 https://www.elastic.co/community/security 2014-06-24 2015-06-24
logstash-forwarder and logstash -- susceptibility to POODLE vulnerability logstash-forwarder 0.4.0.20150507 logstash 1.4.3

Elastic reports:

The combination of Logstash Forwarder and Lumberjack input (and output) was vulnerable to the POODLE attack in SSLv3 protocol. We have disabled SSLv3 for this combination and set the minimum version to be TLSv1.0. We have added this vulnerability to our CVE page and are working on filling out the CVE.

Thanks to Tray Torrance, Marc Chadwick, and David Arena for reporting this.

SSLv3 is no longer supported; TLS 1.0+ is required (compatible with Logstash 1.4.2+).

ports/201065 ports/201065 https://www.elastic.co/blog/logstash-1-4-3-released https://www.elastic.co/blog/logstash-forwarder-0-4-0-released 2015-06-09 2015-06-24 2015-06-24
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.466 linux-f10-flashplugin 11.2r202.466

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address a critical vulnerability (CVE-2015-3113) that could potentially allow an attacker to take control of the affected system.

Adobe is aware of reports that CVE-2015-3113 is being actively exploited in the wild via limited, targeted attacks. Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets.

https://helpx.adobe.com/security/products/flash-player/apsb15-14.html CVE-2015-3113 2015-06-23 2015-06-24
rubygem-bson -- DoS and possible injection rubygem-bson 3.0.4

Phill MV reports:

By submitting a specially crafted string to a service relying on the bson rubygem, an attacker may trigger denials of service or even inject data into victim's MongoDB instances.

CVE-2015-4412 http://www.openwall.com/lists/oss-security/2015/06/06/1 http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999 2015-06-04 2015-06-23
php5 -- multiple vulnerabilities php5-dom php5-ftp php5-gd php5-pgsql 5.4.42 php55-dom php55-ftp php55-gd php55-pgsql 5.5.26 php56-dom php56-ftp php56-gd php56-psql 5.6.10

The PHP project reports:

DOM and GD:

  • Fixed bug #69719 (Incorrect handling of paths with NULs).

FTP:

  • Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643)

Postgres:

  • Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644)
CVE-2015-4643 CVE-2015-4644 http://www.php.net/ChangeLog-5.php#5.4.42 http://www.php.net/ChangeLog-5.php#5.5.26 http://www.php.net/ChangeLog-5.php#5.6.10 http://openwall.com/lists/oss-security/2015/06/18/3 2015-06-11 2015-06-23
devel/ipython -- remote execution ipython 3.2.0

Kyle Kelley reports:

Summary: JSON error responses from the IPython notebook REST API contained URL parameters and were incorrectly reported as text/html instead of application/json. The error messages included some of these URL params, resulting in a cross site scripting attack. This affects users on Mozilla Firefox but not Chromium/Google Chrome.

API paths with issues:

  • /api/contents (3.0-3.1)
  • /api/notebooks (2.0-2.4, 3.0-3.1)
CVE-2015-4706 CVE-2015-4707 http://seclists.org/oss-sec/2015/q2/779 2015-06-22 2015-06-22
www/chromium -- mulitple vulnerabilities chromium 43.0.2357.130 chromium-npapi 43.0.2357.130 chromium-pulse 43.0.2357.130

Google Chrome Releases reports:

4 security fixes in this release:

  • [464922] High CVE-2015-1266: Scheme validation error in WebUI. Credit to anonymous.
  • [494640] High CVE-2015-1268: Cross-origin bypass in Blink. Credit to Mariusz Mlynski.
  • [497507] Medium CVE-2015-1267: Cross-origin bypass in Blink. Credit to anonymous.
  • [461481] Medium CVE-2015-1269: Normalization error in HSTS/HPKP preload list. Credit to Mike Ruddy.
CVE-2015-1266 CVE-2015-1267 CVE-2015-1268 CVE-2015-1269 http://googlechromereleases.blogspot.nl/2015/06/chrome-stable-update.html 2015-06-22 2015-06-22
rubygem-paperclip -- validation bypass vulnerabilitiy rubygem-paperclip 4.2.2

Jon Yurek reports:

Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.

There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being `image/jpeg`, this will bypass a validation checking for images. But it will also pass the spoof check, because a file named .html and containing actual HTML passes the spoof check.

This change makes it so that we also check the supplied content type. So even if the file contains HTML and ends with .html, it doesn't match the content type of `image/jpeg` and so it fails.

CVE-2015-2963 https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57 https://robots.thoughtbot.com/paperclip-security-release http://jvn.jp/en/jp/JVN83881261/index.html 2015-06-05 2015-06-22
chicken -- Potential buffer overrun in string-translate* chicken 4.10.0.r2,1

chicken developer Peter Bex reports:

Using gcc's Address Sanitizer, it was discovered that the string-translate* procedure from the data-structures unit can scan beyond the input string's length up to the length of the source strings in the map that's passed to string-translate*. This issue was fixed in master 8a46020, and it will make its way into CHICKEN 4.10.

This bug is present in all released versions of CHICKEN.

CVE-2015-4556 ports/200980 http://lists.nongnu.org/archive/html/chicken-announce/2015-06/msg00010.html http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html http://lists.nongnu.org/archive/html/chicken-announce/2015-07/msg00001.html 2015-06-15 2015-06-22 2015-07-31
chicken -- buffer overrun in substring-index[-ci] chicken 4.10.0.r1,1

chicken developer Moritz Heidkamp reports:

The substring-index[-ci] procedures of the data-structures unit are vulnerable to a buffer overrun attack when passed an integer greater than zero as the optional START argument.

As a work-around you can switch to SRFI 13's string-contains procedure which also returns the substring's index in case it is found.

CVE-2014-9651 http://lists.gnu.org/archive/html/chicken-users/2015-01/msg00048.html http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt 2015-01-12 2015-06-22 2015-06-23
cacti -- Multiple XSS and SQL injection vulerabilities cacti 0.8.8d

The Cacti Group, Inc. reports:

Important Security Fixes

  • Multiple XSS and SQL injection vulerabilities

Changelog

  • bug: Fixed SQL injection VN: JVN#78187936 / TN:JPCERT#98968540
  • bug#0002542: [FG-VD-15-017] Cacti Cross-Site Scripting Vulnerability Notification
  • bug#0002571: SQL Injection and Location header injection from cdef id CVE-2015-4342
  • bug#0002572: SQL injection in graph template
CVE-2015-4342 ports/200963 http://www.cacti.net/release_notes_0_8_8d.php http://seclists.org/fulldisclosure/2015/Jun/19 2015-06-09 2015-06-21
cacti -- multiple security vulnerabilities cacti 0.8.8c

The Cacti Group, Inc. reports:

Important Security Fixes

  • CVE-2013-5588 - XSS issue via installer or device editing
  • CVE-2013-5589 - SQL injection vulnerability in device editing
  • CVE-2014-2326 - XSS issue via CDEF editing
  • CVE-2014-2327 - Cross-site request forgery (CSRF) vulnerability
  • CVE-2014-2328 - Remote Command Execution Vulnerability in graph export
  • CVE-2014-4002 - XSS issues in multiple files
  • CVE-2014-5025 - XSS issue via data source editing
  • CVE-2014-5026 - XSS issues in multiple files
CVE-2013-5588 CVE-2013-5589 CVE-2014-2326 CVE-2014-2327 CVE-2014-2328 CVE-2014-4002 CVE-2014-5025 CVE-2014-5026 ports/198586 http://sourceforge.net/p/cacti/mailman/message/33072838/ http://www.cacti.net/release_notes_0_8_8c.php 2014-11-23 2015-06-21
p5-Dancer -- possible to abuse session cookie values p5-Dancer 1.3138

Russell Jenkins reports:

It was possible to abuse session cookie values so that file-based session stores such as Dancer::Session::YAML or Dancer2::Session::YAML would attempt to read/write from any file on the filesystem with the same extension the file-based store uses, such as '*.yml' for the YAML stores.

http://lists.preshweb.co.uk/pipermail/dancer-users/2015-June/004621.html 2015-06-12 2015-06-20
drupal -- multiple vulnerabilities drupal6 6.36 drupal7 7.38

Drupal development team reports:

Impersonation (OpenID module - Drupal 6 and 7 - Critical)

A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts.

This vulnerability is mitigated by the fact that the victim must have an account with an associated OpenID identity from a particular set of OpenID providers (including, but not limited to, Verisign, LiveJournal, or StackExchange).

Open redirect (Field UI module - Drupal 7 - Less critical)

The Field UI module uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

This vulnerability is mitigated by the fact that only sites with the Field UI module enabled are affected.

Drupal 6 core is not affected, but see the similar advisory for the Drupal 6 contributed CCK module: SA-CONTRIB-2015-126

Open redirect (Overlay module - Drupal 7 - Less critical)

The Overlay module displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.

This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled.

Information disclosure (Render cache system - Drupal 7 - Less critical)

On sites utilizing Drupal 7's render cache system to cache content on the site by user role, private content viewed by user 1 may be included in the cache and exposed to non-privileged users.

This vulnerability is mitigated by the fact that render caching is not used in Drupal 7 core itself (it requires custom code or the contributed Render Cache module to enable) and that it only affects sites that have user 1 browsing the live site. Exposure is also limited if an administrative role has been assigned to the user 1 account (which is done, for example, by the Standard install profile that ships with Drupal core).

CVE-2015-3231 CVE-2015-3232 CVE-2015-3233 CVE-2015-3234 https://www.drupal.org/SA-CORE-2015-002 2015-06-17 2015-06-19
cURL -- Multiple Vulnerability curl 7.407.43

cURL reports:

libcurl can wrongly send HTTP credentials when re-using connections.

libcurl allows applications to set credentials for the upcoming transfer with HTTP Basic authentication, like with CURLOPT_USERPWD for example. Name and password. Just like all other libcurl options the credentials are sticky and are kept associated with the "handle" until something is made to change the situation.

Further, libcurl offers a curl_easy_reset() function that resets a handle back to its pristine state in terms of all settable options. A reset is of course also supposed to clear the credentials. A reset is typically used to clear up the handle and prepare it for a new, possibly unrelated, transfer.

Within such a handle, libcurl can also store a set of previous connections in case a second transfer is requested to a host name for which an existing connection is already kept alive.

With this flaw present, using the handle even after a reset would make libcurl accidentally use those credentials in a subseqent request if done to the same host name and connection as was previously accessed.

An example case would be first requesting a password protected resource from one section of a web site, and then do a second request of a public resource from a completely different part of the site without authentication. This flaw would then inadvertently leak the credentials in the second request.

libcurl can get tricked by a malicious SMB server to send off data it did not intend to.

In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back.

The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handicrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the values cause libcurl to access invalid memory.

CVE-2015-3236 CVE-2015-3237 http://curl.haxx.se/docs/adv_20150617A.html http://curl.haxx.se/docs/adv_20150617B.html 2015-06-17 2015-06-17
rubygem-rails -- multiple vulnerabilities rubygem-activesupport 3.2.22 rubygem-activesupport4 4.2.2 rubygem-jquery-rails 3.1.3 rubygem-jquery-rails4 4.0.4 rubygem-rack 1.4.6 rubygem-rack15 1.5.4 rubygem-rack16 1.6.2 rubygem-rails 3.2.22 rubygem-rails4 4.2.2 rubygem-web-console 2.1.3

Ruby on Rails blog:

Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.

CVE-2015-1840 CVE-2015-3224 CVE-2015-3225 CVE-2015-3226 CVE-2015-3227 http://weblog.rubyonrails.org/2015/6/16/Rails-3-2-22-4-1-11-and-4-2-2-have-been-released-and-more/ 2015-06-16 2015-06-17
testdisk -- buffer overflow with malicious disk image testdisk 7.0

CGSecurity TestDisk Changelog reports:

Various fix including security fix, thanks to:

  • Coverity scan (Static Analysis of source code)

  • afl-fuzz (security-oriented fuzzer).

  • Denis Andzakovic from Security Assessment for reporting an exploitable Stack Buffer Overflow.

Denis Andzakovic reports:

A buffer overflow is triggered within the software when a malicious disk image is attempted to be recovered. This may be leveraged by an attacker to crash TestDisk and gain control of program execution. An attacker would have to coerce the victim to run TestDisk against their malicious image.

http://www.cgsecurity.org/wiki/TestDisk_7.0_Release http://www.security-assessment.com/files/documents/advisory/Testdisk%20Check_OS2MB%20Stack%20Buffer%20Overflow%20-%20Release.pdf 2015-04-30 2015-06-16
tomcat -- multiple vulnerabilities tomcat6 6.0.44 tomcat7 7.0.55 tomcat8 8.0.9 hadoop2 2.6.0 oozie 4.1.0

Apache Software Foundation reports:

Low: Denial of Service CVE-2014-0230

When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection.

Moderate: Security Manager bypass CVE-2014-7810

Malicious web applications could use expression language to bypass the protections of a Security Manager as expressions were evaluated within a privileged code section.

CVE-2014-0230 CVE-2014-7810 https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44 2015-05-12 2015-06-16 2015-07-13
security/ossec-hids-* -- root escalation via syscheck feature ossec-hids-server ossec-hids-client ossec-hids-local 2.72.8.2

OSSEC reports:

The CVE-2015-3222 vulnerability, which allows for root escalation via sys check has been fixed in OSSEC 2.8.2. This issue does not affect agents.

CVE-2015-3222 ports/200801 http://www.ossec.net/?p=1198 https://github.com/ossec/ossec-hids/releases/tag/2.8.2 2015-06-11 2015-06-12
openssl -- multiple vulnerabilities openssl 1.0.2_2 mingw32-openssl 1.0.11.0.2b linux-c6-openssl 1.0.1e_6 libressl 2.1.7

The OpenSSL team reports:

  • Missing DHE man-in-the-middle protection (Logjam) (CVE-2015-4000)
  • Malformed ECParameters causes infinite loop (CVE-2015-1788)
  • Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
  • iPKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
  • CMS verify infinite loop with unknown hash function (CVE-2015-1792)
  • Race condition handling NewSessionTicket (CVE-2015-1791)
  • Invalid free in DTLS (CVE-2014-8176)
CVE-2014-8176 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 https://www.openssl.org/news/secadv_20150611.txt 2015-06-11 2015-06-11 2015-07-03
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.466 linux-f10-flashplugin 11.2r202.466

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.

These updates resolve a vulnerability (CVE-2015-3096) that could be exploited to bypass the fix for CVE-2014-5333.

These updates improve memory address randomization of the Flash heap for the Window 7 64-bit platform (CVE-2015-3097).

These updates resolve vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-3098, CVE-2015-3099, CVE-2015-3102).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-3100).

These updates resolve a permission issue in the Flash broker for Internet Explorer that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2015-3101).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3104).

These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2015-3105).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).

These updates resolve a memory leak vulnerability that could be used to bypass ASLR (CVE-2015-3108).

https://helpx.adobe.com/security/products/flash-player/apsb15-11.html CVE-2015-3096 CVE-2015-3097 CVE-2015-3098 CVE-2015-3099 CVE-2015-3100 CVE-2015-3101 CVE-2015-3102 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 CVE-2015-3108 2015-06-09 2015-06-11
libzmq4 -- V3 protocol handler vulnerable to downgrade attacks libzmq4 4.0.04.0.6 4.1.04.1.1

Pieter Hintjens reports:

It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by sending a ZMTP v2 or earlier header. The library accepts such connections without applying its security mechanism.

CVE-2014-9721 https://github.com/zeromq/libzmq/issues/1273 http://www.openwall.com/lists/oss-security/2015/05/07/8 ports/200502 2014-12-04 2015-06-10 2015-09-28
pgbouncer -- remote denial of service pgbouncer 1.5.5

PgBouncer reports:

Fix remote crash - invalid packet order causes lookup of NULL pointer. Not exploitable, just DoS.

CVE-2015-4054 https://pgbouncer.github.io/2015/04/pgbouncer-1-5-5/ http://www.openwall.com/lists/oss-security/2015/05/21/2 ports/200507 2015-04-08 2015-06-10 2015-09-28
cups -- multiple vulnerabilities cups-base 2.0.3

CUPS development team reports:

The new release addresses two security vulnerabilities, add localizations for German and Russian, and includes several general bug fixes. Changes include:

Security: Fixed CERT VU #810572/CVE-2015-1158/CVE-2015-1159 exploiting the dynamic linker (STR #4609)

Security: The scheduler could hang with malformed gzip data (STR #4602)

CVE-2015-1158 CVE-2015-1159 https://cups.org/blog.php?L1082 https://www.kb.cert.org/vuls/id/810572 2015-06-09 2015-06-09
strongswan -- Denial-of-service and potential remote code execution vulnerability strongswan 5.2.25.3.1

StrongSwan Project reports

A denial-of-service and potential remote code execution vulnerability triggered by crafted IKE messages was discovered in strongSwan. Versions 5.2.2 and 5.3.0 are affected.

CVE-2015-3991 https://www.strongswan.org/blog/2015/06/01/strongswan-vulnerability-(cve-2015-3991).html 2015-05-15 2015-06-09 2015-09-28
strongswan -- Information Leak Vulnerability strongswan 4.3.05.3.2

strongSwan Project reports:

An information leak vulnerability was fixed that, in certain IKEv2 setups, allowed rogue servers with a valid certificate accepted by the client to trick it into disclosing user credentials (even plain passwords if the client accepts EAP-GTC). This was caused because constraints against the server's authentication were enforced too late. All versions since 4.3.0 are affected.

CVE-2015-4171 http://www.strongswan.org/blog/2015/06/08/strongswan-5.3.2-released.html 2015-06-08 2015-06-09
redis -- EVAL Lua Sandbox Escape redis redis-devel 2.6.02.8.21 3.03.0.2

Ben Murphy reports:

It is possible to break out of the Lua sandbox in Redis and execute arbitrary code.

This shouldn’t pose a threat to users under the trusted Redis security model where only trusted users can connect to the database. However, in real deployments there could be databases that can be accessed by untrusted users. The main deployments that are vulnerable are developers machines, places where redis servers can be reached via SSRF attacks and cloud hosting.

CVE-2015-4335 http://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/ 2015-06-04 2015-06-08
tidy -- heap-buffer-overflow tidy4 20000804_3 tidy-devel 090315.c_2 tidy-lib 090315.c_2 tidy-html5 4.9.31

Geoff McLane reports:

tidy is affected by a write out of bounds when processing malformed html files.

This issue could be abused on server side applications that use php-tidy extension with user input.

The issue was confirmed, analysed and fixed by the tidy5 maintainer.

https://github.com/htacg/tidy-html5/issues/217 http://seclists.org/oss-sec/2015/q2/633 http://seclists.org/oss-sec/2015/q3/116 CVE-2015-5522 CVE-2015-5523 2015-06-03 2015-06-08 2015-07-15
pcre -- multiple vulnerabilities pcre 8.37_1

Venustech ADLAB reports:

PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex.

PCRE library is prone to a vulnerability which leads to Stack Overflow. Without enough bound checking inside match(), the stack memory could be overflowed via a crafted regular expression.

CVE-2015-3210 CVE-2015-3217 https://bugs.exim.org/show_bug.cgi?id=1636 https://bugs.exim.org/show_bug.cgi?id=1638 2015-05-29 2015-06-04 2015-06-07
hostapd and wpa_supplicant -- multiple vulnerabilities hostapd 2.4_1 wpa_supplicant 2.4_3

Jouni Malinen reports:

WPS UPnP vulnerability with HTTP chunked transfer encoding. (2015-2 - CVE-2015-4141)

Integer underflow in AP mode WMM Action frame processing. (2015-3 - CVE-2015-4142)

EAP-pwd missing payload length validation. (2015-4 - CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)

http://w1.fi/security/2015-2/wps-upnp-http-chunked-transfer-encoding.txt http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt CVE-2015-4141 CVE-2015-4142 CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146 http://openwall.com/lists/oss-security/2015/05/31/6 2015-05-04 2015-06-01
ffmpeg -- multiple vulnerabilities ffmpeg ffmpeg0 0.7.17,1

NVD and Vigilance report:

Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving seek operations on video data.

An attacker can generate an integer overflow in the av_lzo1x_decode() function of Libav, in order to trigger a denial of service, and possibly to execute code.

libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.

libavcodec/utils.c in FFmpeg before 2.4.2 omits a certain codec ID during enforcement of alignment, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted JV data.

libavcodec/mmvideo.c in FFmpeg before 2.4.2 does not consider all lines of HHV Intra blocks during validation of image height, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MM video data.

libavcodec/pngdec.c in FFmpeg before 2.4.2 accepts the monochrome-black format without verifying that the bits-per-pixel value is 1, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted PNG data.

libavcodec/gifdec.c in FFmpeg before 2.4.2 does not properly compute image heights, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted GIF data.

Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.

The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file.

The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file.

The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data.

An attacker can force a read at an invalid address in mjpegdec.c of FFmpeg, in order to trigger a denial of service.

CVE-2012-5150 CVE-2014-4609 CVE-2014-8541 CVE-2014-8542 CVE-2014-8543 CVE-2014-8545 CVE-2014-8547 CVE-2014-8548 CVE-2014-9316 CVE-2014-9317 CVE-2014-9603 CVE-2015-1872 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c3ece52decafc4923aebe7fd74b274e9ebb1962e https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1b291e0466308b341bc2e8c2a49d44862400f014 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=b5e661bcd2bb4fe771cb2c1e21215c68e6a17665 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cd3c4d8c55222337b0b59af4ea1fecfb46606e5e https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=73962e677d871fa0dde5385ee04ea07c048d8864 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7a5590ef4282e19d48d70cba0bc4628c13ec6fd8 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ef32bc8dde52439afd13988f56012a9f4dd55a83 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5b2097626d0e4ccb432d7d8ab040aa8dbde9eb3a https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=30e8a375901f8802853fd6d478b77a127d208bd6 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cb1db92cca98f963e91f421ee0c84f8866325a73 https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fac6f744d8170585f05e098ce9c9f27eeffa818e https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75b0cfcf105c8720a47a2ee80a70ba16799d71b7 https://ffmpeg.org/security.html 2015-03-12 2015-06-02
avidemux26 -- multiple vulnerabilities in bundled FFmpeg avidemux2 2.6.8 avidemux26 2.6.8

The Mageia project reports:

Avidemux is built with a bundled set of FFmpeg libraries. The bundled FFmpeg version has been updated from 1.2.10 to 1.2.12 to fix these security issues and other bugs fixed upstream in FFmpeg.

CVE-2014-9316 CVE-2014-9317 CVE-2014-9603 CVE-2014-9604 CVE-2015-1872 CVE-2015-3417 ports/200507 http://advisories.mageia.org/MGASA-2015-0233.html 2015-05-18 2015-06-01 2015-09-28
rest-client -- plaintext password disclosure rubygem-rest-client 1.6.7_1

The open sourced vulnerability database reports:

REST Client for Ruby contains a flaw that is due to the application logging password information in plaintext. This may allow a local attacker to gain access to password information.

CVE-2015-3448 ports/200504 https://github.com/rest-client/rest-client/issues/349 http://osvdb.org/show/osvdb/117461 2015-01-12 2015-05-31 2015-09-28
rest-client -- session fixation vulnerability rubygem-rest-client 1.6.7_1

Andy Brody reports:

When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration.

CVE-2015-1820 ports/200504 https://github.com/rest-client/rest-client/issues/369 2015-03-24 2015-05-31 2015-09-28
cabextract -- directory traversal with UTF-8 symbols in filenames cabextract 1.6

Cabextract ChangeLog reports:

It was possible for cabinet files to extract to absolute file locations, and it was possible on Cygwin to get around cabextract's absolute and relative path protections by using backslashes.

http://www.cabextract.org.uk/#changes http://www.openwall.com/lists/oss-security/2015/02/18/3 CVE-2015-2060 2015-02-18 2015-05-31
libmspack -- frame_end overflow which could cause infinite loop libmspack 0.5 cabextract 1.5

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.

MITRE reports:

Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.

CVE-2014-9556 https://bugs.debian.org/773041 http://www.openwall.com/lists/oss-security/2015/01/07/2 2014-12-11 2015-05-31
django -- Fixed session flushing in the cached_db backend py27-django 1.81.8.2 py32-django 1.81.8.2 py33-django 1.81.8.2 py34-django 1.81.8.2 py27-django-devel 20150531,1 py32-django-devel 20150531,1 py33-django-devel 20150531,1 py34-django-devel 20150531,1

The Django project reports:

A change to session.flush() in the cached_db session backend in Django 1.8 mistakenly sets the session key to an empty string rather than None. An empty string is treated as a valid session key and the session cookie is set accordingly. Any users with an empty string in their session cookie will use the same session store. session.flush() is called by django.contrib.auth.logout() and, more seriously, by django.contrib.auth.login() when a user switches accounts. If a user is logged in and logs in again to a different account (without logging out) the session is flushed to avoid reuse. After the session is flushed (and its session key becomes '') the account details are set on the session and the session is saved. Any users with an empty string in their session cookie will now be logged into that account.

Thanks to Sam Cooke for reporting the issue.

https://www.djangoproject.com/weblog/2015/may/20/security-release/ CVE-2015-3982 2015-05-20 2015-05-31
proxychains-ng -- current path as the first directory for the library search path proxychains-ng 4.9

Mamoru TASAKA reports:

proxychains4 sets LD_PRELOAD to dlopen libproxychains4.so and execvp() the arbitrary command user has specified. proxychains4 sets the current directory as the first path to search libproxychains4.so

http://openwall.com/lists/oss-security/2015/05/12/6 http://seclists.org/oss-sec/2015/q2/430 CVE-2015-3887 2015-05-11 2015-05-29
wireshark -- multiple vulnerabilities wireshark wireshark-lite tshark tshark-lite 1.12.5

Wireshark development team reports:

The following vulnerabilities have been fixed.

  • wnpa-sec-2015-12

    The LBMR dissector could go into an infinite loop. (Bug 11036) CVE-2015-3808, CVE-2015-3809

  • wnpa-sec-2015-13

    The WebSocket dissector could recurse excessively. (Bug 10989) CVE-2015-3810

  • wnpa-sec-2015-14

    The WCP dissector could crash while decompressing data. (Bug 10978) CVE-2015-3811

  • wnpa-sec-2015-15

    The X11 dissector could leak memory. (Bug 11088) CVE-2015-3812

  • wnpa-sec-2015-16

    The packet reassembly code could leak memory. (Bug 11129) CVE-2015-3813

  • wnpa-sec-2015-17

    The IEEE 802.11 dissector could go into an infinite loop. (Bug 11110) CVE-2015-3814

  • wnpa-sec-2015-18

    The Android Logcat file parser could crash. Discovered by Hanno Böck. (Bug 11188) CVE-2015-3815

CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 https://www.wireshark.org/docs/relnotes/wireshark-1.12.5.html https://www.wireshark.org/security/wnpa-sec-2015-12.html https://www.wireshark.org/security/wnpa-sec-2015-13.html https://www.wireshark.org/security/wnpa-sec-2015-14.html https://www.wireshark.org/security/wnpa-sec-2015-15.html https://www.wireshark.org/security/wnpa-sec-2015-16.html https://www.wireshark.org/security/wnpa-sec-2015-17.html https://www.wireshark.org/security/wnpa-sec-2015-18.html 2015-05-12 2015-05-28
krb5 -- requires_preauth bypass in PKINIT-enabled KDC krb5 1.13.2 krb5-112 1.12.3_2

MIT reports:

In MIT krb5 1.12 and later, when the KDC is configured with PKINIT support, an unauthenticated remote attacker can bypass the requires_preauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line dictionary attack against the user's password.

CVE-2015-2694 http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160 2015-05-25 2015-05-28
cURL -- sensitive HTTP server headers also sent to proxies curl 7.42.1

cURL reports:

libcurl provides applications a way to set custom HTTP headers to be sent to the server by using CURLOPT_HTTPHEADER. A similar option is available for the curl command-line tool with the '--header' option.

When the connection passes through an HTTP proxy the same set of headers is sent to the proxy as well by default. While this is by design, it has not necessarily been clear nor understood by application programmers.

CVE-2015-3153 http://curl.haxx.se/docs/adv_20150429.html 2015-04-29 2015-05-26
cURL -- multiple vulnerabilities curl 7.42.0

cURL reports:

libcurl keeps a pool of its last few connections around after use to fascilitate easy, conventient and completely transparent connection re-use for applications.

When doing HTTP requests NTLM authenticated, the entire connnection becomes authenticated and not just the specific HTTP request which is otherwise how HTTP works. This makes NTLM special and a subject for special treatment in the code. With NTLM, once the connection is authenticated, no further authentication is necessary until the connection gets closed.

When doing HTTP requests Negotiate authenticated, the entire connnection may become authenticated and not just the specific HTTP request which is otherwise how HTTP works, as Negotiate can basically use NTLM under the hood. curl was not adhering to this fact but would assume that such requests would also be authenticated per request.

libcurl supports HTTP "cookies" as documented in RFC 6265. Together with each individual cookie there are several different properties, but for this vulnerability we focus on the associated "path" element. It tells information about for which path on a given host the cookies is valid.

The internal libcurl function called sanitize_cookie_path() that cleans up the path element as given to it from a remote site or when read from a file, did not properly validate the input. If given a path that consisted of a single double-quote, libcurl would index a newly allocated memory area with index -1 and assign a zero to it, thus destroying heap memory it wasn't supposed to.

There is a private function in libcurl called fix_hostname() that removes a trailing dot from the host name if there is one. The function is called after the host name has been extracted from the URL libcurl has been told to act on.

If a URL is given with a zero-length host name, like in "http://:80" or just ":80", fix_hostname() will index the host name pointer with a -1 offset (as it blindly assumes a non-zero length) and both read and assign that address.

http://curl.haxx.se/docs/adv_20150422A.html http://curl.haxx.se/docs/adv_20150422B.html http://curl.haxx.se/docs/adv_20150422C.html http://curl.haxx.se/docs/adv_20150422D.html CVE-2014-3143 CVE-2014-3144 CVE-2014-3145 CVE-2014-3148 2015-04-22 2015-05-26
cassandra -- remote execution of arbitrary code cassandra 1.2.01.2.19 cassandra2 2.0.02.0.14 2.1.02.1.4

Jake Luciani reports:

Under its default configuration, Cassandra binds an unauthenticated JMX/RMI interface to all network interfaces. As RMI is an API for the transport and remote execution of serialized Java, anyone with access to this interface can execute arbitrary code as the running user.

Mitigation:

1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade to a supported version of Cassandra, or manually configure encryption and authentication of JMX, (see https://wiki.apache.org/cassandra/JmxSecurity).

2.0.x users should upgrade to 2.0.14

2.1.x users should upgrade to 2.1.4

Alternately, users of any version not wishing to upgrade can reconfigure JMX/RMI to enable encryption and authentication according to https://wiki.apache.org/cassandra/JmxSecurityor http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html

Credit:

This issue was discovered by Georgi Geshev of MWR InfoSecurity

http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/ CVE-2015-0225 2015-04-01 2015-05-24
py-salt -- potential shell injection vulnerabilities py27-salt 2015.5.0

Colton Myers reports:

In order to fix potential shell injection vulnerabilities in salt modules, a change has been made to the various cmd module functions. These functions now default to python_shell=False, which means that the commands will not be sent to an actual shell.

The largest side effect of this change is that "shellisms", such as pipes, will not work by default. The modules shipped with salt have been audited to fix any issues that might have arisen from this change. Additionally, the cmd state module has been unaffected, and use of cmd.run in jinja is also unaffected. cmd.run calls on the CLI will also allow shellisms.

However, custom execution modules which use shellisms in cmd calls will break, unless you pass python_shell=True to these calls.

As a temporary workaround, you can set cmd_safe: False in your minion and master configs. This will revert the default, but is also less secure, as it will allow shell injection vulnerabilities to be written in custom code. We recommend you only set this setting for as long as it takes to resolve these issues in your custom code, then remove the override.

http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html 2015-05-11 2015-05-24
davmail -- fix potential CVE-2014-3566 vulnerability (POODLE) davmail 4.6.0

Mickaël Guessant reports:

DavMail 4.6.0 released

Enhancements: Fix potential CVE-2014-3566 vulnerability.

http://sourceforge.net/p/davmail/mailman/message/33279118/ http://sourceforge.net/p/davmail/code/2322/ CVE-2014-3566 2014-10-27 2015-05-23
dnsmasq -- remotely exploitable buffer overflow in release candidate dnsmasq-devel 2.73rc62.73rc8

Simon Kelley reports:

Anyone running 2.[73]rc6 or 2.[73]rc7 should be aware that there's a remotely exploitable buffer overflow in those trees. I just tagged 2.[73]rc8, which includes the fix.

(Corrections from second URL.)

http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009529.html http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009535.html 2015-05-15 2015-05-23
dnsmasq -- data exposure and denial of service dnsmasq 2.72_1 dnsmasq-devel 2.73rc4

Nick Sampanis reported a potential memory exposure and denial of service vulnerability against dnsmasq 2.72. The CVE entry summarizes this as:

The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request."

http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html CVE-2015-3294 http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=ad4a8ff7d9097008d7623df8543df435bfddeac8 2015-04-07 2015-05-23
pcre -- multiple vulnerabilities pcre 8.37

PCRE development team reports:

A pattern such as "((?2){0,1999}())?", which has a group containing a forward reference repeated a large (but limited) number of times within a repeated outer group that has a zero minimum quantifier, caused incorrect code to be compiled, leading to the error "internal error: previously-checked referenced subpattern not found" when an incorrect memory address was read. This bug was reported as "heap overflow", discovered by Kai Lu of Fortinet's FortiGuard Labs and given the CVE number CVE-2015-2325.

A pattern such as "((?+1)(\1))/" containing a forward reference subroutine call within a group that also contained a recursive back reference caused incorrect code to be compiled. This bug was reported as "heap overflow", discovered by Kai Lu of Fortinet's FortiGuard Labs, and given the CVE number CVE-2015-2326.

CVE-2015-2325 CVE-2015-2326 http://www.pcre.org/original/changelog.txt 2015-04-28 2015-05-22 2015-06-07
php -- multiple vulnerabilities php5 5.4.41 php55 5.5.25 php56 5.6.9

PHP development team reports:

Fixed bug #69364 (PHP Multipart/form-data remote DoS Vulnerability). (CVE-2015-4024)

Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)

Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022)

Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026)

Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)

CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4025 CVE-2015-4026 https://php.net/ChangeLog-5.php#5.6.9 2015-05-14 2015-05-22
PostgreSQL -- minor security problems. postgresql90-server 9.0.09.0.20 postgresql91-server 9.1.09.1.16 postgresql92-server 9.2.09.2.11 postgresql93-server 9.3.09.3.7 postgresql94-server 9.4.09.4.2

PostgreSQL project reports:

This update fixes three security vulnerabilities reported in PostgreSQL over the past few months. Nether of these issues is seen as particularly urgent. However, users should examine them in case their installations are vulnerable:.

  • CVE-2015-3165 Double "free" after authentication timeout.
  • CVE-2015-3166 Unanticipated errors from the standard library.
  • CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.
CVE-2015-3165 CVE-2015-3166 CVE-2015-3167 2015-04-10 2015-05-22
proftpd -- arbitrary code execution vulnerability with chroot proftpd 1.3.5_7

ProFTPd development team reports:

Vadim Melihow reported a critical issue with proftpd installations that use the mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands to be used by *unauthenticated clients*.

CVE-2015-3306 http://bugs.proftpd.org/show_bug.cgi?id=4169 2015-04-15 2015-05-20
ipsec-tools -- Memory leak leading to denial of service ipsec-tools 0.8.2_1

Javantea reports:

It is a null dereference crash, leading to denial of service against the IKE daemon.

https://www.altsci.com/ipsec/ 2015-05-18 2015-05-19
chromium -- multiple vulnerabilities chromium 43.0.2357.65 chromium-npapi 43.0.2357.65 chromium-pulse 43.0.2357.65

Google Chrome Releases reports:

37 security fixes in this release, including:

  • [474029] High CVE-2015-1252: Sandbox escape in Chrome. Credit to anonymous.
  • [464552] High CVE-2015-1253: Cross-origin bypass in DOM. Credit to anonymous.
  • [444927] High CVE-2015-1254: Cross-origin bypass in Editing. Credit to armin@rawsec.net.
  • [473253] High CVE-2015-1255: Use-after-free in WebAudio. Credit to Khalil Zhani.
  • [478549] High CVE-2015-1256: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.
  • [481015] High CVE-2015-1251: Use-after-free in Speech. Credit to SkyLined working with HP's Zero Day Initiative.
  • [468519] Medium CVE-2015-1257: Container-overflow in SVG. Credit to miaubiz.
  • [450939] Medium CVE-2015-1258: Negative-size parameter in libvpx. Credit to cloudfuzzer
  • [468167] Medium CVE-2015-1259: Uninitialized value in PDFium. Credit to Atte Kettunen of OUSPG
  • [474370] Medium CVE-2015-1260: Use-after-free in WebRTC. Credit to Khalil Zhani.
  • [466351] Medium CVE-2015-1261: URL bar spoofing. Credit to Juho Nurminen.
  • [476647] Medium CVE-2015-1262: Uninitialized value in Blink. Credit to miaubiz.
  • [479162] Low CVE-2015-1263: Insecure download of spellcheck dictionary. Credit to Mike Ruddy.
  • [481015] Low CVE-2015-1264: Cross-site scripting in bookmarks. Credit to K0r3Ph1L.
  • [489518] CVE-2015-1265: Various fixes from internal audits, fuzzing and other initiatives.
  • Multiple vulnerabilities in V8 fixed at the tip of the 4.3 branch (currently 4.3.61.21).
http://googlechromereleases.blogspot.nl/2015/05/stable-channel-update_19.html CVE-2015-1251 CVE-2015-1252 CVE-2015-1253 CVE-2015-1254 CVE-2015-1255 CVE-2015-1256 CVE-2015-1257 CVE-2015-1258 CVE-2015-1259 CVE-2015-1260 CVE-2015-1261 CVE-2015-1262 CVE-2015-1263 CVE-2015-1264 CVE-2015-1265 2015-05-19 2015-05-19
clamav -- multiple vulnerabilities clamav 0.98.7 clamav-devel 0

ClamAV project reports:

ClamAV 0.98.7 is here! This release contains new scanning features and bug fixes.

Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221.

Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2222.

Fix an infinite loop condition on a crafted "xz" archive file. This was reported by Dimitri Kirchner and Goulven Guiheux. CVE-2015-2668.

Apply upstream patch for possible heap overflow in Henry Spencer's regex library. CVE-2015-2305.

Fix crash in upx decoder with crafted file. Discovered and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.

CVE-2015-2170 CVE-2015-2221 CVE-2015-2222 CVE-2015-2305 CVE-2015-2668 http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html 2015-04-29 2015-05-19
rubygems -- request hijacking vulnerability ruby20-gems 2.4.7 ruby21-gems 2.4.7 ruby22-gems 2.4.7

Jonathan Claudius reports:

RubyGems provides the ability of a domain to direct clients to a separate host that is used to fetch gems and make API calls against. This mechanism is implemented via DNS, specificly a SRV record _rubygems._tcp under the original requested domain.

RubyGems did not validate the hostname returned in the SRV record before sending requests to it. This left clients open to a DNS hijack attack, whereby an attacker could return a SRV of their choosing and get the client to use it.

ports/200264 CVE-2015-3900 http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html 2015-05-14 2015-05-17
qemu, xen and VirtualBox OSE -- possible VM escape and code execution ("VENOM") qemu qemu-devel 0.11.1_19 0.122.3.0_1 qemu-sbruno 2.3.50.g20150501_1 virtualbox-ose 4.3.28 xen-tools 4.5.04.5.0_5

Jason Geffner, CrowdStrike Senior Security Researcher reports:

VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host. Absent mitigation, this VM escape could open access to the host system and all other VMs running on that host, potentially giving adversaries significant elevated access to the host's local network and adjacent systems.

CVE-2015-3456 ports/200255 ports/200256 ports/200257 http://venom.crowdstrike.com/ http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html http://xenbits.xen.org/xsa/advisory-133.html 2015-04-29 2015-05-17 2015-09-28
Quassel IRC -- SQL injection vulnerability quassel 0.11.1

Quassel IRC developers report:

Restarting a PostgreSQL database while Quassel Core is running would not properly re-initialize the database session inside Quassel, bringing back an old security issue (CVE-2013-4422).

https://github.com/quassel/quassel/commit/6605882f41331c80f7ac3a6992650a702ec71283 CVE-2015-3427 2015-04-23 2015-05-16
rubygem-redcarpet -- XSS vulnerability rubygem-redcarpet 3.2.3

Daniel LeCheminant reports:

When markdown is being presented as HTML, there seems to be a strange interaction between _ and @ that lets an attacker insert malicious tags.

http://openwall.com/lists/oss-security/2015/04/07/11 https://hackerone.com/reports/46916 http://danlec.com/blog/bug-in-sundown-and-redcarpet 2015-04-07 2015-05-14
dcraw -- integer overflow condition cinepaint 0.22.0 darktable 1.6.7 dcraw 7.009.26 dcraw-m 0 exact-image 0 flphoto 0 freeimage 3.13.0 kodi 14.2_1 libraw 0.16.1 lightzone 4.1.2 netpbm 10.35.96 opengtl 0 rawstudio 2.0_11 ufraw 0.21

ocert reports:

The dcraw tool, as well as several other projects re-using its code, suffers from an integer overflow condition which lead to a buffer overflow.

The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpeg_start() function.

A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition.

CVE-2015-3885 http://www.ocert.org/advisories/ocert-2015-006.html https://github.com/rawstudio/rawstudio/commit/983bda1f0fa5fa86884381208274198a620f006e https://github.com/LibRaw/LibRaw/commit/4606c28f494a750892c5c1ac7903e62dd1c6fdb5 https://sourceforge.net/p/netpbm/code/2512/ 2015-04-24 2015-05-15 2015-09-18
phpMyAdmin -- XSRF and man-in-the-middle vulnerabilities phpMyAdmin 4.4.04.4.6.1

The phpMyAdmin development team reports:

XSRF/CSRF vulnerability in phpMyAdmin setup.

By deceiving a user to click on a crafted URL, it is possible to alter the configuration file being generated with phpMyAdmin setup.

This vulnerability only affects the configuration file generation process and does not affect the effective configuration file. Moreover, the configuration file being generated is at risk only during the period when it's writable.

Vulnerability allowing man-in-the-middle attack on API call to GitHub.

A vulnerability in the API call to GitHub can be exploited to perform a man-in-the-middle attack.

We consider this vulnerability to be serious.

http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php CVE-2015-3902 CVE-2015-3903 2015-05-13 2015-05-13
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.457 linux-f10-flashplugin 11.2r202.457

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions.

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-3078, CVE-2015-3089, CVE-2015-3090, CVE-2015-3093).

These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2015-3088).

These updates resolve a time-of-check time-of-use (TOCTOU) race condition that could be exploited to bypass Protected Mode in Internet Explorer (CVE-2015-3081).

These updates resolve validation bypass issues that could be exploited to write arbitrary data to the file system under user permissions (CVE-2015-3082, CVE-2015-3083, CVE-2015-3085).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3087).

These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-3077, CVE-2015-3084, CVE-2015-3086).

These updates resolve a use-after-free vulnerability that could lead to code execution (CVE-2015-3080).

These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-3091, CVE-2015-3092).

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3079), and provide additional hardening to protect against CVE-2015-3044.

CVE-2015-3044 CVE-2015-3077 CVE-2015-3078 CVE-2015-3079 CVE-2015-3080 CVE-2015-3081 CVE-2015-3082 CVE-2015-3083 CVE-2015-3084 CVE-2015-3085 CVE-2015-3086 CVE-2015-3087 CVE-2015-3088 CVE-2015-3089 CVE-2015-3090 CVE-2015-3091 CVE-2015-3092 CVE-2015-3093 https://helpx.adobe.com/security/products/flash-player/apsb15-09.html 2015-05-12 2015-05-13
mozilla -- multiple vulnerabilities firefox 38.0,1 linux-firefox 38.0,1 seamonkey 2.35 linux-seamonkey 2.35 firefox-esr 31.7.0,1 libxul 31.7.0 32.038.0 thunderbird 31.7.0 32.038.0 linux-thunderbird 31.7.0 32.038.0

The Mozilla Project reports:

MFSA-2015-46 Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)

MFSA-2015-47 Buffer overflow parsing H.264 video with Linux Gstreamer

MFSA-2015-48 Buffer overflow with SVG content and CSS

MFSA-2015-49 Referrer policy ignored when links opened by middle-click and context menu

MFSA-2015-50 Out-of-bounds read and write in asm.js validation

MFSA-2015-51 Use-after-free during text processing with vertical text enabled

MFSA-2015-52 Sensitive URL encoded information written to Android logcat

MFSA-2015-53 Use-after-free due to Media Decoder Thread creation during shutdown

MFSA-2015-54 Buffer overflow when parsing compressed XML

MFSA-2015-55 Buffer overflow and out-of-bounds read while parsing MP4 video metadata

MFSA-2015-56 Untrusted site hosting trusted page can intercept webchannel responses

MFSA-2015-57 Privilege escalation through IPC channel messages

MFSA-2015-58 Mozilla Windows updater can be run outside of application directory

MFSA 2015-93 Integer overflows in libstagefright while processing MP4 video metadata

CVE-2011-3079 CVE-2015-0797 CVE-2015-0833 CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711 CVE-2015-2712 CVE-2015-2713 CVE-2015-2714 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717 CVE-2015-2718 CVE-2015-2720 CVE-2015-4496 https://www.mozilla.org/security/advisories/mfsa2015-46/ https://www.mozilla.org/security/advisories/mfsa2015-47/ https://www.mozilla.org/security/advisories/mfsa2015-48/ https://www.mozilla.org/security/advisories/mfsa2015-49/ https://www.mozilla.org/security/advisories/mfsa2015-50/ https://www.mozilla.org/security/advisories/mfsa2015-51/ https://www.mozilla.org/security/advisories/mfsa2015-52/ https://www.mozilla.org/security/advisories/mfsa2015-53/ https://www.mozilla.org/security/advisories/mfsa2015-54/ https://www.mozilla.org/security/advisories/mfsa2015-55/ https://www.mozilla.org/security/advisories/mfsa2015-56/ https://www.mozilla.org/security/advisories/mfsa2015-57/ https://www.mozilla.org/security/advisories/mfsa2015-58/ https://www.mozilla.org/security/advisories/mfsa2015-93/ 2015-05-12 2015-05-12 2015-08-28
suricata -- TLS/DER Parser Bug (DoS) suricata 2.0.8

OISF Development Team reports:

The OISF development team is pleased to announce Suricata 2.0.8. This release fixes a number of issues in the 2.0 series.

The most important issue is a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. This issue was reported by Kostya Kortchinsky of the Google Security Team and was fixed by Pierre Chifflier of ANSSI.

Those processing large numbers of (untrusted) pcap files need to update as a malformed pcap could crash Suricata. Again, credits go to Kostya Kortchinsky.

CVE-2015-0971 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0971 https://github.com/inliniac/suricata/commit/fa73a0bb8f312fd0a95cc70f6b3ee4e4997bdba7 2015-05-06 2015-05-12
libssh -- null pointer dereference libssh 0.6.5

Andreas Schneider reports:

libssh versions 0.5.1 and above have a logical error in the handling of a SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY package. A detected error did not set the session into the error state correctly and further processed the packet which leads to a null pointer dereference. This is the packet after the initial key exchange and doesn’t require authentication.

This could be used for a Denial of Service (DoS) attack.

CVE-2015-3146 https://www.libssh.org/2015/04/30/libssh-0-6-5-security-and-bugfix-release 2015-04-30 2015-05-10
Vulnerablitiy in HWP document filter libreoffice 4.3.7 apache-openoffice 4.1.1_9 apache-openoffice-devel 4.2.1677190,3

US-CERT/NIST reports:

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

CVE-2015-1774 http://www.openoffice.org/security/cves/CVE-2015-1774.html https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/ 2015-04-27 2015-05-07
wordpress -- 2 cross-site scripting vulnerabilities wordpress 4.2.2,1 de-wordpress 4.2.2 ja-wordpress 4.2.2 ru-wordpress 4.2.2 zh-wordpress-zh_CN 4.2.2 zh-wordpress-zh_TW 4.2.2

Samuel Sidler reports:

The Genericons icon font package, which is used in a number of popular themes and plugins, contained an HTML file vulnerable to a cross-site scripting attack. All affected themes and plugins hosted on WordPress.org (including the Twenty Fifteen default theme) have been updated today by the WordPress security team to address this issue by removing this nonessential file. To help protect other Genericons usage, WordPress 4.2.2 proactively scans the wp-content directory for this HTML file and removes it. Reported by Robert Abela of Netsparker.

WordPress versions 4.2 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. WordPress 4.2.2 includes a comprehensive fix for this issue.

The release also includes hardening for a potential cross-site scripting vulnerability when using the visual editor. This issue was reported by Mahadev Subedi.

https://wordpress.org/news/2015/05/wordpress-4-2-2/ 2015-05-07 2015-05-07 2015-09-15
wordpress -- cross-site scripting vulnerability wordpress 4.2.1,1 de-wordpress 4.2.1 ja-wordpress 4.2.1 ru-wordpress 4.2.1 zh-wordpress-zh_CN 4.2.1 zh-wordpress-zh_TW 4.2.1

Gary Pendergast reports:

WordPress 4.2.1 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

A few hours ago, the WordPress team was made aware of a cross-site scripting vulnerability, which could enable commenters to compromise a site. The vulnerability was discovered by Jouko Pynnöne.

https://wordpress.org/news/2015/04/wordpress-4-2-1/ 2015-04-27 2015-05-07 2015-09-15
powerdns -- Label decompression bug can cause crashes or CPU spikes powerdns 3.4.5 powerdns-recursor 3.7.3

The PowerDNS project reports:

A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause service-affecting CPU spikes.

CVE-2015-1868 CVE-2015-5470 https://doc.powerdns.com/md/security/powerdns-advisory-2015-01/ http://www.openwall.com/lists/oss-security/2015/07/10/8 2015-04-23 2015-05-01 2015-07-12
chromium -- multiple vulnerabilities chromium 42.0.2311.135 chromium-npapi 42.0.2311.135 chromium-pulse 42.0.2311.135

Google Chrome Releases reports:

5 security fixes in this release, including:

  • [453279] High CVE-2015-1243: Use-after-free in DOM. Credit to Saif El-Sherei.
  • [481777] CVE-2015-1250: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2015-1243 CVE-2015-1250 http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_28.html 2015-04-28 2015-04-28
chromium -- multiple vulnerabilities chromium 42.0.2311.90 chromium-npapi 42.0.2311.90 chromium-pulse 42.0.2311.90

Google Chrome Releases reports:

45 new security fixes, including:

  • [456518] High CVE-2015-1235: Cross-origin-bypass in HTML parser. Credit to anonymous.
  • [313939] Medium CVE-2015-1236: Cross-origin-bypass in Blink. Credit to Amitay Dobo.
  • [461191] High CVE-2015-1237: Use-after-free in IPC. Credit to Khalil Zhani.
  • [445808] High CVE-2015-1238: Out-of-bounds write in Skia. Credit to cloudfuzzer.
  • [463599] Medium CVE-2015-1240: Out-of-bounds read in WebGL. Credit to w3bd3vil.
  • [418402] Medium CVE-2015-1241: Tap-Jacking. Credit to Phillip Moon and Matt Weston of Sandfield Information Systems.
  • [460917] High CVE-2015-1242: Type confusion in V8. Credit to fcole@onshape.com.
  • [455215] Medium CVE-2015-1244: HSTS bypass in WebSockets. Credit to Mike Ruddy.
  • [444957] Medium CVE-2015-1245: Use-after-free in PDFium. Credit to Khalil Zhani.
  • [437399] Medium CVE-2015-1246: Out-of-bounds read in Blink. Credit to Atte Kettunen of OUSPG.
  • [429838] Medium CVE-2015-1247: Scheme issues in OpenSearch. Credit to Jann Horn.
  • [380663] Medium CVE-2015-1248: SafeBrowsing bypass. Credit to Vittorio Gambaletta (VittGam).
  • [476786] CVE-2015-1249: Various fixes from internal audits, fuzzing and other initiatives. Multiple vulnerabilities in V8 fixed at the tip of the 4.2 branch (currently 4.2.77.14).
http://googlechromereleases.blogspot.nl/2015/04/stable-channel-update_14.html CVE-2015-1235 CVE-2015-1236 CVE-2015-1237 CVE-2015-1238 CVE-2015-1240 CVE-2015-1241 CVE-2015-1242 CVE-2015-1244 CVE-2015-1245 CVE-2015-1246 CVE-2015-1247 CVE-2015-1248 CVE-2015-1249 2015-04-14 2015-04-27
wpa_supplicant -- P2P SSID processing vulnerability wpa_supplicant 2.4_1

Jouni Malinen reports:

A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from a peer device.

This can result in copying arbitrary data from an attacker to a fixed length buffer of 32 bytes (i.e., a possible overflow of up to 223 bytes). The SSID buffer is within struct p2p_device that is allocated from heap. The overflow can override couple of variables in the struct, including a pointer that gets freed. In addition about 150 bytes (the exact length depending on architecture) can be written beyond the end of the heap allocation.

This could result in corrupted state in heap, unexpected program behavior due to corrupted P2P peer device information, denial of service due to wpa_supplicant process crash, exposure of memory contents during GO Negotiation, and potentially arbitrary code execution.

Vulnerable versions/configurations

wpa_supplicant v1.0-v2.4 with CONFIG_P2P build option enabled (which is not compiled by default).

Attacker (or a system controlled by the attacker) needs to be within radio range of the vulnerable system to send a suitably constructed management frame that triggers a P2P peer device information to be created or updated.

The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress). However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress.

CVE-2015-1863 http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt 2015-04-22 2015-04-25
Several vulnerabilities found in PHP php5 5.4.40 php55 5.5.24 php56 5.6.8

The PHP project reports:

The PHP development team announces the immediate availability of PHP 5.4.40. 14 security-related bugs were fixed in this release, including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. All PHP 5.4 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.5.24. Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.5 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.6.8. Several bugs have been fixed some of them beeing security related, like CVE-2015-1351 and CVE-2015-1352. All PHP 5.6 users are encouraged to upgrade to this version.

http://php.net/archive/2015.php#id2015-04-16-2 CVE-2014-9709 CVE-2015-2301 CVE-2015-2783 CVE-2015-1351 CVE-2015-1352 ports/199585 2015-04-16 2015-04-25 2015-05-22
wordpress -- multiple vulnabilities wordpress 4.1.2 de-wordpress 4.1.2 ja-wordpress 4.1.2 ru-wordpress 4.1.2 zh-wordpress-zh_CN 4.1.2 zh-wordpress-zh_TW 4.1.2

Gary Pendergast reports:

WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. This was reported by Cedric Van Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team.

We also fixed three other security issues:

  • In WordPress 4.1 and higher, files with invalid or unsafe names could be uploaded. Discovered by Michael Kapfer and Sebastian Kraemer of HSASec.
  • In WordPress 3.9 and higher, a very limited cross-site scripting vulnerability could be used as part of a social engineering attack. Discovered by Jakub Zoczek.
  • Some plugins were vulnerable to an SQL injection vulnerability. Discovered by Ben Bidner of the WordPress security team.

We also made four hardening changes, discovered by J.D. Grimes, Divyesh Prajapati, Allan Collins, Marc-Alexandre Montpas and Jeff Bowen.

https://wordpress.org/news/2015/04/wordpress-4-1-2/ 2015-04-21 2015-04-24 2015-04-24
libtasn1 -- stack-based buffer overflow in asn1_der_decoding libtasn1 4.4

Debian reports:

Hanno Boeck discovered a stack-based buffer overflow in the asn1_der_decoding function in Libtasn1, a library to manage ASN.1 structures. A remote attacker could take advantage of this flaw to cause an application using the Libtasn1 library to crash, or potentially to execute arbitrary code.

CVE-2015-2806 https://www.debian.org/security/2015/dsa-3220.en.html 2015-04-11 2015-04-22
mozilla -- use-after-free firefox 37.0.2,1 linux-firefox 37.0.2,1

The Mozilla Project reports:

MFSA 2015-45 Memory corruption during failed plugin initialization

CVE-2015-2706 https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/ 2015-04-20 2015-04-21
sqlite -- multiple vulnerabilities sqlite3 3.8.9

NVD reports:

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

CVE-2015-3414 CVE-2015-3415 CVE-2015-3416 https://www.sqlite.org/src/info/eddc05e7bb31fae7 https://www.sqlite.org/src/info/02e3c88fbf6abdcf https://www.sqlite.org/src/info/c494171f77dc2e5e http://seclists.org/fulldisclosure/2015/Apr/31 2015-04-14 2015-04-18 2015-05-08
chrony -- multiple vulnerabilities chrony 1.31.1

Chrony News reports:

CVE-2015-1853: DoS attack on authenticated symmetric NTP associations

CVE-2015-1821: Heap-based buffer overflow in access configuration

CVE-2015-1822: Use of uninitialized pointer in command processing

http://chrony.tuxfamily.org/News.html CVE-2015-1821 CVE-2015-1822 CVE-2015-1853 2015-02-17 2015-04-18
Dulwich -- Remote code execution py27-dulwich 0.9.9

MITRE reports:

Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.

CVE-2015-0838 2015-01-07 2015-04-17
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.451 linux-f10-flashplugin 11.2r202.451

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2015-3043 exists in the wild, and recommends users update their product installations to the latest versions.

  • These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, CVE-2015-3043).
  • These updates resolve a type confusion vulnerability that could lead to code execution (CVE-2015-0356).
  • These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2015-0348).
  • These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0349, CVE-2015-0351, CVE-2015-0358, CVE-2015-3039).
  • These updates resolve double-free vulnerabilities that could lead to code execution (CVE-2015-0346, CVE-2015-0359).
  • These updates resolve memory leak vulnerabilities that could be used to bypass ASLR (CVE-2015-0357, CVE-2015-3040).
  • These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2015-3044).
https://helpx.adobe.com/security/products/flash-player/apsb15-06.html CVE-2015-3038 CVE-2015-3039 CVE-2015-3040 CVE-2015-3041 CVE-2015-3042 CVE-2015-3043 CVE-2015-3044 CVE-2015-0346 CVE-2015-0347 CVE-2015-0348 CVE-2015-0349 CVE-2015-0350 CVE-2015-0351 CVE-2015-0352 CVE-2015-0353 CVE-2015-0354 CVE-2015-0355 CVE-2015-0356 CVE-2015-0357 CVE-2015-0358 CVE-2015-0359 CVE-2015-0360 2015-04-14 2015-04-17
Wesnoth -- Remote information disclosure wesnoth wesnoth-devel 1.7.01.12.2

US-CERT/NIST reports:

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

CVE-2015-0844 2015-04-11 2015-04-17
qt4-imageformats, qt4-gui, qt5-gui -- Multiple Vulnerabilities in Qt Image Format Handling qt4-imageformats 4.8.6_3 qt4-gui 4.8.6_5 qt5-gui 5.4.1_1

Richard J. Moore reports:

Due to two recent vulnerabilities identified in the built-in image format handling code, it was decided that this area required further testing to determine if further issues remained. Fuzzing using afl-fuzz located a number of issues in the handling of BMP, ICO and GIF files. The issues exposed included denial of service and buffer overflows leading to heap corruption. It is possible the latter could be used to perform remote code execution.

http://lists.qt-project.org/pipermail/announce/2015-April/000067.html CVE-2015-1858 CVE-2015-1859 CVE-2015-1860 2015-04-12 2015-04-14
Ruby -- OpenSSL Hostname Verification Vulnerability ruby ruby20 2.0,12.0.0.645,1 ruby ruby21 2.1,12.1.6,1 ruby ruby22 2.2,12.2.2,1

Ruby Developers report:

After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates.

Ruby’s OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching of more than one wildcard per subject/SAN is no-longer allowed. As well, comparison of these values are now case-insensitive.

https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/ CVE-2015-1855 2015-04-13 2015-04-14 2015-09-23
mailman -- path traversal vulnerability mailman 2.1.20 mailman-with-htdig 2.1.20 ja-mailman 2.1.14.j7_2,1

Mark Sapiro reports:

A path traversal vulnerability has been discovered and fixed. This vulnerability is only exploitable by a local user on a Mailman server where the suggested Exim transport, the Postfix postfix_to_mailman.py transport or some other programmatic MTA delivery not using aliases is employed.

https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html https://bugs.launchpad.net/mailman/+bug/1437145 CVE-2015-2775 2015-03-27 2015-04-09 2015-06-17
asterisk -- TLS Certificate Common name NULL byte exploit asterisk 1.8.32.3 asterisk11 11.17.1 asterisk13 13.3.2

The Asterisk project reports:

When Asterisk registers to a SIP TLS device and and verifies the server, Asterisk will accept signed certificates that match a common name other than the one Asterisk is expecting if the signed certificate has a common name containing a null byte after the portion of the common name that Asterisk expected. For example, if Asterisk is trying to register to www.domain.com, Asterisk will accept certificates of the form www.domain.com\x00www.someotherdomain.com

http://downloads.asterisk.org/pub/security/AST-2015-003.html CVE-2015-3008 2015-04-04 2015-04-08
ntp -- multiple vulnerabilities ntp 4.2.8p2 ntp-devel 4.3.14

ntp.org reports:

  • [Sec 2779] ntpd accepts unauthenticated packets with symmetric key crypto.
  • [Sec 2781] Authentication doesn't protect symmetric associations against DoS attacks.
CVE-2015-1798 CVE-2015-1799 http://archive.ntp.org/ntp4/ChangeLog-stable 2015-04-07 2015-04-07
mozilla -- multiple vulnerabilities firefox 37.0.1,1 linux-firefox 37.0.1,1

The Mozilla Project reports:

MFSA 2015-44 Certificate verification bypass through the HTTP/2 Alt-Svc header

MFSA 2015-43 Loading privileged content through Reader mode

CVE-2015-0798 CVE-2015-0799 https://www.mozilla.org/security/advisories/mfsa2015-43/ https://www.mozilla.org/security/advisories/mfsa2015-44/ https://www.mozilla.org/security/advisories/ 2015-04-03 2015-04-04
Several vulnerabilities in libav libav 11.3

The libav project reports:

utvideodec: Handle slice_height being zero (CVE-2014-9604)

tiff: Check that there is no aliasing in pixel format selection (CVE-2014-8544)

https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.3 CVE-2014-8544 CVE-2014-9604 2015-03-24 2015-04-03
Several vulnerabilities found in PHP php53 5.3.29_5 php5 5.4.39 php55 5.5.23 php56 5.6.7

The PHP project reports:

The PHP development team announces the immediate availability of PHP 5.6.7. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.6 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.5.23. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.5 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 5.4.39. Six security-related bugs were fixed in this release, including CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.4 users are encouraged to upgrade to this version.

http://php.net/archive/2015.php#id2015-03-20-2 CVE-2015-0231 CVE-2015-2305 CVE-2015-2311 ports/198739 2015-03-19 2015-04-01
subversion -- DoS vulnerabilities mod_dav_svn 1.5.01.7.20 1.8.01.8.13 subversion16 1.0.01.7.20 subversion17 1.0.01.7.20 subversion 1.0.01.7.20 1.8.01.8.13

Subversion Project reports:

Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests.

Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers.

Subversion HTTP servers allow spoofing svn:author property values for new revisions.

http://subversion.apache.org/security/ CVE-2015-0202 CVE-2015-0248 CVE-2015-0251 http://subversion.apache.org/security/CVE-2015-0202-advisory.txt http://subversion.apache.org/security/CVE-2015-0248-advisory.txt http://subversion.apache.org/security/CVE-2015-0251-advisory.txt 2015-03-31 2015-03-31
mozilla -- multiple vulnerabilities firefox 37.0,1 firefox-esr 31.6.0,1 linux-firefox 37.0,1 linux-seamonkey 2.34 linux-thunderbird 31.6.0 seamonkey 2.34 thunderbird 31.6.0 libxul 31.6.0

The Mozilla Project reports:

MFSA-2015-30 Miscellaneous memory safety hazards (rv:37.0 / rv:31.6)

MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin

MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack

MFSA-2015-33 resource:// documents can load privileged pages

MFSA-2015-34 Out of bounds read in QCMS library

MFSA-2015-35 Cursor clickjacking with flash and images

MFSA-2015-36 Incorrect memory management for simple-type arrays in WebRTC

MFSA-2015-37 CORS requests should not follow 30x redirections after preflight

MFSA-2015-38 Memory corruption crashes in Off Main Thread Compositing

MFSA-2015-39 Use-after-free due to type confusion flaws

MFSA-2015-40 Same-origin bypass through anchor navigation

MFSA-2015-41 PRNG weakness allows for DNS poisoning on Android

MFSA-2015-42 Windows can retain access to privileged content on navigation to unprivileged pages

CVE-2012-2808 CVE-2015-0800 CVE-2015-0801 CVE-2015-0802 CVE-2015-0803 CVE-2015-0804 CVE-2015-0805 CVE-2015-0806 CVE-2015-0807 CVE-2015-0808 CVE-2015-0810 CVE-2015-0811 CVE-2015-0812 CVE-2015-0813 CVE-2015-0814 CVE-2015-0815 CVE-2015-0816 https://www.mozilla.org/security/advisories/mfsa2015-30/ https://www.mozilla.org/security/advisories/mfsa2015-31/ https://www.mozilla.org/security/advisories/mfsa2015-32/ https://www.mozilla.org/security/advisories/mfsa2015-33/ https://www.mozilla.org/security/advisories/mfsa2015-34/ https://www.mozilla.org/security/advisories/mfsa2015-35/ https://www.mozilla.org/security/advisories/mfsa2015-36/ https://www.mozilla.org/security/advisories/mfsa2015-37/ https://www.mozilla.org/security/advisories/mfsa2015-38/ https://www.mozilla.org/security/advisories/mfsa2015-39/ https://www.mozilla.org/security/advisories/mfsa2015-40/ https://www.mozilla.org/security/advisories/mfsa2015-41/ https://www.mozilla.org/security/advisories/mfsa2015-42/ https://www.mozilla.org/security/advisories/ 2015-03-31 2015-03-31
osc -- shell command injection via crafted _service files osc 0.151.0

SUSE Security Update reports:

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

CVE-2015-0778 https://www.suse.com/security/cve/CVE-2015-0778.html https://bugzilla.suse.com/show_bug.cgi?id=901643 http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html 2015-03-16 2015-03-31
cpio -- multiple vulnerabilities gcpio 2.11_3

From the Debian Security Team:

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

CVE-2014-9112 https://security-tracker.debian.org/tracker/CVE-2014-9112 CVE-2015-1197 https://bugzilla.suse.com/show_bug.cgi?id=658010 2015-03-27 2015-03-31
libzip -- integer overflow libzip 0.11.2_2 ppsspp 1.0.1_5 ppsspp-devel 1.0.1.2668_1 radare2 0.9.8_1 openlierox 0.58.r3_5,1

libzip developers report:

Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip.

https://bugs.php.net/bug.php?id=69253 https://github.com/php/php-src/commit/ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5 http://hg.nih.at/libzip/rev/9f11d54f692e CVE-2015-2331 2015-03-18 2015-03-28 2015-09-20
django -- multiple vulnerabilities py27-django 1.41.4.20 1.61.6.11 1.71.7.7 py32-django 1.41.4.20 1.61.6.11 1.71.7.7 py33-django 1.41.4.20 1.61.6.11 1.71.7.7 py34-django 1.41.4.20 1.61.6.11 1.71.7.7 py27-django-devel 20150326,1 py32-django-devel 20150326,1 py33-django-devel 20150326,1 py34-django-devel 20150326,1

The Django project reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and 1.8c1. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.

https://www.djangoproject.com/weblog/2015/mar/18/security-releases/ CVE-2015-2316 CVE-2015-2317 2015-03-18 2015-03-27
GNU binutils -- multiple vulnerabilities cross-binutils 2.25 x86_64-pc-mingw32-binutils 2.25

US-CERT/NIST reports:

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.

US-CERT/NIST reports:

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file.

US-CERT/NIST reports:

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file.

CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8501 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8502 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8503 2014-12-09 2015-03-24
libuv -- incorrect revocation order while relinquishing privileges node010 0.10.36

Nodejs releases reports:

CVE-2015-0278

This may potentially allow an attacker to gain elevated privileges.

http://blog.nodejs.org/2015/03/14/node-v0-10-37-stable ports/198861 CVE-2015-0278 2015-03-14 2015-03-24
jenkins -- multiple vulnerabilities jenkins 1.605 jenkins-lts 1.596.1

Jenkins Security Advisory:

Description

SECURITY-171, SECURITY-177 (Reflective XSS vulnerability)

An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker.

SECURITY-180 (forced API token change)

The part of Jenkins that issues a new API token was not adequately protected against anonymous attackers. This allows an attacker to escalate privileges on Jenkins.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23 2015-03-23 2015-03-24
mozilla -- multiple vulnerabilities firefox 36.0.4,1 firefox-esr 31.5.3,1 linux-firefox 36.0.4,1 linux-seamonkey 2.33.1 seamonkey 2.33.1 libxul 31.5.3

The Mozilla Project reports:

MFSA-2015-28 Privilege escalation through SVG navigation

MFSA-2015-29 Code execution through incorrect JavaScript bounds checking elimination

CVE-2015-0817 CVE-2015-0818 https://www.mozilla.org/security/advisories/mfsa2015-28/ https://www.mozilla.org/security/advisories/mfsa2015-29/ https://www.mozilla.org/security/advisories/ 2015-03-20 2015-03-22
OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_19 mingw32-openssl 1.0.11.0.1m linux-c6-openssl 1.0.1e_4 libressl 2.1.5_1

OpenSSL project reports:

  • Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204). OpenSSL only.
  • Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
  • ASN.1 structure reuse memory corruption (CVE-2015-0287)
  • PKCS7 NULL pointer dereferences (CVE-2015-0289)
  • Base64 decode (CVE-2015-0292). OpenSSL only.
  • DoS via reachable assert in SSLv2 servers (CVE-2015-0293). OpenSSL only.
  • Use After Free following d2i_ECPrivatekey error (CVE-2015-0209)
  • X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)
ports/198681 CVE-2015-0204 CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0292 CVE-2015-0293 CVE-2015-0209 CVE-2015-0288 https://www.openssl.org/news/secadv_20150319.txt 2015-03-19 2015-03-19 2015-03-24
libXfont -- BDF parsing issues libXfont 1.5.1 linux-c6-xorg-libs * linux-f10-xorg-libs *

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered an issue in the parsing of BDF font files by libXfont. Additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop (afl) tool uncovered two more issues in the parsing of BDF font files.

As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server (often root access).

http://lists.x.org/archives/xorg-announce/2015-March/002550.html CVE-2015-1802 CVE-2015-1803 CVE-2015-1804 2015-03-17 2015-03-18 2015-07-15
Adobe Flash Player -- critical vulnerabilities linux-c6-flashplugin 11.2r202.442 linux-f10-flashplugin 11.2r202.442

Adobe reports:

Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-0332, CVE-2015-0333, CVE-2015-0335, CVE-2015-0339). These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2015-0334, CVE-2015-0336). These updates resolve a vulnerability that could lead to a cross-domain policy bypass (CVE-2015-0337). These updates resolve a vulnerability that could lead to a file upload restriction bypass (CVE-2015-0340). These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-0338). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-0341, CVE-2015-0342).

https://helpx.adobe.com/security/products/flash-player/apsb15-05.html CVE-2015-0332 CVE-2015-0333 CVE-2015-0334 CVE-2015-0335 CVE-2015-0336 CVE-2015-0337 CVE-2015-0338 CVE-2015-0339 CVE-2015-0340 CVE-2015-0341 CVE-2015-0342 2015-03-12 2015-03-13
sympa -- Remote attackers can read arbitrary files sympa 6.1.24

The Sympa Project reports:

The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.

https://www.sympa.org/security_advisories CVE-2015-1306 2015-01-13 2015-03-13
rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities rt42 4.2.04.2.10 rt40 4.0.04.0.23

Best Practical reports:

RT 3.0.0 and above, if running on Perl 5.14.0 or higher, are vulnerable to a remote denial-of-service via the email gateway; any installation which accepts mail from untrusted sources is vulnerable, regardless of the permissions configuration inside RT. This denial-of-service may encompass both CPU and disk usage, depending on RT's logging configuration. This vulnerability is assigned CVE-2014-9472.

RT 3.8.8 and above are vulnerable to an information disclosure attack which may reveal RSS feeds URLs, and thus ticket data; this vulnerability is assigned CVE-2015-1165. RSS feed URLs can also be leveraged to perform session hijacking, allowing a user with the URL to log in as the user that created the feed; this vulnerability is assigned CVE-2015-1464.

http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html CVE-2014-9472 CVE-2015-1165 CVE-2015-1464 2015-02-26 2015-03-08
phpMyAdmin -- Risk of BREACH attack due to reflected parameter phpMyAdmin 4.3.04.3.11.1

The phpMyAdmin development team reports:

Risk of BREACH attack due to reflected parameter.

With a large number of crafted requests it was possible to infer the CSRF token by a BREACH attack.

Mitigation factor: this vulnerability can only be exploited in the presence of another vulnerability that allows the attacker to inject JavaScript into victim's browser.

http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php CVE-2015-2206 2015-03-04 2015-03-08
mono -- TLS bugs mono 3.10.1 3.123.12.1

The Mono project reports:

Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in SKIP-TLS post.

Mono’s implementation of SSL/TLS also contained support for the weak EXPORT cyphers and was susceptible to the FREAK attack.

http://www.mono-project.com/docs/about-mono/vulnerabilities/#tls-bugs 2015-03-06 2015-03-07
PuTTY -- fails to scrub private keys from memory after use putty 0.64

Simon Tatham reports:

When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys.

PuTTY 0.63 and earlier versions, after loading a private key from a disk file, mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created.

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html CVE-2015-2157 2015-02-28 2015-03-05
chromium -- multiple vulnerabilities chromium 41.0.2272.76 chromium-npapi 41.0.2272.76 chromium-pulse 41.0.2272.76

Chrome Releases reports:

51 security fixes in this release, including:

  • [456516] High CVE-2015-1212: Out-of-bounds write in media. Credit to anonymous.
  • [448423] High CVE-2015-1213: Out-of-bounds write in skia filters. Credit to cloudfuzzer.
  • [445810] High CVE-2015-1214: Out-of-bounds write in skia filters. Credit to cloudfuzzer.
  • [445809] High CVE-2015-1215: Out-of-bounds write in skia filters. Credit to cloudfuzzer.
  • [454954] High CVE-2015-1216: Use-after-free in v8 bindings. Credit to anonymous.
  • [456192] High CVE-2015-1217: Type confusion in v8 bindings. Credit to anonymous.
  • [456059] High CVE-2015-1218: Use-after-free in dom. Credit to cloudfuzzer.
  • [446164] High CVE-2015-1219: Integer overflow in webgl. Credit to Chen Zhang (demi6od) of NSFOCUS Security Team.
  • [437651] High CVE-2015-1220: Use-after-free in gif decoder. Credit to Aki Helin of OUSPG.
  • [455368] High CVE-2015-1221: Use-after-free in web databases. Credit to Collin Payne.
  • [448082] High CVE-2015-1222: Use-after-free in service workers. Credit to Collin Payne.
  • [454231] High CVE-2015-1223: Use-after-free in dom. Credit to Maksymillian Motyl.
  • High CVE-2015-1230: Type confusion in v8. Credit to Skylined working with HP's Zero Day Initiative.
  • [449958] Medium CVE-2015-1224: Out-of-bounds read in vpxdecoder. Credit to Aki Helin of OUSPG.
  • [446033] Medium CVE-2015-1225: Out-of-bounds read in pdfium. Credit to cloudfuzzer.
  • [456841] Medium CVE-2015-1226: Validation issue in debugger. Credit to Rob Wu.
  • [450389] Medium CVE-2015-1227: Uninitialized value in blink. Credit to Christoph Diehl.
  • [444707] Medium CVE-2015-1228: Uninitialized value in rendering. Credit to miaubiz.
  • [431504] Medium CVE-2015-1229: Cookie injection via proxies. Credit to iliwoy.
  • [463349] CVE-2015-1231: Various fixes from internal audits, fuzzing, and other initiatives.
CVE-2015-1212 CVE-2015-1213 CVE-2015-1214 CVE-2015-1215 CVE-2015-1216 CVE-2015-1217 CVE-2015-1218 CVE-2015-1219 CVE-2015-1220 CVE-2015-1221 CVE-2015-1222 CVE-2015-1223 CVE-2015-1224 CVE-2015-1225 CVE-2015-1226 CVE-2015-1227 CVE-2015-1228 CVE-2015-1229 CVE-2015-1230 CVE-2015-1231 http://googlechromereleases.blogspot.nl 2015-03-03 2015-03-04
qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler qt4-gui 4.8.6_4 qt5-gui 5.3.2_2

Richard J. Moore reports:

The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug that would lead to a divsion by zero when loading certain corrupt BMP files. This in turn would cause the application loading these hand crafted BMPs to crash.

CVE-2015-0295 http://lists.qt-project.org/pipermail/announce/2015-February/000059.html 2015-02-22 2015-03-05
jenkins -- multiple vulnerabilities jenkins 1.600 jenkins-lts 1.580.3

Kohsuke Kawaguchi from Jenkins team reports:

Description

SECURITY-125 (Combination filter Groovy script unsecured)

This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master.

SECURITY-162 (directory traversal from artifacts via symlink)

This vulnerability allows users with the job configuration privilege or users with commit access to the build script to access arbitrary files/directories on the master, resulting in the exposure of sensitive information, such as encryption keys.

SECURITY-163 (update center metadata retrieval DoS attack)

This vulnerability allows authenticated users to disrupt the operation of Jenkins by feeding malicious update center data into Jenkins, affecting plugin installation and tool installation.

SECURITY-165 (external entity injection via XPath)

This vulnerability allows users with the read access to Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins.

SECURITY-166 (HudsonPrivateSecurityRealm allows creation of reserved names)

For users using "Jenkins' own user database" setting, Jenkins doesn't refuse reserved names, thus allowing privilege escalation.

SECURITY-167 (External entity processing in XML can reveal sensitive local files)

This vulnerability allows attackers to create malicious XML documents and feed that into Jenkins, which causes Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins.

Severity

SECURITY-125 is rated critical. This attack can be only mounted by users with some trust, but it results in arbitrary code execution on the master.

SECURITY-162 is rated critical. This attack can be only mounted by users with some trust, but it results in the exposure of sensitive information.

SECURITY-163 is rated medium, as it results in the loss of functionality.

SECURITY-165 is rated critical. This attack is easy to mount, and it results in the exposure of sensitive information.

SECURITY-166 is rated critical. For users who use the affected feature, this attack results in arbitrary code execution on the master.

SECURITY-167 is rated critical. This attack is easy to mount, and it results in the exposure of sensitive information.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 2015-03-01 2015-03-01
mozilla -- multiple vulnerabilities firefox 36.0,1 firefox-esr 31.5.0,1 linux-firefox 36.0,1 linux-seamonkey 2.33 linux-thunderbird 31.5.0 seamonkey 2.33 thunderbird 31.5.0 libxul 31.5.0

The Mozilla Project reports:

MFSA-2015-11 Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)

MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files

MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections

MFSA-2015-14 Malicious WebGL content crash when writing strings

MFSA-2015-15 TLS TURN and STUN connections silently fail to simple TCP connections

MFSA-2015-16 Use-after-free in IndexedDB

MFSA-2015-17 Buffer overflow in libstagefright during MP4 video playback

MFSA-2015-18 Double-free when using non-default memory allocators with a zero-length XHR

MFSA-2015-19 Out-of-bounds read and write while rendering SVG content

MFSA-2015-20 Buffer overflow during CSS restyling

MFSA-2015-21 Buffer underflow during MP3 playback

MFSA-2015-22 Crash using DrawTarget in Cairo graphics library

MFSA-2015-23 Use-after-free in Developer Console date with OpenType Sanitiser

MFSA-2015-24 Reading of local files through manipulation of form autocomplete

MFSA-2015-25 Local files or privileged URLs in pages can be opened into new tabs

MFSA-2015-26 UI Tour whitelisted sites in background tab can spoof foreground tabs

MFSA-2015-27 Caja Compiler JavaScript sandbox bypass

CVE-2015-0819 CVE-2015-0820 CVE-2015-0821 CVE-2015-0822 CVE-2015-0823 CVE-2015-0824 CVE-2015-0825 CVE-2015-0826 CVE-2015-0827 CVE-2015-0828 CVE-2015-0829 CVE-2015-0830 CVE-2015-0831 CVE-2015-0832 CVE-2015-0833 CVE-2015-0834 CVE-2015-0835 CVE-2015-0836 https://www.mozilla.org/security/advisories/mfsa2015-11/ https://www.mozilla.org/security/advisories/mfsa2015-12/ https://www.mozilla.org/security/advisories/mfsa2015-13/ https://www.mozilla.org/security/advisories/mfsa2015-14/ https://www.mozilla.org/security/advisories/mfsa2015-15/ https://www.mozilla.org/security/advisories/mfsa2015-16/ https://www.mozilla.org/security/advisories/mfsa2015-17/ https://www.mozilla.org/security/advisories/mfsa2015-18/ https://www.mozilla.org/security/advisories/mfsa2015-19/ https://www.mozilla.org/security/advisories/mfsa2015-20/ https://www.mozilla.org/security/advisories/mfsa2015-21/ https://www.mozilla.org/security/advisories/mfsa2015-22/ https://www.mozilla.org/security/advisories/mfsa2015-23/ https://www.mozilla.org/security/advisories/mfsa2015-24/ https://www.mozilla.org/security/advisories/mfsa2015-25/ https://www.mozilla.org/security/advisories/mfsa2015-26/ https://www.mozilla.org/security/advisories/mfsa2015-27/ https://www.mozilla.org/security/advisories/ 2015-02-24 2015-02-27
php5 -- multiple vulnerabilities php5 5.4.38 php55 5.5.22 php56 5.6.6

The PHP Project reports:

Use after free vulnerability in unserialize() with DateTimeZone.

Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer overflow.

CVE-2015-0235 CVE-2015-0273 http://php.net/ChangeLog-5.php#5.4.38 http://php.net/ChangeLog-5.php#5.5.22 http://php.net/ChangeLog-5.php#5.6.6 2015-02-18 2015-02-26
krb5 1.11 -- New release/fix multiple vulnerabilities krb5-111 1.11.6

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6:

Handle certain invalid RFC 1964 GSS tokens correctly to avoid invalid memory reference vulnerabilities. [CVE-2014-4341

Fix memory management vulnerabilities in GSSAPI SPNEGO. [CVE-2014-4343 CVE-2014-4344]

Fix buffer overflow vulnerability in LDAP KDB back end. [CVE-2014-4345]

Fix multiple vulnerabilities in the LDAP KDC back end. [CVE-2014-5354 CVE-2014-5353]

Fix multiple kadmind vulnerabilities, some of which are based in the gssrpc library. [CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]

http://web.mit.edu/kerberos/krb5-1.11/README-1.11.6.txt 2015-02-25 2015-02-25
samba -- Unexpected code execution in smbd samba4 4.0.04.0.25 samba41 4.1.04.1.17 samba36 3.6.03.6.25

Samba developement team reports:

All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon.

A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges.

CVE-2015-0240 https://www.samba.org/samba/security/CVE-2015-0240 2015-02-23 2015-02-23
e2fsprogs -- buffer overflow if s_first_meta_bg too big e2fsprogs 1.42.12

Theodore Ts'o reports:

If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.

The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.

http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 http://www.ocert.org/advisories/ocert-2015-002.html https://bugzilla.redhat.com/show_bug.cgi?id=1187032 CVE-2015-0247 2014-08-09 2015-02-24
e2fsprogs -- potential buffer overflow in closefs() e2fsprogs 1.42.12_2

Theodore Ts'o reports:

On a carefully crafted filesystem that gets modified through tune2fs or debugfs, it is possible to trigger a buffer overrun when the file system is closed via closefs().

http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?h=maint&id=49d0fe2a14f2a23da2fe299643379b8c1d37df73 CVE-2015-1572 2015-02-06 2015-02-24
bind -- denial of service vulnerability bind910 bind910-base 9.10.1P2 bind99 bind99-base 9.9.6P2 FreeBSD 9.39.3_10 8.48.4_24

ISC reports:

When configured to perform DNSSEC validation, named can crash when encountering a rare set of conditions in the managed trust anchors.

CVE-2015-1349 https://kb.isc.org/article/AA-01235 2015-02-18 2015-02-23
krb5 1.12 -- New release/fix multiple vulnerabilities krb5-112 1.12.3

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3:

Fix multiple vulnerabilities in the LDAP KDC back end. [CVE-2014-5354] [CVE-2014-5353]

Fix multiple kadmind vulnerabilities, some of which are based in the gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423]

http://web.mit.edu/kerberos/krb5-1.12/README-1.12.3.txt 2015-02-20 2015-02-21
unzip -- heap based buffer overflow in iconv patch unzip 6.0_5

Ubuntu Security Notice USN-2502-1 reports:

unzip could be made to run programs if it opened a specially crafted file.

CVE-2015-1315 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1315.html https://security-tracker.debian.org/tracker/CVE-2015-1315 http://www.ubuntu.com/usn/usn-2502-1/ 2015-02-17 2015-02-17
krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 krb5 1.13.1 krb5-112 1.12.2_2 krb5-111 1.11.5_5

The MIT Kerberos team reports:

CVE-2014-5353: The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

CVE-2014-5354: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.

CVE-2014-5353 CVE-2014-5354 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt 2015-02-12 2015-02-12 2015-02-13
xorg-server -- Information leak in the XkbSetGeometry request of X servers. xorg-server 1.14.7_2,1 xorg-server 1.15.0,11.16.4,1

Peter Hutterer reports:

Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request.

The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. The data length is at least up to 64k, it is possible to obtain more data by chaining strings, each string length is then determined by whatever happens to be in that 16-bit region of memory.

A similarly crafted request can likely cause the X server to crash.

CVE-2015-0255 http://lists.freedesktop.org/archives/xorg/2015-February/057158.html 2015-02-10 2015-02-12
openldap -- two remote denial of service vulnerabilities openldap-server 2.4.40_3

Ryan Tandy reports:

With the deref overlay enabled, ldapsearch with '-E deref=member:' causes slapd to crash.

Bill MacAllister discovered that certain queries cause slapd to crash while freeing operation controls. This is a 2.4.40 regression. Earlier releases are not affected.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991 2015-02-02 2015-02-06
chromium -- multiple vulnerabilities chromium 40.0.2214.111 chromium-pulse 40.0.2214.111

Chrome Releases reports:

11 security fixes in this release, including:

  • [447906] High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian.
  • [453979] High CVE-2015-1210: Cross-origin-bypass in V8 bindings. Credit to anonymous.
  • [453982] High CVE-2015-1211: Privilege escalation using service workers. Credit to anonymous.
  • [455225] CVE-2015-1212: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2015-1209 CVE-2015-1210 CVE-2015-1211 CVE-2015-1212 http://googlechromereleases.blogspot.nl 2015-02-05 2015-02-06
PostgreSQL -- multiple buffer overflows and memory issues postgresql90-server 9.0.09.0.19 postgresql91-server 9.1.09.1.15 postgresql92-server 9.2.09.2.10 postgresql93-server 9.3.09.3.6 postgresql94-server 9.4.09.4.1

PostgreSQL Project reports:

This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list of security holes patched below in case they are particularly vulnerable.

  1. CVE-2015-0241 Buffer overruns in "to_char" functions.
  2. CVE-2015-0242 Buffer overrun in replacement printf family of functions.
  3. CVE-2015-0243 Memory errors in functions in the pgcrypto extension.
  4. CVE-2015-0244 An error in extended protocol message reading.
  5. CVE-2014-8161 Constraint violation errors can cause display of values in columns which the user would not normally have rights to see.
CVE-2015-0241 CVE-2015-0242 CVE-2015-0243 CVE-2015-0244 CVE-2014-8161 2015-02-05 2015-02-05
krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 krb5 1.13_1 krb5-112 1.12.2_1 krb5-111 1.11.5_4

SO-AND-SO reports:

CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after gss_process_context_token() is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and double-free memory access violations. libgssrpc server applications such as kadmind are vulnerable as they can be instructed to call gss_process_context_token().

CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR data from an authenticated user, it may perform use-after-free and double-free memory access violations while cleaning up the partial deserialization results. Other libgssrpc server applications may also be vulnerable if they contain insufficiently defensive XDR functions.

CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepts authentications to two-component server principals whose first component is a left substring of "kadmin" or whose realm is a left prefix of the default realm.

CVE-2014-9423: libgssrpc applications including kadmind output four or eight bytes of uninitialized memory to the network as part of an unused "handle" field in replies to clients.

CVE-2014-5352 CVE-2014-9421 CVE-2014-9422 CVE-2014-9423 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt 2015-02-03 2015-02-04
unzip -- out of boundary access issues in test_compr_eb unzip 6.0_4

Ubuntu Security Notice USN-2489-1 reports:

Michal Zalewski discovered that unzip incorrectly handled certain malformed zip archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code.

CVE-2014-9636 http://www.ubuntu.com/usn/usn-2489-1/ http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9636.html http://seclists.org/oss-sec/2014/q4/489 http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450 2014-11-02 2015-02-03
Xymon -- buffer overrun xymon-server 4.3.44.3.18

Debian reports:

web/acknowledge.c uses a string twice in a format string, but only allocates memory for one copy.

http://www.openwall.com/lists/oss-security/2015/01/31/4 https://security-tracker.debian.org/tracker/CVE-2015-1430 CVE-2015-1430 2014-09-28 2015-02-02
rabbitmq -- Security issues in management plugin rabbitmq 3.4.3

The RabbitMQ project reports:

Some user-controllable content was not properly HTML-escaped before being presented to a user in the management web UI:

  • When a user unqueued a message from the management UI, message details (header names, arguments, etc.) were displayed unescaped. An attacker could publish a specially crafted message to add content or execute arbitrary Javascript code on behalf of a user, if this user unqueued the message from the management UI.
  • When viewing policies, their name was displayed unescaped. An attacker could create a policy with a specially crafted name to add content or execute arbitrary Javascript code on behalf of a user who is viewing policies.
  • When listing connected AMQP network clients, client details such as its version were displayed unescaped. An attacker could use a client with a specially crafted version field to add content or execute arbitrary Javascript code on behalf of a user who is viewing connected clients.

In all cases, the attacker needs a valid user account on the targetted RabbitMQ cluster.

Furthermore, some admin-controllable content was not properly escaped:

  • user names;
  • the cluster name.

Likewise, an attacker could add content or execute arbitrary Javascript code on behalf of a user using the management web UI. However, the attacker must be an administrator on the RabbitMQ cluster, thus a trusted user.

http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100 http://www.rabbitmq.com/release-notes/README-3.4.3.txt CVE-2015-0862 2015-01-08 2015-01-31
apache24 -- several vulnerabilities apache24 2.4.12

Apache HTTP SERVER PROJECT reports:

mod_proxy_fcgi: Fix a potential crash due to buffer over-read, with response headers' size above 8K.

mod_cache: Avoid a crash when Content-Type has an empty value. PR 56924.

mod_lua: Fix handling of the Require line when a LuaAuthzProvider is used in multiple Require directives with different arguments. PR57204.

core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior.

CVE-2014-3583 CVE-2014-3581 CVE-2014-8109 CVE-2013-5704 2015-01-29 2015-01-31
asterisk -- Mitigation for libcURL HTTP request injection vulnerability asterisk 1.8.32.2 asterisk11 11.15.1 asterisk13 13.1.1

The Asterisk project reports:

CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules.

Since Asterisk may be configured to allow for user-supplied URLs to be passed to libcURL, it is possible that an attacker could use Asterisk as an attack vector to inject unauthorized HTTP requests if the version of libcURL installed on the Asterisk server is affected by CVE-2014-8150.

http://downloads.asterisk.org/pub/security/AST-2015-002.html 2015-01-12 2015-01-29
asterisk -- File descriptor leak when incompatible codecs are offered asterisk13 13.1.1

The Asterisk project reports:

Asterisk may be configured to only allow specific audio or video codecs to be used when communicating with a particular endpoint. When an endpoint sends an SDP offer that only lists codecs not allowed by Asterisk, the offer is rejected. However, in this case, RTP ports that are allocated in the process are not reclaimed.

This issue only affects the PJSIP channel driver in Asterisk. Users of the chan_sip channel driver are not affected.

As the resources are allocated after authentication, this issue only affects communications with authenticated endpoints.

http://downloads.asterisk.org/pub/security/AST-2015-001.html CVE-2015-1558 2015-01-06 2015-01-29 2015-02-17
glibc -- gethostbyname buffer overflow linux_base-c6 6.6_2 linux_base-f10 0 linux-c6-devtools 6.6_3 linux-f10-devtools 0

Robert Krátký reports:

GHOST is a 'buffer overflow' bug affecting the gethostbyname() and gethostbyname2() function calls in the glibc library. This vulnerability allows a remote attacker that is able to make an application call to either of these functions to execute arbitrary code with the permissions of the user running the application. The gethostbyname() function calls are used for DNS resolving, which is a very common event. To exploit this vulnerability, an attacker must trigger a buffer overflow by supplying an invalid hostname argument to an application that performs a DNS resolution.

CVE-2015-0235 https://access.redhat.com/articles/1332213 http://www.openwall.com/lists/oss-security/2015/01/27/9 2015-01-27 2015-01-28 2015-02-02
Adobe Flash Player -- critical vulnerability linux-c6-flashplugin 11.2r202.438 linux-f10-flashplugin 11.2r202.438

Adobe reports:

Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below.

CVE-2015-0311 https://helpx.adobe.com/security/products/flash-player/apsa15-01.html 2015-01-22 2015-01-26
Bugzilla multiple security issues bugzilla44 4.4.7

Bugzilla Security Advisory

Command Injection

Some code in Bugzilla does not properly utilize 3 arguments form for open() and it is possible for an account with editcomponents permissions to inject commands into product names and other attributes.

Information Leak

Using the WebServices API, a user can possibly execute imported functions from other non-WebService modules. A whitelist has now been added that lists explicit methods that can be executed via the API.

CVE-2014-8630 https://bugzilla.mozilla.org/show_bug.cgi?id=1079065 https://bugzilla.mozilla.org/show_bug.cgi?id=1090275 2015-01-21 2015-01-26
django -- multiple vulnerabilities py27-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py32-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py33-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py34-django 1.41.4.18 1.51.5.12 1.61.6.10 1.71.7.3 py27-django-devel 20150124,1 py32-django-devel 20150124,1 py33-django-devel 20150124,1 py34-django-devel 20150124,1

The Django project reports:

Today the Django team is issuing multiple releases -- Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our security process. These releases are now available on PyPI and our download page.

These releases address several security issues. We encourage all users of Django to upgrade as soon as possible.

https://www.djangoproject.com/weblog/2015/jan/13/security/ CVE-2015-0219 CVE-2015-0220 CVE-2015-0221 CVE-2015-0222 2015-01-13 2015-01-23 2015-01-24
libutp -- remote denial of service or arbitrary code execution bittorrent-libutp 0.20130514_1 transmission-cli transmission-deamon transmission-gtk transmission-qt4 2.74

NVD reports:

Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."

CVE-2012-6129 https://github.com/bittorrent/libutp/issues/38 https://trac.transmissionbt.com/ticket/5002 2012-08-01 2014-12-29
LibreSSL -- DTLS vulnerability libressl 2.1.3

OpenSSL Security Advisory:

A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion.

CVE-2015-0206 https://www.openssl.org/news/secadv_20150108.txt 2015-01-08 2015-01-22
Adobe Flash Player -- multiple vulnerabilities linux-c6-flashplugin 11.2r202.429 linux-f10-flashplugin 11.2r202.429

Adobe reports:

These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.

CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 2015-01-13 2015-01-22
chromium -- multiple vulnerabilities chromium 40.0.2214.91 chromium-pulse 40.0.2214.91

Google Chrome Releases reports:

62 security fixes in this release, including:

  • [430353] High CVE-2014-7923: Memory corruption in ICU. Credit to yangdingning.
  • [435880] High CVE-2014-7924: Use-after-free in IndexedDB. Credit to Collin Payne.
  • [434136] High CVE-2014-7925: Use-after-free in WebAudio. Credit to mark.buer.
  • [422824] High CVE-2014-7926: Memory corruption in ICU. Credit to yangdingning.
  • [444695] High CVE-2014-7927: Memory corruption in V8. Credit to Christian Holler.
  • [435073] High CVE-2014-7928: Memory corruption in V8. Credit to Christian Holler.
  • [442806] High CVE-2014-7930: Use-after-free in DOM. Credit to cloudfuzzer.
  • [442710] High CVE-2014-7931: Memory corruption in V8. Credit to cloudfuzzer.
  • [443115] High CVE-2014-7929: Use-after-free in DOM. Credit to cloudfuzzer.
  • [429666] High CVE-2014-7932: Use-after-free in DOM. Credit to Atte Kettunen of OUSPG.
  • [427266] High CVE-2014-7933: Use-after-free in FFmpeg. Credit to aohelin.
  • [427249] High CVE-2014-7934: Use-after-free in DOM. Credit to cloudfuzzer.
  • [402957] High CVE-2014-7935: Use-after-free in Speech. Credit to Khalil Zhani.
  • [428561] High CVE-2014-7936: Use-after-free in Views. Credit to Christoph Diehl.
  • [419060] High CVE-2014-7937: Use-after-free in FFmpeg. Credit to Atte Kettunen of OUSPG.
  • [416323] High CVE-2014-7938: Memory corruption in Fonts. Credit to Atte Kettunen of OUSPG.
  • [399951] High CVE-2014-7939: Same-origin-bypass in V8. Credit to Takeshi Terada.
  • [433866] Medium CVE-2014-7940: Uninitialized-value in ICU. Credit to miaubiz.
  • [428557] Medium CVE-2014-7941: Out-of-bounds read in UI. Credit to Atte Kettunen of OUSPG and Christoph Diehl.
  • [426762] Medium CVE-2014-7942: Uninitialized-value in Fonts. Credit to miaubiz.
  • [422492] Medium CVE-2014-7943: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
  • [418881] Medium CVE-2014-7944: Out-of-bounds read in PDFium. Credit to cloudfuzzer.
  • [414310] Medium CVE-2014-7945: Out-of-bounds read in PDFium. Credit to cloudfuzzer.
  • [414109] Medium CVE-2014-7946: Out-of-bounds read in Fonts. Credit to miaubiz.
  • [430566] Medium CVE-2014-7947: Out-of-bounds read in PDFium. Credit to fuzztercluck.
  • [414026] Medium CVE-2014-7948: Caching error in AppCache. Credit to jiayaoqijia.
  • [449894] CVE-2015-1205: Various fixes from internal audits, fuzzing and other initiatives.
  • Multiple vulnerabilities in V8 fixed at the tip of the 3.30 branch (currently 3.30.33.15).
CVE-2014-7923 CVE-2014-7924 CVE-2014-7925 CVE-2014-7926 CVE-2014-7927 CVE-2014-7928 CVE-2014-7929 CVE-2014-7930 CVE-2014-7931 CVE-2014-7932 CVE-2014-7933 CVE-2014-7934 CVE-2014-7935 CVE-2014-7936 CVE-2014-7937 CVE-2014-7938 CVE-2014-7939 CVE-2014-7940 CVE-2014-7941 CVE-2014-7942 CVE-2014-7943 CVE-2014-7944 CVE-2014-7945 CVE-2014-7946 CVE-2014-7947 CVE-2014-7948 CVE-2015-1205 http://googlechromereleases.blogspot.nl 2015-01-21 2015-01-21
polarssl -- Remote attack using crafted certificates polarssl 1.2.01.2.12_1 polarssl13 1.3.01.3.9_1

PolarSSL team reports:

During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarssl_free().

This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this means clients when receiving a certificate from the server or servers in case they are actively asking for a client certificate.

CVE-2015-1182 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04 https://www.certifiedsecure.com/polarssl-advisory/ 2015-01-14 2015-01-19
unzip -- input sanitization errors unzip 6.0_2

oCERT reports:

The UnZip tool is an open source extraction utility for archives compressed in the zip format.

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification, the test_compr_eb() and the getZip64Data() functions. The input errors may result in arbitrary code execution.

A specially crafted zip file, passed to unzip -t, can be used to trigger the vulnerability.

CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 http://www.info-zip.org/UnZip.html https://bugzilla.redhat.com/show_bug.cgi?id=1174844 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140 https://bugzilla.redhat.com/show_bug.cgi?id=1174856 2014-12-03 2015-01-16
samba -- Elevation of privilege to Active Directory Domain Controller samba4 4.0.04.0.23 samba41 4.1.04.1.15

Samba team reports:

In Samba's AD DC we neglected to ensure that attempted modifications of the userAccountControl attribute did not allow the UF_SERVER_TRUST_ACCOUNT bit to be set.

CVE-2014-8143 https://www.samba.org/samba/security/CVE-2014-8143 2015-01-15 2015-01-16
kde-runtime -- incorrect CBC encryption handling kde-runtime 4.12_3

Valentin Rusu reports:

Until KDE Applications 14.12.0, kwalletd incorrectly handled CBC encryption blocks when encrypting secrets in kwl files. The secrets were still encrypted, but the result binary data corresponded to an ECB encrypted block instead of CBC.

The ECB encryption algorithm, even if it'll scramble user data, will produce same encrypted byte sequence for the same input text. As a result, attackers may eventually find-out the encrypted text.

CVE-2013-7252 https://www.kde.org/info/security/advisory-20150109-1.txt 2015-01-09 2015-01-14
mozilla -- multiple vulnerabilities firefox 35.0,1 firefox-esr 31.4.0,1 linux-firefox 35.0,1 linux-seamonkey 2.32 linux-thunderbird 31.4.0 seamonkey 2.32 thunderbird 31.4.0 libxul 31.4.0

The Mozilla Project reports:

MFSA-2015-01 Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)

MFSA-2015-02 Uninitialized memory use during bitmap rendering

MFSA-2015-03 sendBeacon requests lack an Origin header

MFSA-2015-04 Cookie injection through Proxy Authenticate responses

MFSA-2015-05 Read of uninitialized memory in Web Audio

MFSA-2015-06 Read-after-free in WebRTC

MFSA-2015-07 Gecko Media Plugin sandbox escape

MFSA-2015-08 Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension

MFSA-2015-09 XrayWrapper bypass through DOM objects

CVE-2014-8634 CVE-2014-8635 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 CVE-2014-8636 https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-02/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-05/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-07/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-08/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-09/ https://www.mozilla.org/security/advisories/ 2015-01-13 2015-01-14
libevent -- integer overflow in evbuffers libevent 1.4.15 libevent2 2.0.22

Debian Security Team reports:

Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.

CVE-2014-6272 https://www.debian.org/security/2015/dsa-3119 2015-01-05 2015-01-11
cURL -- URL request injection vulnerability curl 7.40.0

cURL reports:

When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL. Many programs allow some kind of external sources to set the URL or provide partial pieces for the URL to ask for, and if the URL as received from the user is not stripped good enough this flaw allows malicious users to do additional requests in a way that was not intended, or just to insert request headers into the request that the program didn't intend. We are not aware of any exploit of this flaw.

CVE-2014-8150 http://curl.haxx.se/docs/adv_20150108B.html 2014-12-25 2015-01-09
WebKit-gtk -- Multiple vulnerabilities webkit-gtk2 1.4.8 webkit-gtk3 1.4.8

Webkit release team reports:

This release fixes the following security issues: CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386, CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390.

http://webkitgtk.org/2015/01/07/webkitgtk2.4.8-released.html CVE-2014-1344 CVE-2014-1384 CVE-2014-1385 CVE-2014-1386 CVE-2014-1387 CVE-2014-1388 CVE-2014-1389 CVE-2014-1390 2015-01-07 2015-01-09
OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_17 mingw32-openssl 1.0.11.0.1k linux-c6-openssl 1.0.1e_3

OpenSSL project reports:

DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)

DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)

no-ssl3 configuration sets method to NULL (CVE-2014-3569)

ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)

RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)

DH client certificates accepted without verification [Server] (CVE-2015-0205)

Certificate fingerprints can be modified (CVE-2014-8275)

Bignum squaring may produce incorrect results (CVE-2014-3570)

CVE-2014-3569 CVE-2014-3570 CVE-2014-3571 CVE-2014-3572 CVE-2014-8275 CVE-2015-0204 CVE-2015-0205 CVE-2015-0206 https://www.openssl.org/news/secadv_20150108.txt 2015-01-08 2015-01-08 2015-01-22
wordpress -- multiple vulnerabilities wordpress 3.7.5,1 3.8,13.8.5,1 3.9,13.9.3,1 4.0,14.0.1,1 zh-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1 de-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1 ja-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1 ru-wordpress 3.7.5 3.83.8.5 3.93.9.3 4.04.0.1

MITRE reports:

wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.

WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.

Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.

Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors

wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.

Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.

CVE-2014-9033 CVE-2014-9034 CVE-2014-9035 CVE-2014-9036 CVE-2014-9037 CVE-2014-9038 CVE-2014-9039 2014-11-25 2015-01-05
png -- heap overflow for 32-bit builds png 1.2.61.5.21 1.61.6.16

32-bit builds of PNG library are vulnerable to an unsigned integer overflow that is triggered by a crafted wide interlaced images. Overflow results in a heap corruption that will crash the application and may lead to the controlled overwrite of a selected portions of process address space.

http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt http://codelabs.ru/security/vulns/analysis/libpng/2014-dec-libpng-1.6.15/ 2014-12-23 2015-01-05
file -- multiple vulnerabilities file 5.21 FreeBSD 8.48.4_20 9.19.1_23 9.29.2_16 9.39.3_6 10.010.0_13 10.110.1_1

RedHat reports:

Thomas Jarosch of Intra2net AG reported a number of denial of service issues (resource consumption) in the ELF parser used by file(1). These issues were fixed in the 5.21 release of file(1), but by mistake are missing from the changelog.

CVE-2014-3710 CVE-2014-8116 CVE-2014-8117 FreeBSD-SA-14:28.file http://seclists.org/oss-sec/2014/q4/1056 2014-12-16 2015-01-02
mutt -- denial of service via crafted mail message mutt 1.5.221.5.23_7 ja-mutt 1.5.221.5.23_7 zh-mutt 1.5.221.5.23_7

NVD reports:

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.

71334 CVE-2014-9116 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771125 http://dev.mutt.org/trac/ticket/3716 2014-11-26 2014-12-23
ntp -- multiple vulnerabilities ntp ntp-devel 4.2.8

CERT reports:

The Network Time Protocol (NTP) provides networked systems with a way to synchronize time for various services and applications. ntpd version 4.2.7 and pervious versions allow attackers to overflow several buffers in a way that may allow malicious code to be executed. ntp-keygen prior to version 4.2.7p230 also uses a non-cryptographic random number generator when generating symmetric keys.

The buffer overflow vulnerabilities in ntpd may allow a remote unauthenticated attacker to execute arbitrary malicious code with the privilege level of the ntpd process. The weak default key and non-cryptographic random number generator in ntp-keygen may allow an attacker to gain information regarding the integrity checking and authentication encryption schemes.

CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296 http://www.kb.cert.org/vuls/id/852879 2014-12-19 2014-12-20
git -- Arbitrary command execution on case-insensitive filesystems git 2.2.1

The Git Project reports:

When using a case-insensitive filesystem an attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine. If you are a hosting service whose users may fetch from your service to Windows or Mac OS X machines, you are strongly encouraged to update to protect such users who use existing versions of Git.

CVE-2014-9390 https://github.com/blog/1938-git-client-vulnerability-announced http://article.gmane.org/gmane.linux.kernel/1853266 2014-12-19 2014-12-19
otrs -- Incomplete Access Control otrs 3.2.*3.2.17 3.3.*3.3.11 4.0.*4.0.3

The OTRS project reports:

An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured.

http://www.otrs.com/security-advisory-2014-06-incomplete-access-control/ CVE-2014-9324 2014-12-16 2014-12-16
subversion -- DoS vulnerabilities mod_dav_svn 1.8.01.8.11 subversion16 1.0.01.7.19 subversion17 1.0.01.7.19 subversion 1.0.01.7.19 1.8.01.8.11

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a REPORT request for some invalid formatted special URIs.

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a request for some invalid formatted special URIs.

We consider this to be a medium risk vulnerability. Repositories which allow for anonymous reads will be vulnerable without authentication. Unfortunately, no special configuration is required and all mod_dav_svn servers are vulnerable.

CVE-2014-3580 CVE-2014-8108 http://subversion.apache.org/security/CVE-2014-3580-advisory.txt http://subversion.apache.org/security/CVE-2014-8108-advisory.txt 2014-12-13 2014-12-15
NVIDIA UNIX driver -- remote denial of service or arbitrary code execution nvidia-driver 340.65 nvidia-driver-304 304.125 nvidia-driver-173 173.14.35_3 nvidia-driver-96 96.43.23_2 nvidia-driver-71 71.86.15_4

NVIDIA Unix security team reports:

The GLX indirect rendering support supplied on NVIDIA products is subject to the recently disclosed X.Org vulnerabilities (CVE-2014-8093, CVE-2014-8098) as well as internally identified vulnerabilities (CVE-2014-8298).

Depending on how it is configured, the X server typically runs with raised privileges, and listens for GLX indirect rendering protocol requests from a local socket and potentially a TCP/IP port. The vulnerabilities could be exploited in a way that causes the X server to access uninitialized memory or overwrite arbitrary memory in the X server process. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution.

CVE-2014-8298 CVE-2014-8093 CVE-2014-8098 2014-12-03 2014-12-14
bind -- denial of service vulnerability bind99 bind99-base 9.9.6 bind98 bind98-base bind96 bind96-base 0 FreeBSD 9.39.3_6 9.29.2_16 9.19.1_23 8.48.4_20

ISC reports:

We have today posted updated versions of 9.9.6 and 9.10.1 to address a significant security vulnerability in DNS resolution. The flaw was discovered by Florian Maury of ANSSI, and applies to any recursive resolver that does not support a limit on the number of recursions. [CERTFR-2014-AVI-512], [USCERT VU#264212]

A flaw in delegation handling could be exploited to put named into an infinite loop, in which each lookup of a name server triggered additional lookups of more name servers. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and on the number of queries that it will send before terminating a recursive query (default 50). The recursion depth limit is configured via the max-recursion-depth option, and the query limit via the max-recursion-queries option. For more information, see the security advisory at https://kb.isc.org/article/AA-01216/. [CVE-2014-8500] [RT #37580]

In addition, we have also corrected a potential security vulnerability in the GeoIP feature in the 9.10.1 release only. For more information on this issue, see the security advisory at https://kb.isc.org/article/AA-01217. [CVE-2014-8680]

CVE-2014-8500 CVE-2014-8680 https://www.isc.org/blogs/important-security-advisory-posted/ 2014-12-08 2014-12-11
asterisk -- Remote Crash Vulnerability in WebSocket Server asterisk11 11.14.2

The Asterisk project reports:

When handling a WebSocket frame the res_http_websocket module dynamically changes the size of the memory used to allow the provided payload to fit. If a payload length of zero was received the code would incorrectly attempt to resize to zero. This operation would succeed and end up freeing the memory but be treated as a failure. When the session was subsequently torn down this memory would get freed yet again causing a crash.

Users of the WebSocket functionality also did not take into account that provided text frames are not guaranteed to be NULL terminated. This has been fixed in chan_sip and chan_pjsip in the applicable versions.

http://downloads.asterisk.org/pub/security/AST-2014-019.html CVE-2014-9374 2014-10-30 2014-12-11 2015-01-29
xserver -- multiple issue with X client request handling xorg-server 1.12.4_10,1

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way the X server code base handles requests from X clients, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

The vulnerabilities could be exploited to cause the X server to access uninitialized memory or overwrite arbitrary memory in the X server process. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution.

The GLX extension to the X Window System allows an X client to send X protocol to the X server, to request that the X server perform OpenGL rendering on behalf of the X client. This is known as "GLX indirect rendering", as opposed to "GLX direct rendering" where the X client submits OpenGL rendering commands directly to the GPU, bypassing the X server and avoiding the X server code for GLX protocol handling.

Most GLX indirect rendering implementations share some common ancestry, dating back to "Sample Implementation" code from Silicon Graphics, Inc (SGI), which SGI originally commercially licensed to other Unix workstation and graphics vendors, and later released as open source, so those vulnerabilities may affect other licensees of SGI's code base beyond those running code from the X.Org Foundation or the XFree86 Project.

http://lists.x.org/archives/xorg-announce/2014-December/002500.html CVE-2014-8091 CVE-2014-8092 CVE-2014-8093 CVE-2014-8094 CVE-2014-8095 CVE-2014-8096 CVE-2014-8097 CVE-2014-8098 CVE-2014-8099 CVE-2014-8100 CVE-2014-8101 CVE-2014-8102 2014-12-09 2014-12-10
unbound -- can be tricked into following an endless series of delegations, this consumes a lot of resources unbound 1.5.1

Unbound developer reports:

The resolver can be tricked into following an endless series of delegations, this consumes a lot of resources.

http://unbound.net/downloads/CVE-2014-8602.txt CVE-2014-8602 2014-12-08 2014-12-09
freetype -- Out of bounds stack-based read/write freetype2 2.5.4

Werner LEMBERG reports:

The fix for CVE-2014-2240 was not 100% complete to fix the issue from the CVE completly.

http://lists.nongnu.org/archive/html/freetype-announce/2014-12/msg00000.html CVE-2014-2240 2014-12-07 2014-12-07
phpMyAdmin -- XSS and DoS vulnerabilities phpMyAdmin 4.2.04.2.13.1

The phpMyAdmin development team reports:

DoS vulnerability with long passwords.

With very long passwords it was possible to initiate a denial of service attack on phpMyAdmin.

We consider this vulnerability to be serious.

This vulnerability can be mitigated by configuring throttling in the webserver.

XSS vulnerability in redirection mechanism.

With a crafted URL it was possible to trigger an XSS in the redirection mechanism in phpMyAdmin.

We consider this vulnerability to be non critical.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php CVE-2014-9218 CVE-2014-9219 2014-12-03 2014-12-04
mozilla -- multiple vulnerabilities firefox 34.0,1 firefox-esr 31.3.0,1 linux-firefox 34.0,1 linux-seamonkey 2.31 linux-thunderbird 31.3.0 seamonkey 2.31 thunderbird 31.3.0 libxul 31.3.0 nss 3.17.3

The Mozilla Project reports:

ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data

MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory

MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer

MFSA-2014-88 Buffer overflow while parsing media content

MFSA-2014-87 Use-after-free during HTML5 parsing

MFSA-2014-86 CSP leaks redirect data via violation reports

MFSA-2014-85 XMLHttpRequest crashes with some input streams

MFSA-2014-84 XBL bindings accessible via improper CSS declarations

MFSA-2014-83 Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)

CVE-2014-1587 CVE-2014-1588 CVE-2014-1589 CVE-2014-1590 CVE-2014-1591 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-1595 CVE-2014-1569 https://www.mozilla.org/security/advisories/mfsa2014-83 https://www.mozilla.org/security/advisories/mfsa2014-84 https://www.mozilla.org/security/advisories/mfsa2014-85 https://www.mozilla.org/security/advisories/mfsa2014-86 https://www.mozilla.org/security/advisories/mfsa2014-87 https://www.mozilla.org/security/advisories/mfsa2014-88 https://www.mozilla.org/security/advisories/mfsa2014-89 https://www.mozilla.org/security/advisories/mfsa2014-90 https://www.mozilla.org/security/advisories/ 2014-12-01 2014-12-02
OpenVPN -- denial of service security vulnerability openvpn 2.0.11 2.1.02.2.3 2.3.02.3.6

The OpenVPN project reports:

In late November 2014 Dragana Damjanovic notified OpenVPN developers of a critical denial of service security vulnerability (CVE-2014-8104). The vulnerability allows an tls-authenticated client to crash the server by sending a too-short control channel packet to the server. In other words this vulnerability is denial of service only.

CVE-2014-8104 https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b 2014-12-01 2014-12-02
flac -- Multiple vulnerabilities flac 1.3.0_3 linux-c6-flac 1.2.1_3

Erik de Castro Lopo reports:

Google Security Team member, Michele Spagnuolo, recently found two potential problems in the FLAC code base. They are:

  • CVE-2014-9028: Heap buffer write overflow.
  • CVE-2014-8962: Heap buffer read overflow.
https://git.xiph.org/?p=flac.git;a=commit;h=5b3033a2b355068c11fe637e14ac742d273f076e CVE-2014-8962 https://git.xiph.org/?p=flac.git;a=commit;h=fcf0ba06ae12ccd7c67cee3c8d948df15f946b85 CVE-2014-9028 2014-11-25 2014-11-25 2015-07-15
asterisk -- Multiple vulnerabilities asterisk11 11.14.1

The Asterisk project reports:

AST-2014-014 - High call load may result in hung channels in ConfBridge.

AST-2014-017 - Permission escalation through ConfBridge actions/dialplan functions.

http://downloads.asterisk.org/pub/security/AST-2014-014.html CVE-2014-8414 http://downloads.asterisk.org/pub/security/AST-2014-017.html CVE-2014-8417 2014-11-21 2014-11-21
asterisk -- Multiple vulnerabilities asterisk 1.8.32.1 asterisk11 11.14.1

The Asterisk project reports:

AST-2014-012 - Mixed IP address families in access control lists may permit unwanted traffic.

AST-2014-018 - AMI permission escalation through DB dialplan function.

http://downloads.asterisk.org/pub/security/AST-2014-012.html CVE-2014-8412 http://downloads.asterisk.org/pub/security/AST-2014-018.html CVE-2014-8418 2014-11-21 2014-11-21
phpMyAdmin -- XSS and information disclosure vulnerabilities phpMyAdmin 4.2.04.2.12

The phpMyAdmin development team reports:

  • With a crafted database, table or column name it is possible to trigger an XSS attack in the table browse page.
  • With a crafted ENUM value it is possible to trigger XSS attacks in the table print view and zoom search pages.
  • With a crafted value for font size it is possible to trigger an XSS attack in the home page.

These vulnerabilities can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages. Moreover, exploitation of the XSS vulnerability related to the font size requires forgery of the pma_fontsize cookie.

In the GIS editor feature, a parameter specifying the geometry type was not correcly validated, opening the door to a local file inclusion attack.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.

With a crafted file name it is possible to trigger an XSS in the error reporting page.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.

In the error reporting feature, a parameter specifying the file was not correctly validated, allowing the attacker to derive the line count of an arbitrary file

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required page.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php CVE-2014-8958 CVE-2014-8959 CVE-2014-8960 CVE-2014-8961 2014-11-20 2014-11-21
kwebkitpart, kde-runtime -- insufficient input validation kde-runtime 4.14.2_2 kwebkitpart 1.3.2_4

Albert Aastals Cid reports:

kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly allowing to some javascript being executed on the context of the referenced hostname.

Whilst in most cases, the JavaScript will be executed in an untrusted context, with the bookmarks IO slave, it will be executed in the context of the referenced hostname. It should however be noted that KDE mitigates this risk by attempting to ensure that such URLs cannot be embedded directly into Internet hosted content.

https://www.kde.org/info/security/advisory-20141113-1.txt CVE-2014-8600 2014-11-13 2014-11-20
yii -- Remote arbitrary PHP code execution yii 1.1.15

Yii PHP Framework developers report:

We are releasing Yii 1.1.15 to fix a security issue found in 1.1.14. We urge all 1.1.14 users to upgrade their Yii to this latest release. Note that the issue only affects 1.1.14. All previous releases are not affected. Upgrading to this release from 1.1.14 is very safe and will not break your existing code.

The vulnerability is in the CDetailView widget. When a Yii application uses this widget and configures the "value" property of a CDetailView attribute using end user inputs, it may allow attackers to potentially execute arbitrary PHP scripts on the server. We are not showing how to exploit it here to allow users to upgrade before details about the exploit become publicly known. To our knowledge the details of this issue are only known to core team members.

CVE-2014-4672 http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix 2014-07-03 2014-11-19
chromium -- multiple vulnerabilities chromium 39.0.2171.65 chromium-pulse 39.0.2171.65

Google Chrome Releases reports:

42 security fixes in this release, including:

  • [389734] High CVE-2014-7899: Address bar spoofing. Credit to Eli Grey.
  • [406868] High CVE-2014-7900: Use-after-free in pdfium. Credit to Atte Kettunen from OUSPG.
  • [413375] High CVE-2014-7901: Integer overflow in pdfium. Credit to cloudfuzzer.
  • [414504] High CVE-2014-7902: Use-after-free in pdfium. Credit to cloudfuzzer.
  • [414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit to cloudfuzzer.
  • [418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to Atte Kettunen from OUSPG.
  • [421817] High CVE-2014-7905: Flaw allowing navigation to intents that do not have the BROWSABLE category. Credit to WangTao(neobyte) of Baidu X-Team.
  • [423030] High CVE-2014-7906: Use-after-free in pepper plugins. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.
  • [423703] High CVE-2014-0574: Double-free in Flash. Credit to biloulehibou.
  • [424453] High CVE-2014-7907: Use-after-free in blink. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.
  • [425980] High CVE-2014-7908: Integer overflow in media. Credit to Christoph Diehl.
  • [391001] Medium CVE-2014-7909: Uninitialized memory read in Skia. Credit to miaubiz.
  • CVE-2014-7910: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2014-0574 CVE-2014-7899 CVE-2014-7900 CVE-2014-7901 CVE-2014-7902 CVE-2014-7903 CVE-2014-7904 CVE-2014-7905 CVE-2014-7906 CVE-2014-7907 CVE-2014-7908 CVE-2014-7909 CVE-2014-7910 http://googlechromereleases.blogspot.nl/2014/11/stable-channel-update_18.html 2014-11-18 2014-11-18
kde-workspace -- privilege escalation kde-workspace 4.11.13_1

David Edmundson reports:

KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit.

This helper takes the name of the ntp utility to run as an argument. This allows a hacker to run any arbitrary command as root under the guise of updating the time.

An application can gain root priveledges from an admin user with either misleading information or no interaction.

On some systems the user will be shown a prompt to change the time. However, if the system has policykit-desktop-privileges installed, the datetime helper will be invoked by an admin user without any prompts.

CVE-2014-8651 http://seclists.org/oss-sec/2014/q4/520 2014-11-06 2014-11-17
dbus -- incomplete fix for CVE-2014-3636 part A dbus 1.8.10

Simon McVittie reports:

The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning, and does not fully prevent the attack described as "CVE-2014-3636 part A", which is repeated below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value. CVE-2014-7824 has been allocated for this vulnerability.

CVE-2014-7824 http://lists.freedesktop.org/archives/dbus/2014-November/016395.html 2014-11-10 2014-11-11
wget -- path traversal vulnerability in recursive FTP mode wget 1.16

MITRE reports:

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

CVE-2014-4877 685996 2014-10-27 2014-11-08
Konversation -- out-of-bounds read on a heap-allocated array konversation 1.5.1

Konversation developers report:

Konversation's Blowfish ECB encryption support assumes incoming blocks to be the expected 12 bytes. The lack of a sanity-check for the actual size can cause a denial of service and an information leak to the local user.

CVE-2014-8483 https://www.kde.org/info/security/advisory-20141104-1.txt 2014-11-04 2014-11-05
twiki -- remote Perl code execution twiki 5.1.4_1,1

TWiki developers report:

The debugenableplugins request parameter allows arbitrary Perl code execution.

Using an HTTP GET request towards a TWiki server, add a specially crafted debugenableplugins request parameter to TWiki's view script (typically port 80/TCP). Prior authentication may or may not be necessary.

A remote attacker can execute arbitrary Perl code to view and modify any file the webserver user has access to.

Example: http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit

The TWiki site is vulnerable if you see a page with text "Vulnerable!".

CVE-2014-7236 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236 2014-10-09 2014-10-31
jenkins -- slave-originated arbitrary code execution on master servers jenkins 1.587 jenkins-lts 1.580.1

Kohsuke Kawaguchi from Jenkins team reports:

Historically, Jenkins master and slaves behaved as if they altogether form a single distributed process. This means a slave can ask a master to do just about anything within the confinement of the operating system, such as accessing files on the master or trigger other jobs on Jenkins.

This has increasingly become problematic, as larger enterprise deployments have developed more sophisticated trust separation model, where the administators of a master might take slaves owned by other teams. In such an environment, slaves are less trusted than the master. Yet the "single distributed process" assumption was not communicated well to the users, resulting in vulnerabilities in some deployments.

SECURITY-144 (CVE-2014-3665) introduces a new subsystem to address this problem. This feature is off by default for compatibility reasons. See Wiki for more details, who should turn this on, and implications.

CVE-2014-3566 is rated high. It only affects installations that accept slaves from less trusted computers, but this will allow an owner of of such slave to mount a remote code execution attack on Jenkins.

CVE-2014-3665 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-30 https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control http://www.cloudbees.com/jenkins-security-advisory-2014-10-30 2014-10-30 2014-10-31
libssh -- PRNG state reuse on forking servers libssh 0.6.3

Aris Adamantiadis reports:

When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of openssl doesn't reset its state after the fork, but simply adds the current process id (getpid) to the PRNG state, which is not guaranteed to be unique.

CVE-2014-0017 http://www.openwall.com/lists/oss-security/2014/03/05/1 http://secunia.com/advisories/57407 2014-03-05 2014-10-29
libpurple/pidgin -- multiple vulnerabilities libpurple 2.10.10 pidgin 2.10.10

The pidgin development team reports:

.

CVE-2014-3694 CVE-2014-3697 CVE-2014-3696 CVE-2014-3695 CVE-2014-3698 https://developer.pidgin.im/wiki/ChangeLog 2014-10-22 2014-10-24
phpMyAdmin -- XSS vulnerabilities in SQL debug output and server monitor page. phpMyAdmin 4.2.04.2.10.1

The phpMyAdmin development team reports:

With a crafted database or table name it is possible to trigger an XSS in SQL debug output when enabled and in server monitor page when viewing and analysing executed queries.

This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages. Moreover, debugging SQL is a developer option which is disabled by default and expected to be disabled in production environments.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php CVE-2014-8326 2014-10-21 2014-10-22
asterisk -- Asterisk Susceptibility to POODLE Vulnerability asterisk 1.8.31.1 asterisk11 11.13.1

The Asterisk project reports:

The POODLE vulnerability is described under CVE-2014-3566. This advisory describes the Asterisk's project susceptibility to this vulnerability.

http://downloads.asterisk.org/pub/security/AST-2014-011.html CVE-2014-3566 2014-10-20 2014-10-21
libxml2 -- Denial of service libxml2 2.9.2 linux-c6-libxml2 2.7.6_2 linux-f10-libxml2 *

RedHat reports:

A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.

CVE-2014-3660 https://rhn.redhat.com/errata/RHSA-2014-1655.html 2014-10-16 2014-10-18 2015-07-15
drupal7 -- SQL injection drupal7 7.32

Drupal Security Team reports:

Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks. This vulnerability can be exploited by anonymous users.

CVE-2014-3704 https://www.drupal.org/SA-CORE-2014-005 https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html 2014-10-15 2014-10-16
OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_16 mingw32-openssl 1.0.11.0.1j linux-c6-openssl 1.0.1e_1

The OpenSSL Project reports:

A flaw in the DTLS SRTP extension parsing code allows an attacker, who sends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial Of Service attack. This issue affects OpenSSL 1.0.1 server implementations for both SSL/TLS and DTLS regardless of whether SRTP is used or configured. Implementations of OpenSSL that have been compiled with OPENSSL_NO_SRTP defined are not affected. [CVE-2014-3513].

When an OpenSSL SSL/TLS/DTLS server receives a session ticket the integrity of that ticket is first verified. In the event of a session ticket integrity check failing, OpenSSL will fail to free memory causing a memory leak. By sending a large number of invalid session tickets an attacker could exploit this issue in a Denial Of Service attack. [CVE-2014-3567].

OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications to block the ability for a MITM attacker to force a protocol downgrade.

Some client applications (such as browsers) will reconnect using a downgraded protocol to work around interoperability bugs in older servers. This could be exploited by an active man-in-the-middle to downgrade connections to SSL 3.0 even if both sides of the connection support higher protocols. SSL 3.0 contains a number of weaknesses including POODLE [CVE-2014-3566].

When OpenSSL is configured with "no-ssl3" as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them. [CVE-2014-3568].

CVE-2014-3513 CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 https://www.openssl.org/news/secadv_20141015.txt 2014-10-15 2014-10-15
mozilla -- multiple vulnerabilities firefox 33.0,1 firefox-esr 31.2.0,1 linux-firefox 33.0,1 linux-seamonkey 2.30 linux-thunderbird 31.2.0 seamonkey 2.30 thunderbird 31.2.0 libxul 31.2.0

The Mozilla Project reports:

MFSA 2014-74 Miscellaneous memory safety hazards (rv:33.0 / rv:31.2)

MFSA 2014-75 Buffer overflow during CSS manipulation

MFSA 2014-76 Web Audio memory corruption issues with custom waveforms

MFSA 2014-78 Further uninitialized memory use during GIF

MFSA 2014-79 Use-after-free interacting with text directionality

MFSA 2014-80 Key pinning bypasses

MFSA 2014-81 Inconsistent video sharing within iframe

MFSA 2014-82 Accessing cross-origin objects via the Alarms API

CVE-2014-1574 CVE-2014-1575 CVE-2014-1576 CVE-2014-1577 CVE-2014-1580 CVE-2014-1581 CVE-2014-1582 CVE-2014-1583 CVE-2014-1584 CVE-2014-1585 CVE-2014-1586 https://www.mozilla.org/security/announce/2014/mfsa2014-74.html https://www.mozilla.org/security/announce/2014/mfsa2014-75.html https://www.mozilla.org/security/announce/2014/mfsa2014-76.html https://www.mozilla.org/security/announce/2014/mfsa2014-78.html https://www.mozilla.org/security/announce/2014/mfsa2014-79.html https://www.mozilla.org/security/announce/2014/mfsa2014-80.html https://www.mozilla.org/security/announce/2014/mfsa2014-81.html https://www.mozilla.org/security/announce/2014/mfsa2014-82.html https://www.mozilla.org/security/announce/ 2014-10-14 2014-10-14 2015-08-12
foreman-proxy SSL verification issue foreman-proxy 1.6.2

Foreman Security reports:

The smart proxy when running in an SSL-secured mode permits incoming API calls to any endpoint without requiring, or performing any verification of an SSL client certificate. This permits any client with access to the API to make requests and perform actions permitting control of Puppet CA, DHCP, DNS etc.)

CVE-2014-3691 https://groups.google.com/forum/#!topic/foreman-announce/LcjZx25Bl7U 2014-05-09 2014-10-09
chromium -- multiple vulnerabilities chromium chromium-pulse 38.0.2125.101

Google Chrome Releases reports:

159 security fixes in this release, including 113 found using MemorySanitizer:

  • [416449] Critical CVE-2014-3188: A special thanks to Jüri Aedla for a combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox.
  • [398384] High CVE-2014-3189: Out-of-bounds read in PDFium. Credit to cloudfuzzer.
  • [400476] High CVE-2014-3190: Use-after-free in Events. Credit to cloudfuzzer.
  • [402407] High CVE-2014-3191: Use-after-free in Rendering. Credit to cloudfuzzer.
  • [403276] High CVE-2014-3192: Use-after-free in DOM. Credit to cloudfuzzer.
  • [399655] High CVE-2014-3193: Type confusion in Session Management. Credit to miaubiz.
  • [401115] High CVE-2014-3194: Use-after-free in Web Workers. Credit to Collin Payne.
  • [403409] Medium CVE-2014-3195: Information Leak in V8. Credit to Jüri Aedla.
  • [338538] Medium CVE-2014-3196: Permissions bypass in Windows Sandbox. Credit to James Forshaw.
  • [396544] Medium CVE-2014-3197: Information Leak in XSS Auditor. Credit to Takeshi Terada.
  • [415307] Medium CVE-2014-3198: Out-of-bounds read in PDFium. Credit to Atte Kettunen of OUSPG.
  • [395411] Low CVE-2014-3199: Release Assert in V8 bindings. Credit to Collin Payne.
  • [420899] CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives (Chrome 38).
  • Multiple vulnerabilities in V8 fixed at the tip of the 3.28 branch (currently 3.28.71.15).
CVE-2014-3188 CVE-2014-3189 CVE-2014-3190 CVE-2014-3191 CVE-2014-3192 CVE-2014-3193 CVE-2014-3194 CVE-2014-3195 CVE-2014-3196 CVE-2014-3197 CVE-2014-3198 CVE-2014-3199 CVE-2014-3200 http://googlechromereleases.blogspot.nl/2014/10/stable-channel-update.html 2014-10-07 2014-10-08
Bugzilla multiple security issues bugzilla44 4.4.6

Bugzilla Security Advisory

Unauthorized Account Creation

An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting.

Cross-Site Scripting

During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information.

Information Leak

If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group.

Social Engineering

Search results can be exported as a CSV file which can then be imported into external spreadsheet programs. Specially formatted field values can be interpreted as formulas which can be executed and used to attack a user's computer.

CVE-2014-1572 CVE-2014-1573 CVE-2014-1571 https://bugzilla.mozilla.org/show_bug.cgi?id=1074812 https://bugzilla.mozilla.org/show_bug.cgi?id=1075578 https://bugzilla.mozilla.org/show_bug.cgi?id=1064140 https://bugzilla.mozilla.org/show_bug.cgi?id=1054702 2014-10-06 2014-10-06
rt42 -- vulnerabilities related to shellshock rt42 4.2.04.2.8

Best Practical reports:

RT 4.2.0 and above may be vulnerable to arbitrary execution of code by way of CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, or CVE-2014-6271 -- collectively known as "Shellshock." This vulnerability requires a privileged user with access to an RT instance running with SMIME integration enabled; it applies to both mod_perl and fastcgi deployments. If you have already taken upgrades to bash to resolve "Shellshock," you are protected from this vulnerability in RT, and there is no need to apply this patch. This vulnerability has been assigned CVE-2014-7227.

http://blog.bestpractical.com/2014/10/security-vulnerability-in-rt-42x-cve-2014-7227.html CVE-2014-7227 2014-10-02 2014-10-02
jenkins -- remote execution, privilege escalation, XSS, password exposure, ACL hole, DoS jenkins 1.583 jenkins-lts 1.565.3

Jenkins Security Advisory:

Description

SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)

This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.

SECURITY-110/CVE-2014-3662 (User name discovery)

Anonymous users can test if the user of a specific name exists or not through login attempts.

SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)

An user with a permission limited to Job/CONFIGURE can exploit this vulnerability to effectively create a new job, which should have been only possible for users with Job/CREATE permission, or to destroy jobs that he/she does not have access otherwise.

SECURITY-131/CVE-2014-3664 (directory traversal attack)

Users with Overall/READ permission can access arbitrary files in the file system readable by the Jenkins process, resulting in the exposure of sensitive information, such as encryption keys.

SECURITY-138/CVE-2014-3680 (Password exposure in DOM)

If a parameterized job has a default value in a password field, that default value gets exposed to users with Job/READ permission.

SECURITY-143/CVE-2014-3681 (XSS vulnerability in Jenkins core)

Reflected cross-site scripting vulnerability in Jenkins core. An attacker can navigate the user to a carefully crafted URL and have the user execute unintended actions.

SECURITY-150/CVE-2014-3666 (remote code execution from CLI)

Unauthenticated user can execute arbitrary code on Jenkins master by sending carefully crafted packets over the CLI channel.

SECURITY-155/CVE-2014-3667 (exposure of plugin code)

Programs that constitute plugins can be downloaded by anyone with the Overall/READ permission, resulting in the exposure of otherwise sensitive information, such as hard-coded keys in plugins, if any.

SECURITY-159/CVE-2013-2186 (arbitrary file system write)

Security vulnerability in commons fileupload allows unauthenticated attacker to upload arbitrary files to Jenkins master.

SECURITY-149/CVE-2014-1869 (XSS vulnerabilities in ZeroClipboard)

reflective XSS vulnerability in one of the library dependencies of Jenkins.

SECURITY-113/CVE-2014-3678 (XSS vulnerabilities in monitoring plugin)

Monitoring plugin allows an attacker to cause a victim into executing unwanted actions on Jenkins instance.

SECURITY-113/CVE-2014-3679 (hole in access control)

Certain pages in monitoring plugin are visible to anonymous users, allowing them to gain information that they are not supposed to.

Severity

SECURITY-87 is rated medium, as it results in the loss of functionality.

SECURITY-110 is rated medium, as it results in a limited amount of information exposure.

SECURITY-127 and SECURITY-128 are rated high. The formed can be used to further escalate privileges, and the latter results inloss of data.

SECURITY-131 and SECURITY-138 is rated critical. This vulnerabilities results in exposure of sensitie information and is easily exploitable.

SECURITY-143 is rated high. It is a passive attack, but it can result in a compromise of Jenkins master or loss of data.

SECURITY-150 is rated critical. This attack can be mounted by any unauthenticated anonymous user with HTTP reachability to Jenkins instance, and results in remote code execution on Jenkins.

SECURITY-155 is rated medium. This only affects users who have installed proprietary plugins on publicly accessible instances, which is relatively uncommon.

SECURITY-159 is rated critical. This attack can be mounted by any unauthenticated anonymous user with HTTP reachability to Jenkins instance.

SECURITY-113 is rated high. It is a passive attack, but it can result in a compromise of Jenkins master or loss of data.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 CVE-2014-3661 CVE-2014-3662 CVE-2014-3663 CVE-2014-3664 CVE-2014-3680 CVE-2014-3681 CVE-2014-3666 CVE-2014-3667 CVE-2013-2186 CVE-2014-1869 CVE-2014-3678 CVE-2014-3679 2014-10-01 2014-10-01
bash -- remote code execution bash bash-static 4.3.25_2

Note that this is different than the public "Shellshock" issue.

Specially crafted environment variables could lead to remote arbitrary code execution. This was fixed in bash 4.3.27, however the port was patched with a mitigation in 4.3.25_2.

http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html CVE-2014-6277 CVE-2014-6278 2014-09-27 2014-10-01
phpMyAdmin -- XSS vulnerabilities phpMyAdmin 4.2.04.2.9.1

The phpMyAdmin development team reports:

With a crafted ENUM value it is possible to trigger an XSS in table search and table structure pages. This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required pages.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php CVE-2014-7217 2014-10-01 2014-10-01
bash -- out-of-bounds memory access in parser bash bash-static 4.3.27_1

RedHat security team reports:

It was discovered that the fixed-sized redir_stack could be forced to overflow in the Bash parser, resulting in memory corruption, and possibly leading to arbitrary code execution when evaluating untrusted input that would not otherwise be run as code.

An off-by-one error was discovered in the way Bash was handling deeply nested flow control constructs. Depending on the layout of the .bss segment, this could allow arbitrary execution of code that would not otherwise be executed by Bash.

https://access.redhat.com/security/cve/CVE-2014-7186 CVE-2014-7186 CVE-2014-7187 2014-09-25 2014-10-01
rsyslog -- remote syslog PRI vulnerability rsyslog 7.6.7 rsyslog8 8.4.2

The rsyslog project reports:

potential abort when a message with PRI > 191 was processed if the "pri-text" property was used in active templates, this could be abused to a remote denial of service from permitted senders

The original fix for CVE-2014-3634 was not adequate.

http://www.rsyslog.com/remote-syslog-pri-vulnerability/ CVE-2014-3634 2014-09-30 2014-09-30 2014-10-02
fish -- local privilege escalation and remote code execution fish 1.6.02.1.1

Fish developer David Adam reports:

This release fixes a number of local privilege escalation vulnerability and one remote code execution vulnerability.

http://www.openwall.com/lists/oss-security/2014/09/28/8 CVE-2014-2905 https://github.com/fish-shell/fish-shell/issues/1436 CVE-2014-2906 CVE-2014-3856 https://github.com/fish-shell/fish-shell/issues/1437 CVE-2014-2914 https://github.com/fish-shell/fish-shell/issues/1438 CVE-2014-3219 https://github.com/fish-shell/fish-shell/issues/1440 2014-09-28 2014-09-29
Flash player -- Multiple security vulnerabilities in www/linux-*-flashplugin11 linux-f10-flashplugin 11.2r202.400 linux-c6-flashplugin 11.2r202.400

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0547 CVE-2014-0548 CVE-2014-0549 CVE-2014-0550 CVE-2014-0551 CVE-2014-0552 CVE-2014-0553 CVE-2014-0554 CVE-2014-0555 CVE-2014-0556 CVE-2014-0557 CVE-2014-0559 http://helpx.adobe.com/security/products/flash-player/apsb14-21.html 2014-09-09 2014-09-25
NSS -- RSA Signature Forgery linux-firefox 32.0.3,1 linux-thunderbird 31.1.2 linux-seamonkey 2.29.1 nss 3.17.1 linux-c6-nss 3.16.1

The Mozilla Project reports:

Antoine Delignat-Lavaud discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates.

CVE-2014-1568 https://www.mozilla.org/security/announce/2014/mfsa2014-73.html 2014-09-23 2014-09-25
chromium -- RSA signature malleability in NSS chromium 37.0.2062.124

Google Chrome Releases reports:

[414124] RSA signature malleability in NSS (CVE-2014-1568). Thanks to Antoine Delignat-Lavaud of Prosecco/INRIA, Brian Smith and Advanced Threat Research team at Intel Security

CVE-2014-1568 http://googlechromereleases.blogspot.nl/ 2014-09-24 2014-09-25
krfb -- Multiple security issues in bundled libvncserver krfb 4.12.5_4

Martin Sandsmark reports:

krfb 4.14 [and earlier] embeds libvncserver which has had several security issues.

Several remotely exploitable security issues have been uncovered in libvncserver, some of which might allow a remote authenticated user code execution or application crashes.

CVE-2014-6055 http://lists.kde.org/?l=kde-announce&m=141153917319769&w=2 2014-09-23 2014-09-25
bash -- remote code execution vulnerability bash bash-static 3.03.0.17 3.13.1.18 3.23.2.52 4.04.0.39 4.14.1.12 4.24.2.48 4.34.3.25_1 linux_base-c6 6.5_1

Chet Ramey reports:

Under certain circumstances, bash will execute user code while processing the environment for exported function definitions.

The original fix released for CVE-2014-6271 was not adequate. A similar vulnerability was discovered and tagged as CVE-2014-7169.

CVE-2014-6271 CVE-2014-7169 https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html http://seclists.org/oss-sec/2014/q3/690 2014-09-24 2014-09-24 2014-09-25
asterisk -- Remotely triggered crash asterisk11 11.12.1

The Asterisk project reports:

When an out of call message - delivered by either the SIP or PJSIP channel driver or the XMPP stack - is handled in Asterisk, a crash can occur if the channel servicing the message is sent into the ReceiveFax dialplan application while using the res_fax_spandsp module.

Note that this crash does not occur when using the res_fax_digium module. While this crash technically occurs due to a configuration issue, as attempting to receive a fax from a channel driver that only contains textual information will never succeed, the likelihood of having it occur is sufficiently high as to warrant this advisory.

http://downloads.asterisk.org/pub/security/AST-2014-010.pdf https://issues.asterisk.org/jira/browse/ASTERISK-24301 https://www.asterisk.org/security 2014-09-05 2014-09-18
squid -- Buffer overflow in SNMP processing squid 3.4.8 squid32 0 squid33 3.3.13_2

The squid-cache project reports:

Due to incorrect buffer management Squid can be caused by an attacker to write outside its allocated SNMP buffer.

http://www.squid-cache.org/Advisories/SQUID-2014_3.txt CVE-2014-6270 2014-09-15 2014-09-18
dbus -- multiple vulnerabilities dbus 1.8.8

Simon McVittie reports:

Do not accept an extra fd in the padding of a cmsg message, which could lead to a 4-byte heap buffer overrun (CVE-2014-3635).

Reduce default for maximum Unix file descriptors passed per message from 1024 to 16, preventing a uid with the default maximum number of connections from exhausting the system bus' file descriptors under Linux's default rlimit (CVE-2014-3636).

Disconnect connections that still have a fd pending unmarshalling after a new configurable limit, pending_fd_timeout (defaulting to 150 seconds), removing the possibility of creating an abusive connection that cannot be disconnected by setting up a circular reference to a connection's file descriptor (CVE-2014-3637).

Reduce default for maximum pending replies per connection from 8192 to 128, mitigating an algorithmic complexity denial-of-service attack (CVE-2014-3638).

Reduce default for authentication timeout on the system bus from 30 seconds to 5 seconds, avoiding denial of service by using up all unauthenticated connection slots; and when all unauthenticated connection slots are used up, make new connection attempts block instead of disconnecting them (CVE-2014-3639).

CVE-2014-3635 CVE-2014-3636 CVE-2014-3637 CVE-2014-3638 CVE-2014-3639 http://lists.freedesktop.org/archives/dbus/2014-September/016343.html 2014-09-16 2014-09-17
nginx -- inject commands into SSL session vulnerability nginx 0.6.01.6.2,2 nginx-devel 0.5.61.7.5

The nginx project reports:

Security: it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple "server" blocks (CVE-2014-3616).

CVE-2014-3616 http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html 2014-09-16 2014-09-16
phpMyAdmin -- XSRF/CSRF due to DOM based XSS in the micro history feature phpMyAdmin 4.2.04.2.8.1

The phpMyAdmin development team reports:

XSRF/CSRF due to DOM based XSS in the micro history feature.

By deceiving a logged-in user to click on a crafted URL, it is possible to perform remote code execution and in some cases, create a root account due to a DOM based XSS vulnerability in the micro history feature.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php CVE-2014-6300 2014-09-13 2014-09-13
security/ossec-hids-* -- root escalation via temp files ossec-hids-server ossec-hids-client ossec-hids-local 2.8.1

OSSEC reports:

This correction will create the temp file for the hosts deny file in /var/ossec and will use mktemp where available to create NON-predictable temp file name. In cases where mktemp is not available we have written a BAD version of mktemp, but should be a little better then just process id.

CVE-2014-5284 http://www.ossec.net/?p=1135 2014-09-09 2014-09-11
www/chromium -- multiple vulnerabilities chromium 37.0.2062.120

Google Chrome Releases reports:

4 security fixes in this release, including:

  • [401362] High CVE-2014-3178: Use-after-free in rendering. Credit to miaubiz.
  • [411014] CVE-2014-3179: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2014-3178 CVE-2014-3179 http://googlechromereleases.blogspot.nl/ 2014-09-09 2014-09-09
trafficserver -- unspecified vulnerability trafficserver 5.0.1

Bryan Call reports:

Below is our announcement for the security issue reported to us from Yahoo! Japan. All versions of Apache Traffic Server are vulnerable. We urge users to upgrade to either 4.2.1.1 or 5.0.1 immediately.

This fixes CVE-2014-3525 and limits access to how the health checks are performed.

CVE-2014-3525 http://mail-archives.apache.org/mod_mbox/trafficserver-users/201407.mbox/%3CBFCEC9C8-1BE9-4DCA-AF9C-B8FE798EEC07@yahoo-inc.com%3E 2014-07-23 2014-09-05
chromium -- multiple vulnerabilities chromium 37.0.2062.94

Google Chrome Releases reports:

50 security fixes in this release, including:

  • [386988] Critical CVE-2014-3176, CVE-2014-3177: A special reward to lokihardt@asrt for a combination of bugs in V8, IPC, sync, and extensions that can lead to remote code execution outside of the sandbox.
  • [369860] High CVE-2014-3168: Use-after-free in SVG. Credit to cloudfuzzer.
  • [387389] High CVE-2014-3169: Use-after-free in DOM. Credit to Andrzej Dyjak.
  • [390624] High CVE-2014-3170: Extension permission dialog spoofing. Credit to Rob Wu.
  • [390928] High CVE-2014-3171: Use-after-free in bindings. Credit to cloudfuzzer.
  • [367567] Medium CVE-2014-3172: Issue related to extension debugging. Credit to Eli Grey.
  • [376951] Medium CVE-2014-3173: Uninitialized memory read in WebGL. Credit to jmuizelaar.
  • [389219] Medium CVE-2014-3174: Uninitialized memory read in Web Audio. Credit to Atte Kettunen from OUSPG.
  • [406143] CVE-2014-3175: Various fixes from internal audits, fuzzing and other initiatives (Chrome 37).
CVE-2014-3168 CVE-2014-3169 CVE-2014-3170 CVE-2014-3171 CVE-2014-3172 CVE-2014-3173 CVE-2014-3174 CVE-2014-3175 CVE-2014-3176 CVE-2014-3177 http://googlechromereleases.blogspot.nl/ 2014-08-26 2014-08-26
file -- buffer overruns and missing buffer size tests file 5.19

Christos Zoulas reports:

A specially crafted file can cause a segmentation fault.

http://mx.gw.com/pipermail/file/2014/001553.html 2014-06-09 2014-08-21
django -- multiple vulnerabilities py27-django 1.61.6.6 py27-django15 1.51.5.9 py27-django14 1.41.4.14 py32-django 1.61.6.6 py32-django15 1.51.5.9 py33-django 1.61.6.6 py33-django15 1.51.5.9 py34-django 1.61.6.6 py34-django15 1.51.5.9 py27-django-devel 20140821,1 py32-django-devel 20140821,1 py33-django-devel 20140821,1 py34-django-devel 20140821,1

The Django project reports:

These releases address an issue with reverse() generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; and a data leak in the administrative interface. We encourage all users of Django to upgrade as soon as possible.

https://www.djangoproject.com/weblog/2014/aug/20/security/ CVE-2014-0480 CVE-2014-0481 CVE-2014-0482 CVE-2014-0483 2014-08-20 2014-08-21
PHP multiple vulnerabilities php53 5.3.29

The PHP Team reports:

insecure temporary file use in the configure script

unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion

Heap buffer over-read in DateInterval

fileinfo: cdf_read_short_sector insufficient boundary check

fileinfo: CDF infinite loop in nelements DoS

fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation)

Fix potential segfault in dns_check_record()

CVE-2013-6712 CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 CVE-2014-3515 CVE-2014-3981 CVE-2014-4049 http://php.net/ChangeLog-5.php#5.3.29 https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html 2014-08-14 2014-08-18
phpMyAdmin -- XSS vulnerabilities phpMyAdmin 4.2.04.2.7.1

The phpMyAdmin development team reports:

Multiple XSS vulnerabilities in browse table, ENUM editor, monitor, query charts and table relations pages.

With a crafted database, table or a primary/unique key column name it is possible to trigger an XSS when dropping a row from the table. With a crafted column name it is possible to trigger an XSS in the ENUM editor dialog. With a crafted variable name or a crafted value for unit field it is possible to trigger a self-XSS when adding a new chart in the monitor page. With a crafted value for x-axis label it is possible to trigger a self-XSS in the query chart page. With a crafted relation name it is possible to trigger an XSS in table relations page.

XSS in view operations page.

With a crafted view name it is possible to trigger an XSS when dropping the view in view operation page.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php CVE-2014-5273 CVE-2014-5274 2014-08-17 2014-08-17
chromium -- multiple vulnerabilities chromium 36.0.1985.143

Google Chrome Releases reports:

12 security fixes in this release, including

  • [390174] High CVE-2014-3165: Use-after-free in web sockets. Credit to Collin Payne.
  • [398925] High CVE-2014-3166: Information disclosure in SPDY. Credit to Antoine Delignat-Lavaud.
  • [400950] CVE-2014-3167: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2014-3165 CVE-2014-3166 CVE-2014-3167 http://googlechromereleases.blogspot.nl 2014-08-12 2014-08-13
serf -- SSL Certificate Null Byte Poisoning serf 1.3.7

serf Development list reports:

Serf provides APIs to retrieve information about a certificate. These APIs return the information as NUL terminated strings (commonly called C strings). X.509 uses counted length strings which may include a NUL byte. This means that a library user will interpret any information as ending upon seeing this NUL byte and will only see a partial value for that field.

Attackers could exploit this vulnerability to create a certificate that a client will accept for a different hostname than the full certificate is actually for by embedding a NUL byte in the certificate.

This can lead to a man-in-the-middle attack. There are no known instances of this problem being exploited in the wild and in practice it should be difficult to actually exploit this vulnerability.

CVE-2014-3504 2014-08-06 2014-08-11
subversion -- several vulnerabilities subversion16 1.0.01.7.18 subversion17 1.0.01.7.18 subversion 1.0.01.7.18 1.8.01.8.10

Subversion Project reports:

Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API to handle matching wildcards in certificate Common Names and Subject Alternate Names. However, apr_fnmatch is not designed for this purpose. Instead it is designed to behave like common shell globbing. In particular this means that '*' is not limited to a single label within a hostname (i.e. it will match '.'). But even further apr_fnmatch supports '?' and character classes (neither of which are part of the RFCs defining how certificate validation works).

Subversion stores cached credentials by an MD5 hash based on the URL and the authentication realm of the server the credentials are cached for. MD5 has been shown to be subject to chosen plaintext hash collisions. This means it may be possible to generate an authentication realm which results in the same MD5 hash for a different URL.

CVE-2014-3522 CVE-2014-3528 http://subversion.apache.org/security/CVE-2014-3522-advisory.txt http://subversion.apache.org/security/CVE-2014-3528-advisory.txt 2014-08-06 2014-08-11
nginx -- inject commands into SSL session vulnerability nginx 1.6.0,21.6.1,2 nginx-devel 1.5.61.7.4

The nginx project reports:

Security: pipelined commands were not discarded after STARTTLS command in SMTP proxy (CVE-2014-3556); the bug had appeared in 1.5.6.

CVE-2014-3556 http://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html 2014-08-05 2014-08-09
OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_14 mingw32-openssl 1.0.11.0.1i

The OpenSSL Project reports:

A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. [CVE-2014-3508]

The issue affects OpenSSL clients and allows a malicious server to crash the client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. [CVE-2014-5139]

If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension it could write up to 255 bytes to freed memory. [CVE-2014-3509]

An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This can be exploited through a Denial of Service attack. [CVE-2014-3505]

An attacker can force openssl to consume large amounts of memory whilst processing DTLS handshake messages. This can be exploited through a Denial of Service attack. [CVE-2014-3506]

By sending carefully crafted DTLS packets an attacker could cause openssl to leak memory. This can be exploited through a Denial of Service attack. [CVE-2014-3507]

OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages. [CVE-2014-3510]

A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. This allows a man-in-the-middle attacker to force a downgrade to TLS 1.0 even if both the server and the client support a higher protocol version, by modifying the client's TLS records. [CVE-2014-3511]

A malicious client or server can send invalid SRP parameters and overrun an internal buffer. Only applications which are explicitly set up for SRP use are affected. [CVE-2014-3512]

https://www.openssl.org/news/secadv_20140806.txt CVE-2014-3505 CVE-2014-3506 CVE-2014-3507 CVE-2014-3508 CVE-2014-3509 CVE-2014-3510 CVE-2014-3511 CVE-2014-3512 CVE-2014-5139 2014-08-06 2014-08-06
krfb -- Possible Denial of Service or code execution via integer overflow krfb 4.12.5_1

Albert Aastals Cid reports:

krfb embeds libvncserver which embeds liblzo2, it contains various flaws that result in integer overflow problems.

This potentially allows a malicious application to create a possible denial of service or code execution. Due to the need to exploit precise details of the target architecture and threading it is unlikely that remote code execution can be achieved in practice.

CVE-2014-4607 http://lists.kde.org/?l=kde-announce&m=140709940701878&w=2 2014-08-03 2014-08-03
samba -- remote code execution samba4 4.0.04.0.21 samba41 4.1.04.1.11

Samba developers report:

A malicious browser can send packets that may overwrite the heap of the target nmbd NetBIOS name services daemon. It may be possible to use this to generate a remote code execution vulnerability as the superuser (root).

CVE-2014-3560 http://www.samba.org/samba/security/CVE-2014-3560 2014-07-31 2014-08-02
gpgme -- heap-based buffer overflow in gpgsm status handler gpgme 1.5.0

Tomas Trnka reports:

Gpgme contains a buffer overflow in the gpgsm status handler that could possibly be exploited using a specially crafted certificate.

CVE-2014-3564 https://bugzilla.redhat.com/show_bug.cgi?id=1113267 2014-06-25 2014-08-02
kdelibs -- KAuth PID Reuse Flaw kdelibs 4.12.5_3

Martin Sandsmark reports:

The KAuth framework uses polkit-1 API which tries to authenticate using the requestors PID. This is prone to PID reuse race conditions.

This potentially allows a malicious application to pose as another for authentication purposes when executing privileged actions.

CVE-2014-5033 http://lists.kde.org/?l=kde-announce&m=140674898412923&w=2 2014-07-30 2014-07-31
tor -- traffic confirmation attack tor 0.2.4.23 tor-devel 0.2.5.6.a

The Tor Project reports:

Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.

https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack CVE-2014-5117 2014-07-30 2014-07-30
i2p -- Multiple Vulnerabilities i2p 0.9.14

The i2p project reports:

XSS and remote execution vulnerabilities reported by Exodus Intelligence.

Exodus Intelligence reports:

The vulnerability we have found is able to perform remote code execution with a specially crafted payload. This payload can be customized to unmask a user and show the public IP address in which the user connected from within 'a couple of seconds.'

http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/ http://geti2p.net/en/blog/post/2014/07/26/0.9.14-Release 2014-07-24 2014-07-28
bugzilla -- Cross Site Request Forgery bugzilla44 4.4.5

A Bugzilla Security Advisory reports:

Adobe does not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against Bugzilla's JSONP endpoint, possibly obtaining sensitive bug information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API.

CVE-2014-1546 2014-07-24 2014-07-25
apache22 -- several vulnerabilities apache22 2.2.02.2.29 apache22-event-mpm 2.2.02.2.29 apache22-itk-mpm 2.2.02.2.29 apache22-peruser-mpm 2.2.02.2.29 apache22-worker-mpm 2.2.02.2.29

Apache HTTP SERVER PROJECT reports:

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds "MergeTrailers" directive to restore legacy behavior.

CVE-2014-0118 CVE-2014-0231 CVE-2014-0226 CVE-2013-5704 2014-07-19 2014-07-24 2014-09-03
tomcat -- multiple vulnerabilities tomcat6 6.0.40 tomcat7 7.0.53 tomcat8 8.0.4

Tomcat Security Team reports:

Tomcat does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

An integer overflow, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

An integer overflow in parseChunkHeader allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CVE-2014-0096 CVE-2014-0099 CVE-2014-0075 https://tomcat.apache.org/security-6.html https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html 2014-05-23 2014-07-23
mozilla -- multiple vulnerabilities firefox 31.0,1 firefox-esr 24.7.0,1 linux-firefox 31.0,1 linux-thunderbird 24.7.0 thunderbird 24.7.0 nss 3.16.1_2

The Mozilla Project reports:

MFSA 2014-66 IFRAME sandbox same-origin access through redirect

MFSA 2014-65 Certificate parsing broken by non-standard character encoding

MFSA 2014-64 Crash in Skia library when scaling high quality images

MFSA 2014-63 Use-after-free while when manipulating certificates in the trusted cache

MFSA 2014-62 Exploitable WebGL crash with Cesium JavaScript library

MFSA 2014-61 Use-after-free with FireOnStateChange event

MFSA 2014-60 Toolbar dialog customization event spoofing

MFSA 2014-59 Use-after-free in DirectWrite font handling

MFSA 2014-58 Use-after-free in Web Audio due to incorrect control message ordering

MFSA 2014-57 Buffer overflow during Web Audio buffering for playback

MFSA 2014-56 Miscellaneous memory safety hazards (rv:31.0 / rv:24.7)

CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1549 CVE-2014-1550 CVE-2014-1551 CVE-2014-1552 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 CVE-2014-1558 CVE-2014-1559 CVE-2014-1560 CVE-2014-1561 https://www.mozilla.org/security/announce/2014/mfsa2014-56.html https://www.mozilla.org/security/announce/2014/mfsa2014-57.html https://www.mozilla.org/security/announce/2014/mfsa2014-58.html https://www.mozilla.org/security/announce/2014/mfsa2014-59.html https://www.mozilla.org/security/announce/2014/mfsa2014-60.html https://www.mozilla.org/security/announce/2014/mfsa2014-61.html https://www.mozilla.org/security/announce/2014/mfsa2014-62.html https://www.mozilla.org/security/announce/2014/mfsa2014-63.html https://www.mozilla.org/security/announce/2014/mfsa2014-64.html https://www.mozilla.org/security/announce/2014/mfsa2014-65.html https://www.mozilla.org/security/announce/2014/mfsa2014-66.html https://www.mozilla.org/security/announce/ 2014-07-22 2014-07-23
mcollective -- cert valication issue mcollective 2.5.3

Melissa Stone reports:

The MCollective aes_security public key plugin does not correctly validate certs against the CA. By exploiting this vulnerability within a race/initialization window, an attacker with local access could initiate an unauthorized MCollective client connection with a server, and thus control the mcollective plugins running on that server. This vulnerability requires a collective be configured to use the aes_security plugin. Puppet Enterprise and open source MCollective are not configured to use the plugin and are not vulnerable by default.

CVE-2014-3251 https://groups.google.com/forum/#!topic/puppet-announce/cPykqUXMmK4 2014-07-09 2014-07-21
qt4-imageformats, qt5-gui -- DoS vulnerability in the GIF image handler qt4-imageformats 4.8.6_1 qt5-gui 5.2.1_4

Richard J. Moore reports:

The builtin GIF decoder in QtGui prior to Qt 5.3 contained a bug that would lead to a null pointer dereference when loading certain hand crafted corrupt GIF files. This in turn would cause the application loading these hand crafted GIFs to crash.

CVE-2014-0190 67087 http://lists.qt-project.org/pipermail/announce/2014-April/000045.html 2014-04-24 2014-07-19 2014-07-21
apache24 -- several vulnerabilities apache24 2.4.10

Apache HTTP SERVER PROJECT reports:

mod_proxy: Fix crash in Connection header handling which allowed a denial of service attack against a reverse proxy with a threaded MPM.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of sevice via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

CVE-2014-0117 CVE-2014-3523 CVE-2014-0226 CVE-2014-0118 CVE-2014-0231 2014-07-15 2014-07-19
phpMyAdmin -- multiple XSS vulnerabilities, missing validation phpMyAdmin 4.2.04.2.6

The phpMyAdmin development team reports:

Self-XSS due to unescaped HTML output in database structure page.

With a crafted table comment, it is possible to trigger an XSS in database structure page.

Self-XSS due to unescaped HTML output in database triggers page.

When navigating into the database triggers page, it is possible to trigger an XSS with a crafted trigger name.

Multiple XSS in AJAX confirmation messages.

With a crafted column name it is possible to trigger an XSS when dropping the column in table structure page. With a crafted table name it is possible to trigger an XSS when dropping or truncating the table in table operations page.

Access for an unprivileged user to MySQL user list.

An unpriviledged user could view the MySQL user list and manipulate the tabs displayed in phpMyAdmin for them.

CVE-2014-4954 CVE-2014-4955 CVE-2014-4986 CVE-2014-4987 http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php 2014-07-18 2014-07-18 2014-07-20
chromium -- multiple vulnerabilities chromium 36.0.1985.125

Google Chrome Releases reports:

26 security fixes in this release, including

  • [380885] Medium CVE-2014-3160: Same-Origin-Policy bypass in SVG. Credit to Christian Schneider.
  • [393765] CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2014-3160 CVE-2014-3162 http://googlechromereleases.blogspot.nl 2014-07-16 2014-07-16
kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw kdelibs 4.10.954.12.5_2

Richard J. Moore reports:

The POP3 kioslave used by KMail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked.

This flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails.

CVE-2014-3494 68113 http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2 2014-06-17 2014-07-16
postfixadmin -- SQL injection vulnerability postfixadmin 2.3.7

Thijs Kinkhorst reports:

Postfixadmin has an SQL injection vulnerability. This vulnerability is only exploitable by authenticated users able to create new aliases.

CVE-2014-2655 66455 ports/189248 http://www.openwall.com/lists/oss-security/2014/03/26/6 https://www.debian.org/security/2014/dsa-2889 2014-03-28 2014-07-13 2015-09-28
dbus -- multiple vulnerabilities dbus 1.8.6

Simon McVittie reports:

Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's support for file descriptor passing. A malicious process could force system services or user applications to be disconnected from the D-Bus system bus by sending them a message containing a file descriptor, then causing that file descriptor to exceed the kernel's maximum recursion depth (itself introduced to fix a DoS) before dbus-daemon forwards the message to the victim process. Most services and applications exit when disconnected from the system bus, leading to a denial of service.

Additionally, Alban discovered that bug fd.o#79694, a bug previously reported by Alejandro Martínez Suárez which was n believed to be security flaw, could be used for a similar denial of service, by causing dbus-daemon to attempt to forward invalid file descriptors to a victim process when file descriptors become associated with the wrong message.

CVE-2014-3532 CVE-2014-3533 http://lists.freedesktop.org/archives/dbus/2014-July/016235.html 2014-07-02 2014-07-03
mencoder -- potential buffer overrun when processing malicious lzo compressed input mencoder 1.1.r20140418_1

Michael Niedermayer and Luca Barbato report in upstream ffmpeg:

avutil/lzo: Fix integer overflow

http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee CVE-2014-4610 2014-06-24 2014-06-28
mplayer -- potential buffer overrun when processing malicious lzo compressed input mplayer 1.1.r20140418_3

Michael Niedermayer and Luca Barbato report in upstream ffmpeg:

avutil/lzo: Fix integer overflow

http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=ccda51b14c0fcae2fad73a24872dce75a7964996 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6af26c55c1ea30f85a7d9edbc373f53be1743ee CVE-2014-4610 2014-06-24 2014-06-28
LZO -- potential buffer overrun when processing malicious input data lzo2 2.07 busybox 1.22.1_2

Markus Franz Xaver Johannes Oberhumer reports, in the package's NEWS file:

Fixed a potential integer overflow condition in the "safe" decompressor variants which could result in a possible buffer overrun when processing maliciously crafted compressed input data.

As this issue only affects 32-bit systems and also can only happen if you use uncommonly huge buffer sizes where you have to decompress more than 16 MiB (2^24 bytes) compressed bytes within a single function call, the practical implications are limited.

http://www.oberhumer.com/opensource/lzo/download/lzo-2.07.tar.gz CVE-2014-4608 2014-06-25 2014-06-26 2015-01-06
gnupg -- possible DoS using garbled compressed data packets gnupg1 1.4.17 gnupg 2.0.24

Werner Koch reports:

This release includes a *security fix* to stop a possible DoS using garbled compressed data packets which can be used to put gpg into an infinite loop.

http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html 2014-06-23 2014-06-23
samba -- multiple vulnerabilities samba36 3.6.24 samba4 4.0.19 samba41 4.1.9

The samba project reports:

A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service.

Valid unicode path names stored on disk can cause smbd to crash if an authenticated client attempts to read them using a non-unicode request.

CVE-2014-0244 CVE-2014-3493 https://www.samba.org/samba/security/CVE-2014-0244 https://www.samba.org/samba/security/CVE-2014-3493 2014-06-23 2014-06-23
phpMyAdmin -- two XSS vulnerabilities due to unescaped db/table names phpMyAdmin 4.1.04.2.4

The phpMyAdmin development team reports:

Self-XSS due to unescaped HTML output in recent/favorite tables navigation.

When marking a crafted database or table name as favorite or having it in recent tables, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

Self-XSS due to unescaped HTML output in navigation items hiding feature.

When hiding or unhiding a crafted table name in the navigation, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

CVE-2014-4348 CVE-2014-4349 http://www.phpmyadmin.net/home_page/security/PMASA-2014-2.php http://www.phpmyadmin.net/home_page/security/PMASA-2014-3.php 2014-06-20 2014-06-20 2014-06-24
iodined -- authentication bypass iodine 0.7.0

Erik Ekman of the iodine project reports:

The client could bypass the password check by continuing after getting error from the server and guessing the network parameters. The server would still accept the rest of the setup and also network traffic.

https://github.com/yarrick/iodine/commit/b715be5cf3978fbe589b03b09c9398d0d791f850 2014-06-16 2014-06-18
asterisk -- multiple vulnerabilities asterisk11 11.10.1 asterisk18 1.8.28.1

The Asterisk project reports:

Asterisk Manager User Unauthorized Shell Access. Manager users can execute arbitrary shell commands with the MixMonitor manager action. Asterisk does not require system class authorization for a manager user to use the MixMonitor action, so any manager user who is permitted to use manager commands can potentially execute shell commands as the user executing the Asterisk process.

Exhaustion of Allowed Concurrent HTTP Connections. Establishing a TCP or TLS connection to the configured HTTP or HTTPS port respectively in http.conf and then not sending or completing a HTTP request will tie up a HTTP session. By doing this repeatedly until the maximum number of open HTTP sessions is reached, legitimate requests are blocked.

CVE-2014-4046 CVE-2014-4047 http://downloads.asterisk.org/pub/security/AST-2014-006.pdf http://downloads.asterisk.org/pub/security/AST-2014-007.pdf https://www.asterisk.org/security 2014-06-12 2014-06-17
dbus -- local DoS dbus 1.8.01.8.4 1.6.20

Simon MvVittie reports:

Alban Crequy at Collabora Ltd. discovered and fixed a denial-of-service flaw in dbus-daemon, part of the reference implementation of D-Bus. Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate.

CVE-2014-3477 http://lists.freedesktop.org/archives/dbus/2014-June/016220.html 2014-06-10 2014-06-14
chromium -- multiple vulnerabilities chromium 35.0.1916.153

Google Chrome Releases reports:

4 security fixes in this release, including:

  • [369525] High CVE-2014-3154: Use-after-free in filesystem api. Credit to Collin Payne.
  • [369539] High CVE-2014-3155: Out-if-bounds read in SPDY. Credit to James March, Daniel Sommermann and Alan Frindell of Facebook.
  • [369621] Medium CVE-2014-3156: Buffer overflow in clipboard. Credit to Atte Kettunen of OUSPG.
  • [368980] CVE-2014-3157: Heap overflow in media.
CVE-2014-3154 CVE-2014-3155 CVE-2014-3156 CVE-2014-3157 http://googlechromereleases.blogspot.nl 2014-06-10 2014-06-10
mozilla -- multiple vulnerabilities firefox 30.0,1 firefox-esr 24.6.0,1 seamonkey 2.26.1 linux-firefox 30.0,1 linux-seamonkey 2.26.1 linux-thunderbird 24.6.0 nspr 4.10.6 thunderbird 24.6.0

The Mozilla Project reports:

MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6)

MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer

MFSA 2014-51 Use-after-free in Event Listener Manager

MFSA 2014-52 Use-after-free with SMIL Animation Controller

MFSA 2014-53 Buffer overflow in Web Audio Speex resampler

MFSA 2014-54 Buffer overflow in Gamepad API

MFSA 2014-55 Out of bounds write in NSPR

CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1540 CVE-2014-1541 CVE-2014-1542 CVE-2014-1543 CVE-2014-1545 https://www.mozilla.org/security/announce/2014/mfsa2014-48.html https://www.mozilla.org/security/announce/2014/mfsa2014-49.html https://www.mozilla.org/security/announce/2014/mfsa2014-51.html https://www.mozilla.org/security/announce/2014/mfsa2014-52.html https://www.mozilla.org/security/announce/2014/mfsa2014-53.html https://www.mozilla.org/security/announce/2014/mfsa2014-54.html https://www.mozilla.org/security/announce/2014/mfsa2014-55.html 2014-06-10 2014-06-10
OpenSSL -- multiple vulnerabilities openssl 1.0.11.0.1_13 mingw32-openssl 1.0.11.0.1h FreeBSD 8.08.4_12 9.19.1_15 9.29.2_8 10.010.0_5

The OpenSSL Project reports:

An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server. [CVE-2014-0224]

By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. [CVE-2014-0221]

A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. [CVE-2014-0195]

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. [CVE-2014-3470]

CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 http://www.freebsd.org/security/advisories/FreeBSD-SA-14:14.openssl.asc http://www.openssl.org/news/secadv_20140605.txt 2014-06-05 2014-06-05
gnutls -- client-side memory corruption gnutls 2.12.23_6

GnuTLS project reports:

This vulnerability affects the client side of the gnutls library. A server that sends a specially crafted ServerHello could corrupt the memory of a requesting client.

CVE-2014-3466 http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 2014-05-14 2014-06-04
gnutls -- client-side memory corruption gnutls3 3.13.1.25

GnuTLS project reports:

This vulnerability affects the client side of the gnutls library. A server that sends a specially crafted ServerHello could corrupt the memory of a requesting client.

CVE-2014-3466 http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 2014-05-14 2014-06-03
mumble -- multiple vulnerabilities mumble 1.2.01.2.6

Mumble reports:

SVG images with local file references could trigger client DoS

The Mumble client did not properly HTML-escape some external strings before using them in a rich-text (HTML) context.

http://mumble.info/security/Mumble-SA-2014-005.txt http://mumble.info/security/Mumble-SA-2014-006.txt 2014-04-16 2014-05-29
mumble -- NULL pointer dereference and heap-based buffer overflow mumble 1.2.41.2.4_6

Mumble reports:

A malformed Opus voice packet sent to a Mumble client could trigger a NULL pointer dereference or an out-of-bounds array access.

A malformed Opus voice packet sent to a Mumble client could trigger a heap-based buffer overflow.

CVE-2014-0044 CVE-2014-0045 http://mumble.info/security/Mumble-SA-2014-001.txt http://mumble.info/security/Mumble-SA-2014-002.txt 2014-01-25 2014-05-29
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.359

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0510 CVE-2014-0516 CVE-2014-0517 CVE-2014-0518 CVE-2014-0519 CVE-2014-0520 https://helpx.adobe.com/security/products/flash-player/apsb14-14.html 2014-03-13 2014-05-26
openjpeg -- Multiple vulnerabilities openjpeg 1.5.2

Openjpeg release notes report:

That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1 release.

That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045, CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887, where fixed in the 1.5.2 release.

CVE-2012-3358 CVE-2012-3535 CVE-2013-1447 CVE-2013-4289 CVE-2013-4290 CVE-2013-6045 CVE-2013-6052 CVE-2013-6053 CVE-2013-6054 CVE-2013-6887 http://openjpeg.googlecode.com/svn/tags/version.1.5.1/NEWS http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS 2012-05-13 2014-05-24
chromium -- multiple vulnerabilities chromium 35.0.1916.114

Google Chrome Releases reports:

23 security fixes in this release, including:

  • [356653] High CVE-2014-1743: Use-after-free in styles. Credit to cloudfuzzer.
  • [359454] High CVE-2014-1744: Integer overflow in audio. Credit to Aaron Staple.
  • [346192] High CVE-2014-1745: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.
  • [364065] Medium CVE-2014-1746: Out-of-bounds read in media filters. Credit to Holger Fuhrmannek.
  • [330663] Medium CVE-2014-1747: UXSS with local MHTML file. Credit to packagesu.
  • [331168] Medium CVE-2014-1748: UI spoofing with scrollbar. Credit to Jordan Milne.
  • [374649] CVE-2014-1749: Various fixes from internal audits, fuzzing and other initiatives.
  • [358057] CVE-2014-3152: Integer underflow in V8 fixed in version 3.25.28.16.
CVE-2014-1743 CVE-2014-1744 CVE-2014-1745 CVE-2014-1746 CVE-2014-1747 CVE-2014-1748 CVE-2014-1749 CVE-2014-3152 http://googlechromereleases.blogspot.nl/ 2014-05-20 2014-05-20
chromium -- multiple vulnerabilities chromium 34.0.1847.137

Google Chrome Releases reports:

3 security fixes in this release:

  • [358038] High CVE-2014-1740: Use-after-free in WebSockets. Credit to Collin Payne.
  • [349898] High CVE-2014-1741: Integer overflow in DOM ranges. Credit to John Butler.
  • [356690] High CVE-2014-1742: Use-after-free in editing. Credit to cloudfuzzer.
CVE-2014-1740 CVE-2014-1741 CVE-2014-1742 http://googlechromereleases.blogspot.nl/ 2014-05-13 2014-05-14
libXfont -- X Font Service Protocol and Font metadata file handling issues libXfont 1.4.7_3 linux-c6-xorg-libs 7.4_2 linux-f10-xorg-libs *

Alan Coopersmith reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered several issues in the way the libXfont library handles the responses it receives from xfs servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from libXfont trusting the font server to send valid protocol data, and not verifying that the values will not overflow or cause other damage. This code is commonly called from the X server when an X Font Server is active in the font path, so may be running in a setuid-root process depending on the X server in use. Exploits of this path could be used by a local, authenticated user to attempt to raise privileges; or by a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.

CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 http://lists.x.org/archives/xorg-announce/2014-May/002431.html 2014-05-13 2014-05-13 2015-07-15
libxml2 -- lack of end-of-document check DoS libxml2 2.9.1 linux-c6-libxml2 2.7.6_2 linux-f10-libxml2 *

CVE MITRE reports:

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.

CVE-2013-2877 https://git.gnome.org/browse/libxml2/tag/?id=CVE-2013-2877 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2877 2013-04-11 2013-07-10 2015-07-15
libxml2 -- entity substitution DoS libxml2 2.9.1 linux-c6-libxml2 2.7.6_2 linux-f10-libxml2 *

Stefan Cornelius reports:

It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substitution in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors.

This issue was discovered by Daniel Berrange of Red Hat.

CVE-2014-0191 http://www.openwall.com/lists/oss-security/2014/05/06/4 https://git.gnome.org/browse/libxml2/tag/?id=CVE-2014-0191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191 2013-12-03 2014-05-06 2015-07-15
OpenSSL -- NULL pointer dereference / DoS openssl 1.0.11.0.1_12

OpenBSD and David Ramos reports:

Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache, are prone to a race condition which may allow a remote attacker to crash the current service.

http://www.openwall.com/lists/oss-security/2014/05/02/5 https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321 CVE-2014-0198 2014-05-02 2014-05-03
qt4-xml -- XML Entity Expansion Denial of Service qt4-xml 4.8.6

Richard J. Moore reports:

QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted data then the application may use unexpected amounts of memory if a malicious document is processed.

It is possible to construct XML documents using internal entities that consume large amounts of memory and other resources to process, this is known as the 'Billion Laughs' attack. Qt versions prior to 5.2 did not offer protection against this issue.

CVE-2013-4549 http://lists.qt-project.org/pipermail/announce/2013-December/000036.html 2013-12-05 2014-05-05
strongswan -- Remote Authentication Bypass strongswan 5.1.3

strongSwan developers report:

Remote attackers are able to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.

Only installations that actively initiate or re-authenticate IKEv2 IKE_SAs are affected.

CVE-2014-2338 http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html 2014-03-12 2014-05-04
mohawk -- multiple vulnerabilities mohawk 2.0.12

The mohawk project reports:

Segfault when parsing malformed / unescaped url, coredump when setting syslog facility.

http://fossil.bsdsx.fr/mohawk/tktview?name=1707f0e351 http://fossil.bsdsx.fr/mohawk/tktview?name=1c7565019e 2014-04-10 2014-04-30
chromium -- multiple vulnerabilities chromium 34.0.1847.132

Google Chrome Releases reports (belatedly):

9 security fixes in this release, including:

  • [354967] High CVE-2014-1730: Type confusion in V8. Credit to Anonymous.
  • [349903] High CVE-2014-1731: Type confusion in DOM. Credit to John Butler.
  • [359802] High CVE-2014-1736: Integer overflow in V8. Credit to SkyLined working with HP's Zero Day Initiative.
  • [352851] Medium CVE-2014-1732: Use-after-free in Speech Recognition. Credit to Khalil Zhani.
  • [351103] Medium CVE-2014-1733: Compiler bug in Seccomp-BPF. Credit to Jed Davis.
  • [367314] CVE-2014-1734: Various fixes from internal audits, fuzzing and other initiatives.
  • [359130, 359525, 360429] CVE-2014-1735: Multiple vulnerabilities in V8 fixed in version 3.24.35.33.
CVE-2014-1730 CVE-2014-1731 CVE-2014-1732 CVE-2014-1733 CVE-2014-1734 CVE-2014-1735 CVE-2014-1736 http://googlechromereleases.blogspot.nl/ 2014-04-24 2014-04-30
mozilla -- multiple vulnerabilities firefox 29.0,1 firefox-esr 24.5.0,1 linux-firefox 29.0,1 linux-seamonkey 2.26 linux-thunderbird 24.5.0 seamonkey 2.26 thunderbird 24.5.0

The Mozilla Project reports:

MFSA 2014-34 Miscellaneous memory safety hazards (rv:29.0 / rv:24.5)

MFSA 2014-35 Privilege escalation through Mozilla Maintenance Service Installer

MFSA 2014-36 Web Audio memory corruption issues

MFSA 2014-37 Out of bounds read while decoding JPG images

MFSA 2014-38 Buffer overflow when using non-XBL object as XBL

MFSA 2014-39 Use-after-free in the Text Track Manager for HTML video

MFSA 2014-41 Out-of-bounds write in Cairo

MFSA 2014-42 Privilege escalation through Web Notification API

MFSA 2014-43 Cross-site scripting (XSS) using history navigations

MFSA 2014-44 Use-after-free in imgLoader while resizing images

MFSA 2014-45 Incorrect IDNA domain name matching for wildcard certificates

MFSA 2014-46 Use-after-free in nsHostResolve

MFSA 2014-47 Debugger can bypass XrayWrappers with JavaScript

CVE-2014-1492 CVE-2014-1518 CVE-2014-1519 CVE-2014-1520 CVE-2014-1522 CVE-2014-1523 CVE-2014-1524 CVE-2014-1525 CVE-2014-1526 CVE-2014-1527 CVE-2014-1528 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 https://www.mozilla.org/security/announce/2014/mfsa2014-34.html https://www.mozilla.org/security/announce/2014/mfsa2014-35.html https://www.mozilla.org/security/announce/2014/mfsa2014-36.html https://www.mozilla.org/security/announce/2014/mfsa2014-37.html https://www.mozilla.org/security/announce/2014/mfsa2014-38.html https://www.mozilla.org/security/announce/2014/mfsa2014-39.html https://www.mozilla.org/security/announce/2014/mfsa2014-41.html https://www.mozilla.org/security/announce/2014/mfsa2014-42.html https://www.mozilla.org/security/announce/2014/mfsa2014-43.html https://www.mozilla.org/security/announce/2014/mfsa2014-44.html https://www.mozilla.org/security/announce/2014/mfsa2014-45.html https://www.mozilla.org/security/announce/2014/mfsa2014-46.html https://www.mozilla.org/security/announce/2014/mfsa2014-47.html http://www.mozilla.org/security/known-vulnerabilities/ 2014-04-29 2014-04-29
django -- multiple vulnerabilities py26-django 1.61.6.3 py27-django 1.61.6.3 py31-django 1.61.6.3 py32-django 1.61.6.3 py33-django 1.61.6.3 py34-django 1.61.6.3 py26-django15 1.51.5.6 py27-django15 1.51.5.6 py31-django15 1.51.5.6 py32-django15 1.51.5.6 py33-django15 1.51.5.6 py34-django15 1.51.5.6 py26-django14 1.41.4.11 py27-django14 1.41.4.11 py31-django14 1.41.4.11 py32-django14 1.41.4.11 py33-django14 1.41.4.11 py34-django14 1.41.4.11 py26-django-devel 20140423,1 py27-django-devel 20140423,1

The Django project reports:

These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and upgrade as soon as possible.

https://www.djangoproject.com/weblog/2014/apr/21/security/ CVE-2014-0472 CVE-2014-0473 CVE-2014-0474 2014-04-21 2014-04-23 2014-04-30
OpenSSL -- Remote Data Injection / DoS openssl 1.0.11.0.1_11 mingw32-openssl 1.0.11.0.1g

Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are prone to a race condition which may allow a remote attacker to inject random data into other connections.

https://rt.openssl.org/Ticket/Display.html?id=2167 http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse CVE-2010-5298 2010-02-09 2014-04-23
bugzilla -- Cross-Site Request Forgery bugzilla40 2.0.04.4.3 bugzilla42 2.0.04.4.3 bugzilla44 2.0.04.4.3

A Bugzilla Security Advisory reports:

The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. If the victim then reports a new security sensitive bug, the attacker would get immediate access to this bug.

Due to changes involved in the Bugzilla API, this fix is not backported to the 4.0 and 4.2 branches, meaning that Bugzilla 4.0.12 and older, and 4.2.8 and older, will remain vulnerable to this issue.

CVE-2014-1517 https://bugzilla.mozilla.org/show_bug.cgi?id=713926 2014-04-17 2014-04-18 2014-04-18
bugzilla -- Social Engineering bugzilla40 2.0.04.0.12 bugzilla42 4.1.14.2.8 bugzilla44 4.4.04.4.3

A Bugzilla Security Advisory reports:

Dangerous control characters can be inserted into Bugzilla, notably into bug comments. If the text, which may look safe, is copied into a terminal such as xterm or gnome-terminal, then unexpected commands could be executed on the local machine.

https://bugzilla.mozilla.org/show_bug.cgi?id=968576 2014-04-17 2014-04-18 2014-04-18
OpenLDAP -- incorrect handling of NULL in certificate Common Name openldap24-client 2.4.18 linux-f10-openldap 2.4.18

Jan Lieskovsky reports:

OpenLDAP does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority

CVE-2009-3767 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3767 2009-08-07 2014-04-11
cURL -- inappropriate GSSAPI delegation curl 7.10.67.21.6 linux-f10-curl 7.10.67.21.6

cURL reports:

When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism.

CVE-2011-2192 http://curl.haxx.se/docs/adv_20110623.html 2011-06-23 2014-04-11 2014-04-30
dbus-glib -- privledge escalation dbus-glib 0.100.1 linux-f10-dbus-glib 0.100.1

Sebastian Krahmer reports:

A privilege escalation flaw was found in the way dbus-glib, the D-Bus add-on library to integrate the standard D-Bus library with the GLib thread abstraction and main loop, performed filtering of the message sender (message source subject), when the NameOwnerChanged signal was received. A local attacker could use this flaw to escalate their privileges.

CVE-2013-0292 https://bugs.freedesktop.org/show_bug.cgi?id=60916 2013-02-15 2014-04-11 2014-04-30
nas -- multiple vulnerabilities nas 1.9.4 linux-f10-nas-libs 1.9.4

Hamid Zamani reports:

multiple security problems (buffer overflows, format string vulnerabilities and missing input sanitising), which could lead to the execution of arbitrary code.

CVE-2013-4256 CVE-2013-4257 CVE-2013-4258 http://radscan.com/pipermail/nas/2013-August/001270.html 2013-08-07 2014-04-11
libaudiofile -- heap-based overflow in Microsoft ADPCM compression module libaudiofile 0.2.7 linux-f10-libaudiofile 0.2.7

Debian reports:

Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WAV file.

CVE-2014-0159 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510205 2008-12-30 2014-04-11 2014-04-30
ChaSen -- buffer overflow chasen-base 2.4.5 chasen 2.4.5

JVN iPedia reports:

ChaSen provided by Nara Institute of Science and Technology is a software for morphologically analyzing Japanese. ChaSen contains an issue when reading in strings, which may lead to a buffer overflow.

An arbitrary script may be executed by an attacker with access to a system that is running a product listed in "Products Affected."

CVE-2011-4000 http://jvn.jp/en/jp/JVN16901583/index.html 2011-11-08 2014-04-13
OpenSSL -- Local Information Disclosure openssl 1.0.11.0.1_10 mingw32-openssl 1.0.11.0.1g FreeBSD 8.38.3_15 8.48.4_8 9.19.1_11 9.29.2_4 10.010.0_1

OpenSSL reports:

A flaw in the implementation of Montgomery Ladder Approach would create a side-channel that leaks sensitive timing information.

A local attacker might be able to snoop a signing process and might recover the signing key from it.

CVE-2014-0076 FreeBSD-SA-14:06.openssl https://www.openssl.org/news/vulnerabilities.html#2014-0076 2014-04-07 2014-04-11
openafs -- Denial of Service openafs 1.4.81.6.7

The OpenAFS development team reports:

An attacker with the ability to connect to an OpenAFS fileserver can trigger a buffer overflow, crashing the server.

The buffer overflow can be triggered by sending an unauthenticated request for file server statistical information.

Clients are not affected.

CVE-2014-0159 http://openafs.org/security/OPENAFS-SA-2014-001.txt 2014-04-09 2014-04-09
chromium -- multiple vulnerabilities chromium 34.0.1847.116

Google Chrome Releases reports:

31 vulnerabilities fixed in this release, including:

  • [354123] High CVE-2014-1716: UXSS in V8. Credit to Anonymous.
  • [353004] High CVE-2014-1717: OOB access in V8. Credit to Anonymous.
  • [348332] High CVE-2014-1718: Integer overflow in compositor. Credit to Aaron Staple.
  • [343661] High CVE-2014-1719: Use-after-free in web workers. Credit to Collin Payne.
  • [356095] High CVE-2014-1720: Use-after-free in DOM. Credit to cloudfuzzer.
  • [350434] High CVE-2014-1721: Memory corruption in V8. Credit to Christian Holler.
  • [330626] High CVE-2014-1722: Use-after-free in rendering. Credit to miaubiz.
  • [337746] High CVE-2014-1723: Url confusion with RTL characters. Credit to George McBay.
  • [327295] High CVE-2014-1724: Use-after-free in speech. Credit to Atte Kettunen of OUSPG.
  • [357332] Medium CVE-2014-1725: OOB read with window property. Credit to Anonymous
  • [346135] Medium CVE-2014-1726: Local cross-origin bypass. Credit to Jann Horn.
  • [342735] Medium CVE-2014-1727: Use-after-free in forms. Credit to Khalil Zhani.
  • [360298] CVE-2014-1728: Various fixes from internal audits, fuzzing and other initiatives.
  • [345820, 347262, 348319, 350863, 352982, 355586, 358059] CVE-2014-1729: Multiple vulnerabilities in V8 fixed in version 3.24.35.22.
CVE-2014-1716 CVE-2014-1717 CVE-2014-1718 CVE-2014-1719 CVE-2014-1720 CVE-2014-1721 CVE-2014-1722 CVE-2014-1723 CVE-2014-1724 CVE-2014-1725 CVE-2014-1726 CVE-2014-1727 CVE-2014-1728 CVE-2014-1729 http://googlechromereleases.blogspot.nl/ 2014-04-08 2014-04-08
OpenSSL -- Remote Information Disclosure openssl 1.0.11.0.1_10 mingw32-openssl 1.0.11.0.1g FreeBSD 10.010.0_1

OpenSSL Reports:

A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.

Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.

The bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users.

The code used to handle the Heartbeat Extension does not do sufficient boundary checks on record length, which allows reading beyond the actual payload.

CVE-2014-0160 FreeBSD-SA-14:06.openssl https://www.openssl.org/news/secadv_20140407.txt https://www.openssl.org/news/vulnerabilities.html#2014-0076 http://www.heartbleed.com 2014-04-07 2014-04-07 2014-04-11
otrs -- Clickjacking issue otrs 3.1.21 3.2.*3.2.16 3.3.*3.3.6

The OTRS Project reports:

An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in OTRS.

http://www.w3.org/1999/xhtml CVE-2014-2554 2014-04-01 2014-04-03
LibYAML input sanitization errors libyaml 0.1.6 mingw32-libyaml 0.1.6

oCERT reports:

The LibYAML project is an open source YAML 1.1 parser and emitter written in C.

The library is affected by a heap-based buffer overflow which can lead to arbitrary code execution. The vulnerability is caused by lack of proper expansion for the string passed to the yaml_parser_scan_uri_escapes() function.

A specially crafted YAML file, with a long sequence of percent-encoded characters in a URL, can be used to trigger the overflow.

CVE-2014-2525 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2525 2014-03-11 2014-03-26
Icinga -- buffer overflow in classic web interface icinga 1.11.1

The Icinga Team reports:

Wrong strlen check against MAX_INPUT_BUFFER without taking '\0' into account [...]

CVE-2014-2386 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2386 2014-02-18 2014-03-29
file -- out-of-bounds access in search rules with offsets from input file file 5.18

Aaron Reffett reports:

softmagic.c in file ... and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.

CVE-2014-2270 http://bugs.gw.com/view.php?id=31 2013-12-20 2014-03-29
Joomla! -- Core - Multiple Vulnerabilities joomla2 2.5.*2.5.18 joomla3 3.0.*3.2.2

The JSST and the Joomla! Security Center report:

[20140301] - Core - SQL Injection

Inadequate escaping leads to SQL injection vulnerability.

[20140302] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability in com_contact.

[20140303] - Core - XSS Vulnerability

Inadequate escaping leads to XSS vulnerability.

[20140304] - Core - Unauthorised Logins

Inadequate checking allowed unauthorised logins via GMail authentication.

http://developer.joomla.org/security/578-20140301-core-sql-injection.html http://developer.joomla.org/security/579-20140302-core-xss-vulnerability.html http://developer.joomla.org/security/580-20140303-core-xss-vulnerability.html http://developer.joomla.org/security/581-20140304-core-unauthorised-logins.html 2014-03-01 2014-03-23 2014-04-30
mail/trojita -- may leak mail contents (not user credentials) over unencrypted connection trojita 0.4.1

Jan Kundrát reports:

An SSL stripping vulnerability was discovered in Trojitá, a fast Qt IMAP e-mail client. User's credentials are never leaked, but if a user tries to send an e-mail, the automatic saving into the "sent" or "draft" folders could happen over a plaintext connection even if the user's preferences specify STARTTLS as a requirement.

CVE-2014-2567 http://jkt.flaska.net/blog/Trojita_0_4_1__a_security_update_for_CVE_2014_2567.html 2014-03-20 2014-03-23
nginx-devel -- SPDY heap buffer overflow nginx-devel 1.3.151.5.12

The nginx project reports:

A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.

CVE-2014-0133 http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html 2014-03-18 2014-03-23
nginx -- SPDY heap buffer overflow nginx 1.4.7

The nginx project reports:

A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133).

The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.

The problem is fixed in nginx 1.5.12, 1.4.7.

CVE-2014-0133 http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html 2014-03-18 2014-03-23
apache -- several vulnerabilities apache24 2.4.02.4.9 apache22 2.2.02.2.27 apache22-event-mpm 2.2.02.2.27 apache22-itk-mpm 2.2.02.2.27 apache22-peruser-mpm 2.2.02.2.27 apache22-worker-mpm 2.2.02.2.27

Apache HTTP SERVER PROJECT reports:

Clean up cookie logging with fewer redundant string parsing passes. Log only cookies with a value assignment. Prevents segfaults when logging truncated cookies.

mod_dav: Keep track of length of cdata properly when removing leading spaces. Eliminates a potential denial of service from specifically crafted DAV WRITE requests.

CVE-2014-0098 CVE-2013-6438 2014-02-25 2014-03-22
mozilla -- multiple vulnerabilities firefox 28.0,1 firefox-esr 24.4.0,1 linux-firefox 28.0,1 linux-seamonkey 2.25 linux-thunderbird 24.4.0 seamonkey 2.25 thunderbird 24.4.0

The Mozilla Project reports:

MFSA 2014-15 Miscellaneous memory safety hazards (rv:28.0 / rv:24.4)

MFSA 2014-16 Files extracted during updates are not always read only

MFSA 2014-17 Out of bounds read during WAV file decoding

MFSA 2014-18 crypto.generateCRMFRequest does not validate type of key

MFSA 2014-19 Spoofing attack on WebRTC permission prompt

MFSA 2014-20 onbeforeunload and Javascript navigation DOS

MFSA 2014-21 Local file access via Open Link in new tab

MFSA 2014-22 WebGL content injection from one domain to rendering in another

MFSA 2014-23 Content Security Policy for data: documents not preserved by session restore

MFSA 2014-24 Android Crash Reporter open to manipulation

MFSA 2014-25 Firefox OS DeviceStorageFile object vulnerable to relative path escape

MFSA 2014-26 Information disclosure through polygon rendering in MathML

MFSA 2014-27 Memory corruption in Cairo during PDF font rendering

MFSA 2014-28 SVG filters information disclosure through feDisplacementMap

MFSA 2014-29 Privilege escalation using WebIDL-implemented APIs

MFSA 2014-30 Use-after-free in TypeObject

MFSA 2014-31 Out-of-bounds read/write through neutering ArrayBuffer objects

MFSA 2014-32 Out-of-bounds write through TypedArrayObject after neutering

CVE-2014-1493 CVE-2014-1494 CVE-2014-1496 CVE-2014-1497 CVE-2014-1498 CVE-2014-1499 CVE-2014-1500 CVE-2014-1501 CVE-2014-1502 CVE-2014-1504 CVE-2014-1505 CVE-2014-1506 CVE-2014-1507 CVE-2014-1508 CVE-2014-1509 CVE-2014-1510 CVE-2014-1511 CVE-2014-1512 CVE-2014-1513 CVE-2014-1514 https://www.mozilla.org/security/announce/2014/mfsa2014-15.html https://www.mozilla.org/security/announce/2014/mfsa2014-16.html https://www.mozilla.org/security/announce/2014/mfsa2014-17.html https://www.mozilla.org/security/announce/2014/mfsa2014-18.html https://www.mozilla.org/security/announce/2014/mfsa2014-19.html https://www.mozilla.org/security/announce/2014/mfsa2014-20.html https://www.mozilla.org/security/announce/2014/mfsa2014-21.html https://www.mozilla.org/security/announce/2014/mfsa2014-22.html https://www.mozilla.org/security/announce/2014/mfsa2014-23.html https://www.mozilla.org/security/announce/2014/mfsa2014-24.html https://www.mozilla.org/security/announce/2014/mfsa2014-25.html https://www.mozilla.org/security/announce/2014/mfsa2014-26.html https://www.mozilla.org/security/announce/2014/mfsa2014-27.html https://www.mozilla.org/security/announce/2014/mfsa2014-28.html https://www.mozilla.org/security/announce/2014/mfsa2014-29.html https://www.mozilla.org/security/announce/2014/mfsa2014-30.html https://www.mozilla.org/security/announce/2014/mfsa2014-31.html https://www.mozilla.org/security/announce/2014/mfsa2014-32.html http://www.mozilla.org/security/known-vulnerabilities/ 2014-03-19 2014-03-19 2014-03-20
www/chromium -- multiple vulnerabilities chromium 33.0.1750.152

Google Chrome Releases reports:

New vulnerabilities after the Pwn2Own competition:

  • [352369] Code execution outside sandbox. Credit to VUPEN.
    • [352374] High CVE-2014-1713: Use-after-free in Blink bindings
    • [352395] High CVE-2014-1714: Windows clipboard vulnerability
  • [352420] Code execution outside sandbox. Credit to Anonymous.
    • [351787] High CVE-2014-1705: Memory corruption in V8
    • [352429] High CVE-2014-1715: Directory traversal issue
CVE-2014-1705 CVE-2014-1713 CVE-2014-1714 CVE-2014-1715 http://googlechromereleases.blogspot.nl/ 2014-03-14 2014-03-15
mutt -- denial of service, potential remote code execution mutt 1.5.23

Beatrice Torracca and Evgeni Golov report:

A buffer overflow has been discovered that could result in denial of service or potential execution of arbitrary code.

This condition can be triggered by malformed RFC2047 header lines

CVE-2014-0467 http://packetstormsecurity.com/files/cve/CVE-2014-0467 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0467 2014-03-12 2014-03-14
wemux -- read-only can be bypassed wemux 3.2.0

JonApps reports:

The read-only mode can be bypassed and any command sent to bash session

https://github.com/zolrath/wemux/issues/36 2013-12-24 2014-03-13
samba -- multiple vulnerabilities samba34 0 samba35 0 samba36 3.6.*3.6.23 samba4 4.0.*4.0.16 samba41 4.1.*4.1.6

Samba project reports:

In Samba's SAMR server we neglect to ensure that attempted password changes will update the bad password count, nor set the lockout flags. This would allow a user unlimited attempts against the password by simply calling ChangePasswordUser2 repeatedly.

This is available without any other authentication.

smbcacls can remove a file or directory ACL by mistake.

CVE-2013-4496 CVE-2013-6442 http://www.samba.org/samba/security/CVE-2013-4496 http://www.samba.org/samba/security/CVE-2013-6442 2014-03-11 2014-03-11
asterisk -- multiple vulnerabilities asterisk11 11.8.1 asterisk18 1.8.26.1

The Asterisk project reports:

Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request.

Denial of Service Through File Descriptor Exhaustion with chan_sip Session-Timers. An attacker can use all available file descriptors using SIP INVITE requests. Asterisk will respond with code 400, 420, or 422 for INVITEs meeting this criteria. Each INVITE meeting these conditions will leak a channel and several file descriptors. The file descriptors cannot be released without restarting Asterisk which may allow intrusion detection systems to be bypassed by sending the requests slowly.

Remote Crash Vulnerability in PJSIP channel driver. A remotely exploitable crash vulnerability exists in the PJSIP channel driver if the "qualify_frequency" configuration option is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request. The response handling code wrongly assumes that a PJSIP endpoint will always be associated with an outgoing request which is incorrect.

CVE-2014-2286 CVE-2014-2287 CVE-2014-2288 http://downloads.asterisk.org/pub/security/AST-2014-001.pdf http://downloads.asterisk.org/pub/security/AST-2014-002.pdf http://downloads.asterisk.org/pub/security/AST-2014-003.pdf https://www.asterisk.org/security 2014-03-10 2014-03-10
www/chromium --multiple vulnerabilities chromium 33.0.1750.149

Google Chrome Releases reports:

7 vulnerabilities fixed in this release, including:

  • [344881] High CVE-2014-1700: Use-after-free in speech. Credit to Chamal de Silva.
  • [342618] High CVE-2014-1701: UXSS in events. Credit to aidanhs.
  • [333058] High CVE-2014-1702: Use-after-free in web database. Credit to Collin Payne.
  • [338354] High CVE-2014-1703: Potential sandbox escape due to a use-after-free in web sockets.
  • [328202, 349079, 345715] CVE-2014-1704: Multiple vulnerabilities in V8 fixed in version 3.23.17.18.
CVE-2014-1700 CVE-2014-1701 CVE-2014-1702 CVE-2014-1703 CVE-2014-1704 http://googlechromereleases.blogspot.nl/ 2014-03-11 2014-03-11
freetype2 -- Out of bounds read/write freetype2 2.5.3

Mateusz Jurczyk reports:

Out of bounds stack-based read/write in cf2_hintmap_build.

This is a critical vulnerability in the CFF Rasterizer code recently contributed by Adobe, leading to potential arbitrary code execution in the context of the FreeType2 library client.

http://savannah.nongnu.org/bugs/?41697 2014-02-25 2014-03-09
xmms -- Integer Overflow And Underflow Vulnerabilities xmms 1.2.11_20

Secunia reports:

Secunia Research has discovered two vulnerabilities in XMMS, which can be exploited by malicious people to compromise a user's system.

1) An integer underflow error exists in the processing of skin bitmap images. This can be exploited to cause a stack-based buffer overflow via specially crafted skin images containing manipulated header information.

Successful exploitation allows execution of arbitrary code.

2) An integer overflow error exists in the processing of skin bitmap images. This can be exploited to cause memory corruption via specially crafted skin images containing manipulated header information.

Successful exploitation may allow the execution of arbitrary code.

CVE-2007-0653 CVE-2007-0654 2007-02-06 2014-03-06
nginx -- SPDY memory corruption nginx-devel 1.5.10

The nginx project reports:

A bug in the experimental SPDY implementation in nginx 1.5.10 was found, which might allow an attacker to corrupt worker process memory by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0088).

The problem only affects nginx 1.5.10 on 32-bit platforms, compiled with the ngx_http_spdy_module module (which is not compiled by default), if the "spdy" option of the "listen" directive is used in a configuration file.

CVE-2014-0088 http://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html 2014-03-04 2014-03-06
chromium -- multiple vulnerabilities chromium 33.0.1750.146

Google Chrome Releases reports:

19 vulnerabilities fixed in this release, including:

  • [344492] High CVE-2013-6663: Use-after-free in svg images. Credit to Atte Kettunen of OUSPG.
  • [326854] High CVE-2013-6664: Use-after-free in speech recognition. Credit to Khalil Zhani.
  • [337882] High CVE-2013-6665: Heap buffer overflow in software rendering. Credit to cloudfuzzer.
  • [332023] Medium CVE-2013-6666: Chrome allows requests in flash header request. Credit to netfuzzerr.
  • [348175] CVE-2013-6667: Various fixes from internal audits, fuzzing and other initiatives.
  • [343964, 344186, 347909] CVE-2013-6668: Multiple vulnerabilities in V8 fixed in version 3.24.35.10.
CVE-2013-6663 CVE-2013-6664 CVE-2013-6665 CVE-2013-6666 CVE-2013-6667 CVE-2013-6668 http://googlechromereleases.blogspot.nl/ 2014-03-03 2014-03-05
gnutls -- multiple certificate verification issues gnutls 2.12.23_4 linux-f10-gnutls 2.12.23_4 gnutls-devel 3.1.22 3.2.03.2.12 gnutls3 3.1.22 3.2.03.2.12

GnuTLS project reports:

A vulnerability was discovered that affects the certificate verification functions of all gnutls versions. A specially crafted certificate could bypass certificate validation checks. The vulnerability was discovered during an audit of GnuTLS for Red Hat.

Suman Jana reported a vulnerability that affects the certificate verification functions of gnutls 2.11.5 and later versions. A version 1 intermediate certificate will be considered as a CA certificate by default (something that deviates from the documented behavior).

CVE-2014-0092 CVE-2014-1959 http://www.gnutls.org/security.html#GNUTLS-SA-2014-1 http://www.gnutls.org/security.html#GNUTLS-SA-2014-2 2014-03-03 2014-03-04 2014-04-30
file -- denial of service file 5.17

The Fine Free file project reports:

file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.

CVE-2014-1943 http://mx.gw.com/pipermail/file/2014/001327.html 2014-02-16 2014-03-03
Python -- buffer overflow in socket.recvfrom_into() python27 2.7.6_3 python31 3.1.5_10 python32 3.2.5_7 python33 3.3.3_2

Vincent Danen via Red Hat Issue Tracker reports:

A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code.

This vulnerable function, socket.recvfrom_into(), was introduced in Python 2.5. Earlier versions are not affected by this flaw.

65379 CVE-2014-1912 https://mail.python.org/pipermail/python-dev/2014-February/132758.html http://bugs.python.org/issue20246 https://bugzilla.redhat.com/show_bug.cgi?id=1062370 2014-01-14 2014-03-01
subversion -- mod_dav_svn vulnerability subversion 1.3.01.7.16 1.8.01.8.8 subversion16 1.3.01.7.16 subversion17 1.3.01.7.16

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on. This can lead to a DoS. There are no known instances of this problem being exploited in the wild, but the details of how to exploit it have been disclosed on the Subversion development mailing list.

CVE-2014-0032 https://subversion.apache.org/security/CVE-2014-0032-advisory.txt 2014-01-10 2014-02-26 2014-04-30
otrs -- XSS Issue otrs 3.1.20 3.2.*3.2.15 3.3.*3.3.5

The OTRS Project reports:

An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed.

https://www.otrs.com/security-advisory-2014-03-xss-issue/ CVE-2014-1695 2014-02-25 2014-02-25
chromium -- multiple vulnerabilities chromium 33.0.1750.117

Google Chrome Releases reports:

28 security fixes in this release, including:

  • [334897] High CVE-2013-6652: Issue with relative paths in Windows sandbox named pipe policy. Credit to tyranid.
  • [331790] High CVE-2013-6653: Use-after-free related to web contents. Credit to Khalil Zhani.
  • [333176] High CVE-2013-6654: Bad cast in SVG. Credit to TheShow3511.
  • [293534] High CVE-2013-6655: Use-after-free in layout. Credit to cloudfuzzer.
  • [331725] High CVE-2013-6656: Information leak in XSS auditor. Credit to NeexEmil.
  • [331060] Medium CVE-2013-6657: Information leak in XSS auditor. Credit to NeexEmil.
  • [322891] Medium CVE-2013-6658: Use-after-free in layout. Credit to cloudfuzzer.
  • [306959] Medium CVE-2013-6659: Issue with certificates validation in TLS handshake. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco, Inria Paris.
  • [332579] Low CVE-2013-6660: Information leak in drag and drop. Credit to bishopjeffreys.
  • [344876] Low-High CVE-2013-6661: Various fixes from internal audits, fuzzing and other initiatives. Of these, seven are fixes for issues that could have allowed for sandbox escapes from compromised renderers.
CVE-2013-6652 CVE-2013-6653 CVE-2013-6654 CVE-2013-6655 CVE-2013-6656 CVE-2013-6657 CVE-2013-6658 CVE-2013-6659 CVE-2013-6660 CVE-2013-6661 http://googlechromereleases.blogspot.nl/ 2014-02-20 2014-02-24
PostgreSQL -- multiple privilege issues postgresql-server 8.4.20 9.0.09.0.16 9.1.09.1.12 9.2.09.2.7 9.3.09.3.3

PostgreSQL Project reports:

This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN OPTION permission. It also fixes multiple privilege escalation issues, including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, and CVE-2014-0066. More information on these issues can be found on our security page and the security issue detail wiki page.

With this release, we are also alerting users to a known security hole that allows other users on the same machine to gain access to an operating system account while it is doing "make check": CVE-2014-0067. "Make check" is normally part of building PostgreSQL from source code. As it is not possible to fix this issue without causing significant issues to our testing infrastructure, a patch will be released separately and publicly. Until then, users are strongly advised not to run "make check" on machines where untrusted users have accounts.

CVE-2014-0060 CVE-2014-0061 CVE-2014-0062 CVE-2014-0063 CVE-2014-0064 CVE-2014-0065 CVE-2014-0066 CVE-2014-0067 2014-02-20 2014-02-20
phpMyAdmin -- Self-XSS due to unescaped HTML output in import. phpMyAdmin 3.3.14.1.7

The phpMyAdmin development team reports:

When importing a file with crafted filename, it is possible to trigger an XSS. We consider this vulnerability to be non critical.

http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php CVE-2014-1879 2014-02-15 2014-02-15
jenkins -- multiple vulnerabilities jenkins 1.551 jenkins-lts 1.532.2

Jenkins Security Advisory reports:

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

  1. iSECURITY-105

    In some places, Jenkins XML API uses XStream to deserialize arbitrary content, which is affected by CVE-2013-7285 reported against XStream. This allows malicious users of Jenkins with a limited set of permissions to execute arbitrary code inside Jenkins master.

  2. SECURITY-76 & SECURITY-88 / CVE-2013-5573

    Restrictions of HTML tags for user-editable contents are too lax. This allows malicious users of Jenkins to trick other unsuspecting users into providing sensitive information.

  3. SECURITY-109

    Plugging a hole in the earlier fix to SECURITY-55. Under some circimstances, a malicious user of Jenkins can configure job X to trigger another job Y that the user has no access to.

  4. SECURITY-108

    CLI job creation had a directory traversal vulnerability. This allows a malicious user of Jenkins with a limited set of permissions to overwrite files in the Jenkins master and escalate privileges.

  5. SECURITY-106

    The embedded Winstone servlet container is susceptive to session hijacking attack.

  6. SECURITY-93

    The password input control in the password parameter definition in the Jenkins UI was serving the actual value of the password in HTML, not an encrypted one. If a sensitive value is set as the default value of such a parameter definition, it can be exposed to unintended audience.

  7. SECURITY-89

    Deleting the user was not invalidating the API token, allowing users to access Jenkins when they shouldn't be allowed to do so.

  8. SECURITY-80

    Jenkins UI was vulnerable to click jacking attacks.

  9. SECURITY-79

    "Jenkins' own user database" was revealing the presence/absence of users when login attempts fail.

  10. SECURITY-77

    Jenkins had a cross-site scripting vulnerability in one of its cookies. If Jenkins is deployed in an environment that allows an attacker to override Jenkins cookies in victim's browser, this vulnerability can be exploited.

  11. SECURITY-75

    Jenkins was vulnerable to session fixation attack. If Jenkins is deployed in an environment that allows an attacker to override Jenkins cookies in victim's browser, this vulnerability can be exploited.

  12. SECURITY-74

    Stored XSS vulnerability. A malicious user of Jenkins with a certain set of permissions can cause Jenkins to store arbitrary HTML fragment.

  13. SECURITY-73

    Some of the system diagnostic functionalities were checking a lesser permission than it should have. In a very limited circumstances, this can cause an attacker to gain information that he shouldn't have access to.

Severity

  1. SECURITY-106, and SECURITY-80 are rated high. An attacker only needs direct HTTP access to the server to mount this attack.
  2. SECURITY-105, SECURITY-109, SECURITY-108, and SECURITY-74 are rated high. These vulnerabilities allow attackes with valid Jenkins user accounts to escalate privileges in various ways.
  3. SECURITY-76, SECURIT-88, and SECURITY-89 are rated medium. These vulnerabilities requires an attacker to be an user of Jenkins, and the mode of the attack is limited.
  4. SECURITY-93, and SECURITY-79 are rated low. These vulnerabilities only affect a small part of Jenkins and has limited impact.
  5. SECURITY-77, SECURITY-75, and SECURITY-73 are rated low. These vulnerabilities are hard to exploit unless combined with other exploit in the network.
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 CVE-2013-5573 CVE-2013-7285 2014-02-14 2014-02-15
lighttpd -- multiple vulnerabilities lighttpd 1.4.34

lighttpd security advisories report:

It is possible to inadvertantly enable vulnerable ciphers when using ssl.cipher-list.

In certain cases setuid() and similar can fail, potentially triggering lighttpd to restart running as root.

If FAMMonitorDirectory fails, the memory intended to store the context is released; some lines below the "version" compoment of that context is read. Reading invalid data doesn't matter, but the memory access could trigger a segfault.

http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt CVE-2013-4508 CVE-2013-4559 CVE-2013-4560 2013-11-28 2014-02-14
phpmyfaq -- multiple vulnerabilities phpmyfaq 2.8.6

The phpMyFAQ team reports:

An arbitrary script may be executed on the user's Internet Explorer when using an older version of the browser. If a user views a malicious page while logged in, settings may be changed unintentionally.

CVE-2014-0813 CVE-2014-0814 http://www.phpmyfaq.de/advisory_2014-02-04.php 2014-02-04 2014-02-06
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.336

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0497 http://www.adobe.com/support/security/bulletins/apsb14-04.html 2014-02-04 2014-02-04 2014-02-05
mozilla -- multiple vulnerabilities firefox 25.0,127.0,1 24.3.0,1 linux-firefox 27.0,1 linux-seamonkey 2.24 linux-thunderbird 24.3.0 seamonkey 2.24 thunderbird 24.3.0

The Mozilla Project reports:

MFSA 2014-01 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3)

MFSA 2014-02 Clone protected content with XBL scopes

MFSA 2014-03 UI selection timeout missing on download prompts

MFSA 2014-04 Incorrect use of discarded images by RasterImage

MFSA 2014-05 Information disclosure with *FromPoint on iframes

MFSA 2014-06 Profile path leaks to Android system log

MFSA 2014-07 XSLT stylesheets treated as styles in Content Security Policy

MFSA 2014-08 Use-after-free with imgRequestProxy and image proccessing

MFSA 2014-09 Cross-origin information leak through web workers

MFSA 2014-10 Firefox default start page UI content invokable by script

MFSA 2014-11 Crash when using web workers with asm.js

MFSA 2014-12 NSS ticket handling issues

MFSA 2014-13 Inconsistent JavaScript handling of access to Window objects

CVE-2014-1477 CVE-2014-1478 CVE-2014-1479 CVE-2014-1480 CVE-2014-1481 CVE-2014-1482 CVE-2014-1483 CVE-2014-1484 CVE-2014-1485 CVE-2014-1486 CVE-2014-1487 CVE-2014-1488 CVE-2014-1489 CVE-2014-1490 CVE-2014-1491 https://www.mozilla.org/security/announce/2014/mfsa2014-01.html https://www.mozilla.org/security/announce/2014/mfsa2014-02.html https://www.mozilla.org/security/announce/2014/mfsa2014-03.html https://www.mozilla.org/security/announce/2014/mfsa2014-04.html https://www.mozilla.org/security/announce/2014/mfsa2014-05.html https://www.mozilla.org/security/announce/2014/mfsa2014-06.html https://www.mozilla.org/security/announce/2014/mfsa2014-07.html https://www.mozilla.org/security/announce/2014/mfsa2014-08.html https://www.mozilla.org/security/announce/2014/mfsa2014-09.html https://www.mozilla.org/security/announce/2014/mfsa2014-10.html https://www.mozilla.org/security/announce/2014/mfsa2014-11.html https://www.mozilla.org/security/announce/2014/mfsa2014-12.html http://www.mozilla.org/security/known-vulnerabilities/ 2014-02-04 2014-02-04
libyaml heap overflow resulting in possible code execution libyaml 0.1.4_3 pkg 1.2.6 pkg-devel 1.2.6

libyaml was prone to a heap overflow that could result in arbitrary code execution. Pkg uses libyaml to parse the package manifests in some cases. Pkg also used libyaml to parse the remote repository until 1.2.

RedHat Product Security Team reports on libyaml:

A heap-based buffer overflow flaw was found in the way libyaml parsed YAML tags. A remote attacker could provide a specially-crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

CVE-2013-6393 https://bugzilla.redhat.com/show_bug.cgi?id=1033990 2013-11-24 2014-02-01 2014-02-01
socat -- buffer overflow with data from command line socat 1.7.2.3

Florian Weimer of the Red Hat Product Security Team reports:

Due to a missing check during assembly of the HTTP request line a long target server name in the PROXY-CONNECT address can cause a stack buffer overrun. Exploitation requires that the attacker is able to provide the target server name to the PROXY-CONNECT address in the command line. This can happen for example in scripts that receive data from untrusted sources.

CVE-2014-0019 http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt 2014-01-24 2014-01-29
otrs -- multiple vulnerabilities otrs 3.1.19 3.2.*3.2.14 3.3.*3.3.4

The OTRS Project reports:

SQL injection issue

An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks.

CVE-2014-1471 https://www.otrs.com/security-advisory-2014-02-sql-injection-issue/ https://www.otrs.com/security-advisory-2014-01-csrf-issue-customer-web-interface/ 2014-01-28 2014-01-28 2014-02-06
chromium -- multiple vulnerabilities chromium 32.0.1700.102

Google Chrome Releases reports:

14 security fixes in this release, including:

  • [330420] High CVE-2013-6649: Use-after-free in SVG images. Credit to Atte Kettunen of OUSPG.
  • [331444] High CVE-2013-6650: Memory corruption in V8. This issue was fixed in v8 version 3.22.24.16. Credit to Christian Holler.
CVE-2013-6649 CVE-2013-6650 http://googlechromereleases.blogspot.nl/ 2014-01-27 2014-01-27
rt42 -- denial-of-service attack via the email gateway rt42 4.24.2.1_3 4.2.24.2.2_2 p5-Email-Address-List 0.02

The RT development team reports:

Versions of RT between 4.2.0 and 4.2.2 (inclusive) are vulnerable to a denial-of-service attack via the email gateway; any installation which accepts mail from untrusted sources is vulnerable, regardless of the permissions configuration inside RT. This vulnerability is assigned CVE-2014-1474.

This vulnerability is caused by poor parsing performance in the Email::Address::List module, which RT depends on. We recommend that affected users upgrade their version of Email::Address::List to v0.02 or above, which resolves the issue. Due to a communications mishap, the release on CPAN will temporarily appear as "unauthorized," and the command-line cpan client will hence not install it. We expect this to be resolved shortly; in the meantime, the release is also available from our server.

CVE-2014-1474 http://blog.bestpractical.com/2014/01/security-vulnerability-in-rt-42.html 2014-01-27 2014-01-27
strongswan -- multiple DoS vulnerabilities strongswan 5.1.1

strongSwan Project reports:

A DoS vulnerability triggered by crafted IKEv1 fragmentation payloads was discovered in strongSwan's IKE daemon charon. All versions since 5.0.2 are affected.

A DoS vulnerability and potential authorization bypass triggered by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan. All versions since 4.3.3 are affected.

A DoS vulnerability in strongSwan was discovered, which is triggered by XAuth usernames and EAP identities in versions 5.0.3 and 5.0.4.

CVE-2013-5018 CVE-2013-6075 CVE-2013-6076 http://www.strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6076%29.html 2013-11-01 2014-01-27
varnish -- DoS vulnerability in Varnish HTTP cache varnish 3.0.5

Varnish Cache Project reports:

If Varnish receives a certain illegal request, and the subroutine 'vcl_error{}' restarts the request, the varnishd worker process will crash with an assert.

The varnishd management process will restart the worker process, but there will be a brief interruption of service and the cache will be emptied, causing more traffic to go to the backend.

We are releasing this advisory because restarting from vcl_error{} is both fairly common and documented.

This is purely a denial of service vulnerability, there is no risk of privilege escalation.

Workaround

Insert this at the top of your VCL file:

		sub vcl_error {
			if (obj.status == 400 || obj.status == 413) {
				return(deliver);
			}
		}

		Or add this test at the top of your existing vcl_error{}.
	  
CVE-2013-4484 https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-October/000686.html 2013-10-30 2014-01-25
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.335

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2014-0491 CVE-2014-0492 http://helpx.adobe.com/security/products/flash-player/apsb14-02.html 2014-01-14 2014-01-24
HTMLDOC -- buffer overflow issues when reading AFM files and parsing page sizes htmldoc 1.8.28

Michael Sweet reports:

HTMLDOC 1.8.28 fixes some known security issues and formatting bugs. Changes include:

  • SECURITY: Fixed three buffer overflow issues when reading AFM files and parsing page sizes.
http://www.msweet.org/projects.php?Z1 2014-01-06 2014-01-22 2014-01-23
virtualbox-ose -- local vulnerability virtualbox-ose 4.2.22

Oracle reports:

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.22, and 4.3.6 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.

CVE-2013-5892 http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html 2014-01-15 2014-01-16
chromium -- multiple vulnerabilities chromium 32.0.1700.77

Google Chrome Releases reports:

11 security fixes in this release, including:

  • [249502] High CVE-2013-6646: Use-after-free in web workers. Credit to Collin Payne.
  • [326854] High CVE-2013-6641: Use-after-free related to forms. Credit to Atte Kettunen of OUSPG.
  • [324969] High CVE-2013-6642: Address bar spoofing in Chrome for Android. Credit to lpilorz.
  • [321940] High CVE-2013-6643: Unprompted sync with an attacker’s Google account. Credit to Joao Lucas Melo Brasio.
  • [318791] Medium CVE-2013-6645 Use-after-free related to speech input elements. Credit to Khalil Zhani.
  • [333036] CVE-2013-6644: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2013-6641 CVE-2013-6642 CVE-2013-6643 CVE-2013-6644 CVE-2013-6645 CVE-2013-6646 http://googlechromereleases.blogspot.nl/ 2014-01-14 2014-01-15
ntpd DRDoS / Amplification Attack using ntpdc monlist command ntp 4.2.7p26

ntp.org reports:

Unrestricted access to the monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013

Use noquery to your default restrictions to block all status queries.

Use disable monitor to disable the ``ntpdc -c monlist'' command while still allowing other status queries.

CVE-2013-5211 SA-14:02.ntpd http://support.ntp.org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using 2014-01-01 2014-01-14
nagios -- denial of service vulnerability nagios 3.5.1_3

Eric Stanley reports:

Most CGIs previously incremented the input variable counter twice when it encountered a long key value. This could cause the CGI to read past the end of the list of CGI variables.

CVE-2013-7108 CVE-2013-7205 http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/ https://bugzilla.redhat.com/show_bug.cgi?id=1046113 2013-12-20 2014-01-14
bind -- denial of service vulnerability bind99 9.9.4.2 bind99-base 9.9.4.2 bind98 9.8.6.2 bind98-base 9.8.6.2 bind96 9.6.3.2.ESV.R10.2 bind96-base 9.6.3.2.ESV.R10.2 FreeBSD 9.29.2_3 9.19.1_10 8.48.4_7 8.38.3_14

ISC reports:

Because of a defect in handling queries for NSEC3-signed zones, BIND can crash with an "INSIST" failure in name.c when processing queries possessing certain properties. By exploiting this defect an attacker deliberately constructing a query with the right properties could achieve denial of service against an authoritative nameserver serving NSEC3-signed zones.

CVE-2014-0591 SA-13:07.bind https://kb.isc.org/article/AA-01078/74/ 2014-01-08 2014-01-13 2014-04-30
libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont libXfont 1.4.7,1

freedesktop.org reports:

A BDF font file containing a longer than expected string can cause a buffer overflow on the stack. Testing in X servers built with Stack Protector restulted in an immediate crash when reading a user-proveded specially crafted font.

As libXfont is used to read user-specified font files in all X servers distributed by X.Org, including the Xorg server which is often run with root privileges or as setuid-root in order to access hardware, this bug may lead to an unprivileged user acquiring root privileges in some systems.

CVE-2013-6462 http://lists.x.org/archives/xorg-announce/2014-January/002389.html 2013-12-24 2014-01-08
openssl -- multiple vulnerabilities openssl 1.0.1_9

OpenSSL development team reports:

Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:

  • Fix for TLS record tampering bug [CVE-2013-4353]
  • Fix for TLS version checking bug [CVE-2013-6449]
  • Fix for DTLS retransmission bug [CVE-2013-6450]
CVE-2013-4353 CVE-2013-6449 CVE-2013-6450 http://www.openssl.org/news/openssl-1.0.1-notes.html 2014-01-06 2014-01-06
OpenX -- SQL injection vulnerability openx 3.0.2

Revive reports:

An SQL-injection vulnerability was recently discovered and reported to the Revive Adserver team by Florian Sander. The vulnerability is known to be already exploited to gain unauthorised access to the application using brute force mechanisms, however other kind of attacks might be possible and/or already in use. The risk is rated to be critical as the most common end goal of the attackers is to spread malware to the visitors of all the websites and ad networks that the ad server is being used on.

The vulnerability is also present and exploitable in OpenX Source 2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.

http://www.revive-adserver.com/security/revive-sa-2013-001/ http://www.kreativrauschen.com/blog/2013/12/18/zero-day-vulnerability-in-openx-source-2-8-11-and-revive-adserver-3-0-1/ CVE-2013-7149 2013-12-20 2013-12-22
cURL library -- cert name check ignore with GnuTLS curl 7.21.47.33.0_2

cURL project reports:

libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off.

libcurl offers two separate and independent options for verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to verify the trust chain using a CA cert bundle, while the second tells libcurl to make sure that the name fields in the server certificate meets the criteria. Both options are enabled by default.

This flaw had the effect that when an application disabled CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the CURLOPT_SSL_VERIFYHOST check. Applications can disable CURLOPT_SSL_VERIFYPEER and still achieve security by doing the check on its own using other means.

The curl command line tool is not affected by this problem as it either enables both options or disables both at the same time.

http://curl.haxx.se/docs/adv_20131217.html CVE-2013-6422 2013-12-17 2013-12-18
gnupg -- RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis attack gnupg 1.4.16 gnupg1 1.4.16

Werner Koch reports:

CVE-2013-4576 has been assigned to this security bug.

The paper describes two attacks. The first attack allows to distinguish keys: An attacker is able to notice which key is currently used for decryption. This is in general not a problem but may be used to reveal the information that a message, encrypted to a commonly not used key, has been received by the targeted machine. We do not have a software solution to mitigate this attack.

The second attack is more serious. It is an adaptive chosen ciphertext attack to reveal the private key. A possible scenario is that the attacker places a sensor (for example a standard smartphone) in the vicinity of the targeted machine. That machine is assumed to do unattended RSA decryption of received mails, for example by using a mail client which speeds up browsing by opportunistically decrypting mails expected to be read soon. While listening to the acoustic emanations of the targeted machine, the smartphone will send new encrypted messages to that machine and re-construct the private key bit by bit. A 4096 bit RSA key used on a laptop can be revealed within an hour.

CVE-2013-4576 http://lists.gnupg.org/pipermail/gnupg-announce/2013q4/000337.html 2013-12-18 2013-12-18 2014-04-30
asterisk -- multiple vulnerabilities asterisk10 10.12.4 asterisk11 11.6.1 asterisk18 1.8.24.1

The Asterisk project reports:

A 16 bit SMS message that contains an odd message length value will cause the message decoding loop to run forever. The message buffer is not on the stack but will be overflowed resulting in corrupted memory and an immediate crash.

External control protocols, such as the Asterisk Manager Interface, often have the ability to get and set channel variables; this allows the execution of dialplan functions. Dialplan functions within Asterisk are incredibly powerful, which is wonderful for building applications using Asterisk. But during the read or write execution, certain diaplan functions do much more. For example, reading the SHELL() function can execute arbitrary commands on the system Asterisk is running on. Writing to the FILE() function can change any file that Asterisk has write access to. When these functions are executed from an external protocol, that execution could result in a privilege escalation.

CVE-2013-7100 http://downloads.asterisk.org/pub/security/AST-2013-006.pdf http://downloads.asterisk.org/pub/security/AST-2013-007.pdf https://www.asterisk.org/security 2013-12-16 2013-12-17
phpmyfaq -- arbitrary PHP code execution vulnerability phpmyfaq 2.8.4

The phpMyFAQ team reports:

Secunia noticed while analysing the advisory that authenticated users with "Right to add attachments" are able to exploit an already publicly known issue in the bundled Ajax File Manager of phpMyFAQ version 2.8.3, which leads to arbitrary PHP code execution for authenticated users with the permission "Right to add attachments".

http://en.securitylab.ru/lab/PT-2013-41 http://www.phpmyfaq.de/advisory_2013-11-26.php 2013-11-26 2013-12-16 2013-12-17
zabbix -- shell command injection vulnerability zabbix2-agent 2.0.10

Recurity Labs Team project reports:

Zabbix agent is vulnerable to remote command execution from the Zabbix server in some cases.

CVE-2013-6824 https://support.zabbix.com/browse/ZBX-7479 2013-12-03 2013-12-16
PHP5 -- memory corruption in openssl_x509_parse() php5 5.4.05.4.23 php53 5.3.28 php55 5.5.05.5.7

Stefan Esser reports:

The PHP function openssl_x509_parse() uses a helper function called asn1_time_to_time_t() to convert timestamps from ASN1 string format into integer timestamp values. The parser within this helper function is not binary safe and can therefore be tricked to write up to five NUL bytes outside of an allocated buffer.

This problem can be triggered by x509 certificates that contain NUL bytes in their notBefore and notAfter timestamp fields and leads to a memory corruption that might result in arbitrary code execution.

Depending on how openssl_x509_parse() is used within a PHP application the attack requires either a malicious cert signed by a compromised/malicious CA or can be carried out with a self-signed cert.

CVE-2013-6420 https://www.sektioneins.de/advisories/advisory-012013-php-openssl_x509_parse-memory-corruption-vulnerability.html 2013-12-13 2013-12-14
mozilla -- multiple vulnerabilities firefox 25.0,126.0,1 24.2.0,1 linux-firefox 26.0,1 linux-seamonkey 2.23 linux-thunderbird 24.2.0 seamonkey 2.23 thunderbird 24.2.0

The Mozilla Project reports:

MFSA 2013-116 JPEG information leak

MFSA 2013-105 Application Installation doorhanger persists on navigation

MFSA 2013-106 Character encoding cross-origin XSS attack

MFSA 2013-107 Sandbox restrictions not applied to nested object elements

MFSA 2013-108 Use-after-free in event listeners

MFSA 2013-109 Use-after-free during Table Editing

MFSA 2013-110 Potential overflow in JavaScript binary search algorithms

MFSA 2013-111 Segmentation violation when replacing ordered list elements

MFSA 2013-112 Linux clipboard information disclosure though selection paste

MFSA 2013-113 Trust settings for built-in roots ignored during EV certificate validation

MFSA 2013-114 Use-after-free in synthetic mouse movement

MFSA 2013-115 GetElementIC typed array stubs can be generated outside observed typesets

MFSA 2013-116 JPEG information leak

MFSA 2013-117 Mis-issued ANSSI/DCSSI certificate

CVE-2013-5609 CVE-2013-5610 CVE-2013-5611 CVE-2013-5612 CVE-2013-5613 CVE-2013-5614 CVE-2013-5615 CVE-2013-5616 CVE-2013-5618 CVE-2013-5619 CVE-2013-6629 CVE-2013-6630 CVE-2013-6671 CVE-2013-6672 CVE-2013-6673 https://www.mozilla.org/security/announce/2013/mfsa2013-104.html https://www.mozilla.org/security/announce/2013/mfsa2013-105.html https://www.mozilla.org/security/announce/2013/mfsa2013-106.html https://www.mozilla.org/security/announce/2013/mfsa2013-107.html https://www.mozilla.org/security/announce/2013/mfsa2013-108.html https://www.mozilla.org/security/announce/2013/mfsa2013-109.html https://www.mozilla.org/security/announce/2013/mfsa2013-110.html https://www.mozilla.org/security/announce/2013/mfsa2013-111.html https://www.mozilla.org/security/announce/2013/mfsa2013-112.html https://www.mozilla.org/security/announce/2013/mfsa2013-113.html https://www.mozilla.org/security/announce/2013/mfsa2013-114.html https://www.mozilla.org/security/announce/2013/mfsa2013-115.html https://www.mozilla.org/security/announce/2013/mfsa2013-116.html https://www.mozilla.org/security/announce/2013/mfsa2013-117.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-12-09 2013-12-14
samba -- multiple vulnerabilities samba34 0 samba35 0 samba36 3.6.*3.6.22 samba4 4.0.*4.0.13 samba41 4.1.*4.1.3

The Samba project reports:

These are security releases in order to address CVE-2013-4408 (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150 (pam_winbind login without require_membership_of restrictions).

CVE-2012-6150 CVE-2013-4408 http://www.samba.org/samba/security/CVE-2012-6150 http://www.samba.org/samba/security/CVE-2013-4408 2012-06-12 2013-12-11
rails -- multiple vulnerabilities rubygem-actionmailer 3.2.16 rubygem-actionpack 3.2.16 rubygem-activemodel 3.2.16 rubygem-activerecord 3.2.16 rubygem-activeresource 3.2.16 rubygem-activesupport 3.2.16 rubygem-rails 3.2.16 rubygem-railties 3.2.16 rubygem-actionpack4 4.0.2 rubygem-activesupport4 4.0.2

Rails weblog:

Rails 3.2.16 and 4.0.2 have been released! These two releases contain important security fixes, so please upgrade as soon as possible! In order to make upgrading as smooth as possible, we've only included commits directly related to each security issue.

The security fixes in 3.2.16 are:

  • CVE-2013-4491
  • CVE-2013-6414
  • CVE-2013-6415
  • CVE-2013-6417

The security fixes in 4.0.2 are:

  • CVE-2013-4491
  • CVE-2013-6414
  • CVE-2013-6415
  • CVE-2013-6416
  • CVE-2013-6417
CVE-2013-4491 CVE-2013-6414 CVE-2013-6415 CVE-2013-6416 CVE-2013-6417 http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/ 2013-12-03 2013-12-08 2014-04-23
drupal -- multiple vulnerabilities drupal6 6.29 drupal7 7.24

Drupal Security Team reports:

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.

  • Multiple vulnerabilities due to optimistic cross-site request forgery protection (Form API validation - Drupal 6 and 7)
  • Multiple vulnerabilities due to weakness in pseudorandom number generation using mt_rand() (Form API, OpenID and random password generation - Drupal 6 and 7)
  • Code execution prevention (Files directory .htaccess for Apache - Drupal 6 and 7)
  • Access bypass (Security token validation - Drupal 6 and 7)
  • Cross-site scripting (Image module - Drupal 7)
  • Cross-site scripting (Color module - Drupal 7)
  • Open redirect (Overlay module - Drupal 7)
https://drupal.org/SA-CORE-2013-003 2013-11-20 2013-12-06
chromium -- multiple vulnerabilities chromium 31.0.1650.63

Google Chrome Releases reports:

15 security fixes in this release, including:

  • [307159] Medium CVE-2013-6634: Session fixation in sync related to 302 redirects. Credit to Andrey Labunets.
  • [314469] High CVE-2013-6635: Use-after-free in editing. Credit to cloudfuzzer.
  • [322959] Medium CVE-2013-6636: Address bar spoofing related to modal dialogs. Credit to Bas Venis.
  • [325501] CVE-2013-6637: Various fixes from internal audits, fuzzing and other initiatives.
  • [319722] Medium CVE-2013-6638: Buffer overflow in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.
  • [319835] High CVE-2013-6639: Out of bounds write in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.
  • [319860] Medium CVE-2013-6640: Out of bounds read in v8. This issue was fixed in v8 version 3.22.24.7. Credit to Jakob Kummerow of the Chromium project.
CVE-2013-6634 CVE-2013-6635 CVE-2013-6636 CVE-2013-6637 CVE-2013-6638 CVE-2013-6639 CVE-2013-6640 http://googlechromereleases.blogspot.nl/ 2013-12-04 2013-12-05
Joomla! -- Core XSS Vulnerabilities joomla2 2.5.*2.5.14 joomla3 3.0.*3.1.5

The JSST and the Joomla! Security Center report:

[20131101] Core XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in com_contact.

[20131102] Core XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.

[20131103] Core XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in com_contact.

http://developer.joomla.org/security/570-core-xss-20131101.html http://developer.joomla.org/security/571-core-xss-20131102.html http://developer.joomla.org/security/572-core-xss-20131103.html 2013-11-01 2013-12-04 2014-04-23
OpenTTD -- Denial of service using forcefully crashed aircrafts openttd 0.3.61.3.3

The OpenTTD Team reports:

The problem is caused by incorrectly handling the fact that the aircraft circling the corner airport will be outside of the bounds of the map. In the 'out of fuel' crash code the height of the tile under the aircraft is determined. In this case that means a tile outside of the allocated map array, which could occasionally trigger invalid reads.

CVE-2013-6411 https://security.openttd.org/en/CVE-2013-6411 http://bugs.openttd.org/task/5820 http://vcs.openttd.org/svn/changeset/26134 2013-11-28 2013-11-28
monitorix -- serious bug in the built-in HTTP server monitorix 3.3.1

Monitorix Project reports:

A serious bug in the built-in HTTP server. It was discovered that the handle_request() routine did not properly perform input sanitization which led into a number of security vulnerabilities. An unauthenticated, remote attacker could exploit this flaw to execute arbitrary commands on the remote host. All users still using older versions are advised to upgrade to this version, which resolves this issue.

http://www.monitorix.org/news.html#N331 https://github.com/mikaku/Monitorix/issues/30 2013-11-21 2013-12-01
subversion -- multiple vulnerabilities subversion 1.4.01.7.14 1.8.01.8.5

Subversion Project reports:

mod_dontdothat does not restrict requests from serf based clients

mod_dontdothat allows you to block update REPORT requests against certain paths in the repository. It expects the paths in the REPORT request to be absolute URLs. Serf based clients send relative URLs instead of absolute URLs in many cases. As a result these clients are not blocked as configured by mod_dontdothat.

mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits

When SVNAutoversioning is enabled via SVNAutoversioning on commits can be made by single HTTP requests such as MKCOL and PUT. If Subversion is built with assertions enabled any such requests that have non-canonical URLs, such as URLs with a trailing /, may trigger an assert. An assert will cause the Apache process to abort.

CVE-2013-4505 CVE-2013-4558 http://subversion.apache.org/security/CVE-2013-4505-advisory.txt http://subversion.apache.org/security/CVE-2013-4558-advisory.txt 2013-11-15 2013-11-25
ruby-gems -- Algorithmic Complexity Vulnerability ruby19-gems 1.8.27 ruby20-gems 1.8.27

Ruby Gem developers report:

The patch for CVE-2013-4363 was insufficiently verified so the combined regular expression for verifying gem version remains vulnerable following CVE-2013-4363.

RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption.

CVE-2013-4363 2013-09-24 2013-11-24
ruby-gems -- Algorithmic Complexity Vulnerability ruby19-gems 1.8.26 ruby20-gems 1.8.26

Ruby Gem developers report:

RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption.

CVE-2013-4287 2013-09-09 2013-11-24
ruby -- Heap Overflow in Floating Point Parsing ruby19 1.9.3.484,1 ruby20 2.0.0.353,1

Ruby developers report:

Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any program that converts input of unknown origin to floating point values (especially common when accepting JSON) are vulnerable.

https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released/ https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released/ CVE-2013-4164 2013-11-22 2013-11-23
samba -- Private key in key.pem world readable samba4 4.0.*4.0.11 samba41 4.1.*4.1.1

The Samba project reports:

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.

CVE-2013-4476 http://www.samba.org/samba/security/CVE-2013-4476 2013-06-12 2013-11-19
samba -- ACLs are not checked on opening an alternate data stream on a file or directory samba34 0 samba35 0 samba36 3.6.*3.6.20 samba4 4.0.*4.0.11 samba41 4.1.*4.1.1

The Samba project reports:

Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying file or directory ACL when opening an alternate data stream.

According to the SMB1 and SMB2+ protocols the ACL on an underlying file or directory should control what access is allowed to alternate data streams that are associated with the file or directory.

CVE-2013-4475 http://www.samba.org/samba/security/CVE-2013-4475 2013-06-12 2013-11-19
nginx -- Request line parsing vulnerability nginx 0.8.411.4.4,1 nginx-devel 0.8.411.5.7

The nginx project reports:

Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact (CVE-2013-4547).

CVE-2013-4547 http://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html 2013-11-19 2013-11-19
chromium -- multiple memory corruption issues chromium 31.0.1650.57

Google Chrome Releases reports:

[319117] [319125] Critical CVE-2013-6632: Multiple memory corruption issues. Credit to Pinkie Pie.

CVE-2013-6632 http://googlechromereleases.blogspot.nl/ 2013-11-14 2013-11-15
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.327

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-5329 CVE-2013-5330 http://www.adobe.com/support/security/bulletins/apsb13-26.html 2013-11-12 2013-11-12
chromium -- multiple vulnerabilities chromium 31.0.1650.48

Google Chrome Releases reports:

25 security fixes in this release, including:

  • [268565] Medium CVE-2013-6621: Use after free related to speech input elements. Credit to Khalil Zhani.
  • [272786] High CVE-2013-6622: Use after free related to media elements. Credit to cloudfuzzer.
  • [282925] High CVE-2013-6623: Out of bounds read in SVG. Credit to miaubiz.
  • [290566] High CVE-2013-6624: Use after free related to “id” attribute strings. Credit to Jon Butler.
  • [295010] High CVE-2013-6625: Use after free in DOM ranges. Credit to cloudfuzzer.
  • [295695] Low CVE-2013-6626: Address bar spoofing related to interstitial warnings. Credit to Chamal de Silva.
  • [299892] High CVE-2013-6627: Out of bounds read in HTTP parsing. Credit to skylined.
  • [306959] Medium CVE-2013-6628: Issue with certificates not being checked during TLS renegotiation. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco of INRIA Paris.
  • [315823] Medium-Critical CVE-2013-2931: Various fixes from internal audits, fuzzing and other initiatives.
  • [258723] Medium CVE-2013-6629: Read of uninitialized memory in libjpeg and libjpeg-turbo. Credit to Michal Zalewski of Google.
  • [299835] Medium CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo. Credit to Michal Zalewski of Google.
  • [296804] High CVE-2013-6631: Use after free in libjingle. Credit to Patrik Höglund of the Chromium project.
CVE-2013-2931 CVE-2013-6621 CVE-2013-6622 CVE-2013-6623 CVE-2013-6624 CVE-2013-6625 CVE-2013-6626 CVE-2013-6627 CVE-2013-6628 CVE-2013-6629 CVE-2013-6630 CVE-2013-6631 http://googlechromereleases.blogspot.nl/ 2013-11-12 2013-11-12
OpenSSH -- Memory corruption in sshd openssh-portable 6.2.p2,16.4.p1,1 openssh-portable-base 6.2.p2,16.4.p1,1

The OpenSSH development team reports:

A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher (aes128-gcm@openssh.com or aes256-gcm@openssh.com) is selected during kex exchange.

If exploited, this vulnerability might permit code execution with the privileges of the authenticated user and may therefore allow bypassing restricted shell/command configurations.

Either upgrade to 6.4 or disable AES-GCM in the server configuration. The following sshd_config option will disable AES-GCM while leaving other ciphers active:

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc

http://www.openssh.com/txt/gcmrekey.adv 2013-11-07 2013-11-08 2013-11-13
Quassel IRC -- SQL injection vulnerability quassel 0.9.1

Quassel IRC developers report:

SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.

CVE-2013-4422 2013-10-07 2013-11-06
mozilla -- multiple vulnerabilities firefox 24.1.0,1 linux-firefox 25.0,1 linux-seamonkey 2.22 linux-thunderbird 24.1.0 seamonkey 2.22 thunderbird 24.1.0

The Mozilla Project reports:

MFSA 2013-93 Miscellaneous memory safety hazards (rv:25.0 / rv:24.1 / rv:17.0.10)

MFSA 2013-94 Spoofing addressbar though SELECT element

MFSA 2013-95 Access violation with XSLT and uninitialized data

MFSA 2013-96 Improperly initialized memory and overflows in some JavaScript functions

MFSA 2013-97 Writing to cycle collected object during image decoding

MFSA 2013-98 Use-after-free when updating offline cache

MFSA 2013-99 Security bypass of PDF.js checks using iframes

MFSA 2013-100 Miscellaneous use-after-free issues found through ASAN fuzzing

MFSA 2013-101 Memory corruption in workers

MFSA 2013-102 Use-after-free in HTML document templates

CVE-2013-1739 CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5598 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 https://www.mozilla.org/security/announce/2013/mfsa2013-93.html https://www.mozilla.org/security/announce/2013/mfsa2013-94.html https://www.mozilla.org/security/announce/2013/mfsa2013-95.html https://www.mozilla.org/security/announce/2013/mfsa2013-96.html https://www.mozilla.org/security/announce/2013/mfsa2013-97.html https://www.mozilla.org/security/announce/2013/mfsa2013-98.html https://www.mozilla.org/security/announce/2013/mfsa2013-99.html https://www.mozilla.org/security/announce/2013/mfsa2013-100.html https://www.mozilla.org/security/announce/2013/mfsa2013-101.html https://www.mozilla.org/security/announce/2013/mfsa2013-102.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-10-29 2013-10-30 2013-10-31
mod_pagespeed -- critical cross-site scripting (XSS) vulnerability mod_pagespeed 1.2.24.2,1

mod_pagespeed developers report:

Various versions of mod_pagespeed are subject to critical cross-site scripting (XSS) vulnerability, CVE-2013-6111. This permits a hostile third party to execute JavaScript in users' browsers in context of the domain running mod_pagespeed, which could permit theft of users' cookies or data on the site.

CVE-2013-6111 2013-10-04 2013-10-28
gnutls -- denial of service gnutls3 3.1.16

Salvatore Bonaccorso reports:

This vulnerability affects the DANE library of gnutls 3.1.x and gnutls 3.2.x. A server that returns more 4 DANE entries could corrupt the memory of a requesting client.

CVE-2013-4466 http://www.gnutls.org/security.html#GNUTLS-SA-2013-3 2013-10-25 2013-10-25 2013-11-01
xorg-server -- use-after-free xorg-server 1.7.01.7.7_11 1.12.01.12.4_4

Alan Coopersmith reports:

Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org security team in which an authenticated X client can cause an X server to use memory after it was freed, potentially leading to crash and/or memory corruption.

CVE-2013-4396 http://lists.x.org/archives/xorg-announce/2013-October/002332.html 2013-10-08 2013-10-24
pycrypto -- PRNG reseed race condition py26-pycrypto 2.6.1 py27-pycrypto 2.6.1 py31-pycrypto 2.6.1 py32-pycrypto 2.6.1 py33-pycrypto 2.6.1

Dwayne Litzenberger reports:

In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator (PRNG) exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal sensitive information or cryptographic keys to remote attackers.

CVE-2013-1445 http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html 2013-10-17 2013-10-19 2014-04-30
wordpress -- multiple vulnerabilities zh-wordpress-zh_CN 3.6.1 zh-wordpress-zh_TW 3.6.1 de-wordpress 3.6.1 ja-wordpress 3.6.1 ru-wordpress 3.6.1 wordpress 3.6.1

The wordpress development team reports:

  • Block unsafe PHP unserialization that could occur in limited situations and setups, which can lead to remote code execution.
  • Prevent a user with an Author role, using a specially crafted request, from being able to create a post "written by" another user.
  • Fix insufficient input validation that could result in redirecting or leading a user to another website.

Additionally, we've adjusted security restrictions around file uploads to mitigate the potential for cross-site scripting.

CVE-2013-4338 CVE-2013-4339 CVE-2013-4340 CVE-2013-5738 CVE-2013-5739 http://wordpress.org/news/2013/09/wordpress-3-6-1/ 2013-09-11 2013-10-19 2014-04-30
node.js -- DoS Vulnerability node 0.10.21 node-devel 0.11.7

node.js developers report

This release contains a security fix for the http server implementation, please upgrade as soon as possible.

http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/ 2013-10-19 2013-10-19
bugzilla -- multiple vulnerabilities bugzilla 4.0.04.0.11 bugzilla40 4.0.04.0.11 bugzilla42 4.2.04.2.7 bugzilla44 4.44.4.1

A Bugzilla Security Advisory reports:

Cross-Site Request Forgery

When a user submits changes to a bug right after another user did, a midair collision page is displayed to inform the user about changes recently made. This page contains a token which can be used to validate the changes if the user decides to submit his changes anyway. A regression in Bugzilla 4.4 caused this token to be recreated if a crafted URL was given, even when no midair collision page was going to be displayed, allowing an attacker to bypass the token check and abuse a user to commit changes on his behalf.

Cross-Site Request Forgery

When an attachment is edited, a token is generated to validate changes made by the user. Using a crafted URL, an attacker could force the token to be recreated, allowing him to bypass the token check and abuse a user to commit changes on his behalf.

Cross-Site Scripting

Some parameters passed to editflagtypes.cgi were not correctly filtered in the HTML page, which could lead to XSS.

Cross-Site Scripting

Due to an incomplete fix for CVE-2012-4189, some incorrectly filtered field values in tabular reports could lead to XSS.

CVE-2013-1733 https://bugzilla.mozilla.org/show_bug.cgi?id=911593 CVE-2013-1734 https://bugzilla.mozilla.org/show_bug.cgi?id=913904 CVE-2013-1742 https://bugzilla.mozilla.org/show_bug.cgi?id=924802 CVE-2013-1743 https://bugzilla.mozilla.org/show_bug.cgi?id=924932 2013-10-16 2013-10-17 2014-04-30
dropbear -- exposure of sensitive information, DoS dropbear 2012.552013.59

The Dropbear project reports:

A weakness and a vulnerability have been reported in Dropbear SSH Server, which can be exploited by malicious people to disclose certain sensitive information and cause a DoS.

62958 62993 CVE-2013-4421 CVE-2013-4434 http://secunia.com/advisories/55173 2013-05-08 2013-10-17
chromium -- multiple vulnerabilities chromium 30.0.1599.101

Google Chrome Releases reports:

5 security fixes in this release, including:

  • [292422] High CVE-2013-2925: Use after free in XHR. Credit to Atte Kettunen of OUSPG.
  • [294456] High CVE-2013-2926: Use after free in editing. Credit to cloudfuzzer.
  • [297478] High CVE-2013-2927: Use after free in forms. Credit to cloudfuzzer.
  • [305790] High CVE-2013-2928: Various fixes from internal audits, fuzzing and other initiatives.
CVE-2013-2925 CVE-2013-2926 CVE-2013-2927 CVE-2013-2928 http://googlechromereleases.blogspot.nl/ 2013-10-15 2013-10-15
mod_fcgid -- possible heap buffer overwrite ap22-mod_fcgid 2.3.9 ap24-mod_fcgid 2.3.9

Apache Project reports:

Fix possible heap buffer overwrite.

CVE-2013-4365 2013-09-29 2013-10-10
gnupg -- possible infinite recursion in the compressed packet parser gnupg 1.4.15 2.0.02.0.22

Werner Koch reports:

Special crafted input data may be used to cause a denial of service against GPG (GnuPG's OpenPGP part) and some other OpenPGP implementations. All systems using GPG to process incoming data are affected..

CVE-2013-4402 2013-10-05 2013-10-05
xinetd -- ignores user and group directives for TCPMUX services xinetd 2.3.15_1

xinetd would execute configured TCPMUX services without dropping privilege to match the service configuration allowing the service to run with same privilege as the xinetd process (root).

CVE-2013-4342 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324678 https://bugzilla.redhat.com/show_bug.cgi?id=1006100 2005-08-23 2013-10-03
polarssl -- Timing attack against protected RSA-CRT implementation polarssl 1.2.9

PolarSSL Project reports:

The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key. Although their test attack is done on a local system, there seems to be enough indication that this can properly be performed from a remote system as well.

All versions prior to PolarSSL 1.2.9 and 1.3.0 are affected if a third party can send arbitrary handshake messages to your server.

If correctly executed, this attack reveals the entire private RSA key after a large number of attack messages (> 600.000 on a local machine) are sent to show the timing differences.

CVE-2013-5915 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05 https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released 2013-10-01 2013-10-02
chromium -- multiple vulnerabilities chromium 30.0.1599.66

Google Chrome Releases reports:

50 security fixes in this release, including:

  • [223962][270758][271161][284785][284786] Medium CVE-2013-2906: Races in Web Audio. Credit to Atte Kettunen of OUSPG.
  • [260667] Medium CVE-2013-2907: Out of bounds read in Window.prototype object. Credit to Boris Zbarsky.
  • [265221] Medium CVE-2013-2908: Address bar spoofing related to the “204 No Content” status code. Credit to Chamal de Silva.
  • [265838][279277] High CVE-2013-2909: Use after free in inline-block rendering. Credit to Atte Kettunen of OUSPG.
  • [269753] Medium CVE-2013-2910: Use-after-free in Web Audio. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).
  • [271939] High CVE-2013-2911: Use-after-free in XSLT. Credit to Atte Kettunen of OUSPG.
  • [276368] High CVE-2013-2912: Use-after-free in PPAPI. Credit to Chamal de Silva and 41.w4r10r(at)garage4hackers.com.
  • [278908] High CVE-2013-2913: Use-after-free in XML document parsing. Credit to cloudfuzzer.
  • [279263] High CVE-2013-2914: Use after free in the Windows color chooser dialog. Credit to Khalil Zhani.
  • [280512] Low CVE-2013-2915: Address bar spoofing via a malformed scheme. Credit to Wander Groeneveld.
  • [281256] High CVE-2013-2916: Address bar spoofing related to the “204 No Content” status code. Credit to Masato Kinugawa.
  • [281480] Medium CVE-2013-2917: Out of bounds read in Web Audio. Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).
  • [282088] High CVE-2013-2918: Use-after-free in DOM. Credit to Byoungyoung Lee of Georgia Tech Information Security Center (GTISC).
  • [282736] High CVE-2013-2919: Memory corruption in V8. Credit to Adam Haile of Concrete Data.
  • [285742] Medium CVE-2013-2920: Out of bounds read in URL parsing. Credit to Atte Kettunen of OUSPG.
  • [286414] High CVE-2013-2921: Use-after-free in resource loader. Credit to Byoungyoung Lee and Tielei Wang of Georgia Tech Information Security Center (GTISC).
  • [286975] High CVE-2013-2922: Use-after-free in template element. Credit to Jon Butler.
  • [299016] CVE-2013-2923: Various fixes from internal audits, fuzzing and other initiatives (Chrome 30).
  • [275803] Medium CVE-2013-2924: Use-after-free in ICU. Upstream bug here.
CVE-2013-2906 CVE-2013-2907 CVE-2013-2908 CVE-2013-2909 CVE-2013-2910 CVE-2013-2911 CVE-2013-2912 CVE-2013-2913 CVE-2013-2914 CVE-2013-2915 CVE-2013-2916 CVE-2013-2917 CVE-2013-2918 CVE-2013-2919 CVE-2013-2920 CVE-2013-2921 CVE-2013-2922 CVE-2013-2923 CVE-2013-2924 http://googlechromereleases.blogspot.nl/ 2013-10-01 2013-10-01
py-graphite-web -- Multiple vulnerabilities py26-graphite-web 0.9.50.9.11 py27-graphite-web 0.9.50.9.11 py31-graphite-web 0.9.50.9.11 py32-graphite-web 0.9.50.9.11 py33-graphite-web 0.9.50.9.11

Graphite developers report:

This release contains several security fixes for cross-site scripting (XSS) as well as a fix for a remote-execution exploit in graphite-web (CVE-2013-5903).

CVE-2013-5093 https://github.com/rapid7/metasploit-framework/pull/2260 2013-08-21 2013-09-30 2014-04-30
django -- denial-of-service via large passwords py26-django 1.51.5.4 1.41.4.8 py27-django 1.51.5.4 1.41.4.8 py26-django-devel 20130922,1 py27-django-devel 20130922,1

The Django project reports:

These releases address a denial-of-service attack against Django's authentication framework. All users of Django are encouraged to upgrade immediately.

CVE-2013-1443 https://www.djangoproject.com/weblog/2013/sep/15/security/ 2013-09-15 2013-09-22 2014-04-30
FreeBSD -- Cross-mount links between nullfs(5) mounts FreeBSD 9.19.1_7 8.48.4_4 8.38.3_11

Problem Description:

The nullfs(5) implementation of the VOP_LINK(9) VFS operation does not check whether the source and target of the link are both in the same nullfs instance. It is therefore possible to create a hardlink from a location in one nullfs instance to a file in another, as long as the underlying (source) filesystem is the same.

Impact:

If multiple nullfs views into the same filesystem are mounted in different locations, a user with read access to one of these views and write access to another will be able to create a hard link from the latter to a file in the former, even though they are, from the user's perspective, different filesystems. The user may thereby gain write access to files which are nominally on a read-only filesystem.

CVE-2013-5710 SA-13:13.nullfs 2013-09-10 2013-09-19
FreeBSD -- Insufficient credential checks in network ioctl(2) FreeBSD 9.19.1_7 8.48.4_4 8.38.3_11

Problem Description:

As is commonly the case, the IPv6 and ATM network layer ioctl request handlers are written in such a way that an unrecognized request is passed on unmodified to the link layer, which will either handle it or return an error code.

Network interface drivers, however, assume that the SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR and SIOCSIFNETMASK requests have been handled at the network layer, and therefore do not perform input validation or verify the caller's credentials. Typical link-layer actions for these requests may include marking the interface as "up" and resetting the underlying hardware.

Impact:

An unprivileged user with the ability to run arbitrary code can cause any network interface in the system to perform the link layer actions associated with a SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR or SIOCSIFNETMASK ioctl request; or trigger a kernel panic by passing a specially crafted address structure which causes a network interface driver to dereference an invalid pointer.

Although this has not been confirmed, the possibility that an attacker may be able to execute arbitrary code in kernel context can not be ruled out.

CVE-2013-5691 SA-13:12.ifioctl 2013-09-10 2013-09-19
mozilla -- multiple vulnerabilities firefox 18.0,124.0,1 17.0.9,1 linux-firefox 17.0.9,1 linux-seamonkey 2.21 linux-thunderbird 17.0.9 seamonkey 2.21 thunderbird 24.0

The Mozilla Project reports:

MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9)

MFSA 2013-77 Improper state in HTML5 Tree Builder with templates

MFSA 2013-78 Integer overflow in ANGLE library

MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning

MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed

MFSA 2013-81 Use-after-free with select element

MFSA 2013-82 Calling scope for new Javascript objects can lead to memory corruption

MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification

MFSA 2013-84 Same-origin bypass through symbolic links

MFSA 2013-85 Uninitialized data in IonMonkey

MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers

MFSA 2013-87 Shared object library loading from writable location

MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes

MFSA 2013-89 Buffer overflow with multi-column, lists, and floats

MFSA 2013-90 Memory corruption involving scrolling

MFSA 2013-91 User-defined properties on DOM proxies get the wrong "this" object

MFSA 2013-92 GC hazard with default compartments and frame chain restoration

CVE-2013-1718 CVE-2013-1719 CVE-2013-1720 CVE-2013-1721 CVE-2013-1722 CVE-2013-1723 CVE-2013-1724 CVE-2013-1725 CVE-2013-1726 CVE-2013-1727 CVE-2013-1728 CVE-2013-1729 CVE-2013-1730 CVE-2013-1731 CVE-2013-1732 CVE-2013-1735 CVE-2013-1736 CVE-2013-1737 CVE-2013-1738 https://www.mozilla.org/security/announce/2013/mfsa2013-76.html https://www.mozilla.org/security/announce/2013/mfsa2013-77.html https://www.mozilla.org/security/announce/2013/mfsa2013-78.html https://www.mozilla.org/security/announce/2013/mfsa2013-79.html https://www.mozilla.org/security/announce/2013/mfsa2013-80.html https://www.mozilla.org/security/announce/2013/mfsa2013-81.html https://www.mozilla.org/security/announce/2013/mfsa2013-82.html https://www.mozilla.org/security/announce/2013/mfsa2013-83.html https://www.mozilla.org/security/announce/2013/mfsa2013-84.html https://www.mozilla.org/security/announce/2013/mfsa2013-85.html https://www.mozilla.org/security/announce/2013/mfsa2013-86.html https://www.mozilla.org/security/announce/2013/mfsa2013-87.html https://www.mozilla.org/security/announce/2013/mfsa2013-88.html https://www.mozilla.org/security/announce/2013/mfsa2013-89.html https://www.mozilla.org/security/announce/2013/mfsa2013-90.html https://www.mozilla.org/security/announce/2013/mfsa2013-91.html https://www.mozilla.org/security/announce/2013/mfsa2013-92.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-08-17 2013-08-18 2013-09-19
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.310

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-3361 CVE-2013-3362 CVE-2013-3363 CVE-2013-5324 http://www.adobe.com/support/security/bulletins/apsb13-21.html 2013-09-10 2013-09-13
django -- multiple vulnerabilities py26-django 1.51.5.3 1.41.4.7 py27-django 1.51.5.3 1.41.4.7 py26-django-devel 20130912,1 py27-django-devel 20130912,1

The Django project reports:

These releases address a directory-traversal vulnerability in one of Django's built-in template tags. While this issue requires some fairly specific factors to be exploitable, we encourage all users of Django to upgrade promptly.

CVE-2013-4315 https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/ 2013-09-10 2013-09-12 2014-04-30
svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack. subversion 1.4.01.6.23_2 1.7.01.7.13 1.8.01.8.3

Subversion Project reports:

svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destination could be replaced by a symlink allowing for privilege escalation. svnserve does not create a pid file by default.

All versions are only vulnerable when the --pid-file=ARG option is used.

CVE-2013-4277 http://subversion.apache.org/security/CVE-2013-4277-advisory.txt 2013-08-30 2013-09-02
cacti -- allow remote attackers to execute arbitrary SQL commands cacti 0.8.8b

Cacti release reports:

Multiple security vulnerabilities have been fixed:

  • SQL injection vulnerabilities
CVE-2013-1434 CVE-2013-1435 http://www.cacti.net/release_notes_0_8_8b.php 2013-08-06 2013-08-29
asterisk -- multiple vulnerabilities asterisk11 11.*11.5.1 asterisk10 10.*10.12.3 asterisk18 1.8.*1.8.21.1

The Asterisk project reports:

Remote Crash From Late Arriving SIP ACK With SDP

Remote Crash when Invalid SDP is sent in SIP Request

CVE-2013-5641 CVE-2013-5642 http://downloads.asterisk.org/pub/security/AST-2013-004.html http://downloads.asterisk.org/pub/security/AST-2013-005.html https://www.asterisk.org/security 2013-08-27 2013-08-28 2013-08-29
chromium -- multiple vulnerabilities chromium 29.0.1547.57

Google Chrome Releases reports:

25 security fixes in this release, including:

  • [181617] High CVE-2013-2900: Incomplete path sanitization in file handling. Credit to Krystian Bigaj.
  • [254159] Low CVE-2013-2905: Information leak via overly broad permissions on shared memory files. Credit to Christian Jaeger.
  • [257363] High CVE-2013-2901: Integer overflow in ANGLE. Credit to Alex Chapman.
  • [260105] High CVE-2013-2902: Use after free in XSLT. Credit to cloudfuzzer.
  • [260156] High CVE-2013-2903: Use after free in media element. Credit to cloudfuzzer.
  • [260428] High CVE-2013-2904: Use after free in document parsing. Credit to cloudfuzzer.
  • [274602] CVE-2013-2887: Various fixes from internal audits, fuzzing and other initiatives (Chrome 29).
CVE-2013-2887 CVE-2013-2900 CVE-2013-2901 CVE-2013-2902 CVE-2013-2903 CVE-2013-2904 CVE-2013-2905 http://googlechromereleases.blogspot.nl/ 2013-08-20 2013-08-21
gstreamer-ffmpeg -- Multiple vulnerabilities in bundled libav gstreamer-ffmpeg 0.10.13_1

Bundled version of libav in gstreamer-ffmpeg contains a number of vulnerabilities.

CVE-2011-3892 CVE-2011-3893 CVE-2011-3895 CVE-2011-3929 CVE-2011-3936 CVE-2011-3937 CVE-2011-3940 CVE-2011-3945 CVE-2011-3947 CVE-2011-3951 CVE-2011-3952 CVE-2011-4031 CVE-2011-4351 CVE-2011-4352 CVE-2011-4353 CVE-2011-4364 CVE-2011-4579 CVE-2012-0848 CVE-2012-0850 CVE-2012-0851 CVE-2012-0852 CVE-2012-0853 CVE-2012-0858 CVE-2012-0947 CVE-2012-2772 CVE-2012-2775 CVE-2012-2777 CVE-2012-2779 CVE-2012-2783 CVE-2012-2784 CVE-2012-2786 CVE-2012-2787 CVE-2012-2788 CVE-2012-2790 CVE-2012-2791 CVE-2012-2793 CVE-2012-2794 CVE-2012-2798 CVE-2012-2800 CVE-2012-2801 CVE-2012-2803 CVE-2012-5144 http://libav.org/releases/libav-0.7.7.changelog 2013-08-20 2013-08-20
GnuPG and Libgcrypt -- side-channel attack vulnerability libgcrypt 1.5.3 linux-f10-libgcrypt 1.5.3

Werner Koch of the GNU project reports:

Noteworthy changes in version 1.5.3:

Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys...

Note that Libgcrypt is used by GnuPG 2.x and thus this release fixes the above problem. The fix for GnuPG less than 2.0 can be found in the just released GnuPG 1.4.14.

CVE-2013-4242 http://eprint.iacr.org/2013/448 http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000329.html http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html 2013-07-18 2013-08-17
puppet -- multiple vulnerabilities puppet 2.72.7.23 3.03.2.4

Puppet Labs reports:

By using the `resource_type` service, an attacker could cause puppet to load arbitrary Ruby files from the puppet master node's file system. While this behavior is not enabled by default, `auth.conf` settings could be modified to allow it. The exploit requires local file system access to the Puppet Master.

Puppet Module Tool (PMT) did not correctly control permissions of modules it installed, instead transferring permissions that existed when the module was built.

CVE-2013-4761 CVE-2013-4956 http://puppetlabs.com/security/cve/cve-2013-4761/ http://puppetlabs.com/security/cve/cve-2013-4956/ 2013-07-05 2013-08-16
lcms2 -- Null Pointer Dereference Denial of Service Vulnerability lcms2 2.5

Mageia security team reports:

It was discovered that Little CMS did not properly verify certain memory allocations. If a user or automated system using Little CMS were tricked into opening a specially crafted file, an attacker could cause Little CMS to crash (CVE-2013-4160).

CVE-2013-4160 http://advisories.mageia.org/MGASA-2013-0240.html https://bugs.mageia.org/show_bug.cgi?id=10816 2013-07-22 2013-08-15 2013-08-19
polarssl -- denial of service vulnerability polarssl 1.2.8

Paul Bakker reports:

A bug in the logic of the parsing of PEM encoded certificates in x509parse_crt() can result in an infinite loop, thus hogging processing power.

While parsing a Certificate message during the SSL/TLS handshake, PolarSSL extracts the presented certificates and sends them on to be parsed. As the RFC specifies that the certificates in the Certificate message are always X.509 certificates in DER format, bugs in the decoding of PEM certificates should normally not be triggerable via the SSL/TLS handshake.

Versions of PolarSSL prior to 1.1.7 in the 1.1 branch and prior to 1.2.8 in the 1.2 branch call the generic x509parse_crt() function for parsing during the handshake. x509parse_crt() is a generic functions that wraps parsing of both PEM-encoded and DER-formatted certificates. As a result it is possible to craft a Certificate message that includes a PEM encoded certificate in the Certificate message that triggers the infinite loop.

CVE-2013-4623 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03 2013-06-21 2013-08-13 2013-08-15
samba -- denial of service vulnerability samba34 0 samba35 0 samba36 3.6.*3.6.17 samba4 4.0.*4.0.8

The Samba project reports:

All current released versions of Samba are vulnerable to a denial of service on an authenticated or guest connection. A malformed packet can cause the smbd server to loop the CPU performing memory allocations and preventing any further service.

A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated if guest connections are allowed.

CVE-2013-4124 http://www.samba.org/samba/security/CVE-2013-4124 2013-08-05 2013-08-09 2013-08-09
mozilla -- multiple vulnerabilities firefox 18.0,123.0,1 17.0.8,1 linux-firefox 17.0.8,1 linux-seamonkey 2.20 linux-thunderbird 17.0.8 seamonkey 2.20 thunderbird 11.017.0.8

The Mozilla Project reports:

MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8)

MFSA 2013-64 Use after free mutating DOM during SetBody

MFSA 2013-65 Buffer underflow when generating CRMF requests

MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater

MFSA 2013-67 Crash during WAV audio file decoding

MFSA 2013-68 Document URI misrepresentation and masquerading

MFSA 2013-69 CRMF requests allow for code execution and XSS attacks

MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes

MFSA 2013-71 Further Privilege escalation through Mozilla Updater

MFSA 2013-72 Wrong principal used for validating URI for some Javascript components

MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest

MFSA 2013-74 Firefox full and stub installer DLL hijacking

MFSA 2013-75 Local Java applets may read contents of local file system

CVE-2013-1701 CVE-2013-1702 CVE-2013-1704 CVE-2013-1705 CVE-2013-1706 CVE-2013-1707 CVE-2013-1708 CVE-2013-1709 CVE-2013-1710 CVE-2013-1711 CVE-2013-1712 CVE-2013-1713 CVE-2013-1714 CVE-2013-1715 CVE-2013-1717 https://www.mozilla.org/security/announce/2013/mfsa2013-63.html https://www.mozilla.org/security/announce/2013/mfsa2013-64.html https://www.mozilla.org/security/announce/2013/mfsa2013-65.html https://www.mozilla.org/security/announce/2013/mfsa2013-66.html https://www.mozilla.org/security/announce/2013/mfsa2013-67.html https://www.mozilla.org/security/announce/2013/mfsa2013-68.html https://www.mozilla.org/security/announce/2013/mfsa2013-69.html https://www.mozilla.org/security/announce/2013/mfsa2013-70.html https://www.mozilla.org/security/announce/2013/mfsa2013-71.html https://www.mozilla.org/security/announce/2013/mfsa2013-72.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-08-06 2013-08-08
PuTTY -- Four security holes in versions before 0.63 putty 0.63

Simon Tatham reports:

This [0.63] release fixes multiple security holes in previous versions of PuTTY, which can allow an SSH-2 server to make PuTTY overrun or underrun buffers and crash. [...]

These vulnerabilities can be triggered before host key verification, which means that you are not even safe if you trust the server you think you're connecting to, since it could be spoofed over the network and the host key check would not detect this before the attack could take place.

Additionally, when PuTTY authenticated with a user's private key, the private key or information equivalent to it was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps. This release fixes that as well.

CVE-2013-4206 CVE-2013-4207 CVE-2013-4208 CVE-2013-4852 http://lists.tartarus.org/pipermail/putty-announce/2013/000018.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-modmul.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-bignum-division-by-zero.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-signature-stringlen.html 2013-07-08 2013-08-07
typo3 -- Multiple vulnerabilities in TYPO3 Core typo3 4.5.04.5.29 4.7.04.7.14 6.1.06.1.3

Typo Security Team reports:

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting and Remote Code Execution.

TYPO3 bundles flash files for video and audio playback. Old versions of FlowPlayer and flashmedia are susceptible to Cross-Site Scripting. No authentication is required to exploit this vulnerability.

The file upload component and the File Abstraction Layer are failing to check for denied file extensions, which allows authenticated editors (even with limited permissions) to upload php files with arbitrary code, which can then be executed in web server's context.

CVE-2011-3642 CVE-2013-1464 2013-07-30 2013-08-05
phpMyAdmin -- clickJacking protection can be bypassed phpMyAdmin 4.0.5

The phpMyAdmin development team reports:

phpMyAdmin has a number of mechanisms to avoid a clickjacking attack, however these mechanisms either work only in modern browser versions, or can be bypassed.

"We have no solution for 3.5.x, due to the proposed solution requiring JavaScript. We don't want to introduce a dependency to JavaScript in the 3.5.x family."

http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php 2013-08-04 2013-08-04
chromium -- multiple vulnerabilities chromium 28.0.1500.95

Google Chrome Releases reports:

Eleven vulnerabilities, including:

[257748] Medium CVE-2013-2881: Origin bypass in frame handling. Credit to Karthik Bhargavan.

[260106] High CVE-2013-2882: Type confusion in V8. Credit to Cloudfuzzer.

[260165] High CVE-2013-2883: Use-after-free in MutationObserver. Credit to Cloudfuzzer.

[248950] High CVE-2013-2884: Use-after-free in DOM. Credit to Ivan Fratric of Google Security Team.

[249640] [257353] High CVE-2013-2885: Use-after-free in input handling. Credit to Ivan Fratric of Google Security Team.

[261701] High CVE-2013-2886: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-2881 CVE-2013-2882 CVE-2013-2883 CVE-2013-2884 CVE-2013-2885 CVE-2013-2886 http://www.googlechromereleases.blogspot.nl/ 2013-07-30 2013-08-03
phpMyAdmin -- multiple vulnerabilities phpMyAdmin 4.04.0.4.2 phpMyAdmin35 3.53.5.8.2

The phpMyAdmin development team reports:

XSS due to unescaped HTML Output when executing a SQL query.

Using a crafted SQL query, it was possible to produce an XSS on the SQL query form.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

5 XSS vulnerabilities in setup, chart display, process list, and logo link.

  • In the setup/index.php, using a crafted # hash with a Javascript event, untrusted JS code could be executed.
  • In the Display chart view, a chart title containing HTML code was rendered unescaped, leading to possible JavaScript code execution via events.
  • A malicious user with permission to create databases or users having HTML tags in their name, could trigger an XSS vulnerability by issuing a sleep query with a long delay. In the server status monitor, the query parameters were shown unescaped.
  • By configuring a malicious URL for the phpMyAdmin logo link in the navigation sidebar, untrusted script code could be executed when a user clicked the logo.
  • The setup field for "List of trusted proxies for IP allow/deny" Ajax validation code returned the unescaped input on errors, leading to possible JavaScript execution by entering arbitrary HTML.

If a crafted version.json would be presented, an XSS could be introduced.

Due to not properly validating the version.json file, which is fetched from the phpMyAdmin.net website, could lead to an XSS attack, if a crafted version.json file would be presented.

This vulnerability can only be exploited with a combination of complicated techniques and tricking the user to visit a page.

Full path disclosure vulnerabilities.

By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual.

XSS vulnerability when a text to link transformation is used.

When the TextLinkTransformationPlugin is used to create a link to an object when displaying the contents of a table, the object name is not properly escaped, which could lead to an XSS, if the object name has a crafted value.

The stored XSS vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required forms.

Self-XSS due to unescaped HTML output in schema export.

When calling schema_export.php with crafted parameters, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

SQL injection vulnerabilities, producing a privilege escalation (control user).

Due to a missing validation of parameters passed to schema_export.php and pmd_pdf.php, it was possible to inject SQL statements that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the mysql database.

These vulnerabilities can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form. Moreover, a control user must have been created and configured as part of the phpMyAdmin configuration storage installation.

http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/3.5.8.2/phpMyAdmin-3.5.8.2-notes.html/view http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.0.4.2/phpMyAdmin-4.0.4.2-notes.html/view 2013-07-28 2013-07-28 2013-07-29
wordpress -- multiple vulnerabilities wordpress 3.5.2,1 zh-wordpress-zh_CN 3.5.2 zh-wordpress-zh_TW 3.5.2 de-wordpress 3.5.2 ja-wordpress 3.5.2 ru-wordpress 3.5.2

The wordpress development team reports:

  • Blocking server-side request forgery attacks, which could potentially enable an attacker to gain access to a site
  • Disallow contributors from improperly publishing posts
  • An update to the SWFUpload external library to fix cross-site scripting vulnerabilities
  • Prevention of a denial of service attack, affecting sites using password-protected posts
  • An update to an external TinyMCE library to fix a cross-site scripting vulnerability
  • Multiple fixes for cross-site scripting
  • Avoid disclosing a full file path when a upload fails
CVE-2013-2199 CVE-2013-2200 CVE-2013-2201 CVE-2013-2202 CVE-2013-2203 CVE-2013-2204 CVE-2013-2205 https://wordpress.org/news/2013/06/wordpress-3-5-2/ 2013-06-21 2013-07-27 2014-04-30
bind -- denial of service vulnerability bind99 9.9.39.9.3.2 bind99-base 9.9.39.9.3.2 bind98 9.8.59.8.5.2 bind98-base 9.8.59.8.5.2 FreeBSD 9.09.1_5 8.48.4_2

ISC reports:

A specially crafted query that includes malformed rdata can cause named to terminate with an assertion failure while rejecting the malformed query.

CVE-2013-4854 SA-13:07.bind https://kb.isc.org/article/AA-01015/0 2013-07-26 2013-07-26 2013-07-27
gnupg -- side channel attack on RSA secret keys gnupg 1.4.14

A Yarom and Falkner paper reports:

Flush+Reload is a cache side-channel attack that monitors access to data in shared pages. In this paper we demonstrate how to use the attack to extract private encryption keys from GnuPG. The high resolution and low noise of the Flush+Reload attack enables a spy program to recover over 98% of the bits of the private key in a single decryption or signing round. Unlike previous attacks, the attack targets the last level L3 cache. Consequently, the spy program and the victim do not need to share the execution core of the CPU. The attack is not limited to a traditional OS and can be used in a virtualised environment, where it can attack programs executing in a different VM.

http://eprint.iacr.org/2013/448 http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html 2013-07-18 2013-07-25 2013-07-26
openafs -- single-DES cell-wide key brute force vulnerability openafs 1.6.5

OpenAFS Project reports:

The small size of the DES key space permits an attacker to brute force a cell's service key and then forge traffic from any user within the cell. The key space search can be performed in under 1 day at a cost of around $100 using publicly available services.

CVE-2013-4134 http://openafs.org/pages/security/OPENAFS-SA-2013-003.txt http://openafs.org/pages/security/how-to-rekey.txt http://openafs.org/pages/security/install-rxkad-k5-1.6.txt 2013-07-24 2013-07-25
subversion -- remotely triggerable "Assertion failed" DoS vulnerability or read overflow. subversion 1.8.01.8.1 1.7.01.7.11

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will trigger an assertion on some requests made against a revision root. This can lead to a DoS. If assertions are disabled it will trigger a read overflow which may cause a SEGFAULT (or equivalent) or undefined behavior.

Commit access is required to exploit this.

CVE-2013-4131 http://subversion.apache.org/security/CVE-2013-4131-advisory.txt 2013-07-19 2013-07-24 2013-07-25
suPHP -- Privilege escalation suphp 0.7.2

suPHP developer Sebastian Marsching reports:

When the suPHP_PHPPath was set, mod_suphp would use the specified PHP executable to pretty-print PHP source files (MIME type x-httpd-php-source or application/x-httpd-php-source).

However, it would not sanitize the environment. Thus a user that was allowed to use the SetEnv directive in a .htaccess file (AllowOverride FileInfo) could make PHP load a malicious configuration file (e.g. loading malicious extensions).

As the PHP process for highlighting the source file was run with the privileges of the user Apache HTTPd was running as, a local attacker could probably execute arbitrary code with the privileges of this user.

https://lists.marsching.com/pipermail/suphp/2013-May/002552.html 2013-05-20 2013-07-22
apache24 -- several vulnerabilities apache24 2.4.6

Apache HTTP SERVER PROJECT reports:

mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.

mod_session_dbd: Make sure that dirty flag is respected when saving sessions, and ensure the session ID is changed each time the session changes. This changes the format of the updatesession SQL statement. Existing configurations must be changed.

CVE-2013-1896 CVE-2013-2249 http://www.apache.org/dist/httpd/Announcement2.4.html 2013-07-11 2013-07-20 2013-07-21
gallery -- multiple vulnerabilities gallery3 3.0.9

Red Hat Security Response Team reports:

Gallery upstream has released 3.0.9 version, correcting two security flaws:

Issue #1 - Improper stripping of URL fragments in flowplayer SWF file might lead to reply attacks (a different flaw than CVE-2013-2138).

Issue #2 - gallery3: Multiple information exposure flaws in data rest core module.

CVE-2013-2240 CVE-2013-2241 http://sourceforge.net/apps/trac/gallery/ticket/2073 https://bugzilla.redhat.com/show_bug.cgi?id=981197 http://sourceforge.net/apps/trac/gallery/ticket/2074 https://bugzilla.redhat.com/show_bug.cgi?id=981198 http://galleryproject.org/gallery_3_0_9 2013-06-28 2013-07-17
PHP5 -- Heap corruption in XML parser php53 5.3.27

The PHP development team reports:

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.

CVE-2013-4113 https://bugs.php.net/bug.php?id=65236 2013-07-10 2013-07-16
PHP5 -- Integer overflow in Calendar module php5 5.4.05.4.16 php53 5.3.26

The PHP development team reports:

Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.

CVE-2013-4635 https://bugs.php.net/bug.php?id=64895 2013-05-22 2013-07-16
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.297

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-3344 CVE-2013-3345 CVE-2013-3347 http://www.adobe.com/support/security/bulletins/apsb13-17.html 2013-07-09 2013-07-15 2013-07-18
squid -- denial of service squid 3.23.2.12 3.33.3.8

Squid project reports:

Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted HTTP requests

This problem allows any client who can generate HTTP requests to perform a denial of service attack on the Squid service.

CVE-2013-4123 http://www.squid-cache.org/Advisories/SQUID-2013_3.txt 2013-07-13 2013-07-15
libzrtpcpp -- multiple security vulnerabilities libzrtpcpp 2.3.4

Mark Dowd reports:

Vulnerability 1. Remote Heap Overflow: If an attacker sends a packet larger than 1024 bytes that gets stored temporarily (which occurs many times - such as when sending a ZRTP Hello packet), a heap overflow will occur, leading to potential arbitrary code execution on the vulnerable host.

Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains multiple stack overflows that arise when preparing a response to a client's ZRTP Hello packet.

Vulnerability 3. Information Leaking / Out of Bounds Reads: The ZRTPCPP library performs very little validation regarding the expected size of a packet versus the actual amount of data received. This can lead to both information leaking and out of bounds data reads (usually resulting in a crash). Information leaking can be performed for example by sending a malformed ZRTP Ping packet.

CVE-2013-2221 CVE-2013-2222 CVE-2013-2223 2013-06-27 2013-07-11
ruby -- Hostname check bypassing vulnerability in SSL client ruby19 1.9.3.448,1 ruby18 1.8.7.374,1

Ruby Developers report:

Ruby's SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes.

CVE-2013-4073 http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/ 2013-06-27 2013-07-11 2013-09-24
otrs -- Sql Injection + Xss Issue otrs 3.2.9

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs leading to SQL injection. An attacker with a valid agent login could manipulate URLs in the ITSM ConfigItem search, leading to a JavaScript code injection (XSS) problem.

CVE-2013-4717 CVE-2013-4718 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-05/ 2013-07-09 2013-07-11
chromium -- multiple vulnerabilities chromium 28.0.1500.71

Google Chrome Releases reports:

A special reward for Andrey Labunets for his combination of CVE-2013-2879 and CVE-2013-2868 along with some (since fixed) server-side bugs.

[252216] Low CVE-2013-2867: Block pop-unders in various scenarios.

[252062] High CVE-2013-2879: Confusion setting up sign-in and sync. Credit to Andrey Labunets.

[252034] Medium CVE-2013-2868: Incorrect sync of NPAPI extension component. Credit to Andrey Labunets.

[245153] Medium CVE-2013-2869: Out-of-bounds read in JPEG2000 handling. Credit to Felix Groebert of Google Security Team.

[244746] [242762] Critical CVE-2013-2870: Use-after-free with network sockets. Credit to Collin Payne.

[244260] Medium CVE-2013-2853: Man-in-the-middle attack against HTTP in SSL. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco at INRIA Paris.

[243991] [243818] High CVE-2013-2871: Use-after-free in input handling. Credit to miaubiz.

[Mac only] [242702] Low CVE-2013-2872: Possible lack of entropy in renderers. Credit to Eric Rescorla.

[241139] High CVE-2013-2873: Use-after-free in resource loading. Credit to miaubiz.

[233848] Medium CVE-2013-2875: Out-of-bounds-read in SVG. Credit to miaubiz.

[229504] Medium CVE-2013-2876: Extensions permissions confusion with interstitials. Credit to Dev Akhawe.

[229019] Low CVE-2013-2877: Out-of-bounds read in XML parsing. Credit to Aki Helin of OUSPG.

[196636] None: Remove the "viewsource" attribute on iframes. Credit to Collin Jackson.

[177197] Medium CVE-2013-2878: Out-of-bounds read in text handling. Credit to Atte Kettunen of OUSPG.

CVE-2013-2853 CVE-2013-2867 CVE-2013-2868 CVE-2013-2869 CVE-2013-2870 CVE-2013-2871 CVE-2013-2872 CVE-2013-2873 CVE-2013-2875 CVE-2013-2876 CVE-2013-2877 CVE-2013-2878 CVE-2013-2879 http://googlechromereleases.blogspot.nl/ 2013-07-09 2013-07-10
apache22 -- several vulnerabilities apache22 2.2.02.2.25 apache22-event-mpm 2.2.02.2.25 apache22-itk-mpm 2.2.02.2.25 apache22-peruser-mpm 2.2.02.2.25 apache22-worker-mpm 2.2.02.2.25

Apache HTTP SERVER PROJECT reports:

The mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.

CVE-2013-1862 CVE-2013-1896 2013-06-21 2013-07-05 2013-07-10
phpMyAdmin -- Global variable scope injection phpMyAdmin 4.04.0.4.1

The phpMyAdmin development team reports:

The import.php script was vulnerable to GLOBALS variable injection. Therefore, an attacker could manipulate any configuration parameter.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php CVE-2013-4729 2013-06-30 2013-06-30
apache-xml-security-c -- heap overflow during XPointer evaluation apache-xml-security-c 1.7.2

The Apache Software Foundation reports:

The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code.

CVE-2013-2210 http://santuario.apache.org/secadv.data/CVE-2013-2210.txt 2013-06-27 2013-06-28
mozilla -- multiple vulnerabilities firefox 18.0,122.0,1 17.0.7,1 linux-firefox 17.0.7,1 linux-seamonkey 2.19 linux-thunderbird 17.0.7 seamonkey 2.19 thunderbird 11.017.0.7

The Mozilla Project reports:

Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7)

Title: Memory corruption found using Address Sanitizer

Privileged content access and execution via XBL

Arbitrary code execution within Profiler

Execution of unmapped memory through onreadystatechange

Data in the body of XHR HEAD requests leads to CSRF attacks

SVG filters can lead to information disclosure

PreserveWrapper has inconsistent behavior

Sandbox restrictions not applied to nested frame elements

X-Frame-Options ignored when using server push with multi-part responses

XrayWrappers can be bypassed to run user defined methods in a privileged context

getUserMedia permission dialog incorrectly displays location

Homograph domain spoofing in .com, .net and .name

Inaccessible updater can lead to local privilege escalation

CVE-2013-1682 CVE-2013-1683 CVE-2013-1684 CVE-2013-1685 CVE-2013-1686 CVE-2013-1687 CVE-2013-1688 CVE-2013-1690 CVE-2013-1692 CVE-2013-1693 CVE-2013-1694 CVE-2013-1695 CVE-2013-1696 CVE-2013-1697 CVE-2013-1698 CVE-2013-1699 CVE-2013-1700 http://www.mozilla.org/security/announce/2013/mfsa2013-49.html http://www.mozilla.org/security/announce/2013/mfsa2013-50.html http://www.mozilla.org/security/announce/2013/mfsa2013-51.html http://www.mozilla.org/security/announce/2013/mfsa2013-52.html http://www.mozilla.org/security/announce/2013/mfsa2013-53.html http://www.mozilla.org/security/announce/2013/mfsa2013-54.html http://www.mozilla.org/security/announce/2013/mfsa2013-55.html http://www.mozilla.org/security/announce/2013/mfsa2013-56.html http://www.mozilla.org/security/announce/2013/mfsa2013-57.html http://www.mozilla.org/security/announce/2013/mfsa2013-58.html http://www.mozilla.org/security/announce/2013/mfsa2013-59.html http://www.mozilla.org/security/announce/2013/mfsa2013-60.html http://www.mozilla.org/security/announce/2013/mfsa2013-61.html http://www.mozilla.org/security/announce/2013/mfsa2013-62.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-06-25 2013-06-26
cURL library -- heap corruption in curl_easy_unescape curl 7.77.24.0_4

cURL developers report:

libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption.

The function curl_easy_unescape() decodes URL-encoded strings to raw binary data. URL-encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller.

The function takes a source string and a length parameter, and if the length provided is 0 the function will instead use strlen() to figure out how much data to parse.

The "%HH" parser wrongly only considered the case where a zero byte would terminate the input. If a length-limited buffer was passed in which ended with a '%' character which was followed by two hexadecimal digits outside of the buffer libcurl was allowed to parse alas without a terminating zero, libcurl would still parse that sequence as well. The counter for remaining data to handle would then be decreased too much and wrap to become a very large integer and the copying would go on too long and the destination buffer that is allocated on the heap would get overwritten.

We consider it unlikely that programs allow user-provided strings unfiltered into this function. Also, only the not zero-terminated input string use case is affected by this flaw. Exploiting this flaw for gain is probably possible for specific circumstances but we consider the general risk for this to be low.

The curl command line tool is not affected by this problem as it doesn't use this function.

There are no known exploits available at this time.

CVE-2013-2174 http://curl.haxx.se/docs/adv_20130622.html 2013-06-22 2013-06-23 2013-07-01
puppet -- Unauthenticated Remote Code Execution Vulnerability puppet 2.72.7.22 3.03.2.2

Puppet Developers report:

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

CVE-2013-3567 2013-06-13 2013-06-22 2013-08-01
otrs -- information disclosure otrs 3.2.8

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs in the ticket watch mechanism to see contents of tickets they are not permitted to see.

CVE-2013-4088 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-04/ 2013-06-18 2013-06-19
FreeBSD -- Privilege escalation via mmap FreeBSD 9.09.1_4

Due to insufficient permission checks in the virtual memory system, a tracing process (such as a debugger) may be able to modify portions of the traced process's address space to which the traced process itself does not have write access.

CVE-2013-2171 SA-13:06.mmap 2013-06-18 2013-06-18
apache-xml-security-c -- heap overflow apache-xml-security-c 1.7.1

The Apache Software Foundation reports:

A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitary code execution. If verification of the signature occurs prior to actual evaluation of a signing key, this could be exploited by an unauthenticated attacker.

CVE-2013-2156 http://santuario.apache.org/secadv.data/CVE-2013-2156.txt 2013-06-18 2013-06-18
tor -- guard discovery tor-devel 0.2.4.13.a_1

The Tor Project reports:

Disable middle relay queue overfill detection code due to possible guard discovery attack

https://trac.torproject.org/projects/tor/ticket/9072 2013-06-15 2013-06-16
dbus -- local dos dbus 1.6.12

Simon McVittie reports:

Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in _dbus_printf_string_upper_bound(). This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. It is platform-specific: x86-64 Linux is known to be affected.

CVE-2013-2168 http://lists.freedesktop.org/archives/dbus/2013-June/015696.html 2013-06-13 2013-06-13
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.291

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-3343 2013-06-11 2013-06-14 2013-06-18
owncloud -- Multiple security vulnerabilities owncloud 5.0.7

The ownCloud development team reports:

oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections. Credit to Mateusz Goik (aliantsoft.pl).

oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals. Credit to Mateusz Goik (aliantsoft.pl).

oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities. Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl).

oC-SA-2013-022 / CVE-2013-2044: Open redirector. Credit to Mateusz Goik (aliantsoft.pl).

oC-SA-2013-023 / CVE-2013-2047: Password autocompletion.

oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application. Credit to Mateusz Goik (aliantsoft.pl).

oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API.

oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability.

oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage.

oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities.

http://owncloud.org/about/security/advisories/oC-SA-2013-019/ http://owncloud.org/about/security/advisories/oC-SA-2013-020/ http://owncloud.org/about/security/advisories/oC-SA-2013-021/ http://owncloud.org/about/security/advisories/oC-SA-2013-022/ http://owncloud.org/about/security/advisories/oC-SA-2013-023/ http://owncloud.org/about/security/advisories/oC-SA-2013-024/ http://owncloud.org/about/security/advisories/oC-SA-2013-025/ http://owncloud.org/about/security/advisories/oC-SA-2013-026/ http://owncloud.org/about/security/advisories/oC-SA-2013-027/ http://owncloud.org/about/security/advisories/oC-SA-2013-028/ CVE-2013-2039 CVE-2013-2040 CVE-2013-2041 CVE-2013-2042 CVE-2013-2043 CVE-2013-2044 CVE-2013-2045 CVE-2013-2047 CVE-2013-2048 CVE-2013-2085 CVE-2013-2086 CVE-2013-2089 CVE-2013-2149 CVE-2013-2150 2013-05-14 2013-06-11
php5 -- Heap based buffer overflow in quoted_printable_encode php5 5.4.16 php53 5.3.26

The PHP development team reports:

A Heap-based buffer overflow flaw was found in the php quoted_printable_encode() function. A remote attacker could use this flaw to cause php to crash or execute arbirary code with the permission of the user running php

CVE-2013-2110 https://bugzilla.redhat.com/show_bug.cgi?id=964969 2013-06-06 2013-06-07
dns/bind9* -- A recursive resolver can be crashed by a query for a malformed zone bind99 9.9.39.9.3.1 bind99-base 9.9.39.9.3.1 bind98 9.8.59.8.5.1 bind98-base 9.8.59.8.5.1 bind96 9.6.3.1.ESV.R99.6.3.2.ESV.R9 bind96-base 9.6.3.1.ESV.R99.6.3.2.ESV.R9

ISC reports:

A bug has been discovered in the most recent releases of BIND 9 which has the potential for deliberate exploitation as a denial-of-service attack. By sending a recursive resolver a query for a record in a specially malformed zone, an attacker can cause BIND 9 to exit with a fatal "RUNTIME_CHECK" error in resolver.c.

CVE-2013-3919 2013-06-04 2013-06-06 2013-06-07
phpMyAdmin -- XSS due to unescaped HTML output in Create View page phpMyAdmin 4.04.0.3

The phpMyAdmin development team reports:

When creating a view with a crafted name and an incorrect CREATE statement, it is possible to trigger an XSS.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users from accessing the required form.

http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php CVE-2013-3742 2013-06-05 2013-06-05
telepathy-gabble -- TLS verification bypass telepathy-gabble 0.16.6

Simon McVittie reports:

This release fixes a man-in-the-middle attack.

If you use an unencrypted connection to a "legacy Jabber" (pre-XMPP) server, this version of Gabble will not connect until you make one of these configuration changes:

. upgrade the server software to something that supports XMPP 1.0; or

. use an encrypted "old SSL" connection, typically on port 5223 (old-ssl); or

. turn off "Encryption required (TLS/SSL)" (require-encryption).

CVE-2013-1431 http://lists.freedesktop.org/archives/telepathy/2013-May/006449.html 2013-05-27 2013-06-05
chromium -- multiple vulnerabilities chromium 27.0.1453.110

Google Chrome Releases reports:

[242322] Medium CVE-2013-2855: Memory corruption in dev tools API. Credit to "daniel.zulla".

[242224] High CVE-2013-2856: Use-after-free in input handling. Credit to miaubiz.

[240124] High CVE-2013-2857: Use-after-free in image handling. Credit to miaubiz.

[239897] High CVE-2013-2858: Use-after-free in HTML5 Audio. Credit to "cdel921".

[237022] High CVE-2013-2859: Cross-origin namespace pollution. to "bobbyholley".

[225546] High CVE-2013-2860: Use-after-free with workers accessing database APIs. Credit to Collin Payne.

[209604] High CVE-2013-2861: Use-after-free with SVG. Credit to miaubiz.

[161077] High CVE-2013-2862: Memory corruption in Skia GPU handling. Credit to Atte Kettunen of OUSPG.

[232633] Critical CVE-2013-2863: Memory corruption in SSL socket handling. Credit to Sebastian Marchand of the Chromium development community.

[239134] High CVE-2013-2864: Bad free in PDF viewer. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.

[246389] High CVE-2013-2865: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-2855 CVE-2013-2856 CVE-2013-2857 CVE-2013-2858 CVE-2013-2859 CVE-2013-2860 CVE-2013-2861 CVE-2013-2862 CVE-2013-2863 CVE-2013-2864 CVE-2013-2865 http://googlechromereleases.blogspot.nl/ 2013-06-04 2013-06-04
xorg -- protocol handling issues in X Window System client libraries libX11 1.6.0 libXext 1.3.2 libXfixes 5.0.1 libXi 1.7_1 libXinerama 1.1.3 libXp 1.0.2 libXrandr 1.4.1 libXrender 0.9.7_1 libXres 1.0.7 libXtst 1.2.2 libXv 1.0.8 libXvMC 1.0.7_1 libXxf86dga 1.1.4 libdmx 1.1.3 libxcb 1.9.1 libGL 7.6.1_4 7.8.08.0.5_4 xf86-video-openchrome 0.3.3 libFS 1.0.5 libXxf86vm 1.1.3 libXt 1.1.4 libXcursor 1.1.14

freedesktop.org reports:

Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage. Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server (such as Xvfb or Xephyr) which the user has modified to return invalid data, potentially allowing the user to escalate their privileges.

The vulnerabilities include:

Integer overflows calculating memory needs for replies.

Sign extension issues calculating memory needs for replies.

Buffer overflows due to not validating length or offset values in replies.

Integer overflows parsing user-specified files.

Unbounded recursion parsing user-specified files.

Memory corruption due to unchecked return values.

CVE-2013-1981 CVE-2013-1982 CVE-2013-1983 CVE-2013-1984 CVE-2013-1985 CVE-2013-1986 CVE-2013-1987 CVE-2013-1988 CVE-2013-1989 CVE-2013-1990 CVE-2013-1991 CVE-2013-1992 CVE-2013-1993 CVE-2013-1994 CVE-2013-1995 CVE-2013-1996 CVE-2013-1997 CVE-2013-1998 CVE-2013-1999 CVE-2013-2000 CVE-2013-2001 CVE-2013-2002 CVE-2013-2003 CVE-2013-2004 CVE-2013-2005 CVE-2013-2062 CVE-2013-2063 CVE-2013-2064 CVE-2013-2066 2013-05-23 2013-06-04
krb5 -- UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443] krb5 1.11.2

No advisory has been released yet.

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103. [CVE-2002-2443].

CVE-2002-2443 http://web.mit.edu/kerberos/www/krb5-1.11/ 2013-05-10 2013-06-03
net/openafs -- buffer overflow openafs 1.6.2.*

Nickolai Zeldovich reports:

An attacker with the ability to manipulate AFS directory ACLs may crash the fileserver hosting that volume. In addition, once a corrupt ACL is placed on a fileserver, its existence may crash client utilities manipulating ACLs on that server.

http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt CVE-2013-1794 2013-02-27 2013-06-03
www/mod_security -- NULL pointer dereference DoS mod_security 2.7.3

SecurityFocus reports:

When ModSecurity receives a request body with a size bigger than the value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type" that has no request body processor mapped to it, ModSecurity will systematically crash on every call to "forceRequestBodyVariable".

CVE-2013-2765 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2765 2013-05-27 2013-06-03
passenger -- security vulnerability rubygem-passenger 4.0.5

The Phusion reports:

A denial of service and arbitrary code execution by hijacking temp files. [CVE-2013-2119]

CVE-2013-2119 http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/ 2013-05-29 2013-06-01
devel/subversion -- svnserve remotely triggerable DoS subversion 1.7.01.7.10 1.0.01.6.23

Subversion team reports:

Subversion's svnserve server process may exit when an incoming TCP connection is closed early in the connection process.

CVE-2013-2112 2013-05-31 2013-05-31
devel/subversion -- contrib hook-scripts can allow arbitrary code execution subversion 1.7.01.7.10 1.2.01.6.23

Subversion team reports:

The script contrib/hook-scripts/check-mime-type.pl does not escape argv arguments to 'svnlook' that start with a hyphen. This could be used to cause 'svnlook', and hence check-mime-type.pl, to error out.

The script contrib/hook-scripts/svn-keyword-check.pl parses filenames from the output of 'svnlook changed' and passes them to a further shell command (equivalent to the 'system()' call of the C standard library) without escaping them. This could be used to run arbitrary shell commands in the context of the user whom the pre-commit script runs as (the user who owns the repository).

CVE-2013-2088 2013-05-31 2013-05-31
devel/subversion -- fsfs repositories can be corrupted by newline characters in filenames subversion 1.7.01.7.10 1.1.01.6.23

Subversion team reports:

If a filename which contains a newline character (ASCII 0x0a) is committed to a repository using the FSFS format, the resulting revision is corrupt.

CVE-2013-1968 2013-05-31 2013-05-31
irc/bitchx -- multiple vulnerabilities BitchX 1.2.*,1

bannedit reports:

Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in a MODE command, related to the p_mode variable.

Nico Golde reports:

There is a security issue in ircii-pana in bitchx' hostname command. The e_hostname function (commands.c) uses tmpnam to create a temporary file which is known to be insecure.

Chris reports:

Chris has reported a vulnerability in the Cypress script for BitchX, which can be exploited by malicious people to disclose potentially sensitive information or to compromise a vulnerable system.

The vulnerability is caused due to malicious code being present in the modules/mdop.m file. This can be exploited to disclose the content of various system files or to execute arbitrary shell commands.

Successful exploitation allows execution of arbitrary code, but requires the control of the "lsyn.webhop.net" domain.

CVE-2007-4584 CVE-2007-5839 CVE-2007-5922 2007-08-28 2013-05-31
znc -- null pointer dereference in webadmin module znc 1.0_1

No advisory has been released yet.

Fix NULL pointer dereference in webadmin.

https://github.com/znc/znc/commit/2bd410ee5570cea127233f1133ea22f25174eb28 2013-05-27 2013-05-28
socat -- FD leak socat 1.7.2.2

Gerhard Rieger reports:

Under certain circumstances an FD leak occurs and can be misused for denial of service attacks against socat running in server mode.

CVE-2013-3571 http://seclists.org/oss-sec/2013/q2/411 2013-05-26 2013-05-26
ruby -- Object taint bypassing in DL and Fiddle in Ruby ruby19 1.9.3.429,1

Ruby Developers report:

There is a vulnerability in DL and Fiddle in Ruby where tainted strings can be used by system calls regardless of the $SAFE level set in Ruby.

Native functions exposed to Ruby with DL or Fiddle do not check the taint values set on the objects passed in. This can result in tainted objects being accepted as input when a SecurityError exception should be raised.

CVE-2013-2065 http://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/ 2013-05-14 2013-05-26
couchdb -- DOM based Cross-Site Scripting via Futon UI couchdb 1.2.1,1

Jan Lehnardt reports:

Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user.

CVE-2012-5650 http://mail-archives.apache.org/mod_mbox/couchdb-user/201301.mbox/%3C2FFF2FD7-8EAF-4EBF-AFDA-5AEB6EAC853F@apache.org%3E 2012-01-14 2013-05-26
otrs -- information disclosure otrs 3.2.7

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs in the ticket split mechanism to see contents of tickets and they are not permitted to see.

CVE-2013-3551 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-03/ 2013-05-22 2013-05-23
otrs -- XSS vulnerability otrs 3.1.8

The OTRS Project reports:

An attacker with permission to write changes, workorder items or FAQ articles could inject JavaScript code into the articles which would be executed by the browser of other users reading the article.

CVE-2013-2637 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/ 2013-04-02 2013-05-23
RT -- multiple vulnerabilities rt38 3.83.8.17 rt40 4.04.0.13

Thomas Sibley reports:

We discovered a number of security vulnerabilities which affect both RT 3.8.x and RT 4.0.x. We are releasing RT versions 3.8.17 and 4.0.13 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 3.8 and 4.0.

The vulnerabilities addressed by 3.8.17, 4.0.13, and the below patches include the following:

RT 4.0.0 and above are vulnerable to a limited privilege escalation leading to unauthorized modification of ticket data. The DeleteTicket right and any custom lifecycle transition rights may be bypassed by any user with ModifyTicket. This vulnerability is assigned CVE-2012-4733.

RT 3.8.0 and above include a version of bin/rt that uses semi-predictable names when creating tempfiles. This could possibly be exploited by a malicious user to overwrite files with permissions of the user running bin/rt. This vulnerability is assigned CVE-2013-3368.

RT 3.8.0 and above allow calling of arbitrary Mason components (without control of arguments) for users who can see administration pages. This could be used by a malicious user to run private components which may have negative side-effects. This vulnerability is assigned CVE-2013-3369.

RT 3.8.0 and above allow direct requests to private callback components. Though no callback components ship with RT, this could be used to exploit an extension or local callback which uses the arguments passed to it insecurely. This vulnerability is assigned CVE-2013-3370.

RT 3.8.3 and above are vulnerable to cross-site scripting (XSS) via attachment filenames. The vector is difficult to exploit due to parsing requirements. Additionally, RT 4.0.0 and above are vulnerable to XSS via maliciously-crafted "URLs" in ticket content when RT's "MakeClicky" feature is configured. Although not believed to be exploitable in the stock configuration, a patch is also included for RTIR 2.6.x to add bulletproofing. These vulnerabilities are assigned CVE-2013-3371.

RT 3.8.0 and above are vulnerable to an HTTP header injection limited to the value of the Content-Disposition header. Injection of other arbitrary response headers is not possible. Some (especially older) browsers may allow multiple Content-Disposition values which could lead to XSS. Newer browsers contain security measures to prevent this. Thank you to Dominic Hargreaves for reporting this vulnerability. This vulnerability is assigned CVE-2013-3372.

RT 3.8.0 and above are vulnerable to a MIME header injection in outgoing email generated by RT. The vectors via RT's stock templates are resolved by this patchset, but any custom email templates should be updated to ensure that values interpolated into mail headers do not contain newlines. This vulnerability is assigned CVE-2013-3373.

RT 3.8.0 and above are vulnerable to limited session re-use when using the file-based session store, Apache::Session::File. RT's default session configuration only uses Apache::Session::File for Oracle. RT instances using Oracle may be locally configured to use the database-backed Apache::Session::Oracle, in which case sessions are never re-used. The extent of session re-use is limited to information leaks of certain user preferences and caches, such as queue names available for ticket creation. Thank you to Jenny Martin for reporting the problem that lead to discovery of this vulnerability. This vulnerability is assigned CVE-2013-3374.

http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000226.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000227.html http://lists.bestpractical.com/pipermail/rt-announce/2013-May/000228.html CVE-2012-4733 CVE-2013-3368 CVE-2013-3369 CVE-2013-3370 CVE-2013-3371 CVE-2013-3372 CVE-2013-3373 CVE-2013-3374 2013-05-22 2013-05-23
chromium -- multiple vulnerabilities chromium 27.0.1453.93

Google Chrome Releases reports:

[235638] High CVE-2013-2837: Use-after-free in SVG. Credit to Slawomir Blazek.

[235311] Medium CVE-2013-2838: Out-of-bounds read in v8. Credit to Christian Holler.

[230176] High CVE-2013-2839: Bad cast in clipboard handling. Credit to Jon of MWR InfoSecurity.

[230117] High CVE-2013-2840: Use-after-free in media loader. Credit to Nils of MWR InfoSecurity.

[227350] High CVE-2013-2841: Use-after-free in Pepper resource handling. Credit to Chamal de Silva.

[226696] High CVE-2013-2842: Use-after-free in widget handling. Credit to Cyril Cattiaux.

[222000] High CVE-2013-2843: Use-after-free in speech handling. Credit to Khalil Zhani.

[196393] High CVE-2013-2844: Use-after-free in style resolution. Credit to Sachin Shinde (@cons0ul).

[188092] [179522] [222136] [188092] High CVE-2013-2845: Memory safety issues in Web Audio. Credit to Atte Kettunen of OUSPG.

[177620] High CVE-2013-2846: Use-after-free in media loader. Credit to Chamal de Silva.

[176692] High CVE-2013-2847: Use-after-free race condition with workers. Credit to Collin Payne.

[176137] Medium CVE-2013-2848: Possible data extraction with XSS Auditor. Credit to Egor Homakov.

[171392] Low CVE-2013-2849: Possible XSS with drag+drop or copy+paste. Credit to Mario Heiderich.

[241595] High CVE-2013-2836: Various fixes from internal audits, fuzzing and other initiatives.

CVE-2013-2836 CVE-2013-2837 CVE-2013-2838 CVE-2013-2839 CVE-2013-2840 CVE-2013-2841 CVE-2013-2842 CVE-2013-2843 CVE-2013-2844 CVE-2013-2845 CVE-2013-2846 CVE-2013-2847 CVE-2013-2848 CVE-2013-2849 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-05-21 2013-05-22
plib -- stack-based buffer overflow plib 1.8.5_4

CVE reports:

Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.

55839 CVE-2012-4552 http://www.openwall.com/lists/oss-security/2012/10/29/8 2012-10-09 2013-05-19
plib -- buffer overflow plib 1.8.5_4

Secunia reports:

A vulnerability has been discovered in PLIB, which can be exploited by malicious people to compromise an application using the library. The vulnerability is caused due to a boundary error within the "ulSetError()" function (src/util/ulError.cxx) when creating the error message, which can be exploited to overflow a static buffer.

Successful exploitation allows the execution of arbitrary code but requires that the attacker can e.g. control the content of an overly long error message passed to the "ulSetError()" function.

The vulnerability is confirmed in version 1.8.5. Other versions may also be affected.

Originally reported in TORCS by Andres Gomez.

CVE-2011-4620 http://openwall.com/lists/oss-security/2011/12/21/2 2011-12-21 2013-05-19
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.285

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-2728 CVE-2013-3324 CVE-2013-3325 CVE-2013-3326 CVE-2013-3327 CVE-2013-3328 CVE-2013-3329 CVE-2013-3330 CVE-2013-3331 CVE-2013-3332 CVE-2013-3333 CVE-2013-3334 CVE-2013-3335 2013-05-14 2013-05-16
mozilla -- multiple vulnerabilities firefox 18.0,121.0,1 17.0.6,1 linux-firefox 17.0.6,1 linux-seamonkey 2.17.1 linux-thunderbird 17.0.6 seamonkey 2.17.1 thunderbird 11.017.0.6

The Mozilla Project reports:

MFSA 2013-41 Miscellaneous memory safety hazards (rv:21.0 / rv:17.0.6)

MFSA 2013-42 Privileged access for content level constructor

MFSA 2013-43 File input control has access to full path

MFSA 2013-44 Local privilege escalation through Mozilla Maintenance Service

MFSA 2013-45 Mozilla Updater fails to update some Windows Registry entries

MFSA 2013-46 Use-after-free with video and onresize event

MFSA 2013-47 Uninitialized functions in DOMSVGZoomEvent

MFSA 2013-48 Memory corruption found using Address Sanitizer

CVE-2012-1942 CVE-2013-0801 CVE-2013-1669 CVE-2013-1670 CVE-2013-1671 CVE-2013-1672 CVE-2013-1674 CVE-2013-1675 CVE-2013-1676 CVE-2013-1677 CVE-2013-1678 CVE-2013-1679 CVE-2013-1680 CVE-2013-1681 http://www.mozilla.org/security/announce/2013/mfsa2013-40.html http://www.mozilla.org/security/announce/2013/mfsa2013-41.html http://www.mozilla.org/security/announce/2013/mfsa2013-42.html http://www.mozilla.org/security/announce/2013/mfsa2013-43.html http://www.mozilla.org/security/announce/2013/mfsa2013-44.html http://www.mozilla.org/security/announce/2013/mfsa2013-45.html http://www.mozilla.org/security/announce/2013/mfsa2013-46.html http://www.mozilla.org/security/announce/2013/mfsa2013-47.html http://www.mozilla.org/security/announce/2013/mfsa2013-48.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-05-14 2013-05-15 2013-05-21
nginx -- multiple vulnerabilities nginx 1.2.0,11.2.8,1 1.3.0,11.4.1,1 nginx-devel 1.1.41.2.8 1.3.01.5.0

The nginx project reports:

A stack-based buffer overflow might occur in a worker process process while handling a specially crafted request, potentially resulting in arbitrary code execution. [CVE-2013-2028]

A security problem related to CVE-2013-2028 was identified, affecting some previous nginx versions if proxy_pass to untrusted upstream HTTP servers is used.

The problem may lead to a denial of service or a disclosure of a worker process memory on a specially crafted response from an upstream proxied server. [CVE-2013-2070]

CVE-2013-2028 CVE-2013-2070 http://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html http://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html 2013-05-07 2013-05-07 2013-05-16
strongSwan -- ECDSA signature verification issue strongswan 5.0.4

strongSwan security team reports:

If the openssl plugin is used for ECDSA signature verification an empty, zeroed or otherwise invalid signature is handled as a legitimate one. Both IKEv1 and IKEv2 are affected.

Affected are only installations that have enabled and loaded the OpenSSL crypto backend (--enable-openssl). Builds using the default crypto backends are not affected.

CVE-2013-2944 2013-04-30 2013-05-03
jenkins -- multiple vulnerabilities jenkins 1.514

Jenkins Security Advisory reports:

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

  1. SECURITY-63 / CVE-2013-2034

    This creates a cross-site request forgery (CSRF) vulnerability on Jenkins master, where an anonymous attacker can trick an administrator to execute arbitrary code on Jenkins master by having him open a specifically crafted attack URL.

    There's also a related vulnerability where the permission check on this ability is done imprecisely, which may affect those who are running Jenkins instances with a custom authorization strategy plugin.

  2. SECURITY-67 / CVE-2013-2033

    This creates a cross-site scripting (XSS) vulnerability, where an attacker with a valid user account on Jenkins can execute JavaScript in the browser of other users, if those users are using certain browsers.

  3. SECURITY-69 / CVE-2013-2034

    This is another CSRF vulnerability that allows an attacker to cause a deployment of binaries to Maven repositories. This vulnerability has the same CVE ID as SEUCRITY-63.

  4. SECURITY-71 / CVE-2013-1808

    This creates a cross-site scripting (XSS) vulnerability.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02 CVE-2013-2034 CVE-2013-2033 CVE-2013-2034 CVE-2013-1808 2013-05-02 2013-05-03
FreeBSD -- NFS remote denial of service FreeBSD 8.38.3_8 9.19.1_3

Insufficient input validation in the NFS server allows an attacker to cause the underlying file system to treat a regular file as a directory.

CVE-2013-3266 SA-13:05.nfsserver 2013-04-21 2013-04-29
Joomla! -- XXS and DDoS vulnerabilities joomla 2.0.*2.5.10

The JSST and the Joomla! Security Center report:

[20130405] - Core - XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in Voting plugin.

[20130403] - Core - XSS Vulnerability

Inadequate filtering allows possibility of XSS exploit in some circumstances.

[20130402] - Core - Information Disclosure

Inadequate permission checking allows unauthorised user to see permission settings in some circumstances.

[20130404] - Core - XSS Vulnerability

Use of old version of Flash-based file uploader leads to XSS vulnerability.

[20130401] - Core - Privilege Escalation

Inadequate permission checking allows unauthorised user to delete private messages.

[20130406] - Core - DOS Vulnerability

Object unserialize method leads to possible denial of service vulnerability.

[20130407] - Core - XSS Vulnerability

Inadequate filtering leads to XSS vulnerability in highlighter plugin

CVE-2013-3059 CVE-2013-3058 CVE-2013-3057 http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html CVE-2013-3056 CVE-2013-3242 CVE-2013-3267 2013-04-24 2013-04-27
phpMyAdmin -- Multiple security vulnerabilities phpMyAdmin 3.53.5.8.1

The phpMyAdmin development team reports:

In some PHP versions, the preg_replace() function can be tricked into executing arbitrary PHP code on the server. This is done by passing a crafted argument as the regular expression, containing a null byte. phpMyAdmin does not correctly sanitize an argument passed to preg_replace() when using the "Replace table prefix" feature, opening the way to this vulnerability..

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form.

phpMyAdmin can be configured to save an export file on the web server, via its SaveDir directive. With this in place, it's possible, either via a crafted filename template or a crafted table name, to save a double extension file like foobar.php.sql. In turn, an Apache webserver on which there is no definition for the MIME type "sql" (the default) will treat this saved file as a ".php" script, leading to remote code execution.

This vulnerability can be triggered only by someone who logged in to phpMyAdmin, as the usual token protection prevents non-logged-in users to access the required form. Moreover, the SaveDir directive is empty by default, so a default configuration is not vulnerable. The $cfg['SaveDir'] directive must be configured, and the server must be running Apache with mod_mime to be exploitable.

CVE-2013-3238 CVE-2013-3239 2013-04-24 2013-04-24
tinc -- Buffer overflow tinc 1.0.21

tinc-vpn.org reports:

Drop packets forwarded via TCP if they are too big.

CVE-2013-1428 2013-01-26 2013-04-22
phpMyAdmin -- XSS due to unescaped HTML output in GIS visualisation page phpMyAdmin 3.53.5.8

The phpMyAdmin development team reports:

When modifying a URL parameter with a crafted value it is possible to trigger an XSS.

These XSS can only be triggered when a valid database is known and when a valid cookie token is used.

CVE-2013-1937 http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php 2013-04-18 2013-04-20
roundcube -- arbitrary file disclosure vulnerability roundcube 0.8.6,1

RoundCube development team reports:

After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issue.

CVE-2013-1904 https://secunia.com/advisories/52806/ 2013-03-27 2013-04-19
jasper -- buffer overflow jasper 1.900.1_12

Fedora reports:

JasPer fails to properly decode marker segments and other sections in malformed JPEG2000 files. Malformed inputs can cause heap buffer overflows which in turn may result in execution of attacker-controlled code.

CVE-2008-3520 CVE-2008-3522 CVE-2011-4516 CVE-2011-4517 http://www.kb.cert.org/vuls/id/887409 2011-12-09 2013-04-18
ModSecurity -- XML External Entity Processing Vulnerability mod_security 2.*2.7.3

Positive Technologies has reported a vulnerability in ModSecurity, which can be exploited by malicious people to disclose potentially sensitive information or cause a DoS (Denial Of Serice).

The vulnerability is caused due to an error when parsing external XML entities and can be exploited to e.g. disclose local files or cause excessive memory and CPU consumption.

.

CVE-2013-1915 https://secunia.com/advisories/52847/ https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1915 https://bugs.gentoo.org/show_bug.cgi?id=464188 2013-04-02 2013-04-16
sieve-connect -- TLS hostname verification was not occurring sieve-connect 0.85

sieve-connect developer Phil Pennock reports:

sieve-connect was not actually verifying TLS certificate identities matched the expected hostname.

http://mail.globnix.net/pipermail/sieve-connect-announce/2013/000005.html 2013-04-14 2013-04-15
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.280

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-1383 CVE-2013-1384 CVE-2013-1385 CVE-2013-1386 2013-04-09 2013-04-10
rubygem-rails -- multiple vulnerabilities rubygem-rails 3.2.13 rubygem-actionpack 3.2.13 rubygem-activerecord 3.2.13 rubygem-activesupport 3.2.13

Ruby on Rails team reports:

Rails versions 3.2.13 has been released. This release contains important security fixes. It is recommended users upgrade as soon as possible.

Four vulnerabilities have been discovered and fixed:

  1. (CVE-2013-1854) Symbol DoS vulnerability in Active Record
  2. (CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack
  3. (CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users
  4. (CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails
CVE-2013-1854 CVE-2013-1856 CVE-2013-1856 CVE-2013-1857 http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/ https://groups.google.com/forum/#!topic/ruby-security-ann/o0Dsdk2WrQ0 https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_QHo4BqnN8 https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/KZwsQbYsOiI https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/zAAU7vGTPvI 2013-03-18 2013-04-10
NVIDIA UNIX driver -- ARGB cursor buffer overflow in "NoScanout" mode nvidia-driver 310.14310.44 195.22304.88

NVIDIA Unix security team reports:

When the NVIDIA driver for the X Window System is operated in "NoScanout" mode, and an X client installs an ARGB cursor that is larger than the expected size (64x64 or 256x256, depending on the driver version), the driver will overflow a buffer. This can cause a denial of service (e.g., an X server segmentation fault), or could be exploited to achieve arbitrary code execution. Because the X server runs as setuid root in many configurations, an attacker could potentially use this vulnerability in those configurations to gain root privileges.

CVE-2013-0131 http://nvidia.custhelp.com/app/answers/detail/a_id/3290 2013-03-27 2013-04-08
opera -- moderately severe issue opera 12.15 opera-devel 12.15 linux-opera 12.15 linux-opera-devel 12.15

Opera reports:

Fixed a moderately severe issue, as reported by Attila Suszte.

http://www.opera.com/docs/changelogs/unified/1215/ http://www.opera.com/support/kb/view/1046/ http://www.opera.com/support/kb/view/1047/ 2013-04-04 2014-04-30
Subversion -- multiple vulnerabilities subversion 1.7.01.7.9 1.0.01.6.21

Subversion team reports:

Subversion's mod_dav_svn Apache HTTPD server module will use excessive amounts of memory when a large number of properties are set or deleted on a node.

Subversion's mod_dav_svn Apache HTTPD server module will crash when a LOCK request is made against activity URLs.

Subversion's mod_dav_svn Apache HTTPD server module will crash in some circumstances when a LOCK request is made against a non-existent URL.

Subversion's mod_dav_svn Apache HTTPD server module will crash when a PROPFIND request is made against activity URLs.

Subversion's mod_dav_svn Apache HTTPD server module will crash when a log REPORT request receives a limit that is out of the allowed range.

CVE-2013-1845 CVE-2013-1846 CVE-2013-1847 CVE-2013-1849 CVE-2013-1884 2013-04-05 2013-04-05
otrs -- Information disclosure and Data manipulation otrs 3.1.14

The OTRS Project reports:

An attacker with a valid agent login could manipulate URLs in the object linking mechanism to see titles of tickets and other objects that are not obliged to be seen. Furthermore, links to objects without permission can be placed and removed.

CVE-2013-2625 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-01/ 2013-04-02 2013-04-05
PostgreSQL -- anonymous remote access data corruption vulnerability postgresql-server 8.3.08.3.21_1 8.4.08.4.17 9.0.09.0.13 9.1.09.1.9 9.2.09.2.4

PostgreSQL project reports:

The PostgreSQL Global Development Group has released a security update to all current versions of the PostgreSQL database system, including versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update fixes a high-exposure security vulnerability in versions 9.0 and later. All users of the affected versions are strongly urged to apply the update *immediately*.

A major security issue (for versions 9.x only) fixed in this release, [CVE-2013-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899), makes it possible for a connection request containing a database name that begins with "-" to be crafted that can damage or destroy files within a server's data directory. Anyone with access to the port the PostgreSQL server listens on can initiate this request. This issue was discovered by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software Center.

Two lesser security fixes are also included in this release: [CVE-2013-1900](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900), wherein random numbers generated by contrib/pgcrypto functions may be easy for another database user to guess (all versions), and [CVE-2013-1901](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901), which mistakenly allows an unprivileged user to run commands that could interfere with in-progress backups (for versions 9.x only).

CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 2013-04-04 2013-04-04
mozilla -- multiple vulnerabilities firefox 18.0,120.0,1 17.0.5,1 linux-firefox 17.0.5,1 linux-seamonkey 2.17 linux-thunderbird 17.0.5 seamonkey 2.17 thunderbird 11.017.0.5

The Mozilla Project reports:

MFSA 2013-30 Miscellaneous memory safety hazards (rv:20.0 / rv:17.0.5)

MFSA 2013-31 Out-of-bounds write in Cairo library

MFSA 2013-32 Privilege escalation through Mozilla Maintenance Service

MFSA 2013-33 World read and write access to app_tmp directory on Android

MFSA 2013-34 Privilege escalation through Mozilla Updater

MFSA 2013-35 WebGL crash with Mesa graphics driver on Linux

MFSA 2013-36 Bypass of SOW protections allows cloning of protected nodes

MFSA 2013-37 Bypass of tab-modal dialog origin disclosure

MFSA 2013-38 Cross-site scripting (XSS) using timed history navigations

MFSA 2013-39 Memory corruption while rendering grayscale PNG images

MFSA 2013-40 Out-of-bounds array read in CERT_DecodeCertPackage

CVE-2013-0788 CVE-2013-0789 CVE-2013-0790 CVE-2013-0791 CVE-2013-0792 CVE-2013-0793 CVE-2013-0794 CVE-2013-0795 CVE-2013-0796 CVE-2013-0797 CVE-2013-0798 CVE-2013-0799 CVE-2013-0800 http://www.mozilla.org/security/announce/2013/mfsa2013-30.html http://www.mozilla.org/security/announce/2013/mfsa2013-31.html http://www.mozilla.org/security/announce/2013/mfsa2013-32.html http://www.mozilla.org/security/announce/2013/mfsa2013-33.html http://www.mozilla.org/security/announce/2013/mfsa2013-34.html http://www.mozilla.org/security/announce/2013/mfsa2013-35.html http://www.mozilla.org/security/announce/2013/mfsa2013-36.html http://www.mozilla.org/security/announce/2013/mfsa2013-37.html http://www.mozilla.org/security/announce/2013/mfsa2013-38.html http://www.mozilla.org/security/announce/2013/mfsa2013-39.html http://www.mozilla.org/security/announce/2013/mfsa2013-40.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-04-02 2013-04-03 2013-04-08
FreeBSD -- BIND remote denial of service FreeBSD 9.09.0_7 9.19.1_2

A flaw in a library used by BIND allows an attacker to deliberately cause excessive memory consumption by the named(8) process. This affects both recursive and authoritative servers.

CVE-2013-2266 SA-13:04.bind https://kb.isc.org/article/AA-00871 2013-04-02 2013-04-02
FreeBSD -- OpenSSL multiple vulnerabilities FreeBSD 8.38.3_7 9.09.0_7 9.19.1_2

A flaw in the OpenSSL handling of OCSP response verification could be exploited to cause a denial of service attack.

OpenSSL has a weakness in the handling of CBC ciphersuites in SSL, TLS and DTLS. The weakness could reveal plaintext in a timing attack.

CVE-2013-0166 CVE-2013-0169 SA-13:04.openssl http://www.openssl.org/news/secadv_20130205.txt 2013-04-02 2013-04-02
OpenVPN -- potential side-channel/timing attack when comparing HMACs openvpn 2.0.9_4 2.1.02.2.2_2 2.3.02.3.1

The OpenVPN project reports:

OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function.

https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc CVE-2013-2061 http://www.openwall.com/lists/oss-security/2013/05/06/6 https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee 2013-03-19 2013-03-31 2013-06-01
libxml2 -- cpu consumption Dos libxml2 2.8.0

Kurt Seifried reports:

libxml2 is affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.)..

CVE-2013-0338 CVE-2013-0339 http://seclists.org/oss-sec/2013/q1/391 https://security-tracker.debian.org/tracker/CVE-2013-0338 https://security-tracker.debian.org/tracker/CVE-2013-0339 2013-02-21 2013-03-29
asterisk -- multiple vulnerabilities asterisk11 11.*11.2.2 asterisk10 10.*10.12.2 asterisk18 1.8.*1.8.20.2

Asterisk project reports:

Buffer Overflow Exploit Through SIP SDP Header

Username disclosure in SIP channel driver

Denial of Service in HTTP server

CVE-2013-2685 CVE-2013-2686 CVE-2013-2264 http://downloads.asterisk.org/pub/security/AST-2013-001.html http://downloads.asterisk.org/pub/security/AST-2013-002.html http://downloads.asterisk.org/pub/security/AST-2013-003.html https://www.asterisk.org/security 2013-03-27 2013-03-29
dns/bind9* -- Malicious Regex Can Cause Memory Exhaustion bind99 9.9.2.2 bind99-base 9.9.2.2 bind98 9.8.4.2 bind98-base 9.8.4.2

ISC reports:

A critical defect in BIND 9 allows an attacker to cause excessive memory consumption in named or other programs linked to libdns.

CVE-2013-2266 2013-03-11 2013-03-27
chromium -- multiple vulnerabilities chromium 26.0.1410.43

Google Chrome Releases reports:

[172342] High CVE-2013-0916: Use-after-free in Web Audio. Credit to Atte Kettunen of OUSPG.

[180909] Low CVE-2013-0917: Out-of-bounds read in URL loader. Credit to Google Chrome Security Team (Cris Neckar).

[180555] Low CVE-2013-0918: Do not navigate dev tools upon drag and drop. Credit to Vsevolod Vlasov of the Chromium development community.

[Linux only] [178760] Medium CVE-2013-0919: Use-after-free with pop-up windows in extensions. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[177410] Medium CVE-2013-0920: Use-after-free in extension bookmarks API. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[174943] High CVE-2013-0921: Ensure isolated web sites run in their own processes.

[174129] Low CVE-2013-0922: Avoid HTTP basic auth brute force attempts. Credit to "t3553r".

[169981] [169972] [169765] Medium CVE-2013-0923: Memory safety issues in the USB Apps API. Credit to Google Chrome Security Team (Mustafa Emre Acer).

[169632] Low CVE-2013-0924: Check an extension's permissions API usage again file permissions. Credit to Benjamin Kalman of the Chromium development community.

[168442] Low CVE-2013-0925: Avoid leaking URLs to extensions without the tabs permissions. Credit to Michael Vrable of Google.

[112325] Medium CVE-2013-0926: Avoid pasting active tags in certain situations. Credit to Subho Halder, Aditya Gupta, and Dev Kar of xys3c (xysec.com).

CVE-2013-0916 CVE-2013-0917 CVE-2013-0918 CVE-2013-0919 CVE-2013-0920 CVE-2013-0921 CVE-2013-0922 CVE-2013-0923 CVE-2013-0924 CVE-2013-0925 CVE-2013-0926 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-03-26 2013-03-26
firebird -- Remote Stack Buffer Overflow firebird25-server 2.5.02.5.2 firebird21-server 2.1.02.1.5

Firebird Project reports:

The FirebirdSQL server is vulnerable to a stack buffer overflow that can be triggered when an unauthenticated user sends a specially crafted packet. The result can lead to remote code execution as the user which runs the FirebirdSQL server.

CVE-2013-2492 https://gist.github.com/zeroSteiner/85daef257831d904479c 2013-01-31 2013-03-06
optipng -- use-after-free vulnerability optipng 0.70.7.4

Secunia reports:

A vulnerability has been reported in OptiPNG, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to a use-after-free error related to the palette reduction functionality. No further information is currently available.

Success exploitation may allow execution of arbitrary code.

CVE-2012-4432 https://secunia.com/advisories/50654 2012-09-16 2013-03-21
php5 -- Multiple vulnerabilities php5 5.4.13 php53 5.3.23

The PHP development team reports:

PHP does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

The SOAP parser in PHP allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.

CVE-2013-1635 CVE-2013-1643 2013-03-04 2013-03-18
piwigo -- CSRF/Path Traversal piwigo 2.4.7

High-Tech Bridge Security Research Lab reports:

The CSRF vulnerability exists due to insufficient verification of the HTTP request origin in "/admin.php" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create arbitrary PHP file on the remote server.

The path traversal vulnerability exists due to insufficient filtration of user-supplied input in "dl" HTTP GET parameter passed to "/install.php" script. The script is present on the system after installation by default, and can be accessed by attacker without any restrictions.

CVE-2013-1468 CVE-2013-1469 http://piwigo.org/bugs/view.php?id=0002843 http://piwigo.org/bugs/view.php?id=0002844 http://dl.packetstormsecurity.net/1302-exploits/piwigo246-traversalxsrf.txt 2013-02-06 2013-03-18
libexif -- multiple remote vulnerabilities libexif 0.6.21

libexif project security advisory:

A number of remotely exploitable issues were discovered in libexif and exif, with effects ranging from information leakage to potential remote code execution.

CVE-2012-2812 CVE-2012-2813 CVE-2012-2814 CVE-2012-2836 CVE-2012-2837 CVE-2012-2840 CVE-2012-2841 CVE-2012-2845 54437 2012-07-12 2013-03-13
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.275

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-0646 CVE-2013-0650 CVE-2013-1371 CVE-2013-1375 2013-03-12 2013-03-12
puppet27 and puppet -- multiple vulnerabilities puppet 3.03.1.1 puppet27 2.72.7.21

Moses Mendoza reports:

A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.

A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions. Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.

A vulnerability has been found in Puppet which could allow authenticated clients to execute arbitrary code on agents that have been configured to accept kick connections. This vulnerability is not present in the default configuration of puppet agents, but if they have been configured to listen for incoming connections ('listen=true'), and the agent's auth.conf has been configured to allow access to the `run` REST endpoint, then a client could construct an HTTP request which could execute arbitrary code. The severity of this issue is exacerbated by the fact that puppet agents typically run as root.

A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.

A vulnerability found in Puppet could allow unauthenticated clients to send requests to the puppet master which would cause it to load code unsafely. While there are no reported exploits, this vulnerability could cause issues like those described in Rails CVE-2013-0156. This vulnerability only affects puppet masters running Ruby 1.9.3 and higher.

This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.

CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2275 https://puppetlabs.com/security/cve/cve-2013-1640/ https://puppetlabs.com/security/cve/cve-2013-1652/ https://puppetlabs.com/security/cve/cve-2013-1653/ https://puppetlabs.com/security/cve/cve-2013-1654/ https://puppetlabs.com/security/cve/cve-2013-1655/ https://puppetlabs.com/security/cve/cve-2013-2275/ https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/f_gybceSV6E https://groups.google.com/forum/?fromgroups=#!topic/puppet-announce/kgDyaPhHniw 2013-03-13 2013-03-13
puppet26 -- multiple vulnerabilities puppet26 2.62.6.18

Moses Mendoza reports:

A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the 'template' or 'inline_template' functions during catalog compilation.

A vulnerability found in Puppet could allow an authenticated client to connect to a puppet master and perform unauthorized actions. Specifically, given a valid certificate and private key, an agent could retrieve catalogs from the master that it is not authorized to access or it could poison the puppet master's caches for any puppet-generated data that supports caching such as catalogs, nodes, facts, and resources. The extent and severity of this vulnerability varies depending on the specific configuration of the master: for example, whether it is using storeconfigs or not, which version, whether it has access to the cache or not, etc.

A vulnerability has been found in Puppet that could allow a client negotiating a connection to a master to downgrade the master's SSL protocol to SSLv2. This protocol has been found to contain design weaknesses. This issue only affects systems running older versions (pre 1.0.0) of openSSL. Newer versions explicitly disable SSLv2.

A vulnerability found in Puppet could allow an authenticated client to execute arbitrary code on a puppet master that is running in the default configuration, or an agent with `puppet kick` enabled. Specifically, a properly authenticated and connected puppet agent could be made to construct an HTTP PUT request for an authorized report that actually causes the execution of arbitrary code on the master.

This vulnerability affects puppet masters 0.25.0 and above. By default, auth.conf allows any authenticated node to submit a report for any other node. This can cause issues with compliance. The defaults in auth.conf have been changed.

CVE-2013-1640 CVE-2013-1652 CVE-2013-1654 CVE-2013-2274 CVE-2013-2275 https://puppetlabs.com/security/cve/cve-2013-1640/ https://puppetlabs.com/security/cve/cve-2013-1652/ https://puppetlabs.com/security/cve/cve-2013-1654/ https://puppetlabs.com/security/cve/cve-2013-2274/ https://puppetlabs.com/security/cve/cve-2013-2275/ 2013-03-13 2013-03-13
perl -- denial of service via algorithmic complexity attack on hashing routines perl 5.12.4_5 5.14.05.14.2_3 5.16.05.16.2_1 perl-threaded 5.12.4_5 5.14.05.14.2_3 5.16.05.16.2_1

Perl developers report:

In order to prevent an algorithmic complexity attack against its hashing mechanism, perl will sometimes recalculate keys and redistribute the contents of a hash. This mechanism has made perl robust against attacks that have been demonstrated against other systems.

Research by Yves Orton has recently uncovered a flaw in the rehashing code which can result in pathological behavior. This flaw could be exploited to carry out a denial of service attack against code that uses arbitrary user input as hash keys.

Because using user-provided strings as hash keys is a very common operation, we urge users of perl to update their perl executable as soon as possible.

CVE-2013-1667 http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html 2013-03-04 2013-03-10
libpurple -- multiple vulnerabilities libpurple 2.10.7

Pidgin reports:

libpurple

Fix a crash when receiving UPnP responses with abnormally long values.

MXit

Fix two bugs where a remote MXit user could possibly specify a local file path to be written to.

Fix a bug where the MXit server or a man-in-the-middle could potentially send specially crafted data that could overflow a buffer and lead to a crash or remote code execution.

Sametime

Fix a crash in Sametime when a malicious server sends us an abnormally long user ID.

CVE-2013-0274 CVE-2013-0271 CVE-2013-0272 CVE-2013-0273 https://developer.pidgin.im/wiki/ChangeLog 2013-02-13 2013-03-10 2013-03-16
mozilla -- use-after-free in HTML Editor firefox 18.0,119.0.2,1 17.0.3,1 linux-firefox 17.0.4,1 linux-seamonkey 2.16.1 linux-thunderbird 17.0.4 seamonkey 2.16.1 thunderbird 11.017.0.4 10.0.12

The Mozilla Project reports:

MFSA 2013-29 Use-after-free in HTML Editor

CVE-2013-0787 http://www.mozilla.org/security/announce/2013/mfsa2013-29.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-03-07 2013-03-08
chromium -- WebKit vulnerability chromium 25.0.1364.160

Google Chrome Releases reports:

[180763] High CVE-2013-0912: Type confusion in WebKit. Credit to Nils and Jon of MWR Labs.

CVE-2013-0912 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-03-07 2013-03-08
typo3 -- Multiple vulnerabilities in TYPO3 Core typo3 4.5.04.5.23 4.6.04.6.16 4.7.04.7.8 6.0.06.0.2

Typo Security Team reports:

Extbase Framework - Failing to sanitize user input, the Extbase database abstraction layer is susceptible to SQL Injection. TYPO3 sites which have no Extbase extensions installed are not affected. Extbase extensions are affected if they use the Query Object Model and relation values are user generated input. Credits go to Helmut Hummel and Markus Opahle who discovered and reported the issue.

Access tracking mechanism - Failing to validate user provided input, the access tracking mechanism allows redirects to arbitrary URLs. To fix this vulnerability, we had to break existing behaviour of TYPO3 sites that use the access tracking mechanism (jumpurl feature) to transform links to external sites. The link generation has been changed to include a hash that is checked before redirecting to an external URL. This means that old links that have been distributed (e.g. by a newsletter) will not work any more.

http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-001/ 2013-03-06 2013-03-06
chromium -- multiple vulnerabilities chromium 25.0.1364.152

Google Chrome Releases reports:

[176882] High CVE-2013-0902: Use-after-free in frame loader. Credit to Chamal de Silva.

[176252] High CVE-2013-0903: Use-after-free in browser navigation handling. Credit to "chromium.khalil".

[172926] [172331] High CVE-2013-0904: Memory corruption in Web Audio. Credit to Atte Kettunen of OUSPG.

[168982] High CVE-2013-0905: Use-after-free with SVG animations. Credit to Atte Kettunen of OUSPG.

[174895] High CVE-2013-0906: Memory corruption in Indexed DB. Credit to Google Chrome Security Team (Juri Aedla).

[174150] Medium CVE-2013-0907: Race condition in media thread handling. Credit to Andrew Scherkus of the Chromium development community.

[174059] Medium CVE-2013-0908: Incorrect handling of bindings for extension processes.

[173906] Low CVE-2013-0909: Referer leakage with XSS Auditor. Credit to Egor Homakov.

[172573] Medium CVE-2013-0910: Mediate renderer -> browser plug-in loads more strictly. Credit to Google Chrome Security Team (Chris Evans).

[172264] High CVE-2013-0911: Possible path traversal in database handling. Credit to Google Chrome Security Team (Juri Aedla).

CVE-2013-0902 CVE-2013-0903 CVE-2013-0904 CVE-2013-0905 CVE-2013-0906 CVE-2013-0907 CVE-2013-0908 CVE-2013-0909 CVE-2013-0910 CVE-2013-0911 http://googlechromereleases.blogspot.nl/search/Stable%20Updates 2013-03-04 2013-03-06
stunnel -- Remote Code Execution stunnel 4.214.55

Michal Trojnara reports:

64-bit versions of stunnel with the following conditions: * NTLM authentication enabled * CONNECT protocol negotiation enabled * Configured in SSL client mode * An attacker that can either control the proxy server specified in the "connect" option or execute MITM attacks on the TCP session between stunnel and the proxy

Can be exploited for remote code execution. The code is executed within the configured chroot directory, with privileges of the configured user and group.

CVE-2013-1762 https://www.stunnel.org/CVE-2013-1762.html 2013-03-03 2013-03-03
apache22 -- several vulnerabilities apache22 2.2.02.2.24 apache22-event-mpm 2.2.02.2.24 apache22-itk-mpm 2.2.02.2.24 apache22-peruser-mpm 2.2.02.2.24 apache22-worker-mpm 2.2.02.2.24

Apache HTTP SERVER PROJECT reports:

low: XSS due to unescaped hostnames CVE-2012-3499

Various XSS flaws due to unescaped hostnames and URIs HTML output in mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.

moderate: XSS in mod_proxy_balancer CVE-2012-4558

A XSS flaw affected the mod_proxy_balancer manager interface.

CVE-2012-3499 CVE-2012-4558 2012-10-07 2013-03-02
sudo -- Authentication bypass when clock is reset sudo 1.8.6.p7

Todd Miller reports:

The flaw may allow someone with physical access to a machine that is not password-protected to run sudo commands without knowing the logged in user's password. On systems where sudo is the principal way of running commands as root, such as on Ubuntu and Mac OS X, there is a greater chance that the logged in user has run sudo before and thus that an attack would succeed.

CVE-2013-1775 http://www.sudo.ws/sudo/alerts/epoch_ticket.html 2013-02-27 2013-03-01
sudo -- Potential bypass of tty_tickets constraints sudo 1.8.6.p7

Todd Miller reports:

A (potentially malicious) program run by a user with sudo access may be able to bypass the "tty_ticket" constraints. In order for this to succeed there must exist on the machine a terminal device that the user has previously authenticated themselves on via sudo within the last time stamp timeout (5 minutes by default).

CVE-2013-1776 http://www.sudo.ws/sudo/alerts/tty_tickets.html 2013-02-27 2013-03-01
rubygem-dragonfly -- arbitrary code execution rubygem18-dragonfly rubygem19-dragonfly rubygem20-dragonfly 0.9.14

Mark Evans reports:

Unfortnately there is a security vulnerability in Dragonfly when used with Rails which would potentially allow an attacker to run arbitrary code on a host machine using carefully crafted requests.

CVE-2013-1756 2013-02-19 2013-02-28
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.273

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-0504 CVE-2013-0643 CVE-2013-0648 2013-02-26 2013-02-27
otrs -- XSS vulnerability could lead to remote code execution otrs 3.1.*3.1.11

The OTRS Project reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.14, 3.0.x up to and including 3.0.16 and 3.1.x up to and including 3.1.10.

CVE-2012-4751 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03 2012-10-16 2013-02-25
otrs -- XSS vulnerability in Firefox and Opera could lead to remote code execution otrs 3.1.*3.1.10

The OTRS Project reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email in Firefox and Opera. In this case this is achieved with an invalid HTML structure with nested tags.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.13, 3.0.x up to and including 3.0.15 and 3.1.x up to and including 3.1.9 in combination with Firefox and Opera.

CVE-2012-4600 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-02 2012-08-30 2013-02-25
otrs -- XSS vulnerability in Internet Explorer could lead to remote code execution otrs 3.1.*3.1.9

The OTRS Project reports:

This advisory covers vulnerabilities discovered in the OTRS core system. Due to the XSS vulnerability in Internet Explorer an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your Internet Explorer while displaying the email.

Affected by this vulnerability are all releases of OTRS 2.4.x up to and including 2.4.12, 3.0.x up to and including 3.0.14 and 3.1.x up to and including 3.1.8 in combination with Internet Explorer.

CVE-2012-2582 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-01 2012-08-22 2013-02-25
ruby -- DoS vulnerability in REXML ruby 1.9,11.9.3.392,1

Ruby developers report:

Unrestricted entity expansion can lead to a DoS vulnerability in REXML. (The CVE identifier will be assigned later.) We strongly recommend to upgrade ruby.

When reading text nodes from an XML document, the REXML parser can be coerced in to allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service.

http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/ 2013-02-22 2013-02-24
rubygem-ruby_parser -- insecure tmp file usage rubygem18-ruby_parser rubygem19-ruby_parser rubygem20-ruby_parser 3.1.1

Michael Scherer reports:

This is a relatively minor tmp file usage issue.

CVE-2013-0162 2013-02-24 2013-02-24
django -- multiple vulnerabilities py26-django py27-django 1.31.3.6 1.41.4.4

The Django Project reports:

These security releases fix four issues: one potential phishing vector, one denial-of-service vector, an information leakage issue, and a range of XML vulnerabilities.

  1. Host header poisoning

    an attacker could cause Django to generate and display URLs that link to arbitrary domains. This could be used as part of a phishing attack. These releases fix this problem by introducing a new setting, ALLOWED_HOSTS, which specifies a whitelist of domains your site is known to respond to.

    Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to allow all hosts. This means that to actually fix the security vulnerability you should define this setting yourself immediately after upgrading.

  2. Formset denial-of-service

    an attacker can abuse Django's tracking of the number of forms in a formset to cause a denial-of-service attack. This has been fixed by adding a default maximum number of forms of 1,000. You can still manually specify a bigger max_num, if you wish, but 1,000 should be enough for anyone.

  3. XML attacks

    Django's serialization framework was vulnerable to attacks via XML entity expansion and external references; this is now fixed. However, if you're parsing arbitrary XML in other parts of your application, we recommend you look into the defusedxml Python packages which remedy this anywhere you parse XML, not just via Django's serialization framework.

  4. Data leakage via admin history log

    Django's admin interface could expose supposedly-hidden information via its history log. This has been fixed.

CVE-2013-1664 CVE-2013-1665 CVE-2013-0305 CVE-2013-0306 58022 58061 2013-02-21 2013-02-24
chromium -- multiple vulnerabilities chromium 25.0.1364.97

Google Chrome Releases reports:

[172243] High CVE-2013-0879: Memory corruption with web audio node. Credit to Atte Kettunen of OUSPG.

[171951] High CVE-2013-0880: Use-after-free in database handling. Credit to Chamal de Silva.

[167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG.

[165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan.

[142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG.

[172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans).

[172369] Medium CVE-2013-0885: Too many API permissions granted to web store.

[171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server.

[170666] Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).

[170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads.

[169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Jüri Aedla).

[169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).

[168570] Medium CVE-2013-0893: Race condition in media handling. Credit to Andrew Scherkus of the Chromium development community.

[168473] High CVE-2013-0894: Buffer overflow in vorbis decoding. Credit to Google Chrome Security Team (Inferno).

[Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Jüri Aedla).

[166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar).

[165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.

[164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community.

[160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Jüri Aedla).

[152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno).

CVE-2013-0879 CVE-2013-0880 CVE-2013-0881 CVE-2013-0882 CVE-2013-0883 CVE-2013-0884 CVE-2013-0885 CVE-2013-0887 CVE-2013-0888 CVE-2013-0889 CVE-2013-0890 CVE-2013-0891 CVE-2013-0892 CVE-2013-0893 CVE-2013-0894 CVE-2013-0895 CVE-2013-0896 CVE-2013-0897 CVE-2013-0898 CVE-2013-0899 CVE-2013-0900 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2013-02-21 2013-02-22
krb5 -- null pointer dereference in the KDC PKINIT code [CVE-2013-1415] krb5 1.11

No advisory has been released yet.

Fix a null pointer dereference in the KDC PKINIT code [CVE-2013-1415].

CVE-2013-1415 http://web.mit.edu/kerberos/www/krb5-1.11/ 2013-02-21 2013-02-22
FreeBSD -- glob(3) related resource exhaustion FreeBSD 7.47.4_12 8.38.3_6 9.09.0_6 9.19.1_1

Problem description:

GLOB_LIMIT is supposed to limit the number of paths to prevent against memory or CPU attacks. The implementation however is insufficient.

SA-13:02.libc CVE-2010-2632 2013-02-19 2013-02-21
FreeBSD -- BIND remote DoS with deliberately crafted DNS64 query FreeBSD 9.09.0_6 9.19.1_1

Problem description:

Due to a software defect a crafted query can cause named(8) to crash with an assertion failure.

SA-13:01.bind CVE-2012-5688 2013-02-19 2013-02-21
drupal7 -- Denial of service drupal7 7.19

Drupal Security Team reports:

Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high CPU load. Either of these effects may lead to the site becoming unavailable or unresponsive.

CVE-2013-0316 https://drupal.org/SA-CORE-2013-002 2013-02-20 2013-02-21
nss-pam-ldapd -- file descriptor buffer overflow nss-pam-ldapd 0.8.12

Garth Mollett reports:

A file descriptor overflow issue in the use of FD_SET() in nss-pam-ldapd can lead to a stack-based buffer overflow. An attacker could, under some circumstances, use this flaw to cause a process that has the NSS or PAM module loaded to crash or potentially execute arbitrary code.

CVE-2013-0288 2013-02-18 2013-02-20
bugzilla -- multiple vulnerabilities bugzilla de-bugzilla ru-bugzilla ja-bugzilla 3.6.03.6.13 4.0.04.0.10 4.2.04.2.5

A Bugzilla Security Advisory reports:

Cross-Site Scripting

When viewing a single bug report, which is the default, the bug ID is validated and rejected if it is invalid. But when viewing several bug reports at once, which is specified by the format=multiple parameter, invalid bug IDs can go through and are sanitized in the HTML page itself. But when an invalid page format is passed to the CGI script, the wrong HTML page is called and data are not correctly sanitized, which can lead to XSS.

Information Leak

When running a query in debug mode, the generated SQL query used to collect the data is displayed. The way this SQL query is built permits the user to determine if some confidential field value (such as a product name) exists. This problem only affects Bugzilla 4.0.9 and older. Newer releases are not affected by this issue.

CVE-2013-0785 https://bugzilla.mozilla.org/show_bug.cgi?id=842038 CVE-2013-0786 https://bugzilla.mozilla.org/show_bug.cgi?id=824399 2013-02-19 2013-02-20 2013-03-31
mozilla -- multiple vulnerabilities firefox 18.0,119.0,1 17.0.3,1 linux-firefox 17.0.3,1 linux-seamonkey 2.16 linux-thunderbird 17.0.3 seamonkey 2.16 thunderbird 11.017.0.3 10.0.12 libxul 1.9.2.*10.0.12

The Mozilla Project reports:

MFSA 2013-21 Miscellaneous memory safety hazards (rv:19.0 / rv:17.0.3)

MFSA 2013-22 Out-of-bounds read in image rendering

MFSA 2013-23 Wrapped WebIDL objects can be wrapped again

MFSA 2013-24 Web content bypass of COW and SOW security wrappers

MFSA 2013-25 Privacy leak in JavaScript Workers

MFSA 2013-26 Use-after-free in nsImageLoadingContent

MFSA 2013-27 Phishing on HTTPS connection through malicious proxy

MFSA 2013-28 Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer

CVE-2013-0765 CVE-2013-0772 CVE-2013-0773 CVE-2013-0774 CVE-2013-0775 CVE-2013-0776 CVE-2013-0783 CVE-2013-0784 http://www.mozilla.org/security/announce/2013/mfsa2013-20.html http://www.mozilla.org/security/announce/2013/mfsa2013-21.html http://www.mozilla.org/security/announce/2013/mfsa2013-22.html http://www.mozilla.org/security/announce/2013/mfsa2013-23.html http://www.mozilla.org/security/announce/2013/mfsa2013-24.html http://www.mozilla.org/security/announce/2013/mfsa2013-25.html http://www.mozilla.org/security/announce/2013/mfsa2013-26.html http://www.mozilla.org/security/announce/2013/mfsa2013-27.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-02-19 2013-02-19 2013-02-20
Ruby Rack Gem -- Multiple Issues rubygem18-rack 1.4.5 rubygem19-rack 1.4.5

Rack developers report:

Today we are proud to announce the release of Rack 1.4.5.

Fix CVE-2013-0263, timing attack against Rack::Session::Cookie

Fix CVE-2013-0262, symlink path traversal in Rack::File

CVE-2013-0262 CVE-2013-0263 2013-02-08 2013-02-17
Ruby Activemodel Gem -- Circumvention of attr_protected rubygem18-activemodel 3.2.12 rubygem19-activemodel 3.2.12

Aaron Patterson reports:

The attr_protected method allows developers to specify a blacklist of model attributes which users should not be allowed to assign to. By using a specially crafted request, attackers could circumvent this protection and alter values that were meant to be protected.

All users running an affected release should either upgrade or use one of the work arounds immediately. Users should also consider switching from attr_protected to the whitelist method attr_accessible which is not vulnerable to this attack.

CVE-2013-0276 2013-02-11 2013-02-17
jenkins -- multiple vulnerabilities jenkins 1.501

Jenkins Security Advisory reports:

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

  1. One of the vulnerabilities allows cross-site request forgery (CSRF) attacks on Jenkins master, which causes an user to make unwanted actions on Jenkins. Another vulnerability enables cross-site scripting (XSS) attacks, which has the similar consequence. Another vulnerability allowed an attacker to bypass the CSRF protection mechanism in place, thereby mounting more CSRF attackes. These attacks allow an attacker without direct access to Jenkins to mount an attack.
  2. In the fourth vulnerability, a malicious user of Jenkins can trick Jenkins into building jobs that he does not have direct access to.
  3. And lastly, a vulnerability allows a malicious user of Jenkins to mount a denial of service attack by feeding a carefully crafted payload to Jenkins.
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16 2013-02-16 2013-02-17
poweradmin -- multiple XSS vulnerabilities poweradmin 2.1.6

Multiple cross-site scripting (XSS) vulnerabilities

Multiple scripts are vulnerable to XSS attacks.

55619 http://packetstormsecurity.com/files/116698/Poweradmin-Cross-Site-Scripting.html 2012-01-12 2013-02-16
Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON ruby 1.9,11.9.3.385,1 rubygem18-json 1.7.7 rubygem19-json 1.7.7 rubygem18-json_pure 1.7.7 rubygem19-json_pure 1.7.7

Aaron Patterson reports:

When parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system. Since Ruby symbols are not garbage collected, this can result in a denial of service attack.

The same technique can be used to create objects in a target system that act like internal objects. These "act alike" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.

CVE-2013-0269 2013-02-11 2013-02-16
Ruby -- XSS exploit of RDoc documentation generated by rdoc ruby 1.9,11.9.3.385,1 rubygem18-rdoc 3.12.1 rubygem19-rdoc 3.12.1

Ruby developers report:

RDoc documentation generated by rdoc bundled with ruby are vulnerable to an XSS exploit. All ruby users are recommended to update ruby to newer version which includes security-fixed RDoc. If you are publishing RDoc documentation generated by rdoc, you are recommended to apply a patch for the documentaion or re-generate it with security-fixed RDoc.

CVE-2013-0256 2013-02-06 2013-02-16
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.262

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2013-0633 CVE-2013-0634 https://www.adobe.com/support/security/bulletins/apsb13-04.html 2013-02-07 2013-02-08
OpenSSL -- TLS 1.1, 1.2 denial of service openssl 1.0.1_6

OpenSSL security team reports:

A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a DoS attack.

A flaw in the OpenSSL handling of OCSP response verification can be exploited in a denial of service attack.

CVE-2012-2686 CVE-2013-0166 CVE-2013-0169 http://www.openssl.org/news/secadv_20120510.txt 2013-02-05 2013-02-06
mysql/mariadb/percona server -- multiple vulnerabilities mysql-server 5.15.1.67 5.55.5.29 mariadb-server 5.35.3.12 5.55.5.29 percona-server 5.55.5.29.29.4

ORACLE reports:

Multiple SQL injection vulnerabilities in the replication code

Stack-based buffer overflow

Heap-based buffer overflow

CVE-2012-4414 CVE-2012-5611 CVE-2012-5612 CVE-2012-5615 CVE-2012-5627 https://mariadb.atlassian.net/browse/MDEV-4029 https://mariadb.atlassian.net/browse/MDEV-MDEV-729 https://mariadb.atlassian.net/browse/MDEV-MDEV-729 http://www.mysqlperformanceblog.com/2013/01/23/announcing-percona-server-5-5-29-29-4/ 2012-12-01 2013-02-01
opera -- execution of arbitrary code opera opera-devel linux-opera linux-opera-devel 12.13

Opera reports:

Particular DOM event manipulations can cause Opera to crash. In some cases, this crash might occur in a way that allows execution of arbitrary code. To inject code, additional techniques would have to be employed.

http://www.opera.com/support/kb/view/1042/ http://www.opera.com/support/kb/view/1043/ 2013-01-30 2013-02-01
upnp -- multiple vulnerabilities upnp 1.6.18

Project changelog reports:

This patch addresses three possible buffer overflows in function unique_service_name().The three issues have the folowing CVE numbers:

  • CVE-2012-5958 Issue #2: Stack buffer overflow of Tempbuf
  • CVE-2012-5959 Issue #4: Stack buffer overflow of Event->UDN
  • CVE-2012-5960 Issue #8: Stack buffer overflow of Event->UDN

Notice that the following issues have already been dealt by previous work:

  • CVE-2012-5961 Issue #1: Stack buffer overflow of Evt->UDN
  • CVE-2012-5962 Issue #3: Stack buffer overflow of Evt->DeviceType
  • CVE-2012-5963 Issue #5: Stack buffer overflow of Event->UDN
  • CVE-2012-5964 Issue #6: Stack buffer overflow of Event->DeviceType
  • CVE-2012-5965 Issue #7: Stack buffer overflow of Event->DeviceType
CVE-2012-5958 CVE-2012-5959 CVE-2012-5960 CVE-2012-5961 CVE-2012-5962 CVE-2012-5963 CVE-2012-5964 CVE-2012-5965 2012-11-21 2013-01-30
wordpress -- multiple vulnerabilities wordpress 3.5.1,1 zh-wordpress-zh_CN 3.5.1 zh-wordpress-zh_TW 3.5.1 de-wordpress 3.5.1 ja-wordpress 3.5.1 ru-wordpress 3.5.1

Wordpress reports:

WordPress 3.5.1 also addresses the following security issues:

  • A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We'd like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work.
  • Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team.
  • A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue.
CVE-2013-0235 CVE-2013-0236 CVE-2013-0237 2013-01-24 2013-01-29 2014-04-30
django-cms -- XSS Vulnerability py-django-cms 2.3.5

Cross-site scripting (XSS) vulnerability

Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the page_attribute template tag. Only users with admin access and the permission to edit at least one django CMS page object could exploit this vulnerability. Websites that do not use the page_attribute template tag are not affected.

https://www.django-cms.org/en/blog/2012/12/04/2-3-5-security-release/ 2012-12-04 2013-01-25
chromium -- multiple vulnerabilities chromium 24.0.1312.56

Google Chrome Releases reports:

[151008] High CVE-2013-0839: Use-after-free in canvas font handling. Credit to Atte Kettunen of OUSPG.

[170532] Medium CVE-2013-0840: Missing URL validation when opening new windows.

[169770] High CVE-2013-0841: Unchecked array index in content blocking. Credit to Google Chrome Security Team (Chris Evans).

[166867] Medium CVE-2013-0842: Problems with NULL characters embedded in paths. Credit to Google Chrome Security Team (Jüri Aedla).

CVE-2013-0839 CVE-2013-0840 CVE-2013-0841 CVE-2013-0842 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2013-01-22 2013-01-23
drupal -- multiple vulnerabilities drupal6 6.28 drupal7 7.19

Drupal Security Team reports:

Cross-site scripting (Various core and contributed modules)

Access bypass (Book module printer friendly version)

Access bypass (Image module)

https://drupal.org/SA-CORE-2013-001 2013-01-16 2013-01-20
ettercap -- buffer overflow in target list parsing ettercap 0.7.4.1 0.7.50.7.5.2

Host target list parsing routine in ettercap 0.7.4-series prior to 0.7.4.1 and 0.7.5-series is prone to the stack-based buffer overflow that may lead to the code execution with the privileges of the ettercap process.

In order to trigger this vulnerability, user or service that use ettercap should be tricked to pass the crafted list of targets via the "-j" option.

CVE-2013-0722 http://www.exploit-db.com/exploits/23945/ https://secunia.com/advisories/51731/ 2013-01-07 2013-01-16
java 7.x -- security manager bypass openjdk7 0 linux-sun-jdk 7.07.11 linux-sun-jre 7.07.11

US CERT reports:

Java 7 Update 10 and earlier versions of Java 7 contain a vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

The Java JRE plug-in provides its own Security Manager. Typically, a web applet runs with a security manager provided by the browser or Java Web Start plugin. Oracle's document states, "If there is a security manager already installed, this method first calls the security manager's checkPermission method with a RuntimePermission("setSecurityManager") permission to ensure it's safe to replace the existing security manager. This may result in throwing a SecurityException".

By leveraging the vulnerability in the Java Management Extensions (JMX) MBean components, unprivileged Java code can access restricted classes. By using that vulnerability in conjunction with a second vulnerability involving the Reflection API and the invokeWithArguments method of the MethodHandle class, an untrusted Java applet can escalate its privileges by calling the the setSecurityManager() function to allow full privileges, without requiring code signing. Oracle Java 7 update 10 and earlier Java 7 versions are affected. The invokeWithArguments method was introduced with Java 7, so therefore Java 6 is not affected.

This vulnerability is being attacked in the wild, and is reported to be incorporated into exploit kits. Exploit code for this vulnerability is also publicly available.

Esteban Guillardoy from Immunity Inc. additionally clarifies on the recursive reflection exploitation technique:

The real issue is in the native sun.reflect.Reflection.getCallerClass method.

We can see the following information in the Reflection source code:

Returns the class of the method realFramesToSkip frames up the stack (zero-based), ignoring frames associated with java.lang.reflect.Method.invoke() and its implementation.

So what is happening here is that they forgot to skip the frames related to the new Reflection API and only the old reflection API is taken into account.

This exploit does not only affect Java applets, but every piece of software that relies on the Java Security Manager for sandboxing executable code is affected: malicious code can totally disable Security Manager.

For users who are running native Web browsers with enabled Java plugin, the workaround is to remove the java/icedtea-web port and restart all browser instances.

For users who are running Linux Web browser flavors, the workaround is either to disable the Java plugin in browser or to upgrade linux-sun-* packages to the non-vulnerable version.

It is not recommended to run untrusted applets using appletviewer, since this may lead to the execution of the malicious code on vulnerable versions on JDK/JRE.

CVE-2013-0433 625617 http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf 2013-01-10 2013-01-14
nagios -- buffer overflow in history.cgi nagios 3.4.3_1

full disclosure reports:

history.cgi is vulnerable to a buffer overflow due to the use of sprintf with user supplied data that has not been restricted in size.

CVE-2012-6096 http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0108.html http://nagios.svn.sourceforge.net/viewvc/nagios?view=revision&revision=2547 2012-12-21 2013-01-10
chromium -- multiple vulnerabilities chromium 24.0.1312.52

Google Chrome Releases reports:

[162494] High CVE-2012-5145: Use-after-free in SVG layout. Credit to Atte Kettunen of OUSPG.

[165622] High CVE-2012-5146: Same origin policy bypass with malformed URL. Credit to Erling A Ellingsen and Subodh Iyengar, both of Facebook.

[165864] High CVE-2012-5147: Use-after-free in DOM handling. Credit to José A. Vázquez.

[167122] Medium CVE-2012-5148: Missing filename sanitization in hyphenation support. Credit to Google Chrome Security Team (Justin Schuh).

[166795] High CVE-2012-5149: Integer overflow in audio IPC handling. Credit to Google Chrome Security Team (Chris Evans).

[165601] High CVE-2012-5150: Use-after-free when seeking video. Credit to Google Chrome Security Team (Inferno).

[165538] High CVE-2012-5151: Integer overflow in PDF JavaScript. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[165430] Medium CVE-2012-5152: Out-of-bounds read when seeking video. Credit to Google Chrome Security Team (Inferno).

[164565] High CVE-2012-5153: Out-of-bounds stack access in v8. Credit to Andreas Rossberg of the Chromium development community.

[Mac only] [163208] Medium CVE-2012-5155: Missing Mac sandbox for worker processes. Credit to Google Chrome Security Team (Julien Tinnes).

[162778] High CVE-2012-5156: Use-after-free in PDF fields. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[162776] [162156] Medium CVE-2012-5157: Out-of-bounds reads in PDF image handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[162153] High CVE-2013-0828: Bad cast in PDF root handling. Credit to Mateusz Jurczyk, with contribution from Gynvael Coldwind, both of Google Security Team.

[162114] High CVE-2013-0829: Corruption of database metadata leading to incorrect file access. Credit to Google Chrome Security Team (Jüri Aedla).

[161836] Low CVE-2013-0831: Possible path traversal from extension process. Credit to Google Chrome Security Team (Tom Sepez).

[160380] Medium CVE-2013-0832: Use-after-free with printing. Credit to Google Chrome Security Team (Cris Neckar).

[154485] Medium CVE-2013-0833: Out-of-bounds read with printing. Credit to Google Chrome Security Team (Cris Neckar).

[154283] Medium CVE-2013-0834: Out-of-bounds read with glyph handling. Credit to Google Chrome Security Team (Cris Neckar).

[152921] Low CVE-2013-0835: Browser crash with geolocation. Credit to Arthur Gerkis.

[150545] High CVE-2013-0836: Crash in v8 garbage collection. Credit to Google Chrome Security Team (Cris Neckar).

[145363] Medium CVE-2013-0837: Crash in extension tab handling. Credit to Tom Nielsen.

[Linux only] [143859] Low CVE-2013-0838: Tighten permissions on shared memory segments. Credit to Google Chrome Security Team (Chris Palmer).

CVE-2012-5145 CVE-2012-5146 CVE-2012-5147 CVE-2012-5148 CVE-2012-5149 CVE-2012-5150 CVE-2012-5151 CVE-2012-5152 CVE-2012-5153 CVE-2012-5155 CVE-2012-5156 CVE-2012-5157 CVE-2013-0828 CVE-2013-0829 CVE-2013-0831 CVE-2013-0832 CVE-2013-0833 CVE-2013-0834 CVE-2013-0835 CVE-2013-0836 CVE-2013-0837 CVE-2013-0838 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2013-01-10 2013-01-11
mozilla -- multiple vulnerabilities firefox 11.0,117.0.2,1 10.0.12,1 linux-firefox 17.0.2,1 linux-seamonkey 2.15 linux-thunderbird 17.0.2 seamonkey 2.15 thunderbird 11.017.0.2 10.0.12 libxul 1.9.2.*10.0.12 ca_root_nss 3.14.1

The Mozilla Project reports:

MFSA 2013-01 Miscellaneous memory safety hazards (rv:18.0/ rv:10.0.12 / rv:17.0.2)

MFSA 2013-02 Use-after-free and buffer overflow issues found using Address Sanitizer

MFSA 2013-03 Buffer Overflow in Canvas

MFSA 2013-04 URL spoofing in addressbar during page loads

MFSA 2013-05 Use-after-free when displaying table with many columns and column groups

MFSA 2013-06 Touch events are shared across iframes

MFSA 2013-07 Crash due to handling of SSL on threads

MFSA 2013-08 AutoWrapperChanger fails to keep objects alive during garbage collection

MFSA 2013-09 Compartment mismatch with quickstubs returned values

MFSA 2013-10 Event manipulation in plugin handler to bypass same-origin policy

MFSA 2013-11 Address space layout leaked in XBL objects

MFSA 2013-12 Buffer overflow in Javascript string concatenation

MFSA 2013-13 Memory corruption in XBL with XML bindings containing SVG

MFSA 2013-14 Chrome Object Wrapper (COW) bypass through changing prototype

MFSA 2013-15 Privilege escalation through plugin objects

MFSA 2013-16 Use-after-free in serializeToStream

MFSA 2013-17 Use-after-free in ListenerManager

MFSA 2013-18 Use-after-free in Vibrate

MFSA 2013-19 Use-after-free in Javascript Proxy objects

MFSA 2013-20 Mis-issued TURKTRUST certificates

CVE-2012-5829 CVE-2013-0743 CVE-2013-0744 CVE-2013-0745 CVE-2013-0746 CVE-2013-0747 CVE-2013-0748 CVE-2013-0749 CVE-2013-0750 CVE-2013-0751 CVE-2013-0752 CVE-2013-0753 CVE-2013-0754 CVE-2013-0755 CVE-2013-0756 CVE-2013-0757 CVE-2013-0758 CVE-2013-0759 CVE-2013-0760 CVE-2013-0761 CVE-2013-0762 CVE-2013-0763 CVE-2013-0764 CVE-2013-0766 CVE-2013-0767 CVE-2013-0768 CVE-2013-0769 CVE-2013-0770 CVE-2013-0771 http://www.mozilla.org/security/announce/2013/mfsa2013-01.html http://www.mozilla.org/security/announce/2013/mfsa2013-02.html http://www.mozilla.org/security/announce/2013/mfsa2013-03.html http://www.mozilla.org/security/announce/2013/mfsa2013-04.html http://www.mozilla.org/security/announce/2013/mfsa2013-05.html http://www.mozilla.org/security/announce/2013/mfsa2013-06.html http://www.mozilla.org/security/announce/2013/mfsa2013-07.html http://www.mozilla.org/security/announce/2013/mfsa2013-08.html http://www.mozilla.org/security/announce/2013/mfsa2013-09.html http://www.mozilla.org/security/announce/2013/mfsa2013-10.html http://www.mozilla.org/security/announce/2013/mfsa2013-11.html http://www.mozilla.org/security/announce/2013/mfsa2013-12.html http://www.mozilla.org/security/announce/2013/mfsa2013-13.html http://www.mozilla.org/security/announce/2013/mfsa2013-14.html http://www.mozilla.org/security/announce/2013/mfsa2013-15.html http://www.mozilla.org/security/announce/2013/mfsa2013-16.html http://www.mozilla.org/security/announce/2013/mfsa2013-17.html http://www.mozilla.org/security/announce/2013/mfsa2013-18.html http://www.mozilla.org/security/announce/2013/mfsa2013-19.html http://www.mozilla.org/security/announce/2013/mfsa2013-20.html http://www.mozilla.org/security/known-vulnerabilities/ 2013-01-08 2013-01-09
rubygem-rails -- multiple vulnerabilities rubygem-rails 3.2.11 rubygem-actionpack 3.2.11 rubygem-activerecord 3.2.11 rubygem-activesupport 3.2.11

Ruby on Rails team reports:

Two high-risk vulnerabilities have been discovered:

(CVE-2013-0155) There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing.

Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with "IS NULL" or empty "WHERE" clauses. This issue does not let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL or eliminate a WHERE clause when most users would not expect it.

(CVE-2013-0156) There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.

The parameter parsing code of Ruby on Rails allows applications to automatically cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including creating Symbols and parsing YAML. These unsuitable conversions can be used by an attacker to compromise a Rails application.

CVE-2013-0155 CVE-2013-0156 http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/ https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/t1WFuuQyavI https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/61bkgvnSGTQ 2013-01-08 2013-01-08
rubygem-rails -- SQL injection vulnerability rubygem-rails 3.2.10

Ruby on Rails team reports:

There is a SQL injection vulnerability in Active Record in ALL versions. Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL.

CVE-2012-5664 https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM 2013-01-02 2013-01-07
jenkins -- HTTP access to the server to retrieve the master cryptographic key jenkins 1.498

Jenkins Security Advisory reports:

This advisory announces a security vulnerability that was found in Jenkins core.

An attacker can then use this master cryptographic key to mount remote code execution attack against the Jenkins master, or impersonate arbitrary users in making REST API calls.

There are several factors that mitigate some of these problems that may apply to specific installations.

  • The particular attack vector is only applicable on Jenkins instances that have slaves attached to them, and allow anonymous read access.
  • Jenkins allows users to re-generate the API tokens. Those re-generated API tokens cannot be impersonated by the attacker.
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04 2013-01-04 2013-01-08
django -- multiple vulnerabilities django 1.4.3 django13 1.3.5

The Django Project reports:

  1. Host header poisoning

    Several earlier Django security releases focused on the issue of poisoning the HTTP Host header, causing Django to generate URLs pointing to arbitrary, potentially-malicious domains.

    In response to further input received and reports of continuing issues following the previous release, we're taking additional steps to tighten Host header validation. Rather than attempt to accommodate all features HTTP supports here, Django's Host header validation attempts to support a smaller, but far more common, subset:

    • Hostnames must consist of characters [A-Za-z0-9] plus hyphen ('-') or dot ('.').
    • IP addresses -- both IPv4 and IPv6 -- are permitted.
    • Port, if specified, is numeric.

    Any deviation from this will now be rejected, raising the exception django.core.exceptions.SuspiciousOperation.

  2. Redirect poisoning

    Also following up on a previous issue: in July of this year, we made changes to Django's HTTP redirect classes, performing additional validation of the scheme of the URL to redirect to (since, both within Django's own supplied applications and many third-party applications, accepting a user-supplied redirect target is a common pattern).

    Since then, two independent audits of the code turned up further potential problems. So, similar to the Host-header issue, we are taking steps to provide tighter validation in response to reported problems (primarily with third-party applications, but to a certain extent also within Django itself). This comes in two parts:

    1. A new utility function, django.utils.http.is_safe_url, is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. This function is intended for use whenever user-supplied redirect targets are accepted, to ensure that such redirects cannot lead to arbitrary third-party sites.
    2. All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL.
https://www.djangoproject.com/weblog/2012/dec/10/security/ 2012-12-10 2013-01-06
freetype -- Multiple vulnerabilities freetype2 2.4.11

The FreeType Project reports:

Some vulnerabilities in the BDF implementation have been fixed. Users of this font format should upgrade.

http://sourceforge.net/projects/freetype/files/freetype2/2.4.11/README/view 2012-12-20 2013-01-05
moinmoin -- Multiple vulnerabilities moinmoin 1.9.6

MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6:

  • remote code execution vulnerability in twikidraw/anywikidraw action,
  • path traversal vulnerability in AttachFile action,
  • XSS issue, escape page name in rss link.

CVE entries at MITRE furher clarify:

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

CVE-2012-6081 CVE-2012-6080 CVE-2012-6082 http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES http://www.debian.org/security/2012/dsa-2593 2012-12-29 2013-01-05 2013-01-06
asterisk -- multiple vulnerabilities asterisk11 11.*11.1.2 asterisk10 10.*10.11.1 asterisk18 1.8.*1.8.19.1

Asterisk project reports:

Crashes due to large stack allocations when using TCP

Denial of Service Through Exploitation of Device State Caching

CVE-2012-5976 CVE-2012-5977 http://downloads.digium.com/pub/security/AST-2012-014.html http://downloads.digium.com/pub/security/AST-2012-015.html https://www.asterisk.org/security 2013-01-02 2013-01-03
ircd-ratbox and charybdis -- remote DoS vulnerability ircd-ratbox 2.*3.0.8 charybdis 3.4.2

atheme.org reports:

All versions of Charybdis are vulnerable to a remotely-triggered crash bug caused by code originating from ircd-ratbox 2.0. (Incidentally, this means all versions since ircd-ratbox 2.0 are also vulnerable.)

http://www.ratbox.org/ASA-2012-12-31.txt 2012-12-31 2013-01-02
puppet -- multiple vulnerabilities puppet 2.6.*2.6.17

puppet -- multiple vulnerabilities

Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.

Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.

Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.

CVE-2012-3864 CVE-2012-3865 CVE-2012-3867 http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.6.17 http://puppetlabs.com/security/cve/cve-2012-3864/ http://puppetlabs.com/security/cve/cve-2012-3865/ http://puppetlabs.com/security/cve/cve-2012-3867/ 2012-07-10 2012-12-30
otrs -- XSS vulnerability otrs 3.1.11

OTRS Security Advisory reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email. In this case this is achieved by using javascript source attributes with whitespaces.

CVE-2012-4751 http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/ http://www.kb.cert.org/vuls/id/603276 2012-10-16 2012-12-30
otrs -- XSS vulnerability in Firefox and Opera otrs 3.1.10

OTRS Security Advisory reports:

This advisory covers vulnerabilities discovered in the OTRS core system. This is a variance of the XSS vulnerability, where an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your browser while displaying the email in Firefox and Opera. In this case this is achieved with an invalid HTML structure with nested tags.

CVE-2012-4600 http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-02/ 2012-08-30 2012-12-30
otrs -- XSS vulnerability in Internet Explorer otrs 3.1.9

OTRS Security Advisory reports:

This advisory covers vulnerabilities discovered in the OTRS core system. Due to the XSS vulnerability in Internet Explorer an attacker could send a specially prepared HTML email to OTRS which would cause JavaScript code to be executed in your Internet Explorer while displaying the email.

CVE-2012-2582 http://www.otrs.com/open-source/community-news/security-advisories/security-advisory-2012-01/ 2012-08-22 2012-12-30
squid -- denial of service squid 2.7.9_4 3.13.1.23 3.23.2.6 3.33.3.0.3

Squid developers report:

Due to missing input validation Squid cachemgr.cgi tool is vulnerable to a denial of service attack when processing specially crafted requests.

This problem allows any client able to reach the cachemgr.cgi to perform a denial of service attack on the service host.

The nature of the attack may cause secondary effects through resource consumption on the host server.

CVE-2012-5643 CVE-2013-0189 http://www.squid-cache.org/Advisories/SQUID-2012_1.txt 2012-12-17 2012-12-28 2013-05-02
opera -- execution of arbitrary code opera 12.12 opera-devel 12.12 linux-opera 12.12 linux-opera-devel 12.12

Opera reports:

When loading GIF images into memory, Opera should allocate the correct amount of memory to store that image. Specially crafted image files can cause Opera to allocate the wrong amount of memory. Subsequent data may then overwrite unrelated memory with attacker-controlled data. This can lead to a crash, which may also execute that data as code.

http://www.opera.com/support/kb/view/1038/ http://www.opera.com/support/kb/view/1039/ 2012-12-18 2012-12-18 2014-04-30
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.258

Adobe reports:

These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-5676 CVE-2012-5677 CVE-2012-5678 https://www.adobe.com/support/security/bulletins/apsb12-27.html 2012-12-11 2012-12-14
chromium -- multiple vulnerabilities chromium 23.0.1271.97

Google Chrome Releases reports:

[158204] High CVE-2012-5139: Use-after-free with visibility events. Credit to Chamal de Silva.

[159429] High CVE-2012-5140: Use-after-free in URL loader. Credit to Chamal de Silva.

[160456] Medium CVE-2012-5141: Limit Chromoting client plug-in instantiation. Credit to Google Chrome Security Team (Jüri Aedla).

[160803] Critical CVE-2012-5142: Crash in history navigation. Credit to Michal Zalewski of Google Security Team.

[160926] Medium CVE-2012-5143: Integer overflow in PPAPI image buffers. Credit to Google Chrome Security Team (Cris Neckar).

[161639] High CVE-2012-5144: Stack corruption in AAC decoding. Credit to pawlkt.

CVE-2012-5139 CVE-2012-5140 CVE-2012-5141 CVE-2012-5142 CVE-2012-5143 CVE-2012-5144 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-12-11 2012-12-12
tomcat -- bypass of CSRF prevention filter tomcat6 6.0.06.0.35 tomcat7 7.0.07.0.31

The Apache Software Foundation reports:

The CSRF prevention filter could be bypassed if a request was made to a protected resource without a session identifier present in the request.

CVE-2012-4431 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-12-04 2012-12-04
tomcat -- denial of service tomcat6 6.0.06.0.35 tomcat7 7.0.07.0.27

The Apache Software Foundation reports:

When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while reading the response an infinite loop is entered leading to a denial of service.

CVE-2012-4534 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-12-04 2012-12-04
tomcat -- bypass of security constraints tomcat6 6.0.06.0.35 tomcat7 7.0.07.0.29

The Apache Software Foundation reports:

When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending "/j_security_check" to the end of the URL if some other component (such as the Single-Sign-On valve) had called request.setUserPrincipal() before the call to FormAuthenticator#authenticate().

CVE-2012-3546 http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-12-04 2012-12-04 2012-12-29
dns/bind9* -- servers using DNS64 can be crashed by a crafted query bind99 9.9.2.1 bind99-base 9.9.2.1 bind98 9.8.4.1 bind98-base 9.8.4.1

ISC reports:

BIND 9 nameservers using the DNS64 IPv6 transition mechanism are vulnerable to a software defect that allows a crafted query to crash the server with a REQUIRE assertion failure. Remote exploitation of this defect can be achieved without extensive effort, resulting in a denial-of-service (DoS) vector against affected servers.

CVE-2012-5688 2012-11-27 2012-12-04
bogofilter -- heap corruption by invalid base64 input bogofilter 1.2.3 bogofilter-sqlite 1.2.3 bogofilter-tc 1.2.3

David Relson reports:

Fix a heap corruption in base64 decoder on invalid input. Analysis and patch by Julius Plenz, [FU Berlin, Germany].

CVE-2012-5468 http://bogofilter.sourceforge.net/security/bogofilter-SA-2012-01 2012-10-17 2012-12-03
chromium -- multiple vulnerabilities chromium 23.0.1271.95

Google Chrome Releases reports:

[161564] High CVE-2012-5138: Incorrect file path handling. Credit to Google Chrome Security Team (Jüri Aedla).

[162835] High CVE-2012-5137: Use-after-free in media source handling. Credit to Pinkie Pie.

CVE-2012-5137 CVE-2012-5138 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-11-29 2012-11-30
YUI JavaScript library -- JavaScript injection exploits in Flash components yahoo-ui 2.8.2

The YUI team reports:

Vulnerability in YUI 2.4.0 through YUI 2.9.0

A XSS vulnerability has been discovered in some YUI 2 .swf files from versions 2.4.0 through 2.9.0. This defect allows JavaScript injection exploits to be created against domains that host affected YUI .swf files.

If your site loads YUI 2 from a CDN (yui.yahooapis.com, ajax.googleapis.com, etc.) and not from your own domain, you are not affected. YUI 3 is not affected by this issue.

CVE-2012-5881 CVE-2012-5882 http://yuilibrary.com/support/20121030-vulnerability/ 2012-10-30 2012-11-27 2012-11-29
chromium -- multiple vulnerabilities chromium 23.0.1271.91

Google Chrome Releases reports:

[156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit to miaubiz.

[148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.

[155711] Low CVE-2012-5132: Browser crash with chunked encoding. Credit to Attila Szász.

[158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to Google Chrome Security Team (Jüri Aedla).

[159165] Medium CVE-2012-5135: Use-after-free with printing. Credit to Fermin Serna of Google Security Team.

[159829] Medium CVE-2012-5136: Bad cast in input element handling. Credit to Google Chrome Security Team (Inferno).

CVE-2012-5130 CVE-2012-5132 CVE-2012-5133 CVE-2012-5134 CVE-2012-5135 CVE-2012-5136 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-11-26 2012-11-27
FreeBSD -- Linux compatibility layer input validation error FreeBSD 7.47.4_11 8.38.3_5 9.09.0_5

Problem description:

A programming error in the handling of some Linux system calls may result in memory locations being accessed without proper validation.

SA-12:08.linux CVE-2012-4576 2012-11-22 2012-11-24
FreeBSD -- Insufficient message length validation for EAP-TLS messages FreeBSD 8.38.3_5 9.09.0_5

Problem description:

The internal authentication server of hostapd does not sufficiently validate the message length field of EAP-TLS messages.

SA-12:07.hostapd CVE-2012-4445 2012-11-22 2012-11-24
FreeBSD -- Multiple Denial of Service vulnerabilities with named(8) FreeBSD 7.47.4_11 8.38.3_5 9.09.0_5

Problem description:

The BIND daemon would crash when a query is made on a resource record with RDATA that exceeds 65535 bytes.

The BIND daemon would lock up when a query is made on specific combinations of RDATA.

SA-12:06.bind CVE-2012-4244 CVE-2012-5166 2012-11-22 2012-11-24
opera -- execution of arbitrary code opera 12.11 opera-devel 12.11 linux-opera 12.11 linux-opera-devel 12.11

Opera reports:

When requesting pages using HTTP, Opera temporarily stores the response in a buffer. In some cases, Opera may incorrectly allocate too little space for a buffer, and may then store too much of the response in that buffer. This causes a buffer overflow, which in turn can lead to a memory corruption and crash. It is possible to use this crash to execute the overflowing data as code, which may be controlled by an attacking site.

http://www.opera.com/support/kb/view/1036/ 2012-11-19 2012-11-22 2014-04-30
lighttpd -- remote DoS in header parsing lighttpd 1.4.301.4.32

Lighttpd security advisory reports:

Certain Connection header values will trigger an endless loop, for example: "Connection: TE,,Keep-Alive"

On receiving such value, lighttpd will enter an endless loop, detecting an empty token but not incrementing the current string position, and keep reading the ',' again and again.

This bug was introduced in 1.4.31, when we fixed an "invalid read" bug (it would try to read the byte before the string if it started with ',', although the value wasn't actually used).

CVE-2012-5533 2012-11-17 2012-11-21
mozilla -- multiple vulnerabilities firefox 11.0,117.0,1 10.0.11,1 linux-firefox 10.0.11,1 linux-seamonkey 2.14 linux-thunderbird 10.0.11 seamonkey 2.14 thunderbird 11.017.0 10.0.11 libxul 1.9.2.*10.0.11

The Mozilla Project reports:

MFSA 2012-91 Miscellaneous memory safety hazards (rv:17.0/ rv:10.0.11)

MFSA 2012-92 Buffer overflow while rendering GIF images

MFSA 2012-93 evalInSanbox location context incorrectly applied

MFSA 2012-94 Crash when combining SVG text on path with CSS

MFSA 2012-95 Javascript: URLs run in privileged context on New Tab page

MFSA 2012-96 Memory corruption in str_unescape

MFSA 2012-97 XMLHttpRequest inherits incorrect principal within sandbox

MFSA 2012-98 Firefox installer DLL hijacking

MFSA 2012-99 XrayWrappers exposes chrome-only properties when not in chrome compartment

MFSA 2012-100 Improper security filtering for cross-origin wrappers

MFSA 2012-101 Improper character decoding in HZ-GB-2312 charset

MFSA 2012-102 Script entered into Developer Toolbar runs with chrome privileges

MFSA 2012-103 Frames can shadow top.location

MFSA 2012-104 CSS and HTML injection through Style Inspector

MFSA 2012-105 Use-after-free and buffer overflow issues found

MFSA 2012-106 Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer

CVE-2012-4201 CVE-2012-4202 CVE-2012-4203 CVE-2012-4204 CVE-2012-4205 CVE-2012-4206 CVE-2012-4207 CVE-2012-4208 CVE-2012-4209 CVE-2012-4210 CVE-2012-4212 CVE-2012-4213 CVE-2012-4214 CVE-2012-4215 CVE-2012-4216 CVE-2012-4217 CVE-2012-4218 CVE-2012-5829 CVE-2012-5830 CVE-2012-5833 CVE-2012-5835 CVE-2012-5836 CVE-2012-5837 CVE-2012-5838 CVE-2012-5839 CVE-2012-5840 CVE-2012-5841 CVE-2012-5842 CVE-2012-5843 http://www.mozilla.org/security/announce/2012/mfsa2012-90.html http://www.mozilla.org/security/announce/2012/mfsa2012-91.html http://www.mozilla.org/security/announce/2012/mfsa2012-92.html http://www.mozilla.org/security/announce/2012/mfsa2012-93.html http://www.mozilla.org/security/announce/2012/mfsa2012-94.html http://www.mozilla.org/security/announce/2012/mfsa2012-95.html http://www.mozilla.org/security/announce/2012/mfsa2012-96.html http://www.mozilla.org/security/announce/2012/mfsa2012-97.html http://www.mozilla.org/security/announce/2012/mfsa2012-98.html http://www.mozilla.org/security/announce/2012/mfsa2012-99.html http://www.mozilla.org/security/announce/2012/mfsa2012-100.html http://www.mozilla.org/security/announce/2012/mfsa2012-101.html http://www.mozilla.org/security/announce/2012/mfsa2012-102.html http://www.mozilla.org/security/announce/2012/mfsa2012-103.html http://www.mozilla.org/security/announce/2012/mfsa2012-104.html http://www.mozilla.org/security/announce/2012/mfsa2012-105.html http://www.mozilla.org/security/announce/2012/mfsa2012-106.html http://www.mozilla.org/security/known-vulnerabilities/ 2012-11-20 2012-11-20
weechat -- Arbitrary shell command execution via scripts weechat 0.3.00.3.9.2 weechat-devel 20121118

Sebastien Helleu reports:

Untrusted command for function hook_process could lead to execution of commands, because of shell expansions.

Workaround with a non-patched version: remove/unload all scripts calling function hook_process (for maximum safety).

http://weechat.org/security/ https://savannah.nongnu.org/bugs/?37764 2012-11-15 2012-11-18 2012-11-18
bugzilla -- multiple vulnerabilities bugzilla 3.6.03.6.12 4.0.04.0.9 4.2.04.2.4

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

Information Leak

If the visibility of a custom field is controlled by a product or a component of a product you cannot see, their names are disclosed in the JavaScript code generated for this custom field despite they should remain confidential.

Calling the User.get method with a 'groups' argument leaks the existence of the groups depending on whether an error is thrown or not. This method now also throws an error if the user calling this method does not belong to these groups (independently of whether the groups exist or not).

Trying to mark an attachment in a bug you cannot see as obsolete discloses its description in the error message. The description of the attachment is now removed from the error message.

Cross-Site Scripting

Due to incorrectly filtered field values in tabular reports, it is possible to inject code leading to XSS.

A vulnerability in swfstore.swf from YUI2 allows JavaScript injection exploits to be created against domains that host this affected YUI .swf file.

CVE-2012-4199 https://bugzilla.mozilla.org/show_bug.cgi?id=731178 CVE-2012-4198 https://bugzilla.mozilla.org/show_bug.cgi?id=781850 CVE-2012-4197 https://bugzilla.mozilla.org/show_bug.cgi?id=802204 CVE-2012-4189 https://bugzilla.mozilla.org/show_bug.cgi?id=790296 CVE-2012-5881 CVE-2012-5882 CVE-2012-5883 https://bugzilla.mozilla.org/show_bug.cgi?id=808845 http://yuilibrary.com/support/20121030-vulnerability/ 2012-11-13 2012-11-14 2012-11-27
typo3 -- Multiple vulnerabilities in TYPO3 Core typo3 4.5.04.5.21 4.6.04.6.14 4.7.04.7.6

Typo Security Team reports:

TYPO3 Backend History Module - Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability. Credits go to Thomas Worm who discovered and reported the issue.

TYPO3 Backend API - Failing to properly HTML-encode user input the tree render API (TCA-Tree) is susceptible to Cross-Site Scripting. TYPO3 Versions below 6.0 does not make us of this API, thus is not exploitable, if no third party extension is installed which uses this API. A valid backend login is required to exploit this vulnerability. Credits go to Richard Brain who discovered and reported the issue.

http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-005/ 2012-11-08 2012-11-12
DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust opendkim 2.7.1

US-CERT reports:

DomainKeys Identified Mail (DKIM) Verifiers may inappropriately convey message trust when messages are signed using test or small bit signing keys.

268267 2012-10-24 2012-11-12
weechat -- Crash or freeze when decoding IRC colors in strings weechat 0.3.60.3.9.1 weechat-devel 2011061420121110

Sebastien Helleu reports:

A buffer overflow is causing a crash or freeze of WeeChat when decoding IRC colors in strings.

Workaround for a non-patched version: /set irc.network.colors_receive off

CVE-2012-5854 ports/173513 http://weechat.org/security/ https://savannah.nongnu.org/bugs/?37704 2012-11-09 2012-11-10 2012-11-13
ruby -- Hash-flooding DoS vulnerability for ruby 1.9 ruby 1.91.9.3.327

The official ruby site reports:

Carefully crafted sequence of strings can cause a denial of service attack on the service that parses the sequence to create a Hash object by using the strings as keys. For instance, this vulnerability affects web application that parses the JSON data sent from untrusted entity.

This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby 1.9 versions were using modified MurmurHash function but it's reported that there is a way to create sequence of strings that collide their hash values each other. This fix changes the Hash function of String object from the MurmurHash to SipHash 2-4.

CVE-2012-5371 http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/ 2012-11-10 2012-11-10
tomcat -- authentication weaknesses tomcat 5.5.05.5.36 6.0.06.0.36 7.0.07.0.30

The Apache Software Foundation reports:

Three weaknesses in Tomcat's implementation of DIGEST authentication were identified and resolved:

  • Tomcat tracked client rather than server nonces and nonce count.
  • When a session ID was present, authentication was bypassed.
  • The user name and password were not checked before when indicating that a nonce was stale.

These issues reduced the security of DIGEST authentication making replay attacks possible in some circumstances.

The first issue was identified by Tilmann Kuhn. The second and third issues were identified by the Tomcat security team during the code review resulting from the first issue.

CVE-2012-3439 http://tomcat.apache.org/security.html http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-11-05 2012-11-08 2012-11-09
tomcat -- Denial of Service tomcat 6.0.06.0.36 7.0.07.0.28

The Apache Software Foundation reports:

The checks that limited the permitted size of request headers were implemented too late in the request parsing process for the HTTP NIO connector. This enabled a malicious user to trigger an OutOfMemoryError by sending a single request with very large headers. This issue was identified by Josh Spiewak.

CVE-2012-2733 http://tomcat.apache.org/security.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html 2012-11-05 2012-11-08 2012-11-09
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.243

Adobe reports:

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 CVE-2012-5277 CVE-2012-5278 CVE-2012-5279 CVE-2012-5280 https://www.adobe.com/support/security/bulletins/apsb12-24.html 2012-10-08 2012-11-02
chromium -- multiple vulnerabilities chromium 23.0.1271.64

Google Chrome Releases reports:

[157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.

[Linux 64-bit only] [150729] Medium CVE-2012-5120: Out-of-bounds array access in v8. Credit to Atte Kettunen of OUSPG.

[143761] High CVE-2012-5116: Use-after-free in SVG filter handling. Credit to miaubiz.

[Mac OS only] [149717] High CVE-2012-5118: Integer bounds check issue in GPU command buffers. Credit to miaubiz.

[154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.

[145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Gröbert of the Google Security Team.

[149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.

[154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).

[154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia. Credit to Google Chrome Security Team (Inferno).

[155323] High CVE-2012-5124: Memory corruption in texture handling. Credit to Al Patrick of the Chromium development community.

[156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.

[156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).

[157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).

CVE-2012-5127 CVE-2012-5120 CVE-2012-5116 CVE-2012-5118 CVE-2012-5121 CVE-2012-5117 CVE-2012-5119 CVE-2012-5122 CVE-2012-5123 CVE-2012-5124 CVE-2012-5125 CVE-2012-5126 CVE-2012-5128 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-11-06 2012-11-07
opera -- multiple vulnerabilities opera 12.10 opera-devel 12.10 linux-opera 12.10 linux-opera-devel 12.10

Opera reports:

CORS (Cross-Origin Resource Sharing) allows web pages to retrieve the contents of pages from other sites, with their permission, as they would appear for the current user. When requests are made in this way, the browser should only allow the page content to be retrieved if the target site sends the correct headers that give permission for their contents to be used in this way. Specially crafted requests may trick Opera into thinking that the target site has given permission when it had not done so. This can result in the contents of any target page being revealed to untrusted sites, including any sensitive information or session IDs contained within the source of those pages.

Also reported are vulnerabilities involving SVG graphics and XSS.

http://www.opera.com/support/kb/view/1030/ http://www.opera.com/support/kb/view/1031/ http://www.opera.com/support/kb/view/1033/ 2012-11-06 2012-11-06 2014-04-30
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.238

Adobe reports:

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-5248 CVE-2012-5249 CVE-2012-5250 CVE-2012-5251 CVE-2012-5252 CVE-2012-5253 CVE-2012-5254 CVE-2012-5255 CVE-2012-5256 CVE-2012-5257 CVE-2012-5258 CVE-2012-5259 CVE-2012-5260 CVE-2012-5261 CVE-2012-5262 CVE-2012-5263 CVE-2012-5264 CVE-2012-5265 CVE-2012-5266 CVE-2012-5267 CVE-2012-5269 CVE-2012-5270 CVE-2012-5271 CVE-2012-5272 CVE-2012-5285 CVE-2012-5286 CVE-2012-5287 CVE-2012-5673 CVE-2012-2034 CVE-2012-2035 CVE-2012-2036 CVE-2012-2037 CVE-2012-2038 CVE-2012-2039 CVE-2012-2040 https://www.adobe.com/support/security/bulletins/apsb12-22.html 2012-10-08 2012-11-02
apache22 -- several vulnerabilities apache22 2.2.02.2.23 apache22-event-mpm 2.2.02.2.23 apache22-itk-mpm 2.2.02.2.23 apache22-peruser-mpm 2.2.02.2.23 apache22-worker-mpm 2.2.02.2.23

Apache HTTP SERVER PROJECT reports:

low: XSS in mod_negotiation when untrusted uploads are supported CVE-2012-2687

Possible XSS for sites which use mod_negotiation and allow untrusted uploads to locations which have MultiViews enabled.

low: insecure LD_LIBRARY_PATH handling CVE-2012-0883

This issue was already fixed in port version 2.2.22_5

CVE-2012-2687 CVE-2012-0833 2012-09-13 2012-11-02
webmin -- potential XSS attack via real name field webmin 1.600_1

The webmin updates site reports

Module: Change Passwords; Version: 1.600; Problem: Fix for potential XSS attack via real name field; Solution: New module.

http://www.webmin.com/updates.html 2012-11-02 2012-11-02
ruby -- Unintentional file creation caused by inserting an illegal NUL character ruby 1.9.3,11.9.3.286,1

The official ruby site reports:

A vulnerability was found that file creation routines can create unintended files by strategically inserting NUL(s) in file paths. This vulnerability has been reported as CVE-2012-4522.

Ruby can handle arbitrary binary patterns as Strings, including NUL chars. On the other hand OSes and other libraries tend not. They usually treat a NUL as an End of String mark. So to interface them with Ruby, NUL chars should properly be avoided.

However methods like IO#open did not check the filename passed to them, and just passed those strings to lower layer routines. This led to create unintentional files.

CVE-2012-4522 http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/ https://access.redhat.com/security/cve/CVE-2012-4522/ 2012-10-12 2012-11-01
ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s ruby 1.8.7,11.8.7.371,1 1.9.3,11.9.3.286,1

The official ruby site reports:

Vulnerabilities found for Exception#to_s, NameError#to_s, and name_err_mesg_to_s() which is Ruby interpreter-internal API. A malicious user code can bypass $SAFE check by utilizing one of those security holes.

Ruby's $SAFE mechanism enables untrusted user codes to run in $SAFE >= 4 mode. This is a kind of sandboxing so some operations are restricted in that mode to protect other data outside the sandbox.

The problem found was around this mechanism. Exception#to_s, NameError#to_s, and name_err_mesg_to_s() interpreter-internal API was not correctly handling the $SAFE bits so a String object which is not tainted can destructively be marked as tainted using them. By using this an untrusted code in a sandbox can modify a formerly-untainted string destructively.

Ruby 1.8 once had a similar security issue. It fixed Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue survived previous security fix

CVE-2012-4464 CVE-2012-4466 http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/ https://access.redhat.com/security/cve/CVE-2012-4464/ 2012-08-21 2012-11-01
RT -- Multiple Vulnerabilities rt40 4.04.0.8 rt38 3.8.15

BestPractical report:

All versions of RT are vulnerable to an email header injection attack. Users with ModifySelf or AdminUser can cause RT to add arbitrary headers or content to outgoing mail. Depending on the scrips that are configured, this may be be leveraged for information leakage or phishing.

RT 4.0.0 and above and RTFM 2.0.0 and above contain a vulnerability due to lack of proper rights checking, allowing any privileged user to create Articles in any class.

All versions of RT with cross-site-request forgery (CSRF) protection (RT 3.8.12 and above, RT 4.0.6 and above, and any instances running the security patches released 2012-05-22) contain a vulnerability which incorrectly allows though CSRF requests which toggle ticket bookmarks.

All versions of RT are vulnerable to a confused deputy attack on the user. While not strictly a CSRF attack, users who are not logged in who are tricked into following a malicious link may, after supplying their credentials, be subject to an attack which leverages their credentials to modify arbitrary state. While users who were logged in would have observed the CSRF protection page, users who were not logged in receive no such warning due to the intervening login process. RT has been extended to notify users of pending actions during the login process.

RT 3.8.0 and above are susceptible to a number of vulnerabilities concerning improper signing or encryption of messages using GnuPG; if GnuPG is not enabled, none of the following affect you.

CVE-2012-4730 CVE-2012-4731 CVE-2012-4732 CVE-2012-4734 CVE-2012-4735 CVE-2012-4884 http://blog.bestpractical.com/2012/10/security-vulnerabilities-in-rt.html 2012-10-26 2012-11-01
drupal7 -- multiple vulnerabilities drupal7 7.16

Drupal Security Team reports:

  1. Arbitrary PHP code execution

    A bug in the installer code was identified that allows an attacker to re-install Drupal using an external database server under certain transient conditions. This could allow the attacker to execute arbitrary PHP code on the original server.

  2. Information disclosure - OpenID module

    For sites using the core OpenID module, an information disclosure vulnerability was identified that allows an attacker to read files on the local filesystem by attempting to log in to the site using a malicious OpenID server.

http://drupal.org/node/1815912 2012-10-17 2012-10-31
mozilla -- multiple vulnerabilities firefox 11.0,116.0.2,1 10.0.10,1 linux-firefox 10.0.10,1 linux-seamonkey 2.13.2 linux-thunderbird 10.0.10 seamonkey 2.13.2 thunderbird 11.016.0.2 10.0.10 libxul 1.9.2.*10.0.10

The Mozilla Project reports:

MFSA 2012-90 Fixes for Location object issues

CVE-2012-4194 CVE-2012-4195 CVE-2012-4196 http://www.mozilla.org/security/known-vulnerabilities/ http://www.mozilla.org/security/announce/2012/mfsa2012-90.html 2012-10-26 2012-10-27
Exim -- remote code execution exim 4.704.80.1

This vulnerability affects Exim instances built with DKIM enabled (this is the default for FreeBSD Exim port) and running verification of DKIM signatures on the incoming mail messages.

Phil Penncock reports:

This is a SECURITY release, addressing a CRITICAL remote code execution flaw in versions of Exim between 4.70 and 4.80 inclusive, when built with DKIM support (the default).

This security vulnerability can be exploited by anyone who can send email from a domain for which they control the DNS.

You are not vulnerable if you built Exim with DISABLE_DKIM or if you put this at the start of an ACL plumbed into acl_smtp_connect or acl_smtp_rcpt:

warn control = dkim_disable_verify
CVE-2012-5671 https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html 2012-10-25 2012-10-26
django -- multiple vulnerabilities django 1.4.2 django13 1.3.4

The Django Project reports:

  1. Host header poisoning

    Some parts of Django -- independent of end-user-written applications -- make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured; Django's documentation has for some time contained notes advising users on such configuration.

    Django's own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3 and Django 1.4 -- specifically, django.http.HttpRequest.get_host() -- was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on "validsite.com":

    Host: validsite.com:random@evilsite.com

    Using this, an attacker can cause parts of Django -- particularly the password-reset mechanism -- to generate and display arbitrary URLs to users.

    To remedy this, the parsing in HttpRequest.get_host() is being modified; Host headers which contain potentially dangerous content (such as username/password pairs) now raise the exception django.core.exceptions.SuspiciousOperation.

  2. Documentation of HttpOnly cookie option

    As of Django 1.4, session cookies are always sent with the HttpOnly flag, which provides some additional protection from cross-site scripting attacks by denying client-side scripts access to the session cookie.

    Though not directly a security issue in Django, it has been reported that the Django 1.4 documentation incorrectly described this change, by claiming that this was now the default for all cookies set by the HttpResponse.set_cookie() method.

    The Django documentation has been updated to reflect that this only applies to the session cookie. Users of Django are encouraged to review their use of set_cookie() to ensure that the HttpOnly flag is being set or unset appropriately.

CVE-2012-4520 https://www.djangoproject.com/weblog/2012/oct/17/security/ 2012-10-17 2012-10-24
Wireshark -- Multiple Vulnerabilities wireshark 1.8.2_1 wireshark-lite 1.8.2_1 tshark 1.8.2_1 tshark-lite 1.8.2_1

Wireshark reports:

The HSRP dissector could go into an infinite loop.

The PPP dissector could abort.

Martin Wilck discovered an infinite loop in the DRDA dissector.

Laurent Butti discovered a buffer overflow in the LDP dissector.

CVE-2012-5237 CVE-2012-5238 CVE-2012-5239 CVE-2012-5240 http://www.wireshark.org/security/wnpa-sec-2012-26.html http://www.wireshark.org/security/wnpa-sec-2012-27.html http://www.wireshark.org/security/wnpa-sec-2012-28.html http://www.wireshark.org/security/wnpa-sec-2012-29.html http://www.wireshark.org/docs/relnotes/wireshark-1.8.3.html 2012-10-02 2012-10-22 2013-06-19
xlockmore -- local exploit xlockmore 5.40_1 ja-xlockmore 5.40_1

Ignatios Souvatzis of NetBSD reports:

Due to an error in the dclock screensaver in xlockmore, users who explicitly use this screensaver or a random mix of screensavers using something like "xlockmore -mode random" may have their screen unlocked unexpectedly at a random time.

CVE-2012-4524 http://www.openwall.com/lists/oss-security/2012/10/17/10 2012-10-17 2012-10-17 2014-04-30
xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled xinetd 2.3.15

Thomas Swan reports:

xinetd allows for services to be configured with the TCPMUX or TCPMUXPLUS service types, which makes those services available on port 1, as per RFC 1078 [1], if the tcpmux-server service is enabled. When the tcpmux-server service is enabled, xinetd would expose _all_ enabled services via the tcpmux port, instead of just the configured service(s). This could allow a remote attacker to bypass firewall restrictions and access services via the tcpmux port.

CVE-2012-0862 https://bugzilla.redhat.com/show_bug.cgi?id=790940 2012-02-15 2012-10-17
Zend Framework -- Multiple vulnerabilities via XXE injection ZendFramework 1.11.13 magento 1.7.0.2

The Zend Framework team reports:

The XmlRpc package of Zend Framework is vulnerable to XML eXternal Entity Injection attacks (both server and client). The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.

Additionally, the Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc components are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

CVE-2012-3363 https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt http://framework.zend.com/security/advisory/ZF2012-01 http://framework.zend.com/security/advisory/ZF2012-02 http://www.openwall.com/lists/oss-security/2012/06/26/2 https://secunia.com/advisories/49665/ http://www.magentocommerce.com/download/release_notes 2012-06-26 2012-10-16 2015-10-14
gitolite -- path traversal vulnerability gitolite 3.013.04

Sitaram Chamarty reports:

I'm sorry to say there is a potential path traversal vulnerability in v3. Thanks to Stephane Chazelas for finding it and alerting me.

Can it affect you? This can only affect you if you are using wild card repos, *and* at least one of your patterns allows the string "../" to match multiple times.

How badly can it affect you? A malicious user who *also* has the ability to create arbitrary files in, say, /tmp (e.g., he has his own userid on the same box), can compromise the entire "git" user. Otherwise the worst he can do is create arbitrary repos in /tmp.

CVE-2012-4506 https://groups.google.com/forum/#!topic/gitolite/K9SnQNhCQ-0/discussion 2012-10-09 2012-10-15
phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack phpMyAdmin 3.53.5.3

The phpMyAdmin development team reports:

When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS.

To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the phpmyadmin.net website in non-SSL mode. A man-in-the-middle could modify this script on the wire to cause mischief.

CVE-2012-5339 http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php CVE-2012-5368 http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php 2012-10-08 2012-10-14
chromium -- multiple vulnerabilities chromium 22.0.1229.94

Google Chrome Releases reports:

[154983][154987] Critical CVE-2012-5112: SVG use-after-free and IPC arbitrary file write. Credit to Pinkie Pie.

CVE-2012-5112 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-10-10 2012-10-10
mozilla -- multiple vulnerabilities firefox 11.0,116.0.1,1 10.0.9,1 linux-firefox 10.0.9,1 linux-seamonkey 2.13.1 linux-thunderbird 10.0.9 seamonkey 2.13.1 thunderbird 11.016.0.1 10.0.9 libxul 1.9.2.*10.0.9

The Mozilla Project reports:

MFSA 2012-74 Miscellaneous memory safety hazards (rv:16.0/ rv:10.0.8)

MFSA 2012-75 select element persistance allows for attacks

MFSA 2012-76 Continued access to initial origin after setting document.domain

MFSA 2012-77 Some DOMWindowUtils methods bypass security checks

MFSA 2012-78 Reader Mode pages have chrome privileges

MFSA 2012-79 DOS and crash with full screen and history navigation

MFSA 2012-80 Crash with invalid cast when using instanceof operator

MFSA 2012-81 GetProperty function can bypass security checks

MFSA 2012-82 top object and location property accessible by plugins

MFSA 2012-83 Chrome Object Wrapper (COW) does not disallow acces to privileged functions or properties

MFSA 2012-84 Spoofing and script injection through location.hash

MFSA 2012-85 Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer

MFSA 2012-86 Heap memory corruption issues found using Address Sanitizer

MFSA 2012-87 Use-after-free in the IME State Manager

MFSA 2012-88 Miscellaneous memory safety hazards (rv:16.0.1)

MFSA 2012-89 defaultValue security checks not applied

CVE-2012-3982 CVE-2012-3983 CVE-2012-3984 CVE-2012-3985 CVE-2012-3986 CVE-2012-3987 CVE-2012-3988 CVE-2012-3989 CVE-2012-3990 CVE-2012-3991 CVE-2012-3992 CVE-2012-3993 CVE-2012-3994 CVE-2012-3995 CVE-2012-4179 CVE-2012-4180 CVE-2012-4181 CVE-2012-4182 CVE-2012-4183 CVE-2012-4184 CVE-2012-4186 CVE-2012-4187 CVE-2012-4188 CVE-2012-4190 CVE-2012-4191 CVE-2012-4192 CVE-2012-4193 http://www.mozilla.org/security/known-vulnerabilities/ http://www.mozilla.org/security/announce/2012/mfsa2012-74.html http://www.mozilla.org/security/announce/2012/mfsa2012-75.html http://www.mozilla.org/security/announce/2012/mfsa2012-76.html http://www.mozilla.org/security/announce/2012/mfsa2012-77.html http://www.mozilla.org/security/announce/2012/mfsa2012-78.html http://www.mozilla.org/security/announce/2012/mfsa2012-79.html http://www.mozilla.org/security/announce/2012/mfsa2012-80.html http://www.mozilla.org/security/announce/2012/mfsa2012-81.html http://www.mozilla.org/security/announce/2012/mfsa2012-82.html http://www.mozilla.org/security/announce/2012/mfsa2012-83.html http://www.mozilla.org/security/announce/2012/mfsa2012-84.html http://www.mozilla.org/security/announce/2012/mfsa2012-85.html http://www.mozilla.org/security/announce/2012/mfsa2012-86.html http://www.mozilla.org/security/announce/2012/mfsa2012-87.html http://www.mozilla.org/security/announce/2012/mfsa2012-88.html http://www.mozilla.org/security/announce/2012/mfsa2012-89.html 2012-10-09 2012-10-10 2012-10-11
dns/bind9* -- crash on deliberately constructed combination of records bind99 9.9.1.4 bind99-base 9.9.1.4 bind98 9.8.3.4 bind98-base 9.8.3.4 bind97 9.7.6.4 bind97-base 9.7.6.4 bind96 9.6.3.1.ESV.R7.4 bind96-base 9.6.3.1.ESV.R7.4

ISC reports:

A deliberately constructed combination of records could cause named to hang while populating the additional section of a response.

CVE-2012-5166 2012-09-26 2012-10-10
chromium -- multiple vulnerabilities chromium 22.0.1229.92

Google Chrome Releases reports:

[138208] High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG.

[147499] Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG.

[148692] Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthur Gerkis.

[151449] Medium CVE-2012-5110: Out-of-bounds read in compositor. Credit to Google Chrome Security Team (Inferno).

[151895] Low CVE-2012-5111: Plug-in crash monitoring was missing for Pepper plug-ins. Credit to Google Chrome Security Team (Chris Evans).

CVE-2012-2900 CVE-2012-5108 CVE-2012-5109 CVE-2012-5110 CVE-2012-5111 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-10-08 2012-10-08
OpenX -- SQL injection vulnerability openx 2.8.10

Secunia reports:

A vulnerability has been discovered in OpenX, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "xajaxargs" parameter to www/admin/updates-history.php (when "xajax" is set to "expandOSURow") is not properly sanitised in e.g. the "queryAuditBackupTablesByUpgradeId()" function (lib/OA/Upgrade/DB_UpgradeAuditor.php) before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is confirmed in version 2.8.9. Prior versions may also be affected.

http://secunia.com/advisories/50598/ 2012-09-14 2012-09-27
chromium -- multiple vulnerabilities chromium 22.0.1229.79

Google Chrome Releases reports:

[143439] High CVE-2012-2889: UXSS in frame handling. Credit to Sergey Glazunov.

[143437] High CVE-2012-2886: UXSS in v8 bindings. Credit to Sergey Glazunov.

[139814] High CVE-2012-2881: DOM tree corruption with plug-ins. Credit to Chamal de Silva.

[135432] High CVE-2012-2876: Buffer overflow in SSE2 optimizations. Credit to Atte Kettunen of OUSPG.

[140803] High CVE-2012-2883: Out-of-bounds write in Skia. Credit to Atte Kettunen of OUSPG.

[143609] High CVE-2012-2887: Use-after-free in onclick handling. Credit to Atte Kettunen of OUSPG.

[143656] High CVE-2012-2888: Use-after-free in SVG text references. Credit to miaubiz.

[144899] High CVE-2012-2894: Crash in graphics context handling. Credit to Slawomir Blazek.

[137707] Medium CVE-2012-2877: Browser crash with extensions and modal dialogs. Credit to Nir Moshe.

[139168] Low CVE-2012-2879: DOM topology corruption. Credit to pawlkt.

[141651] Medium CVE-2012-2884: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.

[132398] High CVE-2012-2874: Out-of-bounds write in Skia. Credit to Google Chrome Security Team (Inferno).

[134955] [135488] [137106] [137288] [137302] [137547] [137556] [137606] [137635] [137880] [137928] [144579] [145079] [145121] [145163] [146462] Medium CVE-2012-2875: Various lower severity issues in the PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[137852] High CVE-2012-2878: Use-after-free in plug-in handling. Credit to Fermin Serna of Google Security Team.

[139462] Medium CVE-2012-2880: Race condition in plug-in paint buffer. Credit to Google Chrome Security Team (Cris Neckar).

[140647] High CVE-2012-2882: Wild pointer in OGG container handling. Credit to Google Chrome Security Team (Inferno).

[142310] Medium CVE-2012-2885: Possible double free on exit. Credit to the Chromium development community.

[143798] [144072] [147402] High CVE-2012-2890: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[144051] Low CVE-2012-2891: Address leak over IPC. Credit to Lei Zhang of the Chromium development community.

[144704] Low CVE-2012-2892: Pop-up block bypass. Credit to Google Chrome Security Team (Cris Neckar).

[144799] High CVE-2012-2893: Double free in XSL transforms. Credit to Google Chrome Security Team (Cris Neckar).

[145029] [145157] [146460] High CVE-2012-2895: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

CVE-2012-2889 CVE-2012-2886 CVE-2012-2881 CVE-2012-2876 CVE-2012-2883 CVE-2012-2887 CVE-2012-2888 CVE-2012-2894 CVE-2012-2877 CVE-2012-2879 CVE-2012-2884 CVE-2012-2874 CVE-2012-2875 CVE-2012-2878 CVE-2012-2880 CVE-2012-2882 CVE-2012-2885 CVE-2012-2890 CVE-2012-2891 CVE-2012-2892 CVE-2012-2893 CVE-2012-2895 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-09-25 2012-09-26
eperl -- Remote code execution eperl 2.2.14_4

David Madison reports:

ePerl is a multipurpose Perl filter and interpreter program for Unix systems. The ePerl preprocessor contains an input validation error. The preprocessor allows foreign data to be "safely" included using the 'sinclude' directive.

The problem occurs when a file referenced by a 'sinclude' directive contains a 'include' directive; the contents of the file referred to by the second directive will be loaded and executed.

CVE-2001-0733 http://www.shmoo.com/mail/bugtraq/jun01/msg00286.shtml 2912 http://xforce.iss.net/xforce/xfdb/6743 http://osvdb.org/show/osvdb/1880 2001-06-21 2012-09-26
ImageMagick and GraphicsMagick -- DoS via specially crafted PNG file ImageMagick 6.7.8.6 ImageMagick-nox11 6.7.8.6 GraphicsMagick 1.3.01.3.16 GraphicsMagick-nox11 1.3.01.3.16

Kurt Seifried reports:

There is an issue in ImageMagick that is also present in GraphicsMagick. CVE-2011-3026 deals with libpng memory allocation, and limitations have been added so that a bad PNG can't cause the system to allocate a lot of memory and a denial of service. However on further investigation of ImageMagick, Tom Lane found that PNG malloc function (Magick_png_malloc) in turn calls AcquireMagickMemory with an improper size argument.

CVE-2012-3438 https://bugzilla.redhat.com/show_bug.cgi?id=844105 54716 http://secunia.com/advisories/50090 http://xforce.iss.net/xforce/xfdb/77259 http://osvdb.org/show/osvdb/84323 2012-07-28 2012-09-20 2014-04-30
php5-sqlite -- open_basedir bypass php5-sqlite 5.25.2.17_11 5.35.3.15 php52-sqlite 5.2.17_11 php53-sqlite 5.3.15

MITRE CVE team reports:

The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.

CVE-2012-3365 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365 2012-06-14 2012-09-19
php5 -- Denial of Service in php_date_parse_tzfile() php5 5.25.2.17_11 5.35.3.9 php52 5.2.17_11 php53 5.3.9

MITRE CVE team reports:

Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.

CVE-2012-0789 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789 https://bugs.php.net/bug.php?id=53502 2010-12-08 2012-09-19
dns/bind9* -- Several vulnerabilities bind99 9.9.1.3 bind98 9.8.3.3 bind97 9.7.6.3 bind96 9.6.3.1.ESV.R7.3

ISC reports:

Prevents a crash when queried for a record whose RDATA exceeds 65535 bytes.

Prevents a crash when validating caused by using "Bad cache" data before it has been initialized.

ISC_QUEUE handling for recursive clients was updated to address a race condition that could cause a memory leak. This rarely occurred with UDP clients, but could be a significant problem for a server handling a steady rate of TCP queries.

A condition has been corrected where improper handling of zero-length RDATA could cause undesirable behavior, including termination of the named process.

2012-09-12 2012-09-18
jenkins -- multiple vulnerabilities jenkins 1.482

Jenkins Security Advisory reports:

This advisory announces security vulnerabilities that were found in Jenkins core and several plugins.

  1. The first vulnerability in Jenkins core allows unprivileged users to insert data into Jenkins master, which can lead to remote code execution. For this vulnerability to be exploited, the attacker must have an HTTP access to a Jenkins master, and he must have a read access to Jenkins.
  2. The second vulnerability in Jenkins core is a cross-site scripting vulnerability. This allows an attacker to craft an URL that points to Jenkins, and if a legitimate user clicks this link, and the attacker will be able to hijack the user session.
  3. The third vulnerability is a cross-site scripting vulnerability in the Violations plugin
  4. The fourth vulnerability is a cross-site scripting vulnerability in The Continuous Integration Game plugin
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-09-17 2012-09-17 2012-09-17
vlc -- arbitrary code execution in Real RTSP and MMS support vlc 2.0.1,3

Jean-Baptiste Kempf, on behalf of the VideoLAN project reports:

If successful, a malicious third party could crash the VLC media player process. Arbitrary code execution could be possible on some systems.

http://www.videolan.org/security/sa1201.html http://www.videolan.org/security/sa1202.html CVE-2012-1775 CVE-2012-1776 2012-03-12 2012-09-15
bacula -- Console ACL Bypass bacula 5.2.11

A security issue has been reported in Bacula, which can be exploited by malicious users to bypass certain security restrictions.

The security issue is caused due to an error within the implementation of console ACLs, which can be exploited to gain access to certain restricted functionality and e.g. dump resources.

CVE-2012-4430 http://www.bacula.org/git/cgit.cgi/bacula/commit/?id=67debcecd3d530c429e817e1d778e79dcd1db905 https://secunia.com/advisories/50535/ http://sourceforge.net/projects/bacula/files/bacula/5.2.11/ReleaseNotes/view 2012-09-12 2012-09-15
mod_pagespeed -- multiple vulnerabilities mod_pagespeed 0.10.22.6

Google Reports:

mod_pagespeed 0.10.22.6 is a security update that fixes two critical issues that affect earlier versions:

  • CVE-2012-4001, a problem with validation of own host name.
  • CVE-2012-4360, a cross-site scripting attack, which affects versions starting from 0.10.19.1.

The effect of the first problem is that it is possible to confuse mod_pagespeed about its own host name, and to trick it into fetching resources from other machines. This could be an issue if the HTTP server has access to machines that are not otherwise publicly visible.

The second problem would permit a hostile third party to execute JavaScript in users' browsers in context of the domain running mod_pagespeed, which could permit interception of users' cookies or data on the site.

Because of the severity of the two problems, users are strongly encouraged to update immediately.

Behavior Changes in the Update:

As part of the fix to the first issue, mod_pagespeed will not fetch resources from machines other than localhost if they are not explicitly mentioned in the configuration. This means that if you need resources on the server's domain to be handled by some other system, you'll need to explicitly use ModPagespeedMapOriginDomain or ModPagespeedDomain to authorize that.

CVE-2012-4001 CVE-2012-4360 https://developers.google.com/speed/docs/mod_pagespeed/announce-0.10.22.6 2012-09-12 2012-09-12
freeradius -- arbitrary code execution for TLS-based authentication freeradius 2.1.102.1.12_2

freeRADIUS security team reports:

Overflow in EAP-TLS for 2.1.10, 2.1.11 and 2.1.12.

The issue was found by Timo Warns, and communicated to security@freeradius.org. A sample exploit for the issue was included in the notification.

The vulnerability was created in commit a368a6f4f4aaf on August 18, 2010. Vulnerable versions include 2.1.10, 2.1.11, and 2.1.12. Also anyone running the git "master" branch after August 18, 2010 is vulnerable.

All sites using TLS-based EAP methods and the above versions are vulnerable. The only configuration change which can avoid the issue is to disable EAP-TLS, EAP-TTLS, and PEAP.

An external attacker can use this vulnerability to over-write the stack frame of the RADIUS server, and cause it to crash. In addition, more sophisticated attacks may gain additional privileges on the system running the RADIUS server.

This attack does not require local network access to the RADIUS server. It can be done by an attacker through a WiFi Access Point, so long as the Access Point is configured to use 802.1X authentication with the RADIUS server.

CVE-2012-3547 http://freeradius.org/security.html http://www.pre-cert.de/advisories/PRE-SA-2012-06.txt 2012-09-10 2012-09-11 2012-09-11
emacs -- remote code execution vulnerability emacs 24.*24.2 23.*23.4_2

Chong Yidong reports:

Paul Ling has found a security flaw in the file-local variables code in GNU Emacs.

When the Emacs user option `enable-local-variables' is set to `:safe' (the default value is t), Emacs should automatically refuse to evaluate `eval' forms in file-local variable sections. Due to the bug, Emacs instead automatically evaluates such `eval' forms. Thus, if the user changes the value of `enable-local-variables' to `:safe', visiting a malicious file can cause automatic execution of arbitrary Emacs Lisp code with the permissions of the user.

The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.

54969 CVE-2012-3479 https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155 2012-08-13 2012-09-08 2013-05-13
wordpress -- multiple unspecified privilege escalation bugs wordpress 3.4.2

Wordpress reports:

Version 3.4.2 also fixes a few security issues and contains some security hardening. The vulnerabilities included potential privilege escalation and a bug that affects multisite installs with untrusted users. These issues were discovered and fixed by the WordPress security team.

http://wordpress.org/news/2012/09/wordpress-3-4-2/ 2012-09-06 2012-09-07
moinmoin -- cross-site scripting via RST parser moinmoin 1.9.4

MITRE CVE team reports:

Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.4, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute.

46476 CVE-2011-1058 http://moinmo.in/SecurityFixes 2011-02-21 2012-09-05
moinmoin -- wrong processing of group membership moinmoin 1.91.9.4_1

MoinMoin developers report:

If you have group NAMES containing "All" or "Known" or "Trusted", they behaved wrong until now (they erroneously included All/Known/Trusted users even if you did not list them as members), but will start working correctly with this changeset.

E.g. AllFriendsGroup:

  • JoeDoe

AllFriendsGroup will now (correctly) include only JoeDoe. It (erroneously) contained all users (including JoeDoe) before.

E.g. MyTrustedFriendsGroup:

  • JoeDoe

MyTrustedFriendsGroup will now (correctly) include only JoeDoe. It (erroneously) contained all trusted users and JoeDoe before.

CVE-2012-4404 http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16 2012-09-03 2012-09-05 2012-09-11
php5 -- header splitting attack via carriage-return character php5 5.25.2.17_11 5.35.3.11 5.45.4.1 php52 5.2.17_11 php53 5.3.11

Rui Hirokawa reports:

As of PHP 5.1.2, header() can no longer be used to send multiple response headers in a single call to prevent the HTTP Response Splitting Attack. header() only checks the linefeed (LF, 0x0A) as line-end marker, it doesn't check the carriage-return (CR, 0x0D).

However, some browsers including Google Chrome, IE also recognize CR as the line-end.

The current specification of header() still has the vulnerability against the HTTP header splitting attack.

CVE-2011-1398 https://bugs.php.net/bug.php?id=60227 2011-11-06 2012-09-05 2012-09-19
bitcoin -- denial of service bitcoin 0.6.3

A unspecified denial-of-service attack that could cause the bitcoin process to become unresponsive was found.

CVE-2012-3789 https://bitcointalk.org/?topic=88734 2012-07-20 2012-09-02
bugzilla -- multiple vulnerabilities bugzilla 3.6.03.6.11 4.0.04.0.8 4.2.04.2.3

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

LDAP Injection

When the user logs in using LDAP, the username is not escaped when building the uid=$username filter which is used to query the LDAP directory. This could potentially lead to LDAP injection.

Directory Browsing

Extensions are not protected against directory browsing and users can access the source code of the templates which may contain sensitive data. Directory browsing is blocked in Bugzilla 4.3.3 only, because it requires a configuration change in the Apache httpd.conf file to allow local .htaccess files to use Options -Indexes. To not break existing installations, this fix has not been backported to stable branches. The access to templates is blocked for all supported branches except the old 3.6 branch, because this branch doesn't have .htaccess in the bzr repository and cannot be fixed easily for existing installations without potentially conflicting with custom changes.

CVE-2012-3981 https://bugzilla.mozilla.org/show_bug.cgi?id=785470 https://bugzilla.mozilla.org/show_bug.cgi?id=785522 https://bugzilla.mozilla.org/show_bug.cgi?id=785511 2012-08-30 2012-09-01
GNU gatekeeper -- denial of service gatekeeper 3.1

Jan Willamowius reports:

GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of service (connection and thread consumption) via a large number of connections.

CVE-2012-3534 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3534 http://www.openwall.com/lists/oss-security/2012/08/25/4 http://www.gnugk.org/gnugk-3.1.html 2012-08-15 2012-09-01
mediawiki -- multiple vulnerabilities mediawiki 1.191.19.2 1.181.18.5

Mediawiki reports:

(Bug 39700) Wikipedia administrator Writ Keeper discovered a stored XSS (HTML injection) vulnerability. This was possible due to the handling of link text on File: links for nonexistent files. MediaWiki 1.16 and later is affected.

(Bug 39180) User Fomafix reported several DOM-based XSS vulnerabilities, made possible by a combination of loose filtering of the uselang parameter, and JavaScript gadgets on various language Wikipedias.

(Bug 39180) During internal review, it was discovered that CSRF tokens, available via the api, were not protected with X-Frame-Options headers. This could lead to a CSRF vulnerability if the API response is embedded in an external website using using an iframe.

(Bug 39824) During internal review, it was discovered extensions were not always allowed to prevent the account creation action. This allowed users blocked by the GlobalBlocking extension to create accounts.

(Bug 39184) During internal review, it was discovered that password data was always saved to the local MediaWiki database even if authentication was handled by an extension, such as LDAP. This could allow a compromised MediaWiki installation to leak information about user's LDAP passwords. Additionally, in situations when an authentication plugin returned false in its strict function, this would allow old passwords to be used for accounts that did not exist in the external system, indefinitely.

(Bug 39823) During internal review, it was discovered that metadata about blocks, hidden by a user with suppression rights, was visible to administrators.

https://bugzilla.wikimedia.org/show_bug.cgi?id=39700 https://bugzilla.wikimedia.org/show_bug.cgi?id=37587 https://bugzilla.wikimedia.org/show_bug.cgi?id=39180 https://bugzilla.wikimedia.org/show_bug.cgi?id=39824 https://bugzilla.wikimedia.org/show_bug.cgi?id=39184 https://bugzilla.wikimedia.org/show_bug.cgi?id=39823 CVE-2012-4377 CVE-2012-4378 CVE-2012-4379 CVE-2012-4380 CVE-2012-4381 CVE-2012-4382 2012-08-27 2012-09-01
wireshark -- denial of service in DRDA dissector wireshark 1.51.8.2_1 wireshark-lite 1.51.8.2_1 tshark 1.51.8.2_1 tshark-lite 1.51.8.2_1

RedHat security team reports:

A denial of service flaw was found in the way Distributed Relational Database Architecture (DRDA) dissector of Wireshark, a network traffic analyzer, performed processing of certain DRDA packet capture files. A remote attacker could create a specially-crafted capture file that, when opened could lead to wireshark executable to consume excessive amount of CPU time and hang with an infinite loop.

CVE-2012-3548 https://bugzilla.redhat.com/show_bug.cgi?id=849926 2012-08-21 2012-08-31 2012-09-05
chromium -- multiple vulnerabilities chromium 21.0.1180.89

Google Chrome Releases reports:

[121347] Medium CVE-2012-2865: Out-of-bounds read in line breaking. Credit to miaubiz.

[134897] High CVE-2012-2866: Bad cast with run-ins. Credit to miaubiz.

[135485] Low CVE-2012-2867: Browser crash with SPDY.

[136881] Medium CVE-2012-2868: Race condition with workers and XHR. Credit to miaubiz.

[137778] High CVE-2012-2869: Avoid stale buffer in URL loading. Credit to Fermin Serna of the Google Security Team.

[138672] [140368] Low CVE-2012-2870: Lower severity memory management issues in XPath. Credit to Nicolas Gregoire.

[138673] High CVE-2012-2871: Bad cast in XSL transforms. Credit to Nicolas Gregoire.

[142956] Medium CVE-2012-2872: XSS in SSL interstitial. Credit to Emmanuel Bronshtein.

CVE-2012-2865 CVE-2012-2866 CVE-2012-2867 CVE-2012-2868 CVE-2012-2869 CVE-2012-2870 CVE-2012-2871 CVE-2012-2872 http://googlechromereleases.blogspot.nl/search/label/Stable%20updates 2012-08-30 2012-08-30
asterisk -- multiple vulnerabilities asterisk 10.*10.7.1 asterisk18 1.8.*1.8.15.1

Asterisk project reports:

Asterisk Manager User Unauthorized Shell Access

ACL rules ignored when placing outbound calls by certain IAX2 users

CVE-2012-2186 CVE-2012-4737 http://downloads.digium.com/pub/security/AST-2012-012.html http://downloads.digium.com/pub/security/AST-2012-013.html https://www.asterisk.org/security 2012-08-30 2012-08-30
mozilla -- multiple vulnerabilities firefox 11.0,115.0,1 10.0.7,1 linux-firefox 10.0.7,1 linux-seamonkey 2.12 linux-thunderbird 10.0.7 seamonkey 2.12 thunderbird 11.015.0 10.0.7 libxul 1.9.2.*10.0.7

The Mozilla Project reports:

MFSA 2012-57 Miscellaneous memory safety hazards (rv:15.0/ rv:10.0.7)

MFSA 2012-58 Use-after-free issues found using Address Sanitizer

MFSA 2012-59 Location object can be shadowed using Object.defineProperty

MFSA 2012-60 Escalation of privilege through about:newtab

MFSA 2012-61 Memory corruption with bitmap format images with negative height

MFSA 2012-62 WebGL use-after-free and memory corruption

MFSA 2012-63 SVG buffer overflow and use-after-free issues

MFSA 2012-64 Graphite 2 memory corruption

MFSA 2012-65 Out-of-bounds read in format-number in XSLT

MFSA 2012-66 HTTPMonitor extension allows for remote debugging without explicit activation

MFSA 2012-67 Installer will launch incorrect executable following new installation

MFSA 2012-68 DOMParser loads linked resources in extensions when parsing text/html

MFSA 2012-69 Incorrect site SSL certificate data display

MFSA 2012-70 Location object security checks bypassed by chrome code

MFSA 2012-71 Insecure use of __android_log_print

MFSA 2012-72 Web console eval capable of executing chrome-privileged code

CVE-2012-1956 CVE-2012-1970 CVE-2012-1971 CVE-2012-1972 CVE-2012-1973 CVE-2012-1974 CVE-2012-1975 CVE-2012-1976 CVE-2012-3956 CVE-2012-3957 CVE-2012-3958 CVE-2012-3959 CVE-2012-3960 CVE-2012-3961 CVE-2012-3962 CVE-2012-3963 CVE-2012-3964 CVE-2012-3965 CVE-2012-3966 CVE-2012-3967 CVE-2012-3968 CVE-2012-3969 CVE-2012-3970 CVE-2012-3971 CVE-2012-3972 CVE-2012-3973 CVE-2012-3974 CVE-2012-3975 CVE-2012-3976 CVE-2012-3978 CVE-2012-3979 CVE-2012-3980 http://www.mozilla.org/security/known-vulnerabilities/ http://www.mozilla.org/security/announce/2012/mfsa2012-57.html http://www.mozilla.org/security/announce/2012/mfsa2012-58.html http://www.mozilla.org/security/announce/2012/mfsa2012-59.html http://www.mozilla.org/security/announce/2012/mfsa2012-60.html http://www.mozilla.org/security/announce/2012/mfsa2012-61.html http://www.mozilla.org/security/announce/2012/mfsa2012-62.html http://www.mozilla.org/security/announce/2012/mfsa2012-63.html http://www.mozilla.org/security/announce/2012/mfsa2012-64.html http://www.mozilla.org/security/announce/2012/mfsa2012-65.html http://www.mozilla.org/security/announce/2012/mfsa2012-66.html http://www.mozilla.org/security/announce/2012/mfsa2012-67.html http://www.mozilla.org/security/announce/2012/mfsa2012-68.html http://www.mozilla.org/security/announce/2012/mfsa2012-69.html http://www.mozilla.org/security/announce/2012/mfsa2012-70.html http://www.mozilla.org/security/announce/2012/mfsa2012-71.html http://www.mozilla.org/security/announce/2012/mfsa2012-72.html 2012-08-28 2012-08-30
coppermine -- Multiple vulnerabilities coppermine 1.5.20

The Coppermine Team reports:

The release covers several path disclosure vulnerabilities. If unpatched, it's possible to generate an error that will reveal the full path of the script. A remote user can determine the full path to the web root directory and other potentially sensitive information. Furthermore, the release covers a recently discovered XSS vulnerability that allows (if unpatched) a malevolent visitor to include own script routines under certain conditions.

CVE-2012-1613 CVE-2012-1614 http://seclists.org/oss-sec/2012/q2/11 http://forum.coppermine-gallery.net/index.php/topic,74682.0.html 2012-03-29 2012-08-30
Java 1.7 -- security manager bypass openjdk 7.07.6.24_1 linux-sun-jdk 7.07.7 linux-sun-jre 7.07.7

US-CERT reports:

Oracle Java Runtime Environment (JRE) 1.7 contains a vulnerability that may allow an applet to call setSecurityManager in a way that allows setting of arbitrary permissions.

By leveraging the public, privileged getField() function, an untrusted Java applet can escalate its privileges by calling the setSecurityManager() function to allow full privileges, without requiring code signing.

This vulnerability is being actively exploited in the wild, and exploit code is publicly available.

This exploit does not only affect Java applets, but every piece of software that relies on the Java Security Manager for sandboxing executable code is affected: malicious code can totally disable Security Manager.

CVE-2012-4681 636312 http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-August/020065.html http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html 2012-08-27 2012-08-30 2012-08-31
fetchmail -- chosen plaintext attack against SSL CBC initialization vectors fetchmail 6.3.96.3.22

Matthias Andree reports:

Fetchmail version 6.3.9 enabled "all SSL workarounds" (SSL_OP_ALL) which contains a switch to disable a countermeasure against certain attacks against block ciphers that permit guessing the initialization vectors, providing that an attacker can make the application (fetchmail) encrypt some data for him -- which is not easily the case.

Stream ciphers (such as RC4) are unaffected.

Credits to Apple Product Security for reporting this.

CVE-2011-3389 2012-01-19 2012-08-30
roundcube -- cross-site scripting in HTML email messages roundcube 0.8.0,10.8.1,1

RoundCube branch 0.8.x prior to the version 0.8.1 is prone to the cross-scripting attack (XSS) originating from incoming HTML e-mails: due to the lack of proper sanitization of JavaScript code inside the "href" attribute, sender could launch XSS attack when recipient opens the message in RoundCube interface.

CVE-2012-3508 http://trac.roundcube.net/wiki/Changelog http://trac.roundcube.net/ticket/1488613 2012-08-14 2012-08-27
Calligra, KOffice -- input validation failure koffice 1.6.3_18,2 koffice-kde4 2.3.3_7 calligra 2.5.0

KDE Security Advisory reports:

A flaw has been found which can allow malicious code to take advantage of an input validation failure in the Microsoft import filter in Calligra and KOffice. Exploitation can allow the attacker to gain control of the running process and execute code on its behalf.

CVE-2012-3455 CVE-2012-3456 http://www.kde.org/info/security/advisory-20120810-1.txt http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf 2012-08-10 2012-08-26
squidclamav -- cross-site scripting in default virus warning pages squidclamav 5.8 6.06.7

SquidClamav developers report:

This release fix several security issues by escaping CGI parameters.

Prior to versions 6.7 and 5.8, CGI script clwarn.cgi was not properly sanitizing input variables, so they could be used to inject arbitrary strings to the generated page, leading to the cross-site scripting attacks.

CVE-2012-4667 http://squidclamav.darold.net/news.html 2012-07-24 2012-08-25
squidclamav -- Denial of Service squidclamav 5.7_1 6.06.7

SquidClamav developers report:

Add a workaround for a squidGuard bug that unescape the URL and send it back unescaped. This result in garbage staying into pipe of the system command call and could crash squidclamav on next read or return false information. This is specially true with URL containing the %0D or %0A character.

This vulnerability can be triggered only in configurations where external chained URL checker is configured via "squidguard" directive.

CVE-2012-3501 http://squidclamav.darold.net/news.html 2012-07-24 2012-08-25 2012-09-04
inn -- plaintext command injection into encrypted channel inn 2.5.2_2

INN developers report:

Fixed a possible plaintext command injection during the negotiation of a TLS layer. The vulnerability detailed in CVE-2011-0411 affects the STARTTLS and AUTHINFO SASL commands. nnrpd now resets its read buffer upon a successful negotiation of a TLS layer. It prevents malicious commands, sent unencrypted, from being executed in the new encrypted state of the session.

CVE-2012-3523 CVE-2011-0411 https://www.isc.org/software/inn/2.5.3article 2012-08-14 2012-08-25
jabberd -- domain spoofing in server dialback protocol jabberd 2.2.16_2

XMPP Standards Foundation reports:

Some implementations of the XMPP Server Dialback protocol (RFC 3920/XEP-0220) have not been checking dialback responses to ensure that validated results are correlated with requests.

An attacking server could spoof one or more domains in communicating with a vulnerable server implementation, thereby avoiding the protections built into the Server Dialback protocol.

CVE-2012-3525 http://xmpp.org/resources/security-notices/server-dialback/ 2012-08-21 2012-08-23
rssh -- configuration restrictions bypass rssh 2.3.3

Derek Martin (rssh maintainer) reports:

John Barber reported a problem where, if the system administrator misconfigures rssh by providing too few access bits in the configuration file, the user will be given default permissions (scp) to the entire system, potentially circumventing any configured chroot. Fixing this required a behavior change: in the past, using rssh without a config file would give all users default access to use scp on an unchrooted system. In order to correct the reported bug, this feature has been eliminated, and you must now have a valid configuration file. If no config file exists, all users will be locked out.

http://www.pizzashack.org/rssh/security.shtml 2010-08-01 2012-08-22
rssh -- arbitrary command execution rssh 2.3.4

Derek Martin (rssh maintainer) reports:

Henrik Erkkonen has discovered that, through clever manipulation of environment variables on the ssh command line, it is possible to circumvent rssh. As far as I can tell, there is no way to effect a root compromise, except of course if the root account is the one you're attempting to protect with rssh...

53430 CVE-2012-3478 http://sourceforge.net/mailarchive/message.php?msg_id=29235647 2012-05-08 2012-08-22
libotr -- buffer overflows libotr 3.2.1

OTR developers report:

The otrl_base64_otr_decode() function and similar functions within OTR suffer from buffer overflows in the case of malformed input; specifically if a message of the format of "?OTR:===." is received then a zero-byte allocation is performed without a similar correlation between the subsequent base64 decoding write, as such it becomes possible to write between zero and three bytes incorrectly to the heap, albeit only with a value of '='.

Because this code path is highly utilized, specifically in the reception of instant messages over pidgin or similar, this vulnerability is considered severe even though in many platforms and circumstances the bug would yield an unexploitable state and result simply in denial of service.

The developers of OTR promptly fixed the errors and users of OTR are advised to upgrade the software at the next release cycle.

CVE-2012-3461 http://lists.cypherpunks.ca/pipermail/otr-dev/2012-July/001347.html 2012-07-27 2012-08-18
OpenTTD -- Denial of Service openttd 1.2.1

The OpenTTD Team reports:

Denial of service (server) using ships on half tiles and landscaping.

CVE-2012-3436 http://security.openttd.org/en/CVE-2012-3436 2012-07-25 2012-08-18
Wireshark -- Multiple vulnerabilities wireshark 1.8.2 wireshark-lite 1.8.2 tshark 1.8.2 tshark-lite 1.8.2

Wireshark reports:

It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

The PPP dissector could crash.

The NFS dissector could use excessive amounts of CPU.

The DCP ETSI dissector could trigger a zero division.

The MongoDB dissector could go into a large loop.

The XTP dissector could go into an infinite loop.

The ERF dissector could overflow a buffer.

The AFP dissector could go into a large loop.

The RTPS2 dissector could overflow a buffer.

The GSM RLC MAC dissector could overflow a buffer.

The CIP dissector could exhaust system memory.

The STUN dissector could crash.

The EtherCAT Mailbox dissector could abort.

The CTDB dissector could go into a large loop.

The pcap-ng file parser could trigger a zero division.

The Ixia IxVeriWave file parser could overflow a buffer.

CVE-2012-4048 CVE-2012-4049 CVE-2012-4285 CVE-2012-4286 CVE-2012-4287 CVE-2012-4288 CVE-2012-4289 CVE-2012-4290 CVE-2012-4291 CVE-2012-4292 CVE-2012-4293 CVE-2012-4294 CVE-2012-4295 CVE-2012-4296 CVE-2012-4297 CVE-2012-4298 http://www.wireshark.org/security/wnpa-sec-2012-11.html http://www.wireshark.org/security/wnpa-sec-2012-12.html http://www.wireshark.org/security/wnpa-sec-2012-13.html http://www.wireshark.org/security/wnpa-sec-2012-14.html http://www.wireshark.org/security/wnpa-sec-2012-15.html http://www.wireshark.org/security/wnpa-sec-2012-16.html http://www.wireshark.org/security/wnpa-sec-2012-17.html http://www.wireshark.org/security/wnpa-sec-2012-18.html http://www.wireshark.org/security/wnpa-sec-2012-19.html http://www.wireshark.org/security/wnpa-sec-2012-20.html http://www.wireshark.org/security/wnpa-sec-2012-21.html http://www.wireshark.org/security/wnpa-sec-2012-22.html http://www.wireshark.org/security/wnpa-sec-2012-23.html http://www.wireshark.org/security/wnpa-sec-2012-24.html http://www.wireshark.org/security/wnpa-sec-2012-25.html 2012-07-22 2012-08-18
databases/postgresql*-server -- multiple vulnerabilities postgresql-server 8.3.*8.3.20 8.4.*8.4.13 9.0.*9.0.9 9.1.*9.1.5

The PostgreSQL Global Development Group reports:

The PostgreSQL Global Development Group today released security updates for all active branches of the PostgreSQL database system, including versions 9.1.5, 9.0.9, 8.4.13 and 8.3.20. This update patches security holes associated with libxml2 and libxslt, similar to those affecting other open source projects. All users are urged to update their installations at the first available opportunity

Users who are relying on the built-in XML functionality to validate external DTDs will need to implement a workaround, as this security patch disables that functionality. Users who are using xslt_process() to fetch documents or stylesheets from external URLs will no longer be able to do so. The PostgreSQL project regrets the need to disable both of these features in order to maintain our security standards. These security issues with XML are substantially similar to issues patched recently by the Webkit (CVE-2011-1774), XMLsec (CVE-2011-1425) and PHP5 (CVE-2012-0057) projects.

CVE-2012-3488 CVE-2012-3489 http://www.postgresql.org/about/news/1407/ 2012-08-17 2012-08-17
phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages phpMyAdmin 3.5.2.2

The phpMyAdmin development team reports:

Using a crafted table name, it was possible to produce a XSS : 1) On the Database Structure page, creating a new table with a crafted name 2) On the Database Structure page, using the Empty and Drop links of the crafted table name 3) On the Table Operations page of a crafted table, using the 'Empty the table (TRUNCATE)' and 'Delete the table (DROP)' links 4) On the Triggers page of a database containing tables with a crafted name, when opening the 'Add Trigger' popup 5) When creating a trigger for a table with a crafted name, with an invalid definition. Having crafted data in a database table, it was possible to produce a XSS : 6) When visualizing GIS data, having a crafted label name.

CVE-2012-4345 http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php 2012-08-12 2012-08-17
typo3 -- Multiple vulernabilities in TYPO3 Core typo3 4.5.04.5.19 4.6.04.6.12 4.7.04.7.4

Typo Security Team reports:

It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting, Information Disclosure, Insecure Unserialize leading to Arbitrary Code Execution.

TYPO3 Backend Help System - Due to a missing signature (HMAC) for a parameter in the view_help.php file, an attacker could unserialize arbitrary objects within TYPO3. We are aware of a working exploit, which can lead to arbitrary code execution. A valid backend user login or multiple successful cross site request forgery attacks are required to exploit this vulnerability.

TYPO3 Backend - Failing to properly HTML-encode user input in several places, the TYPO3 backend is susceptible to Cross-Site Scripting. A valid backend user is required to exploit these vulnerabilities.

TYPO3 Backend - Accessing the configuration module discloses the Encryption Key. A valid backend user with access to the configuration module is required to exploit this vulnerability.

TYPO3 HTML Sanitizing API - By not removing several HTML5 JavaScript events, the API method t3lib_div::RemoveXSS() fails to filter specially crafted HTML injections, thus is susceptible to Cross-Site Scripting. Failing to properly encode for JavaScript the API method t3lib_div::quoteJSvalue(), it is susceptible to Cross-Site Scripting.

TYPO3 Install Tool - Failing to properly sanitize user input, the Install Tool is susceptible to Cross-Site Scripting.

https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004/ 2012-08-15 2012-08-15
fetchmail -- two vulnerabilities in NTLM authentication fetchmail 5.0.86.3.21_1

Matthias Andree reports:

With NTLM support enabled, fetchmail might mistake a server-side error message during NTLM protocol exchange for protocol data, leading to a SIGSEGV.

Also, with a carefully crafted NTLM challenge, a malicious server might cause fetchmail to read from a bad memory location, betraying confidential data. It is deemed hard, although not impossible, to steal other accounts' data.

CVE-2012-3482 2012-08-12 2012-08-14 2012-08-27
Several vulnerabilities found in IcedTea-Web icedtea-web 1.2.1

The IcedTea project team reports:

CVE-2012-3422: Use of uninitialized instance pointers

An uninitialized pointer use flaw was found in IcedTea-Web web browser plugin. A malicious web page could use this flaw make IcedTea-Web browser plugin pass invalid pointer to a web browser. Depending on the browser used, it may cause the browser to crash or possibly execute arbitrary code.

The get_cookie_info() and get_proxy_info() call getFirstInTableInstance() with the instance_to_id_map hash as a parameter. If instance_to_id_map is empty (which can happen when plugin was recently removed), getFirstInTableInstance() returns an uninitialized pointer.

CVE-2012-3423: Incorrect handling of non 0-terminated strings

It was discovered that the IcedTea-Web web browser plugin incorrectly assumed that all strings provided by browser are NUL terminated, which is not guaranteed by the NPAPI (Netscape Plugin Application Programming Interface). When used in a browser that does not NUL terminate NPVariant NPStrings, this could lead to buffer over-read or over-write, resulting in possible information leak, crash, or code execution.

Mozilla browsers currently NUL terminate strings, however recent Chrome versions are known not to provide NUL terminated data.

CVE-2012-3422 CVE-2012-3423 http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-July/019580.html 2012-07-31 2012-08-13
libcloud -- possible SSL MITM due to invalid regexp used to validate target server hostname py-libcloud 0.11.1

The libcloud development team reports:

When establishing a secure (SSL / TLS) connection to a target server an invalid regular expression has been used for performing the hostname verification. Subset instead of the full target server hostname has been marked an an acceptable match for the given hostname. For example, certificate with a hostname field of "aexample.com" was considered a valid certificate for domain "example.com".

CVE-2012-3446 http://seclists.org/fulldisclosure/2012/Aug/55 2012-08-01 2012-08-11
phpMyAdmin -- Path disclosure due to missing library phpMyAdmin 3.5.2.1

The phpMyAdmin development team reports:

The show_config_errors.php script does not include a library, so an error message shows the full path of this file, leading to possible further attacks.

CVE-2012-4219 http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php 2012-08-03 2012-08-11
chromium -- multiple vulnerabilities chromium 21.0.1180.75

Google Chrome Releases reports:

[136643] [137721] [137957] High CVE-2012-2862: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[136968] [137361] High CVE-2012-2863: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

CVE-2012-2862 CVE-2012-2863 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-08-08 2012-08-10
chromium -- multiple vulnerabilities chromium 21.0.1180.60

Google Chrome Releases reports:

[Linux only] [125225] Medium CVE-2012-2846: Cross-process interference in renderers. Credit to Google Chrome Security Team (Julien Tinnes).

[127522] Low CVE-2012-2847: Missing re-prompt to user upon excessive downloads. Credit to Matt Austin of Aspect Security.

[127525] Medium CVE-2012-2848: Overly broad file access granted after drag+drop. Credit to Matt Austin of Aspect Security.

[128163] Low CVE-2012-2849: Off-by-one read in GIF decoder. Credit to Atte Kettunen of OUSPG.

[130251] [130592] [130611] [131068] [131237] [131252] [131621] [131690] [132860] Medium CVE-2012-2850: Various lower severity issues in the PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[132585] [132694] [132861] High CVE-2012-2851: Integer overflows in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[134028] High CVE-2012-2852: Use-after-free with bad object linkage in PDF. Credit to Alexey Samsonov of Google.

[134101] Medium CVE-2012-2853: webRequest can interfere with the Chrome Web Store. Credit to Trev of Adblock.

[134519] Low CVE-2012-2854: Leak of pointer values to WebUI renderers. Credit to Nasko Oskov of the Chromium development community.

[134888] High CVE-2012-2855: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[134954] [135264] High CVE-2012-2856: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

[136235] High CVE-2012-2857: Use-after-free in CSS DOM. Credit to Arthur Gerkis.

[136894] High CVE-2012-2858: Buffer overflow in WebP decoder. Credit to Juri Aedla.

[Linux only] [137541] Critical CVE-2012-2859: Crash in tab handling. Credit to Jeff Roberts of Google Security Team.

[137671] Medium CVE-2012-2860: Out-of-bounds access when clicking in date picker. Credit to Chamal de Silva.

CVE-2012-2846 CVE-2012-2847 CVE-2012-2848 CVE-2012-2849 CVE-2012-2850 CVE-2012-2851 CVE-2012-2852 CVE-2012-2853 CVE-2012-2854 CVE-2012-2855 CVE-2012-2856 CVE-2012-2857 CVE-2012-2858 CVE-2012-2859 CVE-2012-2860 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-07-31 2012-08-10
www/chromium -- multiple vulnerabilities chromium 20.0.1132.57

Google Chrome Releases reports:

[129898] High CVE-2012-2842: Use-after-free in counter handling. Credit to miaubiz.

[130595] High CVE-2012-2843: Use-after-free in layout height tracking. Credit to miaubiz.

[133450] High CVE-2012-2844: Bad object access with JavaScript in PDF. Credit to Alexey Samsonov of Google.

CVE-2012-2842 CVE-2012-2843 CVE-2012-2844 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-07-11 2012-08-10
rubygem-rails -- multiple vulnerabilities rubygem-rails 3.2.8 rubygem-actionpack 3.2.8 rubygem-activesupport 3.2.8

Rails core team reports:

This version contains three important security fixes, please upgrade immediately.

One of security fixes impacts all users and is related to HTML escaping code. The other two fixes impacts people using select_tag's prompt option and strip_tags helper from ActionPack.

CVE-2012-3463 Potential XSS Vulnerability in select_tag prompt.

CVE-2012-3464 Potential XSS Vulnerability in the HTML escaping code.

CVE-2012-3465 XSS Vulnerability in strip_tags.

CVE-2012-3463 CVE-2012-3464 CVE-2012-3465 https://groups.google.com/d/msg/rubyonrails-security/fV3QUToSMSw/eHBSFOUYHpYJ https://groups.google.com/d/msg/rubyonrails-security/kKGNeMrnmiY/r2yM7xy-G48J https://groups.google.com/d/msg/rubyonrails-security/FgVEtBajcTY/tYLS1JJTu38J http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ 2012-08-08 2012-08-10
sudosh -- buffer overflow sudosh2 1.0.2 sudosh3 3.2.0_2

ISS reports:

sudosh2 and sudosh3 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the replay() function. By persuading a victim to replay a specially-crafted recorded sudo session, a local attacker could overflow a buffer and execute arbitrary code on the system with elevated privileges or cause the application to crash.

http://xforce.iss.net/xforce/xfdb/55903 http://secunia.com/advisories/38349 http://secunia.com/advisories/38292 2010-01-17 2012-08-09
FreeBSD -- named(8) DNSSEC validation Denial of Service FreeBSD 7.47.4_10 8.18.1_13 8.28.2_10 8.38.3_4 9.09.0_4

Problem description:

BIND 9 stores a cache of query names that are known to be failing due to misconfigured name servers or a broken chain of trust. Under high query loads, when DNSSEC validation is active, it is possible for a condition to arise in which data from this cache of failing queries could be used before it was fully initialized, triggering an assertion failure.

SA-12:05.bind CVE-2012-3817 2012-07-24 2012-08-07
automake -- Insecure 'distcheck' recipe granted world-writable distdir automake 1.5.01.12.2

GNU reports:

The recipe of the 'distcheck' target granted temporary world-write permissions on the extracted distdir. This introduced a locally exploitable race condition for those who run "make distcheck" with a non-restrictive umask (e.g., 022) in a directory that was accessible by others. A successful exploit would result in arbitrary code execution with the privileges of the user running "make distcheck".

It is important to stress that this vulnerability impacts not only the Automake package itself, but all packages with Automake-generated makefiles. For an effective fix it is necessary to regenerate the Makefile.in files with a fixed Automake version.

CVE-2012-3386 https://lists.gnu.org/archive/html/automake/2012-07/msg00023.html 2012-07-09 2012-08-06 2012-08-25
mozilla -- multiple vulnerabilities firefox 11.0,114.0.1,1 10.0.6,1 linux-firefox 10.0.6,1 linux-seamonkey 2.11 linux-thunderbird 10.0.6 seamonkey 2.11 thunderbird 11.014.0 10.0.6 libxul 1.9.2.*10.0.6

The Mozilla Project reports:

MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/ rv:10.0.6)

MFSA 2012-43 Incorrect URL displayed in addressbar through drag and drop

MFSA 2012-44 Gecko memory corruption

MFSA 2012-45 Spoofing issue with location

MFSA 2012-46 XSS through data: URLs

MFSA 2012-47 Improper filtering of javascript in HTML feed-view

MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden

MFSA 2012-49 Same-compartment Security Wrappers can be bypassed

MFSA 2012-50 Out of bounds read in QCMS

MFSA 2012-51 X-Frame-Options header ignored when duplicated

MFSA 2012-52 JSDependentString::undepend string conversion results in memory corruption

MFSA 2012-53 Content Security Policy 1.0 implementation errors cause data leakage

MFSA 2012-54 Clickjacking of certificate warning page

MFSA 2012-55 feed: URLs with an innerURI inherit security context of page

MFSA 2012-56 Code execution through javascript: URLs

CVE-2012-1949 CVE-2012-1950 CVE-2012-1951 CVE-2012-1952 CVE-2012-1953 CVE-2012-1954 CVE-2012-1955 CVE-2012-1957 CVE-2012-1958 CVE-2012-1959 CVE-2012-1960 CVE-2012-1961 CVE-2012-1962 CVE-2012-1963 CVE-2012-1964 CVE-2012-1965 CVE-2012-1966 CVE-2012-1967 http://www.mozilla.org/security/known-vulnerabilities/ http://www.mozilla.org/security/announce/2012/mfsa2012-42.html http://www.mozilla.org/security/announce/2012/mfsa2012-43.html http://www.mozilla.org/security/announce/2012/mfsa2012-44.html http://www.mozilla.org/security/announce/2012/mfsa2012-45.html http://www.mozilla.org/security/announce/2012/mfsa2012-46.html http://www.mozilla.org/security/announce/2012/mfsa2012-47.html http://www.mozilla.org/security/announce/2012/mfsa2012-48.html http://www.mozilla.org/security/announce/2012/mfsa2012-49.html http://www.mozilla.org/security/announce/2012/mfsa2012-50.html http://www.mozilla.org/security/announce/2012/mfsa2012-51.html http://www.mozilla.org/security/announce/2012/mfsa2012-52.html http://www.mozilla.org/security/announce/2012/mfsa2012-53.html http://www.mozilla.org/security/announce/2012/mfsa2012-54.html http://www.mozilla.org/security/announce/2012/mfsa2012-55.html http://www.mozilla.org/security/announce/2012/mfsa2012-56.html 2012-07-17 2012-08-02
Apache -- Insecure LD_LIBRARY_PATH handling apache 2.2.22_5 apache-event 2.2.22_5 apache-itk 2.2.22_5 apache-peruser 2.2.22_5 apache-worker 2.2.22_5

Apache reports:

Insecure handling of LD_LIBRARY_PATH was found that could lead to the current working directory to be searched for DSOs. This could allow a local user to execute code as root if an administrator runs apachectl from an untrusted directory.

CVE-2012-0883 http://httpd.apache.org/security/vulnerabilities_24.html http://www.apache.org/dist/httpd/CHANGES_2.4.2 2012-03-02 2012-08-01
django -- multiple vulnerabilities py26-django 1.41.4.1 1.31.3.2 py27-django 1.41.4.1 1.31.3.2 py26-django-devel 20120731,1 py27-django-devel 20120731,1

The Django project reports:

Today the Django team is issuing multiple releases -- Django 1.3.2 and Django 1.4.1 -- to remedy security issues reported to us:

  • Cross-site scripting in authentication views
  • Denial-of-service in image validation
  • Denial-of-service via get_image_dimensions()

All users are encouraged to upgrade Django immediately.

CVE-2012-3442 CVE-2012-3443 CVE-2012-3444 https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/ 2012-07-30 2012-07-31 2014-04-30
bugzilla -- multiple vulnerabilities bugzilla 3.6.03.6.10 4.0.04.0.7 4.2.04.2.2

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

Information Leak

Versions: 4.1.1 to 4.2.1, 4.3.1

In HTML bugmails, all bug IDs and attachment IDs are linkified, and hovering these links displays a tooltip with the bug summary or the attachment description if the user is allowed to see the bug or attachment. But when validating user permissions when generating the email, the permissions of the user who edited the bug were taken into account instead of the permissions of the addressee. This means that confidential information could be disclosed to the addressee if the other user has more privileges than the addressee. Plain text bugmails are not affected as bug and attachment IDs are not linkified.

Information Leak

Versions: 2.17.5 to 3.6.9, 3.7.1 to 4.0.6, 4.1.1 to 4.2.1, 4.3.1

The description of a private attachment could be visible to a user who hasn't permissions to access this attachment if the attachment ID is mentioned in a public comment in a bug that the user can see.

CVE-2012-1968 CVE-2012-1969 https://bugzilla.mozilla.org/show_bug.cgi?id=777398 https://bugzilla.mozilla.org/show_bug.cgi?id=777586 2012-07-26 2012-07-27
nsd -- Denial of Service nsd 3.2.13

Tom Hendrikx reports:

It is possible to crash (SIGSEGV) a NSD child server process by sending it a DNS packet from any host on the internet and the per zone stats build option is enabled. A crashed child process will automatically be restarted by the parent process, but an attacker may keep the NSD server occupied restarting child processes by sending it a stream of such packets effectively preventing the NSD server to serve.

CVE-2012-2979 http://www.nlnetlabs.nl/downloads/CVE-2012-2979.txt 2012-07-27 2012-07-27
rubygem-actionpack -- Denial of Service rubygem-actionpack 3.2.7

There is a DoS vulnerability in Action Pack digest authentication handling in authenticate_or_request_with_http_digest.

CVE-2012-3424 https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM 2012-07-26 2012-07-26
p5-RT-Authen-ExternalAuth -- privilege escalation p5-RT-Authen-ExternalAuth 0.11

The RT development team reports:

RT::Authen::ExternalAuth 0.10 and below (for all versions of RT) are vulnerable to an escalation of privilege attack where the URL of a RSS feed of the user can be used to acquire a fully logged-in session as that user. CVE-2012-2770 has been assigned to this vulnerability.

Users of RT 3.8.2 and above should upgrade to RT::Authen::ExternalAuth 0.11, which resolves this vulnerability.

http://blog.bestpractical.com/2012/07/security-vulnerabilities-in-three-commonly-deployed-rt-extensions.html CVE-2012-2770 2012-07-25 2012-07-26
isc-dhcp -- multiple vulnerabilities isc-dhcp41-server 4.1.e_5,2 isc-dhcp42-server 4.2.4_1

ISC reports:

An unexpected client identifier parameter can cause the ISC DHCP daemon to segmentation fault when running in DHCPv6 mode, resulting in a denial of service to further client requests. In order to exploit this condition, an attacker must be able to send requests to the DHCP server.

An error in the handling of malformed client identifiers can cause a DHCP server running affected versions (see "Impact") to enter a state where further client requests are not processed and the server process loops endlessly, consuming all available CPU cycles. Under normal circumstances this condition should not be triggered, but a non-conforming or malicious client could deliberately trigger it in a vulnerable server. In order to exploit this condition an attacker must be able to send requests to the DHCP server.

Two memory leaks have been found and fixed in ISC DHCP. Both are reproducible when running in DHCPv6 mode (with the -6 command-line argument.) The first leak is confirmed to only affect servers operating in DHCPv6 mode, but based on initial code analysis the second may theoretically affect DHCPv4 servers (though this has not been demonstrated.)

CVE-2012-3570 CVE-2012-3571 CVE-2012-3954 https://kb.isc.org/article/AA-00714 https://kb.isc.org/article/AA-00712 https://kb.isc.org/article/AA-00737 2012-07-24 2012-07-25
dns/bind9* -- Heavy DNSSEC Validation Load Can Cause a 'Bad Cache' Assertion Failure bind99 9.9.1.2 bind98 9.8.3.2 bind97 9.7.6.2 bind96 9.6.3.1.ESV.R7.2

ISC reports:

High numbers of queries with DNSSEC validation enabled can cause an assertion failure in named, caused by using a 'bad cache' data structure before it has been initialized.

BIND 9 stores a cache of query names that are known to be failing due to misconfigured name servers or a broken chain of trust. Under high query loads when DNSSEC validation is active, it is possible for a condition to arise in which data from this cache of failing queries could be used before it was fully initialized, triggering an assertion failure.

This bug cannot be encountered unless your server is doing DNSSEC validation.

CVE-2012-3817 https://kb.isc.org/article/AA-00729 2012-07-24 2012-07-24
rubygem-activerecord -- multiple vulnerabilities rubygem-activemodel 3.2.4

rubygem-activerecord -- multiple vulernabilities

Due to the way Active Record interprets parameters in combination with the way that Rack parses query parameters, it is possible for an attacker to issue unexpected database queries with "IS NULL" where clauses. This issue does *not* let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL where most users wouldn't expect it.

Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries.

CVE-2012-2660 CVE-2012-2661 https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/8SA-M3as7A8 https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/dUaiOOGWL1k 2012-05-31 2012-07-23 2012-07-23
php -- potential overflow in _php_stream_scandir php5 5.45.4.5 5.35.3.15 5.25.2.17_10 php53 5.3.15 php52 5.2.17_10

The PHP Development Team reports:

The release of PHP 5.4.15 and 5.4.5 fix a potential overflow in _php_stream_scandir

CVE-2012-2688 http://www.php.net/archive/2012.php#id2012-07-19-1 2012-07-19 2012-07-23 2013-01-15
dns/nsd -- DoS vulnerability from non-standard DNS packet nsd 3.2.11_2

Marek Vavrusa and Lubos Slovak report:

It is possible to crash (SIGSEGV) a NSD child server process by sending it a non-standard DNS packet from any host on the internet. A crashed child process will automatically be restarted by the parent process, but an attacker may keep the NSD server occupied restarting child processes by sending it a stream of such packets effectively preventing the NSD server to serve.

CVE-2012-2978 ports/170024 http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt 2012-07-19 2012-07-20 2012-07-21
libjpeg-turbo -- heap-based buffer overflow libjpeg-turbo 1.2.1

The Changelog for version 1.2.1 says: Fixed a regression caused by 1.2.0[6] in which decompressing corrupt JPEG images (specifically, images in which the component count was erroneously set to a large value) would cause libjpeg-turbo to segfault.

A Heap-based buffer overflow was found in the way libjpeg-turbo decompressed certain corrupt JPEG images in which the component count was erroneously set to a large value. An attacker could create a specially-crafted JPEG image that, when opened, could cause an application using libpng to crash or, possibly, execute arbitrary code with the privileges of the user running the application.

CVE-2012-2806 http://sourceforge.net/projects/libjpeg-turbo/files/1.2.1/README.txt https://bugzilla.redhat.com/show_bug.cgi?id=826849 2012-05-31 2012-07-18 2012-07-19
Dokuwiki -- cross site scripting vulnerability dokuwiki 20120125_2

Secunia Research reports:

Secunia Research has discovered a vulnerability in DokuWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "ns" POST parameter in lib/exe/ajax.php (when "call" is set to "medialist" and "do" is set to "media") is not properly sanitised within the "tpl_mediaFileList()" function in inc/template.php before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

http://secunia.com/advisories/49196/ CVE-2012-0283 2012-07-13 2012-07-18
puppet -- multiple vulnerabilities puppet 2.7.*2.7.18

puppet -- multiple vulnerabilities

Arbitrary file read on the puppet master from authenticated clients (high). It is possible to construct an HTTP get request from an authenticated client with a valid certificate that will return the contents of an arbitrary file on the Puppet master that the master has read-access to.

Arbitrary file delete/D.O.S on Puppet Master from authenticated clients (high). Given a Puppet master with the "Delete" directive allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does *not* exist in Puppet as configured by default.

The last_run_report.yaml is world readable (medium). The most recent Puppet run report is stored on the Puppet master with world-readable permissions. The report file contains the context diffs of any changes to configuration on an agent, which may contain sensitive information that an attacker can then access. The last run report is overwritten with every Puppet run.

Arbitrary file read on the Puppet master by an agent (medium). This vulnerability is dependent upon vulnerability "last_run_report.yml is world readable" above. By creating a hard link of a Puppet-managed file to an arbitrary file that the Puppet master can read, an attacker forces the contents to be written to the puppet run summary. The context diff is stored in last_run_report.yaml, which can then be accessed by the attacker.

Insufficient input validation for agent hostnames (low). An attacker could trick the administrator into signing an attacker's certificate rather than the intended one by constructing specially crafted certificate requests containing specific ANSI control sequences. It is possible to use the sequences to rewrite the order of text displayed to an administrator such that display of an invalid certificate and valid certificate are transposed. If the administrator signs the attacker's certificate, the attacker can then man-in-the-middle the agent.

Agents with certnames of IP addresses can be impersonated (low). If an authenticated host with a certname of an IP address changes IP addresses, and a second host assumes the first host's former IP address, the second host will be treated by the puppet master as the first one, giving the second host access to the first host's catalog. Note: This will not be fixed in Puppet versions prior to the forthcoming 3.x. Instead, with this announcement IP-based authentication in Puppet < 3.x is deprecated.

CVE-2012-3864 CVE-2012-3865 CVE-2012-3866 CVE-2012-3867 http://projects.puppetlabs.com/projects/puppet/wiki/Release_Notes#2.7.18 http://puppetlabs.com/security/cve/cve-2012-3864/ http://puppetlabs.com/security/cve/cve-2012-3865/ http://puppetlabs.com/security/cve/cve-2012-3866/ http://puppetlabs.com/security/cve/cve-2012-3867/ 2012-07-05 2012-07-10
asterisk -- multiple vulnerabilities asterisk 10.*10.5.2 asterisk18 1.8.*1.8.13.1

Asterisk project reports:

Possible resource leak on uncompleted re-invite transactions.

Remote crash vulnerability in voice mail application.

CVE-2012-3812 http://downloads.digium.com/pub/security/AST-2012-010.html http://downloads.digium.com/pub/security/AST-2012-011.html https://www.asterisk.org/security 2012-07-05 2012-07-06 2012-08-30
typo3 -- Cross-Site Scripting Vulnerability in TYPO3 Core typo3 4.54.5.17 4.64.6.10 4.74.7.2

Typo3 Security Report (TYPO3-CORE-SA-2012-003):

TYPO3 bundles and uses an external JavaScript and Flash Upload Library called swfupload. TYPO3 can be configured to use this Flash uploader. Input passed via the "movieName" parameter to swfupload.swf is not properly sanitised before being used in a call to "ExternalInterface.call()". This can be exploited to execute arbitrary script code in a user's browser session in context of an affected site. The existance of the swfupload library is sufficient to be vulnerable to the reported problem.

http://secunia.com/advisories/49780/ https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/ 2012-07-04 2012-07-06
phpList -- SQL injection and XSS vulnerability phplist 2.10.17

Zero Science Lab reports:

Input passed via the parameter 'sortby' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The param 'num' is vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2012-2740 CVE-2012-2741 52657 https://www.phplist.com/?lid=567 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php 2012-03-21 2012-07-02
chromium -- multiple vulnerabilities chromium 20.0.1132.43

Google Chrome Releases reports:

[118633] Low CVE-2012-2815: Leak of iframe fragment id. Credit to Elie Bursztein of Google.

[120222] High CVE-2012-2817: Use-after-free in table section handling. Credit to miaubiz.

[120944] High CVE-2012-2818: Use-after-free in counter layout. Credit to miaubiz.

[120977] High CVE-2012-2819: Crash in texture handling. Credit to Ken "gets" Russell of the Chromium development community.

[121926] Medium CVE-2012-2820: Out-of-bounds read in SVG filter handling. Credit to Atte Kettunen of OUSPG.

[122925] Medium CVE-2012-2821: Autofill display problem. Credit to "simonbrown60".

[various] Medium CVE-2012-2822: Misc. lower severity OOB read issues in PDF. Credit to awesome ASAN and various Googlers (Kostya Serebryany, Evgeniy Stepanov, Mateusz Jurczyk, Gynvael Coldwind).

[124356] High CVE-2012-2823: Use-after-free in SVG resource handling. Credit to miaubiz.

[125374] High CVE-2012-2824: Use-after-free in SVG painting. Credit to miaubiz.

[128688] Medium CVE-2012-2826: Out-of-bounds read in texture conversion. Credit to Google Chrome Security Team (Inferno).

[Mac only] [129826] Low CVE-2012-2827: Use-after-free in Mac UI. Credit to the Chromium development community (Dharani Govindan).

[129857] High CVE-2012-2828: Integer overflows in PDF. Credit to Mateusz Jurczyk of Google Security Team and Google Chrome Security Team (Chris Evans).

[129947] High CVE-2012-2829: Use-after-free in first-letter handling. Credit to miaubiz.

[129951] High CVE-2012-2830: Wild pointer in array value setting. Credit to miaubiz.

[130356] High CVE-2012-2831: Use-after-free in SVG reference handling. Credit to miaubiz.

[131553] High CVE-2012-2832: Uninitialized pointer in PDF image codec. Credit to Mateusz Jurczyk of Google Security Team.

[132156] High CVE-2012-2833: Buffer overflow in PDF JS API. Credit to Mateusz Jurczyk of Google Security Team.

[132779] High CVE-2012-2834: Integer overflow in Matroska container. Credit to Juri Aedla.

CVE-2012-2815 CVE-2012-2817 CVE-2012-2818 CVE-2012-2819 CVE-2012-2820 CVE-2012-2821 CVE-2012-2822 CVE-2012-2823 CVE-2012-2824 CVE-2012-2826 CVE-2012-2827 CVE-2012-2828 CVE-2012-2829 CVE-2012-2830 CVE-2012-2831 CVE-2012-2832 CVE-2012-2833 CVE-2012-2834 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-06-26 2012-06-27
FreeBSD -- Privilege escalation when returning from kernel FreeBSD 7.47.4_9 8.18.1_12 8.28.2_9 8.38.3_3 9.09.0_3

Problem description:

FreeBSD/amd64 runs on CPUs from different vendors. Due to varying behaviour of CPUs in 64 bit mode a sanity check of the kernel may be insufficient when returning from a system call.

Successful exploitation of the problem can lead to local kernel privilege escalation, kernel data corruption and/or crash. To exploit this vulnerability, an attacker must be able to run code with user privileges on the target system.

SA-12:04.sysret CVE-2012-0217 2012-06-12 2012-06-27
FreeBSD -- Incorrect handling of zero-length RDATA fields in named(8) FreeBSD 7.47.4_9 8.18.1_11 8.28.2_9 8.38.3_3 9.09.0_3

Problem description:

The named(8) server does not properly handle DNS resource records where the RDATA field is zero length, which may cause various issues for the servers handling them.

Resolving servers may crash or disclose some portion of memory to the client. Authoritative servers may crash on restart after transferring a zone containing records with zero-length RDATA fields. These would result in a denial of service, or leak of sensitive information.

SA-12:03.bind CVE-2012-1667 2012-06-12 2012-06-27
FreeBSD -- Incorrect crypt() hashing FreeBSD 7.47.4_8 8.18.1_10 8.28.2_8 8.38.3_2 9.09.0_2

Problem description:

There is a programming error in the DES implementation used in crypt() when handling input which contains characters that can not be represented with 7-bit ASCII.

When the input contains characters with only the most significant bit set (0x80), that character and all characters after it will be ignored.

SA-12:02.crypt CVE-2012-2143 2012-05-30 2012-06-27
FreeBSD -- OpenSSL multiple vulnerabilities FreeBSD 7.47.4_8 8.18.1_10 8.28.2_8 8.38.3_2 9.09.0_2

Problem description:

OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 records when operating as a client or a server that accept SSL 3.0 handshakes. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory. [CVE-2011-4576]

OpenSSL support for handshake restarts for server gated cryptography (SGC) can be used in a denial-of-service attack. [CVE-2011-4619]

If an application uses OpenSSL's certificate policy checking when verifying X509 certificates, by enabling the X509_V_FLAG_POLICY_CHECK flag, a policy check failure can lead to a double-free. [CVE-2011-4109]

A weakness in the OpenSSL PKCS #7 code can be exploited using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the million message attack (MMA). [CVE-2012-0884]

The asn1_d2i_read_bio() function, used by the d2i_*_bio and d2i_*_fp functions, in OpenSSL contains multiple integer errors that can cause memory corruption when parsing encoded ASN.1 data. This error can occur on systems that parse untrusted ASN.1 data, such as X.509 certificates or RSA public keys. [CVE-2012-2110]

SA-12:01.openssl CVE-2011-4576 CVE-2011-4619 CVE-2011-4109 CVE-2012-0884 CVE-2012-2110 2012-05-03 2012-06-27
pycrypto -- vulnerable ElGamal key generation py-pycrypto 2.52.6

Dwayne C. Litzenberger of PyCrypto reports:

In the ElGamal schemes (for both encryption and signatures), g is supposed to be the generator of the entire Z^*_p group. However, in PyCrypto 2.5 and earlier, g is more simply the generator of a random sub-group of Z^*_p.

The result is that the signature space (when the key is used for signing) or the public key space (when the key is used for encryption) may be greatly reduced from its expected size of log(p) bits, possibly down to 1 bit (the worst case if the order of g is 2).

While it has not been confirmed, it has also been suggested that an attacker might be able to use this fact to determine the private key.

Anyone using ElGamal keys should generate new keys as soon as practical.

Any additional information about this bug will be tracked at https://bugs.launchpad.net/pycrypto/+bug/985164

CVE-2012-2417 http://lists.dlitz.net/pipermail/pycrypto/2012q2/000587.html https://bugs.launchpad.net/pycrypto/+bug/985164 2012-05-24 2012-06-24
joomla -- Privilege Escalation joomla 2.5.5

Joomla! reported a Core Privilege Escalation::

Inadequate checking leads to possible user privilege escalation..

http://developer.joomla.org/security/news/470-20120601-core-privilege-escalation.html 2012-04-29 2012-06-19
clamav -- multiple vulnerabilities clamav 0.97.5 clamav-devel 20120612

MITRE Advisories report:

The TAR parser allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence.

The TAR parser allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size.

The Microsoft CHM file parser allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file.

The TAR file parser allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header ofxi the next entry.

CVE-2012-1419 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 2012-03-19 2012-06-16
asterisk -- remote crash vulnerability asterisk10 10.*10.5.1

Asterisk project reports:

Skinny Channel Driver Remote Crash Vulnerability.

CVE-2012-3553 http://downloads.digium.com/pub/security/AST-2012-009.html https://www.asterisk.org/security 2012-06-14 2012-06-14
ImageMagick -- multiple vulnerabilities ImageMagick 6.7.6.4 ImageMagick-nox11 6.7.6.4

ImageMagick reports:

Three vulnerabilities have been identified in ImageMagick's handling of JPEG and TIFF files. With these vulnerabilities, it is possible to cause a denial of service situation in the target system.

CVE-2012-0259 CVE-2012-0260 CVE-2012-1798 http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629 http://www.cert.fi/en/reports/2012/vulnerability635606.html 2012-03-28 2012-06-14 2014-04-30
mantis -- multiple vulnerabilities mantis 1.2.11

Mantis reports:

Roland Becker and Damien Regad (MantisBT developers) found that any user able to report issues via the SOAP interface could also modify any bugnotes (comments) created by other users. In a default/typical MantisBT installation, SOAP API is enabled and any user can sign up to report new issues. This vulnerability therefore impacts upon many public facing MantisBT installations.

Roland Becker (MantisBT developer) found that the delete_attachments_threshold permission was not being checked when a user attempted to delete an attachment from an issue. The more generic update_bug_threshold permission was being checked instead. MantisBT administrators may have been under the false impression that their configuration of the delete_attachments_threshold was successfully preventing unwanted users from deleting attachments.

CVE-2012-2691 CVE-2012-2692 http://www.openwall.com/lists/oss-security/2012/06/09/1 http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&forum_name=mantisbt-dev 2012-06-09 2012-06-12 2012-06-13
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.236

Adobe reports:

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-2034 CVE-2012-2035 CVE-2012-2036 CVE-2012-2037 CVE-2012-2038 CVE-2012-2039 CVE-2012-2040 http://www.adobe.com/support/security/bulletins/apsb12-14.html 2012-06-08 2012-06-09
mozilla -- multiple vulnerabilities firefox 11.0,113.0,1 10.0.5,1 linux-firefox 10.0.5,1 linux-seamonkey 2.10 linux-thunderbird 10.0.5 seamonkey 2.10 thunderbird 11.013.0 10.0.5 libxul 1.9.2.*10.0.5

The Mozilla Project reports:

MFSA 2012-34 Miscellaneous memory safety hazards (rv:13.0/ rv:10.0.5)

MFSA 2012-36 Content Security Policy inline-script bypass

MFSA 2012-37 Information disclosure though Windows file shares and shortcut files

MFSA 2012-38 Use-after-free while replacing/inserting a node in a document

MFSA 2012-39 NSS parsing errors with zero length items

MFSA 2012-40 Buffer overflow and use-after-free issues found using Address Sanitizer

CVE-2011-3101 CVE-2012-0441 CVE-2012-1938 CVE-2012-1939 CVE-2012-1937 CVE-2012-1940 CVE-2012-1941 CVE-2012-1944 CVE-2012-1945 CVE-2012-1946 CVE-2012-1947 http://www.mozilla.org/security/known-vulnerabilities/ http://www.mozilla.org/security/announce/2012/mfsa2012-34.html http://www.mozilla.org/security/announce/2012/mfsa2012-36.html http://www.mozilla.org/security/announce/2012/mfsa2012-37.html http://www.mozilla.org/security/announce/2012/mfsa2012-38.html http://www.mozilla.org/security/announce/2012/mfsa2012-39.html http://www.mozilla.org/security/announce/2012/mfsa2012-40.html 2012-06-05 2012-06-05
quagga -- BGP OPEN denial of service vulnerability quagga 0.99.20.1 quagga-re 0.99.17.10

CERT reports:

If a pre-configured BGP peer sends a specially-crafted OPEN message with a malformed ORF capability TLV, Quagga bgpd process will erroneously try to consume extra bytes from the input packet buffer. The process will detect a buffer overrun attempt before it happens and immediately terminate with an error message. All BGP sessions established by the attacked router will be closed and its BGP routing disrupted.

CVE-2012-1820 http://www.kb.cert.org/vuls/id/962587 2012-06-04 2012-06-05
mail/sympa* -- Multiple vulnerabilities in Sympa archive management sympa 6.0.7 6.1.*6.1.11

David Verdin reports:

Multiple vulnerabilities have been discovered in Sympa archive management that allow to skip the scenario-based authorization mechanisms.

This vulnerability allows the attacker to:

  • display the archives management page ('arc_manage')
  • download the list's archives
  • delete the list's archives
http://www.sympa.org/security_advisories#security_breaches_in_archives_management 2012-05-15 2012-06-05
dns/bind9* -- zero-length RDATA can cause named to terminate, reveal memory bind99 9.9.1.1 bind98 9.8.3.1 bind97 9.7.6.1 bind96 9.6.3.1.ESV.R7.1

ISC reports:

Processing of DNS resource records where the rdata field is zero length may cause various issues for the servers handling them.

Processing of these records may lead to unexpected outcomes. Recursive servers may crash or disclose some portion of memory to the client. Secondary servers may crash on restart after transferring a zone containing these records. Master servers may corrupt zone data if the zone option "auto-dnssec" is set to "maintain". Other unexpected problems that are not listed here may also be encountered.

Impact: This issue primarily affects recursive nameservers. Authoritative nameservers will only be impacted if an administrator configures experimental record types with no data. If the server is configured this way, then secondaries can crash on restart after transferring that zone. Zone data on the master can become corrupted if the zone with those records has named configured to manage the DNSSEC key rotation.

CVE-2012-1667 http://www.isc.org/software/bind/advisories/cve-2012-1667 2012-06-04 2012-06-04 2012-06-06
databases/postgresql*-server -- crypt vulnerabilities postgresql-server 8.3.*8.3.18_1 8.4.*8.4.11_1 9.0.*9.0.7_2 9.1.*9.1.3_1 9.2.*9.2.b1_1

The PostgreSQL Global Development Group reports:

Today the PHP, OpenBSD and FreeBSD communities announced updates to patch a security hole involving their crypt() hashing algorithms. This issue is described in CVE-2012-2143. This vulnerability also affects a minority of PostgreSQL users, and will be fixed in an update release on June 4, 2012.

Affected users are those who use the crypt(text, text) function with DES encryption in the optional pg_crypto module. Passwords affected are those that contain characters that cannot be represented with 7-bit ASCII. If a password contains a character that has the most significant bit set (0x80), and DES encryption is used, that character and all characters after it will be ignored.

CVE-2012-2143 http://www.postgresql.org/about/news/1397/ http://git.postgresql.org/gitweb/?p=postgresql.git;a=patch;h=932ded2ed51e8333852e370c7a6dad75d9f236f9 2012-05-30 2012-05-30 2012-05-31
nut -- upsd can be remotely crashed nut 2.4.02.6.3

Networkupstools project reports:

NUT server (upsd), from versions 2.4.0 to 2.6.3, are exposed to crashes when receiving random data from the network.

This issue is related to the way NUT parses characters, especially from the network. Non printable characters were missed from strings operation (such as strlen), but still copied to the buffer, causing an overflow.

CVE-2012-2944 http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1027934.html http://trac.networkupstools.org/projects/nut/changeset/3633 2012-05-30 2012-05-30
asterisk -- multiple vulnerabilities asterisk16 1.6.*1.6.2.24 asterisk18 1.8.*1.8.12.1 asterisk10 10.*10.4.1

Asterisk project reports:

Remote crash vulnerability in IAX2 channel driver.

Skinny Channel Driver Remote Crash Vulnerability

CVE-2012-2947 http://downloads.digium.com/pub/security/AST-2012-007.html CVE-2012-2948 http://downloads.digium.com/pub/security/AST-2012-008.html https://www.asterisk.org/security 2012-05-29 2012-05-29 2012-05-29
chromium -- multiple vulnerabilities chromium 19.0.1084.52

Google Chrome Releases reports:

[117409] High CVE-2011-3103: Crashes in v8 garbage collection. Credit to the Chromium development community (Brett Wilson).

[118018] Medium CVE-2011-3104: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).

[120912] High CVE-2011-3105: Use-after-free in first-letter handling. Credit to miaubiz.

[122654] Critical CVE-2011-3106: Browser memory corruption with websockets over SSL. Credit to the Chromium development community (Dharani Govindan).

[124625] High CVE-2011-3107: Crashes in the plug-in JavaScript bindings. Credit to the Chromium development community (Dharani Govindan).

[125159] Critical CVE-2011-3108: Use-after-free in browser cache. Credit to "efbiaiinzinz".

[Linux only] [126296] High CVE-2011-3109: Bad cast in GTK UI. Credit to Micha Bartholome.

[126337] [126343] [126378] [127349] [127819] [127868] High CVE-2011-3110: Out of bounds writes in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.

[126414] Medium CVE-2011-3111: Invalid read in v8. Credit to Christian Holler.

[127331] High CVE-2011-3112: Use-after-free with invalid encrypted PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.

[127883] High CVE-2011-3113: Invalid cast with colorspace handling in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.

[128014] High CVE-2011-3114: Buffer overflows with PDF functions. Credit to Google Chrome Security Team (scarybeasts).

[128018] High CVE-2011-3115: Type corruption in v8. Credit to Christian Holler.

CVE-2011-3103 CVE-2011-3104 CVE-2011-3105 CVE-2011-3106 CVE-2011-3107 CVE-2011-3108 CVE-2011-3110 CVE-2011-3111 CVE-2011-3112 CVE-2011-3113 CVE-2011-3114 CVE-2011-3115 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-05-23 2012-05-28
haproxy -- buffer overflow haproxy 1.4.21

HAProxy reports:

A flaw was reported in HAProxy where, due to a boundary error when copying data into the trash buffer, an external attacker could cause a buffer overflow. Exploiting this flaw could lead to the execution of arbitrary code, however it requires non-default settings for the global.tune.bufsize configuration option (must be set to a value greater than the default), and also that header rewriting is enabled (via, for example, the regrep or rsprep directives). This flaw is reported against 1.4.20, prior versions may also be affected.

CVE-2012-2391 https://secunia.com/advisories/49261/ http://haproxy.1wt.eu/download/1.4/src/CHANGELOG http://haproxy.1wt.eu/git?p=haproxy-1.4.git;a=commit;h=30297cb17147a8d339eb160226bcc08c91d9530b http://haproxy.1wt.eu/news.html 2012-05-21 2012-05-24 2012-05-29
RT -- Multiple Vulnerabilities rt40 4.04.0.6 rt38 3.8.12

BestPractical report:

Internal audits of the RT codebase have uncovered a number of security vulnerabilities in RT. We are releasing versions 3.8.12 and 4.0.6 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 3.8 and 4.0.

The vulnerabilities addressed by 3.8.12, 4.0.6, and the below patches include the following:

The previously released tool to upgrade weak password hashes as part of CVE-2011-0009 was an incomplete fix and failed to upgrade passwords of disabled users.

RT versions 3.0 and above contain a number of cross-site scripting (XSS) vulnerabilities which allow an attacker to run JavaScript with the user's credentials. CVE-2011-2083 is assigned to this vulnerability.

RT versions 3.0 and above are vulnerable to multiple information disclosure vulnerabilities. This includes the ability for privileged users to expose users' previous password hashes -- this vulnerability is particularly dangerous given RT's weak hashing previous to the fix in CVE-2011-0009. A separate vulnerability allows privileged users to obtain correspondence history for any ticket in RT. CVE-2011-2084 is assigned to this vulnerability.

All publicly released versions of RT are vulnerable to cross-site request forgery (CSRF). CVE-2011-2085 is assigned to this vulnerability.

We have also added a separate configuration option ($RestrictLoginReferrer) to prevent login CSRF, a different class of CSRF attack.

RT versions 3.6.1 and above are vulnerable to a remote execution of code vulnerability if the optional VERP configuration options ($VERPPrefix and $VERPDomain) are enabled. RT 3.8.0 and higher are vulnerable to a limited remote execution of code which can be leveraged for privilege escalation. RT 4.0.0 and above contain a vulnerability in the global $DisallowExecuteCode option, allowing sufficiently privileged users to still execute code even if RT was configured to not allow it. CVE-2011-4458 is assigned to this set of vulnerabilities.

RT versions 3.0 and above may, under some circumstances, still respect rights that a user only has by way of a currently-disabled group. CVE-2011-4459 is assigned to this vulnerability.

RT versions 2.0 and above are vulnerable to a SQL injection attack, which allow privileged users to obtain arbitrary information from the database. CVE-2011-4460 is assigned to this vulnerability.

CVE-2011-0009 CVE-2011-2082 CVE-2011-2083 CVE-2011-2084 CVE-2011-2085 CVE-2011-4458 CVE-2011-4459 CVE-2011-4460 http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html 2012-05-22 2012-05-23
sympa -- Multiple Security Bypass Vulnerabilities sympa 6.1.11

Secunia team reports:

Multiple vulnerabilities have been reported in Sympa, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerabilities are caused due to the application allowing access to archive functions without checking credentials. This can be exploited to create, download, and delete an archive.

CVE-2012-2352 http://secunia.com/advisories/49045/ 2012-05-14 2012-05-21
foswiki -- Script Insertion Vulnerability via unchecked user registration fields foswiki 1.1.5

Foswiki team reports:

When a new user registers, the new user can add arbitrary HTML and script code into the user topic which is generated by the RegistrationAgent via standard registration fields such as "FirstName" or "OrganisationName".

By design, Foswiki's normal editing features allow arbitrary HTML markup, including script code, to be inserted into any topic anyway, assuming the authenticated user has CHANGE permission - which is the case on many Foswiki sites. However, the assumption that only authenticated users with CHANGE permission may create script content is false if new users exploit the vulnerability detailed in this alert to manipulate the registration agent into creating that content for them.

CVE-2012-1004 http://foswiki.org/Support/SecurityAlert-CVE-2012-1004 2012-04-13 2012-05-21
libxml2 -- An off-by-one out-of-bounds write by XPointer libxml2 2.7.8_3 linux-f10-libxml2 2.7.8_3

Google chrome team reports:

An off-by-one out-of-bounds write flaw was found in the way libxml, a library for providing XML and HTML support, evaluated certain XPointer parts (XPointer is used by libxml to include only the part from the returned XML document, that can be accessed using the XPath expression given with the XPointer). A remote attacker could provide a specially-crafted XML file, which once opened in an application, linked against libxml, would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.

Note: The flaw to be exploited requires the particular application, linked against libxml, to use the XPointer evaluation functionality.

CVE-2011-3202 http://googlechromereleases.blogspot.com/2012/05/stable-channel-update.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3102 2012-05-15 2012-05-18 2014-04-30
inspircd -- buffer overflow inspircd 1.21.2.9 2.02.0.5_2

InspIRCd reports:

InspIRCd contains a heap corruption vulnerability that exists in the dns.cpp code. The res[] buffer is allocated on the heap and can be overflowed. The res[] buffer can be exploited during its deallocation. The number of overflowed bytes can be controlled with DNS compression features.

CVE-2012-1836 http://inspircd.github.com/ 2012-03-19 2012-05-17 2012-06-21
pidgin-otr -- format string vulnerability pidgin-otr 3.2.1

The authors report:

Versions 3.2.0 and earlier of the pidgin-otr plugin contain a format string security flaw. This flaw could potentially be exploited by a remote attacker to cause arbitrary code to be executed on the user's machine.

The flaw is in pidgin-otr, not in libotr. Other applications that use libotr are not affected.

CVE-2012-2369 http://www.cypherpunks.ca/otr/ 2012-05-16 2012-05-16
sudo -- netmask vulnerability sudo 1.8.4_1

Todd Miller reports:

Sudo supports granting access to commands on a per-host basis. The host specification may be in the form of a host name, a netgroup, an IP address, or an IP network (an IP address with an associated netmask).

When IPv6 support was added to sudo, a bug was introduced that caused the IPv6 network matching code to be called when an IPv4 network address does not match. Depending on the value of the uninitialized portion of the IPv6 address, it is possible for the IPv4 network number to match when it should not. This bug only affects IP network matching and does not affect simple IP address matching.

The reported configuration that exhibited the bug was an LDAP-based sudo installation where the sudoRole object contained multiple sudoHost entries, each containing a different IPv4 network. File-based sudoers should be affected as well as the same matching code is used.

CVE-2012-2337 http://www.sudo.ws/sudo/alerts/netmask.html 2012-05-16 2012-05-16
OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service openssl 1.0.1_2

OpenSSL security team reports:

A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and DTLS can be exploited in a denial of service attack on both clients and servers.

CVE-2012-2333 http://www.openssl.org/news/secadv_20120510.txt 2012-05-10 2012-05-10
chromium -- multiple vulnerabilities chromium 19.0.1084.46

Google Chrome Releases reports:

[112983] Low CVE-2011-3083: Browser crash with video + FTP. Credit to Aki Helin of OUSPG.

[113496] Low CVE-2011-3084: Load links from internal pages in their own process. Credit to Brett Wilson of the Chromium development community.

[118374] Medium CVE-2011-3085: UI corruption with long autofilled values. Credit to "psaldorn".

[118642] High CVE-2011-3086: Use-after-free with style element. Credit to Arthur Gerkis.

[118664] Low CVE-2011-3087: Incorrect window navigation. Credit to Charlie Reis of the Chromium development community.

[120648] Medium CVE-2011-3088: Out-of-bounds read in hairline drawing. Credit to Aki Helin of OUSPG.

[120711] High CVE-2011-3089: Use-after-free in table handling. Credit to miaubiz.

[121223] Medium CVE-2011-3090: Race condition with workers. Credit to Arthur Gerkis.

[121734] High CVE-2011-3091: Use-after-free with indexed DB. Credit to Google Chrome Security Team (Inferno).

[122337] High CVE-2011-3092: Invalid write in v8 regex. Credit to Christian Holler.

[122585] Medium CVE-2011-3093: Out-of-bounds read in glyph handling. Credit to miaubiz.

[122586] Medium CVE-2011-3094: Out-of-bounds read in Tibetan handling. Credit to miaubiz.

[123481] High CVE-2011-3095: Out-of-bounds write in OGG container. Credit to Hannu Heikkinen.

[Linux only] [123530] Low CVE-2011-3096: Use-after-free in GTK omnibox handling. Credit to Arthur Gerkis.

[123733] [124182] High CVE-2011-3097: Out-of-bounds write in sampled functions with PDF. Credit to Kostya Serebryany of Google and Evgeniy Stepanov of Google.

[124479] High CVE-2011-3099: Use-after-free in PDF with corrupt font encoding name. Credit to Mateusz Jurczyk of Google Security Team and Gynvael Coldwind of Google Security Team.

[124652] Medium CVE-2011-3100: Out-of-bounds read drawing dash paths. Credit to Google Chrome Security Team (Inferno).

CVE-2011-3083 CVE-2011-3084 CVE-2011-3085 CVE-2011-3086 CVE-2011-3087 CVE-2011-3088 CVE-2011-3089 CVE-2011-3090 CVE-2011-3091 CVE-2011-3092 CVE-2011-3093 CVE-2011-3094 CVE-2011-3095 CVE-2011-3096 CVE-2011-3097 CVE-2011-3099 CVE-2011-3100 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-05-15 2012-05-15
socat -- Heap-based buffer overflow socat 1.7.2.1

The socat development team reports:

This vulnerability can be exploited when socat is invoked with the READLINE address (this is usually only used interactively) without option "prompt" and without option "noprompt" and an attacker succeeds to provide malicious data to the other (arbitrary) address that is then transferred by socat to the READLINE address for output.

Successful exploitation may allow an attacker to execute arbitrary code with the privileges of the socat process.

CVE-2012-0219 www.dest-unreach.org/socat/contrib/socat-secadv3.html 2012-05-14 2012-05-14
php -- multiple vulnerabilities php5 5.45.4.3 5.3.13 php53 5.3.13 php52 5.2.17_9

The PHP Development Team reports:

The release of PHP 5.4.13 and 5.4.3 complete a fix for the vulnerability in CGI-based setups as originally described in CVE-2012-1823. (CVE-2012-2311)

Note: mod_php and php-fpm are not vulnerable to this attack.

PHP 5.4.3 fixes a buffer overflow vulnerability in the apache_request_headers() (CVE-2012-2329).

CVE-2012-1823 CVE-2012-2311 CVE-2012-2329 2012-05-08 2012-05-12
libpurple -- Invalid memory dereference in the XMPP protocol plug-in by processing serie of specially-crafted file transfer requests libpurple 2.10.4

Pidgin reports:

A series of specially crafted file transfer requests can cause clients to reference invalid memory. The user must have accepted one of the file transfer requests.

CVE-2012-2214 2012-05-06 2012-05-12
PivotX -- 'ajaxhelper.php' Cross Site Scripting Vulnerability pivotx 2.3.2

High-Tech Bridge reports:

Input passed via the "file" GET parameter to /pivotx/ajaxhelper.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in administrator's browser session in context of the affected website.

52159 CVE-2012-2274 https://www.htbridge.com/advisory/HTB23087 2012-05-09 2012-05-12 2012-05-14
NVIDIA UNIX driver -- access to arbitrary system memory nvidia-driver 173.14.35_2295.71 96.43.20_3173.14.35 71.86.15_396.43.20_2 71.86.15_2

NVIDIA Unix security team reports:

Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver was disclosed to NVIDIA on March 20th, 2012. The vulnerability makes it possible for an attacker who has read and write access to the GPU device nodes to reconfigure GPUs to gain access to arbitrary system memory. NVIDIA is not aware of any reports of this vulnerability, outside of the disclosure which was made privately to NVIDIA.

NVIDIA has identified the root cause of the vulnerability and has released updated drivers which close it. [NVIDIA encourages] all users with Geforce 8 or newer, G80 Quadro or newer, and all Tesla GPUs to update their drivers to 295.40 or later.

Later, it was additionally discovered that similar exploit could be achieved through remapping of VGA window:

NVIDIA received notification of a security exploit that uses NVIDIA UNIX device files to map and program registers to redirect the VGA window. Through the VGA window, the exploit can access any region of physical system memory. This arbitrary memory access can be further exploited, for example, to escalate user privileges.

CVE-2012-0946 CVE-2012-4225 2012-03-20 2012-05-10 2012-09-12
rubygem-mail -- multiple vulnerabilities rubygem-mail 2.4.4

rubygem-mail -- multiple vulnerabilities

Two issues were fixed. They are a file system traversal in file_delivery method and arbitrary command execution when using exim or sendmail from the command line.

CVE-2012-2139 CVE-2012-2140 http://seclists.org/oss-sec/2012/q2/190 2012-03-14 2012-05-09
node -- private information disclosure node node-devel 0.6.17

Private information disclosure

An attacker can cause private information disclosure.

http://blog.nodejs.org/2012/05/07/http-server-security-vulnerability-please-upgrade-to-0-6-17/ 2012-04-17 2012-05-07
p5-Config-IniFiles -- unsafe temporary file creation p5-Config-IniFiles 2.71

Unsafe Temporary file creation

Config::IniFiles used a predictable name for its temporary file without opening it correctly.

CVE-2012-2451 https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59 2012-05-02 2012-05-07
php -- vulnerability in certain CGI-based setups php5 5.45.4.2 5.3.12 php53 5.3.12 php4 4.4.10 php52 5.2.17_8

php development team reports:

Security Enhancements and Fixes in PHP 5.3.12:

  • Initial fix for cgi-bin ?-s cmdarg parse issue (CVE-2012-1823)
CVE-2012-1823 2012-05-03 2012-05-05
WebCalendar -- multiple vulnerabilities WebCalendar-devel 1.2.4

Hanno Boeck reports:

Fixes [are now available] for various security vulnerabilities including LFI (local file inclusion), XSS (cross site scripting) and others.

CVE-2012-1495 CVE-2012-1496 http://packetstormsecurity.org/files/112332/WebCalendar-1.2.4-Remote-Code-Execution.html http://packetstormsecurity.org/files/112323/WebCalendar-1.2.4-Pre-Auth-Remote-Code-Injection.html http://archives.neohapsis.com/archives/bugtraq/2012-04/0182.html 2012-04-28 2012-05-02
chromium -- multiple vulnerabilities chromium 18.0.1025.168

Google Chrome Releases reports:

[106413] High CVE-2011-3078: Use after free in floats handling. Credit to Google Chrome Security Team (Marty Barbella) and independent later discovery by miaubiz.

[117627] Medium CVE-2011-3079: IPC validation failure. Credit to PinkiePie.

[121726] Medium CVE-2011-3080: Race condition in sandbox IPC. Credit to Willem Pinckaers of Matasano.

[121899] High CVE-2011-3081: Use after free in floats handling. Credit to miaubiz.

[117110] High CVE-2012-1521: Use after free in xml parser. Credit to Google Chrome Security Team (SkyLined) and independent later discovery by wushi of team509 reported through iDefense VCP (V-874rcfpq7z).

CVE-2011-3078 CVE-2011-3079 CVE-2011-3080 CVE-2011-3081 CVE-2012-1521 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-04-30 2012-05-01
php -- multiple vulnerabilities php53 5.3.11 php5 5.3.11

php development team reports:

Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:

  • Insufficient validating of upload name leading to corrupted $_FILES indices. (CVE-2012-1172)
  • Add open_basedir checks to readline_write_history and readline_read_history.

Security Enhancements for both PHP 5.3.11 only:

  • Regression in magic_quotes_gpc fix for CVE-2012-0831.
CVE-2012-0831 CVE-2012-1172 http://www.php.net/archive/2012.php#id2012-04-26-1 2012-03-01 2012-04-28 2012-05-04
samba -- incorrect permission checks vulnerability samba34 3.4.*3.4.17 samba35 3.5.*3.5.15 samba36 3.6.*3.6.5

The Samba project reports:

Samba versions 3.4.x to 3.6.4 inclusive are affected by a vulnerability that allows arbitrary users to modify privileges on a file server.

Security checks were incorrectly applied to the Local Security Authority (LSA) remote proceedure calls (RPC) CreateAccount, OpenAccount, AddAccountRights and RemoveAccountRights allowing any authenticated user to modify the privileges database.

This is a serious error, as it means that authenticated users can connect to the LSA and grant themselves the "take ownership" privilege. This privilege is used by the smbd file server to grant the ability to change ownership of a file or directory which means users could take ownership of files or directories they do not own.

CVE-2012-2111 2012-04-30 2012-04-30
portupgrade-devel -- lack of distfile checksums portupgrade-devel 0,3

Ports security team reports:

The portupgrade-devel port fetched directly from a git respository without checking against a known good SHA hash. This means that it is possible that packages built using this port may not match the one vetted by the maintainer. Users are advised to rebuild portupgrade-devel from known good sources.

http://web.archiveorange.com/archive/v/6ETvLYPz7CfFT9tiHKiI http://www.freebsd.org/cgi/getmsg.cgi?fetch=100677+0+/usr/local/www/db/text/2012/cvs-ports/20120506.cvs-ports 2012-04-30 2012-04-30 2012-05-06
net-snmp -- Remote DoS net-snmp 5.7.1_7

The Red Hat Security Response Team reports:

An array index error, leading to out-of heap-based buffer read flaw was found in the way the net-snmp agent performed lookups in the extension table. When certain MIB subtrees were handled by the extend directive, a remote attacker (having read privileges to the subntree) could use this flaw to cause a denial of service condition via an SNMP GET request involving a non-existent extension table entry.

CVE-2012-2141 https://bugzilla.redhat.com/show_bug.cgi?id=815813 http://www.openwall.com/lists/oss-security/2012/04/26/2 2012-04-26 2012-04-27
mozilla -- multiple vulnerabilities firefox 11.0,112.0,1 10.0.4,1 linux-firefox 10.0.4,1 linux-seamonkey 2.9 linux-thunderbird 10.0.4 seamonkey 2.9 thunderbird 11.012.0 10.0.4 libxul 1.9.2.*10.0.4

The Mozilla Project reports:

MFSA 2012-20 Miscellaneous memory safety hazards (rv:12.0/ rv:10.0.4)

MFSA 2012-21 Multiple security flaws fixed in FreeType v2.4.9

MFSA 2012-22 use-after-free in IDBKeyRange

MFSA 2012-23 Invalid frees causes heap corruption in gfxImageSurface

MFSA 2012-24 Potential XSS via multibyte content processing errors

MFSA 2012-25 Potential memory corruption during font rendering using cairo-dwrite

MFSA 2012-26 WebGL.drawElements may read illegal video memory due to FindMaxUshortElement error

MFSA 2012-27 Page load short-circuit can lead to XSS

MFSA 2012-28 Ambiguous IPv6 in Origin headers may bypass webserver access restrictions

MFSA 2012-29 Potential XSS through ISO-2022-KR/ISO-2022-CN decoding issues

MFSA 2012-30 Crash with WebGL content using textImage2D

MFSA 2012-31 Off-by-one error in OpenType Sanitizer

MFSA 2012-32 HTTP Redirections and remote content can be read by javascript errors

MFSA 2012-33 Potential site identity spoofing when loading RSS and Atom feeds

CVE-2011-1187 CVE-2011-3062 CVE-2012-0467 CVE-2012-0468 CVE-2012-0469 CVE-2012-0470 CVE-2012-0471 CVE-2012-0472 CVE-2012-0473 CVE-2012-0474 CVE-2012-0475 CVE-2012-0477 CVE-2012-0478 CVE-2012-0479 CVE-2012-1126 CVE-2012-1127 CVE-2012-1128 CVE-2012-1129 CVE-2012-1130 CVE-2012-1131 CVE-2012-1132 CVE-2012-1133 CVE-2012-1134 CVE-2012-1135 CVE-2012-1136 CVE-2012-1137 CVE-2012-1138 CVE-2012-1139 CVE-2012-1140 CVE-2012-1141 CVE-2012-1142 CVE-2012-1143 CVE-2012-1144 http://www.mozilla.org/security/announce/2012/mfsa2012-20.html http://www.mozilla.org/security/announce/2012/mfsa2012-21.html http://www.mozilla.org/security/announce/2012/mfsa2012-22.html http://www.mozilla.org/security/announce/2012/mfsa2012-23.html http://www.mozilla.org/security/announce/2012/mfsa2012-24.html http://www.mozilla.org/security/announce/2012/mfsa2012-25.html http://www.mozilla.org/security/announce/2012/mfsa2012-26.html http://www.mozilla.org/security/announce/2012/mfsa2012-27.html http://www.mozilla.org/security/announce/2012/mfsa2012-28.html http://www.mozilla.org/security/announce/2012/mfsa2012-29.html http://www.mozilla.org/security/announce/2012/mfsa2012-30.html http://www.mozilla.org/security/announce/2012/mfsa2012-31.html http://www.mozilla.org/security/announce/2012/mfsa2012-32.html http://www.mozilla.org/security/announce/2012/mfsa2012-33.html 2012-04-24 2012-04-24
Dokuwiki -- cross site scripting vulnerability dokuwiki 20120125_1

Andy Webber reports:

Add User appears to be vulnerable to Cross Site Request Forgery (CSRF/XSRF).

CVE-2012-2128 CVE-2012-2129 2012-04-17 2012-04-23
asterisk -- multiple vulnerabilities asterisk16 1.6.*1.6.2.24 asterisk18 1.8.*1.8.11.1 asterisk10 10.*10.3.1

Asterisk project reports:

Remote Crash Vulnerability in SIP Channel Driver

Heap Buffer Overflow in Skinny Channel Driver

Asterisk Manager User Unauthorized Shell Access

http://downloads.digium.com/pub/security/AST-2012-004.html CVE-2012-2414 http://downloads.digium.com/pub/security/AST-2012-005.html CVE-2012-2415 http://downloads.digium.com/pub/security/AST-2012-006.html CVE-2012-2416 2012-04-23 2012-04-23
wordpress -- multiple vulnerabilities wordpress 3.3.2,1

Wordpress reports:

External code has been updated to non-vulnerable versions. In addition the following bugs have been fixed:

  • Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances.
  • Cross-site scripting vulnerability when making URLs clickable.
  • Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs.
CVE-2012-2399 CVE-2012-2400 CVE-2012-2401 CVE-2012-2402 CVE-2012-2403 CVE-2012-2404 https://codex.wordpress.org/Version_3.3.2 2012-04-20 2012-04-23
OpenSSL -- integer conversions result in memory corruption openssl 1.0.1_1

OpenSSL security team reports:

A potentially exploitable vulnerability has been discovered in the OpenSSL function asn1_d2i_read_bio. Any application which uses BIO or FILE based functions to read untrusted DER format data is vulnerable. Affected functions are of the form d2i_*_bio or d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.

CVE-2012-2110 http://marc.info/?l=full-disclosure&m=133483221408243 http://www.openssl.org/news/secadv_20120419.txt 2012-04-19 2012-04-21
bugzilla -- multiple vulnerabilities bugzilla 3.6.03.6.9 4.0.04.0.6

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

Unauthorized Access

Due to a lack of proper validation of the X-FORWARDED-FOR header of an authentication request, an attacker could bypass the current lockout policy used for protection against brute- force password discovery. This vulnerability can only be exploited if the 'inbound_proxies' parameter is set.

Cross Site Scripting

A JavaScript template used by buglist.cgi could be used by a malicious script to permit an attacker to gain access to some information about bugs he would not normally be allowed to see, using the victim's credentials. To be exploitable, the victim must be logged in when visiting the attacker's malicious page.

All affected installations are encouraged to upgrade as soon as possible.

CVE-2012-0465 CVE-2012-0466 https://bugzilla.mozilla.org/show_bug.cgi?id=728639 https://bugzilla.mozilla.org/show_bug.cgi?id=745397 2012-04-18 2012-04-21
typo -- Cross-Site Scripting typo3 4.6.04.6.7 4.5.04.5.14 4.4.04.4.14

Typo Security Team reports:

Failing to properly encode the output, the default TYPO3 Exception Handler is susceptible to Cross-Site Scripting. We are not aware of a possibility to exploit this vulnerability without third party extensions being installed that put user input in exception messages. However, it has come to our attention that extensions using the extbase MVC framework can be used to exploit this vulnerability if these extensions accept objects in controller actions.

CVE-2012-2112 https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-002/ 2012-04-17 2012-04-18
nginx -- Buffer overflow in the ngx_http_mp4_module nginx 1.0.15 nginx-devel 1.1.19

The nginx project reports:

Buffer overflow in the ngx_http_mp4_module

CVE-2012-2089 http://nginx.org/en/security_advisories.html 2012-04-12 2012-04-16
phpmyfaq -- Remote PHP Code Execution Vulnerability phpmyfaq 2.7.5

The phpMyFAQ project reports:

The bundled ImageManager library allows injection of arbitrary PHP code to execute arbitrary PHP code and upload malware and trojan horses.

http://www.phpmyfaq.de/advisory_2012-04-14.php 2012-04-14 2012-04-14
puppet -- Multiple Vulnerabilities puppet 2.7.*2.7.12_1

Multiple vulnerabilities exist in puppet that can result in arbitrary code execution, arbitrary file read access, denial of service, and arbitrary file write access. Please review the details in each of the CVEs for additional information.

CVE-2012-1906 CVE-2012-1986 CVE-2012-1987 CVE-2012-1988 CVE-2012-1989 http://puppetlabs.com/security/cve/cve-2012-1906/ http://puppetlabs.com/security/cve/cve-2012-1986/ http://puppetlabs.com/security/cve/cve-2012-1987/ http://puppetlabs.com/security/cve/cve-2012-1988/ http://puppetlabs.com/security/cve/cve-2012-1989/ 2012-03-26 2012-04-10
samba -- "root" credential remote code execution samba34 3.4.*3.4.16 samba35 3.5.*3.5.14 samba36 3.6.*3.6.4

Samba development team reports:

Samba versions 3.6.3 and all versions previous to this are affected by a vulnerability that allows remote code execution as the "root" user from an anonymous connection.

As this does not require an authenticated connection it is the most serious vulnerability possible in a program, and users and vendors are encouraged to patch their Samba installations immediately.

CVE-2012-1182 2012-04-10 2012-04-10
bugzilla Cross-Site Request Forgery bugzilla 4.0.04.0.5

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

  • Due to a lack of validation of the enctype form attribute when making POST requests to xmlrpc.cgi, a possible CSRF vulnerability was discovered. If a user visits an HTML page with some malicious HTML code in it, an attacker could make changes to a remote Bugzilla installation on behalf of the victim's account by using the XML-RPC API on a site running mod_perl. Sites running under mod_cgi are not affected. Also, the user would have had to be already logged in to the target site for the vulnerability to work.

All affected installations are encouraged to upgrade as soon as possible.

CVE-2012-0453 https://bugzilla.mozilla.org/show_bug.cgi?id=725663 2012-02-22 2012-04-10
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.2r202.228

Adobe reports:

Multiple Priority 2 vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-0724 CVE-2012-0725 CVE-2012-0772 CVE-2012-0773 https://www.adobe.com/support/security/bulletins/apsb12-07.html 2012-04-05 2012-04-10
png -- memory corruption/possible remote code execution png linux-f10-png 1.4.11

The PNG project reports:

libpng fails to correctly handle malloc() failures for text chunks (in png_set_text_2()), which can lead to memory corruption and the possibility of remote code execution.

CVE-2011-3048 http://www.libpng.org/pub/png/libpng.html 2012-03-29 2012-04-08
freetype -- multiple vulnerabilities freetype2 2.4.9

The Freetype project reports:

Multiple vulnerabilities exist in freetype that can result in application crashes and remote code execution. Please review the details in each of the CVEs for additional information.

CVE-2012-1126 CVE-2012-1127 CVE-2012-1128 CVE-2012-1129 CVE-2012-1130 CVE-2012-1131 CVE-2012-1132 CVE-2012-1133 CVE-2012-1134 CVE-2012-1135 CVE-2012-1136 CVE-2012-1137 CVE-2012-1138 CVE-2012-1139 CVE-2012-1140 CVE-2012-1141 CVE-2012-1142 CVE-2012-1143 CVE-2012-1144 https://sourceforge.net/projects/freetype/files/freetype2/2.4.9/README/view https://bugzilla.redhat.com/show_bug.cgi?id=806270 2012-03-08 2012-04-06
mutt-devel -- failure to check SMTP TLS server certificate mutt-devel 1.5.21_4

Dave B reports on Full Disclosure:

It seems that mutt fails to check the validity of a SMTP servers certificate during a TLS connection. [...] This means that an attacker could potentially MITM a mutt user connecting to their SMTP server even when the user has forced a TLS connection.

CVE-2011-1429 http://seclists.org/fulldisclosure/2011/Mar/87 2012-03-08 2012-04-06
chromium -- multiple vulnerabilities chromium 18.0.1025.151

Google Chrome Releases reports:

[106577] Medium CVE-2011-3066: Out-of-bounds read in Skia clipping. Credit to miaubiz.

[117583] Medium CVE-2011-3067: Cross-origin iframe replacement. Credit to Sergey Glazunov.

[117698] High CVE-2011-3068: Use-after-free in run-in handling. Credit to miaubiz.

[117728] High CVE-2011-3069: Use-after-free in line box handling. Credit to miaubiz.

[118185] High CVE-2011-3070: Use-after-free in v8 bindings. Credit to Google Chrome Security Team (SkyLined).

[118273] High CVE-2011-3071: Use-after-free in HTMLMediaElement. Credit to pa_kt, reporting through HP TippingPoint ZDI (ZDI-CAN-1528).

[118467] Low CVE-2011-3072: Cross-origin violation parenting pop-up window. Credit to Sergey Glazunov.

[118593] High CVE-2011-3073: Use-after-free in SVG resource handling. Credit to Arthur Gerkis.

[119281] Medium CVE-2011-3074: Use-after-free in media handling. Credit to Slawomir Blazek.

[119525] High CVE-2011-3075: Use-after-free applying style command. Credit to miaubiz.

[120037] High CVE-2011-3076: Use-after-free in focus handling. Credit to miaubiz.

[120189] Medium CVE-2011-3077: Read-after-free in script bindings. Credit to Google Chrome Security Team (Inferno).

CVE-2011-3066 CVE-2011-3067 CVE-2011-3068 CVE-2011-3069 CVE-2011-3070 CVE-2011-3071 CVE-2011-3072 CVE-2011-3073 CVE-2011-3074 CVE-2011-3075 CVE-2011-3076 CVE-2011-3077 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-04-05 2012-04-05
libpurple -- Remote DoS via an MSN OIM message that lacks UTF-8 encoding libpurple 2.10.2

US-CERT reports:

The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding.

CVE-2012-1178 2012-03-15 2012-04-01
phpMyAdmin -- Path disclosure due to missing verification of file presence phpMyAdmin 3.43.4.10.2

The phpMYAdmin development team reports:

The show_config_errors.php scripts did not validate the presence of the configuration file, so an error message shows the full path of this file, leading to possible further attacks. For the error messages to be displayed, php.ini's error_reporting must be set to E_ALL and display_errors must be On (these settings are not recommended on a production server in the PHP manual).

CVE-2012-1902 http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php 2012-03-28 2012-03-28
chromium -- multiple vulnerabilities chromium 18.0.1025.142

Google Chrome Releases reports:

[109574] Medium CVE-2011-3058: Bad interaction possibly leading to XSS in EUC-JP. Credit to Masato Kinugawa.

[112317] Medium CVE-2011-3059: Out-of-bounds read in SVG text handling. Credit to Arthur Gerkis.

[114056] Medium CVE-2011-3060: Out-of-bounds read in text fragment handling. Credit to miaubiz.

[116398] Medium CVE-2011-3061: SPDY proxy certificate checking error. Credit to Leonidas Kontothanassis of Google.

[116524] High CVE-2011-3062: Off-by-one in OpenType Sanitizer. Credit to Mateusz Jurczyk of the Google Security Team.

[117417] Low CVE-2011-3063: Validate navigation requests from the renderer more carefully. Credit to kuzzcc, Sergey Glazunov, PinkiePie and scarybeasts (Google Chrome Security Team).

[117471] High CVE-2011-3064: Use-after-free in SVG clipping. Credit to Atte Kettunen of OUSPG.

[117588] High CVE-2011-3065: Memory corruption in Skia. Credit to Omair.

[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

CVE-2011-3057 CVE-2011-3058 CVE-2011-3059 CVE-2011-3060 CVE-2011-3061 CVE-2011-3062 CVE-2011-3063 CVE-2011-3064 CVE-2011-3065 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-03-28 2012-03-28
raptor/raptor2 -- XXE in RDF/XML File Interpretation raptor2 2.0.7 raptor 1.4.21_2

Timothy D. Morgan reports:

In December 2011, VSR identified a vulnerability in multiple open source office products (including OpenOffice, LibreOffice, KOffice, and AbiWord) due to unsafe interpretation of XML files with custom entity declarations. Deeper analysis revealed that the vulnerability was caused by acceptance of external entities by the libraptor library, which is used by librdf and is in turn used by these office products.

In the context of office applications, these vulnerabilities could allow for XML External Entity (XXE) attacks resulting in file theft and a loss of user privacy when opening potentially malicious ODF documents. For other applications which depend on librdf or libraptor, potentially serious consequences could result from accepting RDF/XML content from untrusted sources, though the impact may vary widely depending on the context.

CVE-2012-0037 http://seclists.org/fulldisclosure/2012/Mar/281 http://www.vsecurity.com/resources/advisory/20120324-1/ 2012-03-24 2012-03-25
quagga -- multiple vulnerabilities quagga 0.99.20.1 quagga-re 0.99.17.8

CERT reports:

The ospfd implementation of OSPF in Quagga allows a remote attacker (on a local network segment with OSPF enabled) to cause a denial of service (daemon aborts due to an assert) with a malformed OSPF LS-Update message.

The ospfd implementation of OSPF in Quagga allows a remote attacker (on a local network segment with OSPF enabled) to cause a denial of service (daemon crash) with a malformed OSPF Network- LSA message.

The bgpd implementation of BGP in Quagga allows remote attackers to cause a denial of service (daemon aborts due to an assert) via BGP Open message with an invalid AS4 capability.

CVE-2012-0249 CVE-2012-0250 CVE-2012-0255 http://www.kb.cert.org/vuls/id/551715 2012-03-23 2012-03-24 2012-03-26
Apache Traffic Server -- heap overflow vulnerability trafficserver 3.0.4

CERT-FI reports:

A heap overflow vulnerability has been found in the HTTP (Hypertext Transfer Protocol) protocol handling of Apache Traffic Server. The vulnerability allows an attacker to cause a denial of service or potentially to execute his own code by sending a specially modified HTTP message to an affected server.

CVE-2012-0256 2012-03-22 2012-03-24
chromium -- multiple vulnerabilities chromium 17.0.963.83

Google Chrome Releases reports:

[113902] High CVE-2011-3050: Use-after-free with first-letter handling. Credit to miaubiz.

[116162] High CVE-2011-3045: libpng integer issue from upstream. Credit to Glenn Randers-Pehrson of the libpng project.

[116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling. Credit to Arthur Gerkis.

[116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling. Credit to Ben Vanik of Google.

[116746] High CVE-2011-3053: Use-after-free in block splitting. Credit to miaubiz.

[117418] Low CVE-2011-3054: Apply additional isolations to webui privileges. Credit to Sergey Glazunov.

[117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation. Credit to PinkiePie.

[117550] High CVE-2011-3056: Cross-origin violation with "magic iframe". Credit to Sergey Glazunov.

[117794] Medium CVE-2011-3057: Invalid read in v8. Credit to Christian Holler.

[108648] Low CVE-2011-3049: Extension web request API can interfere with system requests. Credit to Michael Gundlach. Fixed in an earlier release.

CVE-2011-3045 CVE-2011-3049 CVE-2011-3050 CVE-2011-3051 CVE-2011-3052 CVE-2011-3053 CVE-2011-3054 CVE-2011-3055 CVE-2011-3056 CVE-2011-3057 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-03-21 2012-03-22
libtasn1 -- ASN.1 length decoding vulnerability libtasn1 2.12 gnutls 2.12.18 gnutls-devel 2.993.0.16

Mu Dynamics, Inc. reports:

Various functions using the ASN.1 length decoding logic in Libtasn1 were incorrectly assuming that the return value from asn1_get_length_der is always less than the length of the enclosing ASN.1 structure, which is only true for valid structures and not for intentionally corrupt or otherwise buggy structures.

CVE-2012-1569 2012-03-20 2012-03-21 2012-03-24
gnutls -- possible overflow/Denial of service vulnerabilities gnutls 2.12.18 gnutls-devel 2.993.0.15

Mu Dynamics, Inc. reports:

The block cipher decryption logic in GnuTLS assumed that a record containing any data which was a multiple of the block size was valid for further decryption processing, leading to a heap corruption vulnerability.

CVE-2012-1573 2012-03-20 2012-03-21 2012-03-24
asterisk -- multiple vulnerabilities asterisk14 1.4.*1.4.44 asterisk16 1.6.*1.6.2.23 asterisk18 1.8.*1.8.10.1 asterisk10 10.*10.2.1

Asterisk project reports:

Stack Buffer Overflow in HTTP Manager

Remote Crash Vulnerability in Milliwatt Application

http://downloads.asterisk.org/pub/security/AST-2012-002.html http://downloads.asterisk.org/pub/security/AST-2012-003.html 2012-03-15 2012-03-15
OpenSSL -- CMS and S/MIME Bleichenbacher attack openssl 1.0.0_10

The OpenSSL Team reports:

A weakness in the OpenSSL CMS and PKCS #7 code can be exploited using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the million message attack (MMA).

Only users of CMS, PKCS #7, or S/MIME decryption operations are affected. A successful attack needs on average 2^20 messages. In practice only automated systems will be affected as humans will not be willing to process this many messages.

SSL/TLS applications are *NOT* affected by this problem since the SSL/TLS code does not use the PKCS#7 or CMS decryption code.

CVE-2012-0884 http://www.openssl.org/news/secadv_20120312.txt 2012-03-12 2012-03-15
nginx -- potential information leak nginx 1.0.14,1 nginx-devel 1.1.17

nginx development team reports:

Matthew Daley recently discovered a security problem which may lead to a disclosure of previously freed memory on specially crafted response from an upstream server, potentially resulting in sensitive information leak.

http://nginx.net/CHANGES 2012-03-15 2012-03-15
mozilla -- multiple vulnerabilities firefox 4.0,110.0.3,1 3.6.*,13.6.28 linux-firefox 10.0.3,1 linux-seamonkey 2.8 linux-thunderbird 10.0.3 seamonkey 2.8 thunderbird 4.010.0.3 3.1.*3.1.20 libxul 1.9.2.*1.9.2.28

The Mozilla Project reports:

MFSA 2012-13 XSS with Drag and Drop and Javascript: URL

MFSA 2012-14 SVG issues found with Address Sanitizer

MFSA 2012-15 XSS with multiple Content Security Policy headers

MFSA 2012-16 Escalation of privilege with Javascript: URL as home page

MFSA 2012-17 Crash when accessing keyframe cssText after dynamic modification

MFSA 2012-18 window.fullScreen writeable by untrusted content

MFSA 2012-19 Miscellaneous memory safety hazards (rv:11.0/ rv:10.0.3 / rv:1.9.2.28)

CVE-2012-0451 CVE-2012-0455 CVE-2012-0456 CVE-2012-0457 CVE-2012-0458 CVE-2012-0459 CVE-2012-0460 CVE-2012-0461 CVE-2012-0462 CVE-2012-0463 CVE-2012-0464 http://www.mozilla.org/security/announce/2012/mfsa2012-13.html http://www.mozilla.org/security/announce/2012/mfsa2012-14.html http://www.mozilla.org/security/announce/2012/mfsa2012-15.html http://www.mozilla.org/security/announce/2012/mfsa2012-16.html http://www.mozilla.org/security/announce/2012/mfsa2012-17.html http://www.mozilla.org/security/announce/2012/mfsa2012-18.html http://www.mozilla.org/security/announce/2012/mfsa2012-19.html 2012-03-13 2012-03-14 2012-03-18
portaudit -- auditfile remote code execution portaudit 0.6.0

Michael Gmelin and Jörg Scheinert has reported a remote command execution vulnerability in portaudit.

An attacker who can get the user to use a specially crafted audit file will be able to run commands on the users system, with the privileges of the user running running portaudit (often root).

The attack could e.g. happen through DNS hijacking or a man in the middle attack.

Note that if the user has set up portaudit to run from periodic this attack could happen without direct user interaction.

In the FreeBSD Ports Collection (bsd.port.mk) the check for vulnerable ports at install-time directly operates on the auditfile and has the same vulnerability as portaudit. As the Ports Collection infrastructure does not have a version number just be sure to have a Ports Collection new enough to contain the fix for portaudit. Note that this is only a problem for users which has portaudit installed, as they will not have the audit database installed or downloaded otherwise.

http://cvsweb.FreeBSD.org/ports/ports-mgmt/portaudit/Makefile#rev1.30 http://cvsweb.FreeBSD.org/ports/Mk/bsd.port.mk#rev1.707 2012-03-11 2012-03-11
chromium -- Errant plug-in load and GPU process memory corruption chromium 17.0.963.79

Google Chrome Releases reports:

[117620] [117656] Critical CVE-2011-3047: Errant plug-in load and GPU process memory corruption. Credit to PinkiePie.

CVE-2011-3047 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-03-10 2012-03-11
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.1r102.63

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-0768 CVE-2012-0769 https://www.adobe.com/support/security/bulletins/apsb12-05.html 2012-03-05 2012-03-09
chromium -- cross-site scripting vulnerability chromium 17.0.963.78

Google Chrome Releases reports:

[117226] [117230] Critical CVE-2011-3046: UXSS and bad history navigation. Credit to Sergey Glazunov.

CVE-2011-3046 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-03-08 2012-03-09
jenkins -- XSS vulnerability jenkins 1.453

Jenkins Security Advisory reports:

An XSS vulnerability was found in Jenkins core, which allows an attacker to inject malicious HTMLs to pages served by Jenkins. This allows an attacker to escalate his privileges by hijacking sessions of other users. This vulnerability affects all versions.

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-03-05 2012-03-05 2012-03-07
chromium -- multiple vulnerabilities chromium 17.0.963.65

Google Chrome Releases reports:

[105867] High CVE-2011-3031: Use-after-free in v8 element wrapper. Credit to Chamal de Silva.

[108037] High CVE-2011-3032: Use-after-free in SVG value handling. Credit to Arthur Gerkis.

[108406] [115471] High CVE-2011-3033: Buffer overflow in the Skia drawing library. Credit to Aki Helin of OUSPG.

[111748] High CVE-2011-3034: Use-after-free in SVG document handling. Credit to Arthur Gerkis.

[112212] High CVE-2011-3035: Use-after-free in SVG use handling. Credit to Arthur Gerkis.

[113258] High CVE-2011-3036: Bad cast in line box handling. Credit to miaubiz.

[113439] [114924] [115028] High CVE-2011-3037: Bad casts in anonymous block splitting. Credit to miaubiz.

[113497] High CVE-2011-3038: Use-after-free in multi-column handling. Credit to miaubiz.

[113707] High CVE-2011-3039: Use-after-free in quote handling. Credit to miaubiz.

[114054] High CVE-2011-3040: Out-of-bounds read in text handling. Credit to miaubiz.

[114068] High CVE-2011-3041: Use-after-free in class attribute handling. Credit to miaubiz.

[114219] High CVE-2011-3042: Use-after-free in table section handling. Credit to miaubiz.

[115681] High CVE-2011-3043: Use-after-free in flexbox with floats. Credit to miaubiz.

[116093] High CVE-2011-3044: Use-after-free with SVG animation elements. Credit to Arthur Gerkis.

CVE-2011-3031 CVE-2011-3032 CVE-2011-3033 CVE-2011-3034 CVE-2011-3035 CVE-2011-3036 CVE-2011-3037 CVE-2011-3038 CVE-2011-3039 CVE-2011-3040 CVE-2011-3041 CVE-2011-3042 CVE-2011-3043 CVE-2011-3044 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-03-04 2012-03-05
dropbear -- arbitrary code execution dropbear 0.512012.55

The Dropbear project reports:

Dropbear SSH Server could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a use-after- free error. If a command restriction is enforced, an attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.

52159 CVE-2012-0920 http://secunia.com/advisories/48147 http://xforce.iss.net/xforce/xfdb/73444 2012-02-22 2012-03-04
openx -- undisclosed security issue openx 2.8.9

OpenX does not provide information about vulnerabilities beyond their existence.

http://blog.openx.org/12/security-matters-3 2011-12-01 2012-03-02 2012-07-08
databases/postgresql*-client -- multiple vulnerabilities postgresql-client 8.3.18 8.48.4.11 99.0.7 9.19.1.3

The PostgreSQL Global Development Group reports:

These vulnerabilities could allow users to define triggers that execute functions on which the user does not have EXECUTE permission, allow SSL certificate spoofing and allow line breaks in object names to be exploited to execute code when loading a pg_dump file.

CVE-2012-0866 CVE-2012-0867 CVE-2012-0868 http://www.postgresql.org/about/news/1377/ 2012-02-27 2012-02-28
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 11.1r102.62

These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2012-0751 CVE-2012-0752 CVE-2012-0753 CVE-2012-0754 CVE-2012-0755 CVE-2012-0756 CVE-2012-0767 https://www.adobe.com/support/security/bulletins/apsb12-03.html 2012-02-15 2012-02-27
libxml2 -- heap buffer overflow libxml2 linux-f10-libxml2 2.7.8_2

Google chrome team reports:

Heap-based buffer overflow in libxml2, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVE-2011-3919 http://googlechromereleases.blogspot.com/2012/01/stable-channel-update.html 2012-01-05 2012-02-27
plib -- remote code execution via buffer overflow torcs 1.3.3 plib 1.8.5_3

Secunia reports:

A vulnerability has been discovered in PLIB, which can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to a boundary error within the "ulSetError()" function (src/util/ulError.cxx) when creating the error message, which can be exploited to overflow a static buffer.

Successful exploitation allows the execution of arbitrary code but requires that the attacker can e.g. control the content of an overly long error message passed to the "ulSetError()" function.

The vulnerability is confirmed in version 1.8.5. Other versions may also be affected.

CVE-2011-4620 http://secunia.com/advisories/47297/ http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79 2011-12-21 2012-02-19
phpMyAdmin -- XSS in replication setup phpMyAdmin 3.43.4.10.1

The phpMyAdmin development team reports:

It was possible to conduct XSS using a crafted database name.

CVE-2012-1190 http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php 2012-02-18 2012-02-18
piwik -- xss and click-jacking issues piwik 1.7

The Piwik Team reports:

We would like to thank the following security researchers for their responsible disclosure of XSS and click-jacking issues: Piotr Duszynski, Sergey Markov, Mauro Gentile.

"http://piwik.org/blog/2012/02/7775/" 2012-02-16 2012-02-16
mozilla -- heap-buffer overflow firefox 10.0,110.0.2,1 3.6.*,13.6.27 linux-firefox 10.0,110.0.2,1 linux-seamonkey 2.72.7.2 linux-thunderbird 10.010.0.2 seamonkey 2.72.7.2 thunderbird 10.010.0.2 3.1.*3.1.19

The Mozilla Project reports:

MFSA 2012-11 libpng integer overflow

CVE-2011-3026 https://www.mozilla.org/security/announce/2012/mfsa2012-11.html 2012-02-16 2012-02-17 2012-03-18
chromium -- multiple vulnerabilities chromium 17.0.963.56

Google Chrome Releases reports:

[105803] High CVE-2011-3015: Integer overflows in PDF codecs. Credit to Google Chrome Security Team (scarybeasts).

[106336] Medium CVE-2011-3016: Read-after-free with counter nodes. Credit to miaubiz.

[108695] High CVE-2011-3017: Possible use-after-free in database handling. Credit to miaubiz.

[110172] High CVE-2011-3018: Heap overflow in path rendering. Credit to Aki Helin of OUSPG.

[110849] High CVE-2011-3019: Heap buffer overflow in MKV handling. Credit to Google Chrome Security Team (scarybeasts) and Mateusz Jurczyk of the Google Security Team.

[111575] Medium CVE-2011-3020: Native client validator error. Credit to Nick Bray of the Chromium development community.

[111779] High CVE-2011-3021: Use-after-free in subframe loading. Credit to Arthur Gerkis.

[112236] Medium CVE-2011-3022: Inappropriate use of http for translation script. Credit to Google Chrome Security Team (Jorge Obes).

[112259] Medium CVE-2011-3023: Use-after-free with drag and drop. Credit to pa_kt.

[112451] Low CVE-2011-3024: Browser crash with empty x509 certificate. Credit to chrometot.

[112670] Medium CVE-2011-3025: Out-of-bounds read in h.264 parsing. Credit to Slawomir Blazek.

[112822] High CVE-2011-3026: Integer overflow / truncation in libpng. Credit to Juri Aedla.

[112847] Medium CVE-2011-3027: Bad cast in column handling. Credit to miaubiz.

CVE-2011-3015 CVE-2011-3016 CVE-2011-3017 CVE-2011-3018 CVE-2011-3019 CVE-2011-3020 CVE-2011-3021 CVE-2011-3022 CVE-2011-3023 CVE-2011-3024 CVE-2011-3025 CVE-2011-3026 CVE-2011-3027 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-02-15 2012-02-15
Python -- DoS via malformed XML-RPC / HTTP POST request python32 3.2.2_2 python31 3.1.4_2 python27 2.7.2_3 python26 2.6.7_2 python25 2.5.6_2 python24 2.4.5_8 pypy 1.7

Jan Lieskovsky reports,

A denial of service flaw was found in the way Simple XML-RPC Server module of Python processed client connections, that were closed prior the complete request body has been received. A remote attacker could use this flaw to cause Python Simple XML-RPC based server process to consume excessive amount of CPU.

CVE-2012-0845 http://bugs.python.org/issue14001 https://bugzilla.redhat.com/show_bug.cgi?id=789790 https://bugs.pypy.org/issue1047 2012-02-13 2012-02-14 2012-02-26
WebCalendar -- Persistent XSS WebCalendar 1.2.4 WebCalendar-devel 1.2.4

tom reports,

There is no sanitation on the input of the location variable allowing for persistent XSS.

CVE-2012-0846 http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870 2012-01-11 2012-02-12 2012-02-13
mozilla -- use-after-free in nsXBLDocumentInfo::ReadPrototypeBindings firefox 10.0,110.0.1,1 linux-firefox 10.0,110.0.1,1 linux-seamonkey 2.72.7.1 linux-thunderbird 10.010.0.1 seamonkey 2.72.7.1 thunderbird 10.010.0.1

The Mozilla Project reports:

MFSA 2012-10 use after free in nsXBLDocumentInfo::ReadPrototypeBindings

CVE-2012-0452 https://www.mozilla.org/security/announce/2012/mfsa2012-10.html 2012-02-10 2012-02-11
bip -- buffer overflow bip 0.8.8

Julien Tinnes reports,

Bip doesn't check if fd is equal or larger than FD_SETSIZE.

CVE-2012-0806 https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c https://projects.duckcorp.org/issues/269 2012-01-07 2012-02-11
surf -- private information disclosure surf 0.4.1

surf does not protect its cookie jar against access read access from other local users

CVE-2012-0842 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659296 2012-02-10 2012-02-11
glpi -- remote attack via crafted POST request glpi 0.80.2

The GLPI project reports:

The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.

http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en https://forge.indepnet.net/issues/3017 CVE-2011-2720 2011-07-20 2012-02-10 2013-06-19
chromium -- multiple vulnerabilities chromium 17.0.963.46

Google Chrome Releases reports:

[73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste event. Credit to Daniel Cheng of the Chromium development community.

[92550] Low CVE-2011-3954: Crash with excessive database usage. Credit to Collin Payne.

[93106] High CVE-2011-3955: Crash aborting an IndexDB transaction. Credit to David Grogan of the Chromium development community.

[103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins inside extensions. Credit to Devdatta Akhawe, UC Berkeley.

[104056] High CVE-2011-3957: Use-after-free in PDF garbage collection. Credit to Aki Helin of OUSPG.

[105459] High CVE-2011-3958: Bad casts with column spans. Credit to miaubiz.

[106441] High CVE-2011-3959: Buffer overflow in locale handling. Credit to Aki Helin of OUSPG.

[108416] Medium CVE-2011-3960: Out-of-bounds read in audio decoding. Credit to Aki Helin of OUSPG.

[108871] Critical CVE-2011-3961: Race condition after crash of utility process. Credit to Shawn Goertzen.

[108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping. Credit to Aki Helin of OUSPG.

[109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image handling. Credit to Atte Kettunen of OUSPG.

[109245] Low CVE-2011-3964: URL bar confusion after drag + drop. Credit to Code Audit Labs of VulnHunt.com.

[109664] Low CVE-2011-3965: Crash in signature check. Credit to Slawomir Blazek.

[109716] High CVE-2011-3966: Use-after-free in stylesheet error handling. Credit to Aki Helin of OUSPG.

[109717] Low CVE-2011-3967: Crash with unusual certificate. Credit to Ben Carrillo.

[109743] High CVE-2011-3968: Use-after-free in CSS handling. Credit to Arthur Gerkis.

[110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit to Arthur Gerkis.

[110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt. Credit to Aki Helin of OUSPG.

[110374] High CVE-2011-3971: Use-after-free with mousemove events. Credit to Arthur Gerkis.

[110559] Medium CVE-2011-3972: Out-of-bounds read in shader translator. Credit to Google Chrome Security Team (Inferno).

CVE-2011-3953 CVE-2011-3954 CVE-2011-3955 CVE-2011-3956 CVE-2011-3957 CVE-2011-3958 CVE-2011-3959 CVE-2011-3960 CVE-2011-3961 CVE-2011-3962 CVE-2011-3963 CVE-2011-3964 CVE-2011-3965 CVE-2011-3966 CVE-2011-3967 CVE-2011-3968 CVE-2011-3969 CVE-2011-3970 CVE-2011-3971 CVE-2011-3972 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-02-08 2012-02-09
drupal -- multiple vulnerabilities drupal6 6.23 drupal7 7.11

Drupal development team reports:

Cross Site Request Forgery vulnerability in Aggregator module

CVE: CVE-2012-0826

An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service.

This issue affects Drupal 6.x and 7.x.

OpenID not verifying signed attributes in SREG and AX

CVE: CVE-2012-0825

A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information.

This issue affects Drupal 6.x and 7.x.

Access bypass in File module

CVE: CVE-2012-0827

When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to.

This issue affects Drupal 7.x only.

CVE-2012-0825 CVE-2012-0826 CVE-2012-0827 2012-02-01 2012-02-07
bugzilla -- multiple vulnerabilities bugzilla 2.4.*3.6.8 4.0.*4.0.4

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

  • Account Impersonation: When a user creates a new account, Bugzilla doesn't correctly reject email addresses containing non-ASCII characters, which could be used to impersonate another user account. Such email addresses could look visually identical to other valid email addresses, and an attacker could try to confuse other users and be added to bugs he shouldn't have access to.
  • Cross-Site Request Forgery: Due to a lack of validation of the Content-Type head when making POST requests to jsonrpc.cgi, a possible CSRF vulnerability was discovered. If a user visits an HTML page with some malicious JS code in it, an attacker could make changes to a remote Bugzilla installation on behalf of the victim's account by using the JSON-RPC API. The user would have had to be already logged in to the target site for the vulnerability to work.

All affected installations are encouraged to upgrade as soon as possible.

CVE-2012-0448 CVE-2012-0440 https://bugzilla.mozilla.org/show_bug.cgi?id=714472 https://bugzilla.mozilla.org/show_bug.cgi?id=718319 2012-01-31 2012-02-06
php -- arbitrary remote code execution vulnerability php5 5.3.95.3.10

Secunia reports:

A vulnerability has been reported in PHP, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a logic error within the "php_register_variable_ex()" function (php_variables.c) when hashing form posts and updating a hash table, which can be exploited to execute arbitrary code.

CVE-2012-0830 http://www.php.net/archive/2012.php#id2012-02-02-1 http://secunia.com/advisories/47806/ 2012-02-02 2012-02-04 2012-02-06
mathopd -- directory traversal vulnerability mathopd 1.5p7

Michiel Boland reports:

The software has a vulnerability that could lead to directory traversal if the '*' construct for mass virtual hosting is used.

http://www.mail-archive.com/mathopd%40mathopd.org/msg00392.html http://www.mathopd.org/security.html 2012-02-02 2012-02-03
apache -- multiple vulnerabilities apache 2.*2.2.22

CVE MITRE reports:

An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

A flaw was found in mod_log_config. If the '%{cookiename}C' log format string is in use, a remote attacker could send a specific cookie causing a crash. This crash would only be a denial of service if using a threaded MPM.

A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly.

A flaw was found in the default error response for status code 400. This flaw could be used by an attacker to expose "httpOnly" cookies when no custom ErrorDocument is specified.

CVE-2011-3368 CVE-2011-3607 CVE-2011-4317 CVE-2012-0021 CVE-2012-0031 CVE-2012-0053 2011-10-05 2012-01-31
mozilla -- multiple vulnerabilities firefox 4.0,110.0,1 3.6.*,13.6.26 linux-firefox 10.0,1 linux-seamonkey 2.7 linux-thunderbird 10.0 seamonkey 2.7 thunderbird 4.010.0 3.1.*3.1.18

The Mozilla Project reports:

MFSA 2012-01 Miscellaneous memory safety hazards (rv:10.0/ rv:1.9.2.26)

MFSA 2012-02 Overly permissive IPv6 literal syntax

MFSA 2012-03 iframe element exposed across domains via name attribute

MFSA 2012-04 Child nodes from nsDOMAttribute still accessible after removal of nodes

MFSA 2012-05 Frame scripts calling into untrusted objects bypass security checks

MFSA 2012-06 Uninitialized memory appended when encoding icon images may cause information disclosure

MFSA 2012-07 Potential Memory Corruption When Decoding Ogg Vorbis files

MFSA 2012-08 Crash with malformed embedded XSLT stylesheets

MFSA 2012-09 Firefox Recovery Key.html is saved with unsafe permission

CVE-2012-0442 CVE-2012-0443 CVE-2011-3670 CVE-2012-0445 CVE-2011-3659 CVE-2012-0446 CVE-2012-0447 CVE-2012-0449 CVE-2012-0450 http://www.mozilla.org/security/announce/2012/mfsa2012-01.html http://www.mozilla.org/security/announce/2012/mfsa2012-02.html http://www.mozilla.org/security/announce/2012/mfsa2012-03.html http://www.mozilla.org/security/announce/2012/mfsa2012-04.html http://www.mozilla.org/security/announce/2012/mfsa2012-05.html http://www.mozilla.org/security/announce/2012/mfsa2012-06.html http://www.mozilla.org/security/announce/2012/mfsa2012-07.html http://www.mozilla.org/security/announce/2012/mfsa2012-08.html http://www.mozilla.org/security/announce/2012/mfsa2012-09.html 2012-01-31 2012-02-01 2012-03-18
sudo -- format string vulnerability sudo 1.8.01.8.3_2

Todd Miller reports:

Sudo 1.8.0 introduced simple debugging support that was primarily intended for use when developing policy or I/O logging plugins. The sudo_debug() function contains a flaw where the program name is used as part of the format string passed to the fprintf() function. The program name can be controlled by the caller, either via a symbolic link or, on some systems, by setting argv[0] when executing sudo.

Using standard format string vulnerability exploitation techniques it is possible to leverage this bug to achieve root privileges.

Exploitation of the bug does not require that the attacker be listed in the sudoers file. As such, we strongly suggest that affected sites upgrade from affected sudo versions as soon as possible.

CVE-2012-0809 http://www.gratisoft.us/sudo/alerts/sudo_debug.html 2012-01-30 2012-01-30 2012-01-31
FreeBSD -- pam_ssh() does not validate service names FreeBSD 7.37.3_9 7.47.4_5 8.18.1_7 8.28.2_5

Problem Description:

Some third-party applications, including KDE's kcheckpass command, allow the user to specify the name of the policy on the command line. Since OpenPAM treats the policy name as a path relative to /etc/pam.d or /usr/local/etc/pam.d, users who are permitted to run such an application can craft their own policies and cause the application to load and execute their own modules.

SA-11:10.pam CVE-2011-4122 2011-12-23 2012-01-29
FreeBSD -- pam_ssh improperly grants access when user account has unencrypted SSH private keys FreeBSD 7.37.3_9 7.47.4_5 8.18.1_7 8.28.2_5

Problem Description:

The OpenSSL library call used to decrypt private keys ignores the passphrase argument if the key is not encrypted. Because the pam_ssh module only checks whether the passphrase provided by the user is null, users with unencrypted SSH private keys may successfully authenticate themselves by providing a dummy passphrase.

SA-11:09.pam_ssh 2011-12-23 2012-01-29 2013-06-18
FreeBSD -- Buffer overflow in handling of UNIX socket addresses FreeBSD 7.37.3_8 7.47.4_4 8.18.1_6 8.28.2_4

Problem Description:

When a UNIX-domain socket is attached to a location using the bind(2) system call, the length of the provided path is not validated. Later, when this address was returned via other system calls, it is copied into a fixed-length buffer.

Linux uses a larger socket address structure for UNIX-domain sockets than FreeBSD, and the FreeBSD's linux emulation code did not translate UNIX-domain socket addresses into the correct size of structure.

SA-11:05.unix 2011-09-28 2012-01-29
FreeBSD -- errors handling corrupt compress file in compress(1) and gzip(1) FreeBSD 7.37.3_7 7.47.4_3 8.18.1_5 8.28.2_3

Problem Description:

The code used to decompress a file created by compress(1) does not do sufficient boundary checks on compressed code words, allowing reference beyond the decompression table, which may result in a stack overflow or an infinite loop when the decompressor encounters a corrupted file.

SA-11:04.compress CVE-2011-2895 2011-09-28 2012-01-29
FreeBSD -- Network ACL mishandling in mountd(8) FreeBSD 7.37.3_5 7.47.4_1 8.18.1_3 8.28.2_1

Problem Description:

While parsing the exports(5) table, a network mask in the form of "-network=netname/prefixlength" results in an incorrect network mask being computed if the prefix length is not a multiple of 8.

For example, specifying the ACL for an export as "-network 192.0.2.0/23" would result in a netmask of 255.255.127.0 being used instead of the correct netmask of 255.255.254.0.

SA-11:01.mountd CVE-2011-1739 2011-04-20 2012-01-29
postfixadmin -- Multiple Vulnerabilities postfixadmin 2.3.5

The Postfix Admin Team reports:

Multiple XSS vulnerabilities exist:
- XSS with $_GET[domain] in templates/menu.php and edit-vacation
- XSS in some create-domain input fields
- XSS in create-alias and edit-alias error message
- XSS (by values stored in the database) in fetchmail list view, list-domain and list-virtual

Multiple SQL injection issues exist:
- SQL injection in pacrypt() (if $CONF[encrypt] == 'mysql_encrypt')
- SQL injection in backup.php - the dump was not mysql_escape()d, therefore users could inject SQL (for example in the vacation message) which will be executed when restoring the database dump. WARNING: database dumps created with backup.php from 2.3.4 or older might contain malicious SQL. Double-check before using them!

CVE-2012-0811 CVE-2012-0812 http://sourceforge.net/projects/postfixadmin/forums/forum/676076/topic/4977778 2012-01-27 2012-01-27
mpack -- Information disclosure mpack 1.6_3

The oss-security list reports:

Incorrect permissions on temporary files can lead to information disclosure.

CVE-2011-4919 http://openwall.com/lists/oss-security/2011/12/31/1 2011-12-31 2012-01-26
acroread9 -- Multiple Vulnerabilities acroread9 9.4.7

The Adobe Security Team reports:

An unspecified vulnerability in the U3D component allows remote attackers to execute arbitrary code (or cause a denial of service attack) via unknown vectors.

A heap-based buffer overflow allows attackers to execute arbitrary code via unspecified vectors.

CVE-2011-2462 CVE-2011-1353 CVE-2011-2431 CVE-2011-2432 CVE-2011-2433 CVE-2011-2434 CVE-2011-2435 CVE-2011-2436 CVE-2011-2437 CVE-2011-2438 CVE-2011-2439 CVE-2011-2440 CVE-2011-2441 CVE-2011-2442 http://www.adobe.com/support/security/bulletins/apsb11-24.html http://www.adobe.com/support/security/advisories/apsa11-04.html 2011-12-07 2012-01-26
chromium -- multiple vulnerabilities chromium 16.0.912.77

Google Chrome Releases reports:

[106484] High CVE-2011-3924: Use-after-free in DOM selections. Credit to Arthur Gerkis.

[108461] High CVE-2011-3928: Use-after-free in DOM handling. Credit to wushi of team509 reported through ZDI (ZDI-CAN-1415).

[108605] High CVE-2011-3927: Uninitialized value in Skia. Credit to miaubiz.

[109556] High CVE-2011-3926: Heap-buffer-overflow in tree builder. Credit to Arthur Gerkis.

CVE-2011-3924 CVE-2011-3926 CVE-2011-3927 CVE-2011-3928 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2012-01-23 2012-01-24
Wireshark -- Multiple vulnerabilities wireshark 1.41.4.11 1.6.01.6.5 wireshark-lite 1.41.4.11 1.6.01.6.5 tshark 1.41.4.11 1.6.01.6.5 tshark-lite 1.41.4.11 1.6.01.6.5

Wireshark reports:

Laurent Butti discovered that Wireshark failed to properly check record sizes for many packet capture file formats

Wireshark could dereference a NULL pointer and crash.

The RLC dissector could overflow a buffer.

CVE-2012-0041 CVE-2012-0066 CVE-2012-0067 CVE-2012-0068 http://www.wireshark.org/security/wnpa-sec-2012-01.html http://www.wireshark.org/security/wnpa-sec-2012-02.html http://www.wireshark.org/security/wnpa-sec-2012-03.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391 2010-01-10 2012-01-23
spamdyke -- Buffer Overflow Vulnerabilities spamdyke 4.3.0

Secunia reports:

Fixed a number of very serious errors in the usage of snprintf()/vsnprintf().

The return value was being used as the length of the string printed into the buffer, but the return value really indicates the length of the string that *could* be printed if the buffer were of infinite size. Because the returned value could be larger than the buffer's size, this meant remotely exploitable buffer overflows were possible, depending on spamdyke's configuration.

CVE-2012-0802 https://secunia.com/advisories/47548/ http://www.spamdyke.org/documentation/Changelog.txt 2012-01-15 2012-01-23
OpenSSL -- DTLS Denial of Service openssl 1.0.0_9

The OpenSSL Team reports:

A flaw in the fix to CVE-2011-4108 can be exploited in a denial of service attack. Only DTLS applications using OpenSSL 1.0.0f and 0.9.8s are affected.

CVE-2012-0050 http://www.openssl.org/news/secadv_20120118.txt 2012-01-18 2012-01-20
asterisk -- SRTP Video Remote Crash Vulnerability asterisk18 1.8.8.2 asterisk10 10.0.1

Asterisk project reports:

An attacker attempting to negotiate a secure video stream can crash Asterisk if video support has not been enabled and the res_srtp Asterisk module is loaded.

http://downloads.asterisk.org/pub/security/AST-2012-001.html 2012-01-15 2012-01-20 2013-06-19
tomcat -- Denial of Service tomcat 5.5.05.5.35 tomcat 6.0.06.0.34 tomcat 7.0.07.0.23

The Tomcat security team reports:

Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values.

CVE-2012-0022 http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.35 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.34 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.23 2011-10-21 2012-01-17
OpenTTD -- Denial of service (server) via slow read attack openttd 0.3.51.1.5

The OpenTTD Team reports:

Using a slow read type attack it is possible to prevent anyone from joining a server with virtually no resources. Once downloading the map no other downloads of the map can start, so downloading really slowly will prevent others from joining. This can be further aggravated by the pause-on-join setting in which case the game is paused and the players cannot continue the game during such an attack. This attack requires that the user is not banned and passes the authorization to the server, although for many servers there is no server password and thus authorization is easy.

CVE-2012-0049 http://security.openttd.org/en/CVE-2012-0049 2012-01-06 2012-01-16
Multiple implementations -- DoS via hash algorithm collision jruby 1.6.5.1 ruby ruby+nopthreads ruby+nopthreads+oniguruma ruby+oniguruma 1.8.7.357,1 rubygem-rack 1.3.6,3 v8 3.8.5 redis 2.4.6 node 0.6.7

oCERT reports:

A variety of programming languages suffer from a denial-of-service (DoS) condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting predictable collisions in the underlying hashing algorithms.

The issue finds particular exposure in web server applications and/or frameworks. In particular, the lack of sufficient limits for the number of parameters in POST requests in conjunction with the predictable collision properties in the hashing functions of the underlying languages can render web applications vulnerable to the DoS condition. The attacker, using specially crafted HTTP requests, can lead to a 100% of CPU usage which can last up to several hours depending on the targeted application and server performance, the amplification effect is considerable and requires little bandwidth and time on the attacker side.

The condition for predictable collisions in the hashing functions has been reported for the following language implementations: Java, JRuby, PHP, Python, Rubinius, Ruby. In the case of the Ruby language, the 1.9.x branch is not affected by the predictable collision condition since this version includes a randomization of the hashing function.

The vulnerability outlined in this advisory is practically identical to the one reported in 2003 and described in the paper Denial of Service via Algorithmic Complexity Attacks which affected the Perl language.

CVE-2011-4838 CVE-2011-4815 CVE-2011-5036 CVE-2011-5037 http://www.ocert.org/advisories/ocert-2011-003.html http://www.nruns.com/_downloads/advisory28122011.pdf 2011-12-28 2012-01-16 2012-01-20
ffmpeg -- multiple vulnerabilities ffmpeg 0.7.11,1

Ubuntu Security Notice USN-1320-1 reports:

Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed QDM2 streams. If a user were tricked into opening a crafted QDM2 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4351)

Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed VP3 streams. If a user were tricked into opening a crafted file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4352)

Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed VP5 and VP6 streams. If a user were tricked into opening a crafted file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4353)

It was discovered that FFmpeg incorrectly handled certain malformed VMD files. If a user were tricked into opening a crafted VMD file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4364)

Phillip Langlois discovered that FFmpeg incorrectly handled certain malformed SVQ1 streams. If a user were tricked into opening a crafted SVQ1 stream file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-4579)

CVE-2011-4351 CVE-2011-4352 CVE-2011-4353 CVE-2011-4364 CVE-2011-4579 http://www.ubuntu.com/usn/usn-1320-1 2011-09-14 2012-01-14
OpenSSL -- multiple vulnerabilities openssl 1.0.0_8

The OpenSSL Team reports:

6 security flaws have been fixed in OpenSSL 1.0.0f:

If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8, then a policy check failure can lead to a double-free.

OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the bytes used as block cipher padding in SSL 3.0 records. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory.

RFC 3779 data can be included in certificates, and if it is malformed, may trigger an assertion failure. This could be used in a denial-of-service attack.

Support for handshake restarts for server gated cryptograpy (SGC) can be used in a denial-of-service attack.

A malicious TLS client can send an invalid set of GOST parameters which will cause the server to crash due to lack of error checking. This could be used in a denial-of-service attack.

CVE-2011-4108 CVE-2011-4109 CVE-2011-4576 CVE-2011-4577 CVE-2011-4619 CVE-2012-0027 http://openssl.org/news/secadv_20120104.txt 2012-01-04 2012-01-14
isc-dhcp-server -- DoS in DHCPv6 isc-dhcp42-server 4.2.3_2

ISC reports:

Due to improper handling of a DHCPv6 lease structure, ISC DHCP servers that are serving IPv6 address pools AND using Dynamic DNS can encounter a segmentation fault error while updating lease status under certain conditions.

The potential exists for this condition to be intentionally triggered, resulting in effective denial of service to clients expecting service from the affected server.

CVE-2011-4868 https://www.isc.org/software/dhcp/advisories/cve-2011-4868 2012-01-13 2012-01-13
PowerDNS -- Denial of Service Vulnerability powerdns powerdns-devel 3.0.1

The PowerDNS Team reports:

Using well crafted UDP packets, one or more PowerDNS servers could be made to enter a tight packet loop, causing temporary denial of service.

CVE-2012-0206 2012-01-10 2012-01-12
php -- multiple vulnerabilities php5 php5-exif 5.3.9 php52 5.2.17_5 php52-exif 5.2.17_6

php development team reports:

Security Enhancements and Fixes in PHP 5.3.9:

  • Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
  • Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566)
CVE-2011-4566 CVE-2011-4885 http://www.nruns.com/_downloads/advisory28122011.pdf 2011-12-29 2012-01-11 2012-01-19
torcs -- untrusted local library loading torcs 1.3.2

TORCS News reports:

An insecure change to LD_LIBRARY_PATH allows loading of libraries in directories other than the standard paths. This can be a problem when downloading and installing untrusted content from the Internet.

CVE-2010-3384 http://torcs.sourceforge.net/index.php?name=News&file=article&sid=77 http://sourceforge.net/tracker/index.php?func=detail&aid=3089384&group_id=3777&atid=103777 2010-10-20 2012-01-09
spamdyke -- STARTTLS Plaintext Injection Vulnerability spamdyke 4.2.1

Secunia reports:

The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data (e.g. SMTP commands) during the plaintext phase, which will then be executed after upgrading to the TLS ciphertext phase.

CVE-2012-0070 http://secunia.com/advisories/47435/ http://www.spamdyke.org/documentation/Changelog.txt 2012-01-04 2012-01-08 2012-01-23
chromium -- multiple vulnerabilities chromium 16.0.912.75

Google Chrome Releases reports:

[106672] High CVE-2011-3921: Use-after-free in animation frames. Credit to Boris Zbarsky of Mozilla.
[107128] High CVE-2011-3919: Heap-buffer-overflow in libxml. Credit to Juri Aedla.
[108006] High CVE-2011-3922: Stack-buffer-overflow in glyph handling. Credit to Google Chrome Security Team (Cris Neckar).

[107182] Critical CVE-2011-3925: Use-after-free in Safe Browsing navigation. Credit to Chamal de Silva.

CVE-2011-3919 CVE-2011-3921 CVE-2011-3922 CVE-2011-3925 2012-01-05 2012-01-06 2012-01-23
bugzilla -- multiple vulnerabilities bugzilla 2.4.*3.6.7 4.0.*4.0.3

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

  • Tabular and graphical reports, as well as new charts have a debug mode which displays raw data as plain text. This text is not correctly escaped and a crafted URL could use this vulnerability to inject code leading to XSS.
  • The User.offer_account_by_email WebService method ignores the user_can_create_account setting of the authentication method and generates an email with a token in it which the user can use to create an account. Depending on the authentication method being active, this could allow the user to log in using this account. Installations where the createemailregexp parameter is empty are not vulnerable to this issue.
  • The creation of bug reports and of attachments is not protected by a token and so they can be created without the consent of a user if the relevant code is embedded in an HTML page and the user visits this page. This behavior was intentional to let third-party applications submit new bug reports and attachments easily. But as this behavior can be abused by a malicious user, it has been decided to block submissions with no valid token starting from version 4.2rc1. Older branches are not patched to not break these third-party applications after the upgrade.

All affected installations are encouraged to upgrade as soon as possible.

CVE-2011-3657 CVE-2011-3667 CVE-2011-3668 CVE-2011-3669 https://bugzilla.mozilla.org/show_bug.cgi?id=697699 https://bugzilla.mozilla.org/show_bug.cgi?id=711714 https://bugzilla.mozilla.org/show_bug.cgi?id=703975 https://bugzilla.mozilla.org/show_bug.cgi?id=703983 2011-11-28 2012-01-05
WordPress -- cross site scripting vulnerability wordpress 3.3.1,1 de-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 3.3.1

WordPress development team reports:

WordPress 3.3.1 is now available. This maintenance release fixes 15 issues with WordPress 3.3, as well as a fix for a cross-site scripting vulnerability that affected version 3.3. Thanks to Joshua H., Hoang T., Stefan Zimmerman, Chris K., and the Go Daddy security team for responsibly disclosing the bug to our security team.

http://threatpost.com/en_us/blogs/xss-bug-found-wordpress-33-010312 2012-01-03 2012-01-03
zabbix-frontend -- multiple XSS vulnerabilities zabbix-frontend 1.8.10,2

Martina Matari reports:

These URLs (hostgroups.php, usergrps.php) are vulnerable to persistent XSS attacks due to improper sanitation of gname variable when creating user and host groups.

https://support.zabbix.com/browse/ZBX-4015 2011-08-04 2011-12-29
lighttpd -- remote DoS in HTTP authentication lighttpd 1.4.30

US-CERT/NIST reports:

Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.

CVE-2011-4362 2011-11-29 2011-12-28
krb5-appl -- telnetd code execution vulnerability FreeBSD 7.37.3_9 7.47.4_5 8.18.1_7 8.28.2_5 krb5-appl 1.0.2_1

The MIT Kerberos Team reports:

When an encryption key is supplied via the TELNET protocol, its length is not validated before the key is copied into a fixed-size buffer. Also see MITKRB5-SA-2011-008.

SA-11:08.telnetd CVE-2011-4862 http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt 2011-12-23 2011-12-26 2012-01-29
proftpd -- arbitrary code execution vulnerability with chroot FreeBSD 7.37.3_9 7.47.4_5 8.18.1_6 8.28.2_5 proftpd proftpd-mysql 1.3.3g_1 proftpd-devel 1.3.3.r4_3,1

The FreeBSD security advisory FreeBSD-SA-11:07.chroot reports:

If ftpd is configured to place a user in a chroot environment, then an attacker who can log in as that user may be able to run arbitrary code(...).

Proftpd shares the same problem of a similar nature.

SA-11:07.chroot http://seclists.org/fulldisclosure/2011/Nov/452 2011-11-30 2011-12-23 2012-01-29
phpMyAdmin -- Multiple XSS phpMyAdmin 3.43.4.9.r1

The phpMyAdmin development team reports:

Using crafted url parameters, it was possible to produce XSS on the export panels in the server, database and table sections.

Crafted values entered in the setup interface can produce XSS; also, if the config directory exists and is writeable, the XSS payload can be saved to this directory.

CVE-2011-4780 CVE-2011-4782 http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php 2011-12-16 2011-12-22
mozilla -- multiple vulnerabilities firefox 4.0,19.0,1 linux-firefox 9.0,1 linux-seamonkey 2.6 linux-thunderbird 9.0 seamonkey 2.6 thunderbird 4.09.0

The Mozilla Project reports:

MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library

MFSA 2011-55 nsSVGValue out-of-bounds access

MFSA 2011-56 Key detection without JavaScript via SVG animation

MFSA 2011-58 Crash scaling video to extreme sizes

CVE-2011-3658 CVE-2011-3660 CVE-2011-3661 CVE-2011-3663 CVE-2011-3665 http://www.mozilla.org/security/announce/2011/mfsa2011-53.html http://www.mozilla.org/security/announce/2011/mfsa2011-54.html http://www.mozilla.org/security/announce/2011/mfsa2011-55.html http://www.mozilla.org/security/announce/2011/mfsa2011-56.html http://www.mozilla.org/security/announce/2011/mfsa2011-58.html 2011-12-20 2011-12-21 2011-12-21
unbound -- denial of service vulnerabilities from nonstandard redirection and denial of existence unbound 1.4.14

Unbound developer reports:

Unbound crashes when confronted with a non-standard response from a server for a domain. This domain produces duplicate RRs from a certain type and is DNSSEC signed. Unbound also crashes when confronted with a query that eventually, and under specific circumstances, resolves to a domain that misses expected NSEC3 records.

CVE-2011-4528 http://unbound.nlnetlabs.nl/downloads/CVE-2011-4528.txt 2011-12-19 2011-12-19
typo3 -- Remote Code Execution typo3 4.64.6.2 4.5.9

The typo3 security team reports:

A crafted request to a vulnerable TYPO3 installation will allow an attacker to load PHP code from an external source and to execute it on the TYPO3 installation.

This is caused by a PHP file, which is part of the workspaces system extension, that does not validate passed arguments.

CVE-2011-4614 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2011-004/ 2011-12-16 2011-12-18
krb5 -- KDC null pointer dereference in TGS handling krb5 1.91.9.2_1

The MIT Kerberos Team reports:

In releases krb5-1.9 and later, the KDC can crash due to a NULL pointer dereference in code that handles TGS (Ticket Granting Service) requests. The trigger condition is trivial to produce using unmodified client software, but requires the ability to authenticate as a principal in the KDC's realm.

CVE-2011-1530 http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt 2011-12-11 2011-12-14
opera -- multiple vulnerabilities opera linux-opera 11.60 opera-devel 11.60,1

Opera software reports:

  • Fixed a moderately severe issue; details will be disclosed at a later date
  • Fixed an issue that could allow pages to set cookies or communicate cross-site for some top level domains; see our advisory
  • Improved handling of certificate revocation corner cases
  • Added a fix for a weakness in the SSL v3.0 and TLS 1.0 specifications, as reported by Thai Duong and Juliano Rizzo; see our advisory
  • Fixed an issue where the JavaScript "in" operator allowed leakage of cross-domain information, as reported by David Bloom; see our advisory
CVE-2011-3389 CVE-2011-4681 CVE-2011-4682 CVE-2011-4683 http://www.opera.com/support/kb/view/1003/ http://www.opera.com/support/kb/view/1004/ http://www.opera.com/support/kb/view/1005/ 2011-12-06 2011-12-13
chromium -- multiple vulnerabilities chromium 16.0.912.63

Google Chrome Releases reports:

[81753] Medium CVE-2011-3903: Out-of-bounds read in regex matching. Credit to David Holloway of the Chromium development community.
[95465] Low CVE-2011-3905: Out-of-bounds reads in libxml. Credit to Google Chrome Security Team (Inferno).
[98809] Medium CVE-2011-3906: Out-of-bounds read in PDF parser. Credit to Aki Helin of OUSPG.
[99016] High CVE-2011-3907: URL bar spoofing with view-source. Credit to Mitja Kolsek of ACROS Security.
[100863] Low CVE-2011-3908: Out-of-bounds read in SVG parsing. Credit to Aki Helin of OUSPG.
[101010] Medium CVE-2011-3909: [64-bit only] Memory corruption in CSS property array. Credit to Google Chrome Security Team (scarybeasts) and Chu.
[101494] Medium CVE-2011-3910: Out-of-bounds read in YUV video frame handling. Credit to Google Chrome Security Team (Cris Neckar).
[101779] Medium CVE-2011-3911: Out-of-bounds read in PDF. Credit to Google Chrome Security Team (scarybeasts) and Robert Swiecki of the Google Security Team.
[102359] High CVE-2011-3912: Use-after-free in SVG filters. Credit to Arthur Gerkis.
[103921] High CVE-2011-3913: Use-after-free in Range handling. Credit to Arthur Gerkis.
[104011] High CVE-2011-3914: Out-of-bounds write in v8 i18n handling. Credit to Slawomir Blazek.
[104529] High CVE-2011-3915: Buffer overflow in PDF font handling. Credit to Atte Kettunen of OUSPG.
[104959] Medium CVE-2011-3916: Out-of-bounds reads in PDF cross references. Credit to Atte Kettunen of OUSPG.
[105162] Medium CVE-2011-3917: Stack-buffer-overflow in FileWatcher. Credit to Google Chrome Security Team (Marty Barbella).
[107258] High CVE-2011-3904: Use-after-free in bidi handling. Credit to Google Chrome Security Team (Inferno) and miaubiz.

CVE-2011-3903 CVE-2011-3904 CVE-2011-3905 CVE-2011-3906 CVE-2011-3907 CVE-2011-3908 CVE-2011-3909 CVE-2011-3910 CVE-2011-3911 CVE-2011-3912 CVE-2011-3913 CVE-2011-3914 CVE-2011-3915 CVE-2011-3916 CVE-2011-3917 http://googlechromereleases.blogspot.com/search/label/Stable%20updates 2011-12-13 2011-12-13
PuTTY -- Password vulnerability putty 0.590.62

Simon Tatham reports:

PuTTY 0.62 fixes a security issue present in 0.59, 0.60 and 0.61. If you log in using SSH-2 keyboard-interactive authentication (which is the usual method used by modern servers to request a password), the password you type was accidentally kept in PuTTY's memory for the rest of its run, where it could be retrieved by other processes reading PuTTY's memory, or written out to swap files or crash dumps.

CVE-2011-4607 http://lists.tartarus.org/pipermail/putty-announce/2011/000017.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/password-not-wiped.html 2011-12-10 2011-12-12 2013-08-07
asterisk -- Multiple Vulnerabilities asterisk18 1.8.7.2 asterisk16 1.6.2.21

Asterisk project reports:

It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header.

When the "automon" feature is enabled in features.conf, it is possible to send a sequence of SIP requests that cause Asterisk to dereference a NULL pointer and crash.

CVE-2011-4597 CVE-2011-4598 http://downloads.asterisk.org/pub/security/AST-2011-013.html http://downloads.asterisk.org/pub/security/AST-2011-014.html 2011-12-08 2011-12-09
isc-dhcp-server -- Remote DoS isc-dhcp42-server 4.2.3_1 isc-dhcp41-server 4.1.e_3,2

ISC reports:

A bug exists which allows an attacker who is able to send DHCP Request packets, either directly or through a relay, to remotely crash an ISC DHCP server if that server is configured to evaluate expressions using a regular expression (i.e. uses the "~=" or "~~" comparison operators).

CVE-2011-4539 2011-12-07 2011-12-07
phpMyAdmin -- Multiple XSS phpMyAdmin 3.43.4.8.r1

The phpMyAdmin development team reports:

Using crafted database names, it was possible to produce XSS in the Database Synchronize and Database rename panels. Using an invalid and crafted SQL query, it was possible to produce XSS when editing a query on a table overview panel or when using the view creation dialog. Using a crafted column type, it was possible to produce XSS in the table search and create index dialogs.

CVE-2011-4634 http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php 2011-11-24 2011-12-01
hiawatha -- memory leak in PreventSQLi routine hiawatha 7.67.8.2

Hugo Leisink reports via private mail to maintainer:

The memory leak was introduced in version 7.6. It is in the routing that checks for SQL injections. So, if you have set PreventSQLi to 'no', there is no problem.

http://www.hiawatha-webserver.org/changelog 2011-11-18 2011-11-18
BIND -- Remote DOS FreeBSD 7.37.3_9 7.47.4_5 8.18.1_7 8.28.2_5 bind96 9.6.3.1.ESV.R5.1 bind97 9.7.4.1 bind98 9.8.1.1

The Internet Systems Consortium reports:

Organizations across the Internet reported crashes interrupting service on BIND 9 nameservers performing recursive queries. Affected servers crashed after logging an error in query.c with the following message: "INSIST(! dns_rdataset_isassociated(sigrdataset))" Multiple versions were reported being affected, including all currently supported release versions of ISC BIND 9.

Because it may be possible to trigger this bug even on networks that do not allow untrusted users to access the recursive name servers (perhaps via specially crafted e-mail messages, and/or malicious web sites) it is recommended that ALL operators of recursive name servers upgrade immediately.

SA-11:06.bind CVE-2011-4313 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313 https://www.isc.org/software/bind/advisories/cve-2011-4313 2011-11-16 2011-11-16 2012-01-29
Apache 1.3 -- mod_proxy reverse proxy exposure apache 1.3.43 apache+ssl 1.3.43.1.59_2 apache+ipv6 1.3.43 apache+mod_perl 1.3.43 apache+mod_ssl 1.3.41+2.8.31_4 apache+mod_ssl+ipv6 1.3.41+2.8.31_4 ru-apache-1.3 1.3.43+30.23_1 ru-apache+mod_ssl 1.3.43+30.23_1

Apache HTTP server project reports:

An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. There is no patch against this issue!

CVE-2011-3368 http://httpd.apache.org/security/vulnerabilities_13.html http://seclists.org/fulldisclosure/2011/Oct/232 2011-10-05 2011-11-14
kdeutils4 -- Directory traversal vulnerability kdeutils 4.0.*4.7.3

Tim Brown from Nth Dimention reports:

I recently discovered that the Ark archiving tool is vulnerable to directory traversal via malformed. When attempts are made to view files within the malformed Zip file in Ark's default view, the wrong file may be displayed due to incorrect construction of the temporary file name. Whilst this does not allow the wrong file to be overwritten, after closing the default view, Ark will then attempt to delete the temporary file which could result in the deletion of the incorrect file.

CVE-2011-2725 http://seclists.org/fulldisclosure/2011/Oct/351 2011-10-19 2011-11-14
Apache APR -- DoS vulnerabilities apr0 0.9.20.0.9.19

The Apache Portable Runtime Project reports:

Reimplement apr_fnmatch() from scratch using a non-recursive algorithm; now has improved compliance with the fnmatch() spec.

CVE-2011-0419 http://www.apache.org/dist/apr/Announcement0.9.html 2011-05-19 2011-11-13
phpmyadmin -- Local file inclusion phpMyAdmin 3.43.4.7.1 3.3.10.5

Jan Lieskovsky reports:

Importing a specially-crafted XML file which contains an XML entity injection permits to retrieve a local file (limited by the privileges of the user running the web server).

CVE-2011-4107 http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php 2011-11-10 2011-11-12
linux-flashplugin -- multiple vulnerabilities linux-f10-flashplugin 10.3r183.11 1111.1r102.55

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player 11.0.1.152 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 11.0.1.153 and earlier versions for Android.

In addition a patch was released for users of flash10.

CVE-2011-2445 CVE-2011-2450 CVE-2011-2451 CVE-2011-2452 CVE-2011-2453 CVE-2011-2454 CVE-2011-2455 CVE-2011-2456 CVE-2011-2457 CVE-2011-2458 CVE-2011-2459 CVE-2011-2460 https://www.adobe.com/support/security/bulletins/apsb11-28.html 2011-11-10 2011-11-11
libxml -- Integer overflow libxml 1.8.17_5 libxml2 linux-f10-libxml2 2.7.8

Integer overflow in xpath.c, allows context-dependent attackers to to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

CVE-2011-1944 2011-09-02 2011-11-10 2011-11-12
libxml -- Multiple use-after-free vulnerabilities libxml 1.8.17_5

Multiple use-after-free vulnerabilities in libxml 1.8.17 that allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file.

CVE-2009-2416 2009-08-03 2011-11-10 2011-11-12
libxml -- Stack consumption vulnerability libxml 1.8.17_5

Stack consumption vulnerability allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD.

CVE-2009-2414 2009-08-03 2011-11-10 2011-11-12
gnutls -- client session resumption vulnerability gnutls 2.12.14

The GnuTLS team reports:

GNUTLS-SA-2011-2 Possible buffer overflow/Denial of service.

CVE-2011-4128 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596 2011-11-08 2011-11-10
mozilla -- multiple vulnerabilities firefox 4.0,18.0,1 3.6.*,13.6.24,1 libxul 1.9.2.*1.9.2.24 linux-firefox 8.0,1 linux-thunderbird 8.0 thunderbird 4.08.0 3.1.16

The Mozilla Project reports:

MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope parameter (1.9.2 branch)

MFSA 2011-47 Potential XSS against sites using Shift-JIS

MFSA 2011-48 Miscellaneous memory safety hazards (rv:8.0)

MFSA 2011-49 Memory corruption while profiling using Firebug

MFSA 2011-50 Cross-origin data theft using canvas and Windows D2D

MFSA 2011-51 Cross-origin image theft on Mac with integrated Intel GPU

MFSA 2011-52 Code execution via NoWaiverWrapper

CVE-2011-3647 CVE-2011-3648 CVE-2011-3649 CVE-2011-3650 CVE-2011-3651 CVE-2011-3652 CVE-2011-3653 CVE-2011-3654 CVE-2011-3655 http://www.mozilla.org/security/announce/2011/mfsa2011-46.html http://www.mozilla.org/security/announce/2011/mfsa2011-47.html http://www.mozilla.org/security/announce/2011/mfsa2011-48.html http://www.mozilla.org/security/announce/2011/mfsa2011-49.html http://www.mozilla.org/security/announce/2011/mfsa2011-50.html http://www.mozilla.org/security/announce/2011/mfsa2011-51.html http://www.mozilla.org/security/announce/2011/mfsa2011-52.html 2011-11-08 2011-11-08
caml-light -- insecure use of temporary files caml-light 0.75

caml-light uses mktemp() insecurely, and also does unsafe things in /tmp during make install.

CVE-2011-4119 http://seclists.org/oss-sec/2011/q4/249 2011-11-02 2011-11-06
freetype -- Some type 1 fonts handling vulnerabilities freetype2 2.4.7

The FreeType project reports:

A couple of vulnerabilities in handling Type 1 fonts.

CVE-2011-3256 http://sourceforge.net/projects/freetype/files/freetype2/2.4.7/README/view https://bugzilla.redhat.com/attachment.cgi?id=528829&action=diff 2011-10-12 2011-11-01
cacti -- Multiple vulnerabilities cacti 0.8.7h

Cacti Group reports:

SQL injection issue with user login, and cross-site scripting issues.

http://www.cacti.net/release_notes_0_8_7h.php 2011-09-26 2011-10-26
phpmyfaq -- Remote PHP Code Injection Vulnerability phpmyfaq 2.6.19

The phpMyFAQ project reports:

The phpMyFAQ Team has learned of a serious security issue that has been discovered in our bundled ImageManager library we use in phpMyFAQ 2.6 and 2.7. The bundled ImageManager library allows injection of arbitrary PHP code via POST requests.

http://www.phpmyfaq.de/advisory_2011-10-25.php http://forum.phpmyfaq.de/viewtopic.php?f=3&t=13402 2011-10-25 2011-10-26
phpLDAPadmin -- Remote PHP code injection vulnerability phpldapadmin 1.2.01.2.1.1_1,1

EgiX (n0b0d13s at gmail dot com) reports:

The $sortby parameter passed to 'masort' function in file lib/functions.php isn't properly sanitized before being used in a call to create_function() at line 1080. This can be exploited to inject and execute arbitrary PHP code. The only possible attack vector is when handling the 'query_engine' command, in which input passed through $_REQUEST['orderby'] is passed as $sortby parameter to 'masort' function.

http://packetstormsecurity.org/files/106120/phpldapadmin-inject.txt http://sourceforge.net/tracker/?func=detail&aid=3417184&group_id=61828&atid=498546 2011-10-23 2011-10-24
kdelibs4, rekonq -- input validation failure kdelibs 4.0.*4.7.2 rekonq 0.8.0

KDE Security Advisory reports:

The default rendering type for a QLabel is QLabel::AutoText, which uses heuristics to determine whether to render the given content as plain text or rich text. KSSL and Rekonq did not properly force its QLabels to use QLabel::PlainText. As a result, if given a certificate containing rich text in its fields, they would render the rich text. Specifically, a certificate containing a common name (CN) that has a table element will cause the second line of the table to be displayed. This can allow spoofing of the certificate's common name.

http://www.kde.org/info/security/advisory-20111003-1.txt http://www.nth-dimension.org.uk/pub/NDSA20111003.txt.asc CVE-2011-3365 CVE-2011-3366 2011-10-03 2011-10-23
piwik -- unknown critical vulnerabilities piwik 1.11.6

Secunia reports:

Multiple vulnerabilities with an unknown impact have been reported in Piwik. The vulnerabilities are caused due to unspecified errors. No further information is currently available.

http://secunia.com/advisories/46461/ http://piwik.org/blog/2011/10/piwik-1-6/ 2011-10-18 2011-10-20
Xorg server -- two vulnerabilities in X server lock handling code xorg-server 1.7.7_3

Matthieu Herrb reports:

It is possible to deduce if a file exists or not by exploiting the way that Xorg creates its lock files. This is caused by the fact that the X server is behaving differently if the lock file already exists as a symbolic link pointing to an existing or non-existing file.

It is possible for a non-root user to set the permissions for all users on any file or directory to 444, giving unwanted read access or causing denies of service (by removing execute permission). This is caused by a race between creating the lock file and setting its access modes.

CVE-2011-4028 CVE-2011-4029 2011-10-18 2011-10-18
asterisk -- remote crash vulnerability in SIP channel driver asterisk18 1.8.*1.8.7.1 asterisk 10.0.0.*10.0.0.r1

Asterisk project reports:

A remote authenticated user can cause a crash with a malformed request due to an unitialized variable.

CVE-2011-4063 2011-10-17 2011-10-17
PivotX -- Remote File Inclusion Vulnerability of TimThumb pivotx 2.3.0

The PivotX team reports:

TimThumb domain name security bypass and insecure cache handling. PivotX before 2.3.0 includes a vulnerable version of TimThumb.

If you are still running PivotX 2.2.6, you might be vulnerable to a security exploit, that was patched previously. Version 2.3.0 doesn't have this issue, but any older version of PivotX might be vulnerable.

48963 https://secunia.com/advisories/45416/ 2011-08-03 2011-10-17
OpenTTD -- Multiple buffer overflows in validation of external data openttd 0.1.01.1.3

The OpenTTD Team reports:

Multiple buffer overflows in OpenTTD before 1.1.3 allow local users to cause a denial of service (daemon crash) or possibly gain privileges via (1) a crafted BMP file with RLE compression or (2) crafted dimensions in a BMP file.

CVE-2011-3343 http://security.openttd.org/en/CVE-2011-3343 2011-08-25 2011-10-16
OpenTTD -- Buffer overflows in savegame loading openttd 0.1.01.1.3

The OpenTTD Team reports:

Multiple buffer overflows in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors related to (1) NAME, (2) PLYR, (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a savegame.

CVE-2011-3342 http://security.openttd.org/en/CVE-2011-3342 2011-08-08 2011-10-16
OpenTTD -- Denial of service via improperly validated commands openttd 0.3.51.1.3

The OpenTTD Team reports:

Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.

CVE-2011-3341 http://security.openttd.org/en/CVE-2011-3341 2011-08-25 2011-10-16
quagga -- multiple vulnerabilities quagga 0.99.19

CERT-FI reports:

Five vulnerabilities have been found in the BGP, OSPF, and OSPFv3 components of Quagga. The vulnerabilities allow an attacker to cause a denial of service or potentially to execute his own code by sending a specially modified packets to an affected server. Routing messages are typically accepted from the routing peers. Exploiting these vulnerabilities may require an established routing session (BGP peering or OSPF/OSPFv3 adjacency) to the router.

The vulnerability CVE-2011-3327 is related to the extended communities handling in BGP messages. Receiving a malformed BGP update can result in a buffer overflow and disruption of IPv4 routing.

The vulnerability CVE-2011-3326 results from the handling of LSA (Link State Advertisement) states in the OSPF service. Receiving a modified Link State Update message with malicious state information can result in denial of service in IPv4 routing.

The vulnerability CVE-2011-3325 is a denial of service vulnerability related to Hello message handling by the OSPF service. As Hello messages are used to initiate adjacencies, exploiting the vulnerability may be feasible from the same broadcast domain without an established adjacency. A malformed packet may result in denial of service in IPv4 routing.

The vulnerabilities CVE-2011-3324 and CVE-2011-3323 are related to the IPv6 routing protocol (OSPFv3) implemented in ospf6d daemon. Receiving modified Database Description and Link State Update messages, respectively, can result in denial of service in IPv6 routing.

CVE-2011-3323 CVE-2011-3324 CVE-2011-3325 CVE-2011-3326 CVE-2011-3327 2011-09-26 2011-10-05
Mozilla -- multiple vulnerabilities firefox 4.0,17.0,1 3.6.*,13.6.23,1 libxul 1.9.2.*1.9.2.23 linux-firefox 7.0,1 linux-seamonkey 2.4 linux-thunderbird 7.0 seamonkey 2.4 thunderbird 4.07.0 3.1.15

The Mozilla Project reports:

MFSA 2011-36 Miscellaneous memory safety hazards (rv:7.0 / rv:1.9.2.23)

MFSA 2011-37 Integer underflow when using JavaScript RegExp

MFSA 2011-38 XSS via plugins and shadowed window.location object

MFSA 2011-39 Defense against multiple Location headers due to CRLF Injection

MFSA 2011-40 Code installation through holding down Enter

MFSA 2011-41 Potentially exploitable WebGL crashes

MFSA 2011-42 Potentially exploitable crash in the YARR regular expression library

MFSA 2011-43 loadSubScript unwraps XPCNativeWrapper scope parameter

MFSA 2011-44 Use after free reading OGG headers

MFSA 2011-45 Inferring Keystrokes from motion data

CVE-2011-2372 CVE-2011-2995 CVE-2011-2996 CVE-2011-2997 CVE-2011-2999 CVE-2011-3000 CVE-2011-3001 CVE-2011-3002 CVE-2011-3003 CVE-2011-3004 CVE-2011-3005 CVE-2011-3232 http://www.mozilla.org/security/announce/2011/mfsa2011-36.html http://www.mozilla.org/security/announce/2011/mfsa2011-37.html http://www.mozilla.org/security/announce/2011/mfsa2011-38.html http://www.mozilla.org/security/announce/2011/mfsa2011-39.html http://www.mozilla.org/security/announce/2011/mfsa2011-40.html http://www.mozilla.org/security/announce/2011/mfsa2011-41.html http://www.mozilla.org/security/announce/2011/mfsa2011-42.html http://www.mozilla.org/security/announce/2011/mfsa2011-43.html http://www.mozilla.org/security/announce/2011/mfsa2011-44.html http://www.mozilla.org/security/announce/2011/mfsa2011-45.html 2011-09-27 2011-09-28
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r289 linux-f10-flashplugin 10.3r183.10

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player 10.3.183.7 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

There are reports that one of these vulnerabilities (CVE-2011-2444) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message. This universal cross-site scripting issue could be used to take actions on a user's behalf on any website or webmail provider if the user visits a malicious website.

https://www.adobe.com/support/security/bulletins/apsb11-26.html CVE-2011-2426 CVE-2011-2427 CVE-2011-2428 CVE-2011-2429 CVE-2011-2430 CVE-2011-2444 2011-06-06 2011-09-22
phpMyAdmin -- multiple XSS vulnerabilities phpMyAdmin 3.4.5

phpMyAdmin development team reports:

Firstly, if a row contains javascript code, after inline editing this row and saving, the code is executed. Secondly, missing sanitization on the db, table and column names leads to XSS vulnerabilities.

Versions 3.4.0 to 3.4.4 were found vulnerable.

http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php 2011-09-11 2011-09-14
django -- multiple vulnerabilities py23-django py24-django py25-django py26-django py27-django py30-django py31-django 1.31.3.1 1.21.2.7 py23-django-devel py24-django-devel py25-django-devel py26-django-devel py27-django-devel py30-django-devel py31-django-devel 16758,1

The Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.6 and Django 1.3.1 -- to remedy security issues reported to us. Additionally, this announcement contains advisories for several other issues which, while not requiring changes to Django itself, will be of concern to users of Django.

All users are encouraged to upgrade Django, and to implement the recommendations in these advisories, immediately.

Session manipulation

Django's session framework, django.contrib.sessions, is configurable to use any of multiple backends for storage of session data. One such backend, provided with Django itself, integrates with Django's cache framework to use the cache as storage for session data.

When configured in this fashion using memory-based sessions and caching, Django sessions are stored directly in the root namespace of the cache, using session identifiers as keys.

This results in a potential attack when coupled with an application storing user-supplied data in the cache; if an attacker can cause data to be cached using a key which is also a valid session identifier, Django's session framework will treat that data -- so long as it is a dictionary-like object -- as the session, thus allowing arbitrary data to be inserted into a session so long as the attacker knows the session key.

Denial of service attack via URLField

Django's model system includes a field type -- URLField -- which validates that the supplied value is a valid URL, and if the boolean keyword argument verify_exists is true, attempts to validate that the supplied URL also resolves, by issuing a request to it.

By default, the underlying socket libraries in Python do not have a timeout. This can manifest as a security problem in three different ways:

  1. An attacker can supply a slow-to-respond URL. Each request will tie up a server process for a period of time; if the attacker is able to make enough requests, they can tie up all available server processes.
  2. An attacker can supply a URL under his or her control, and which will simply hold an open connection indefinitely. Due to the lack of timeout, the Django process attempting to verify the URL will similarly spin indefinitely. Repeating this can easily tie up all available server processes.
  3. An attacker can supply a URL under his or her control which not only keeps the connection open, but also sends an unending stream of random garbage data. This data will cause the memory usage of the Django process (which will hold the response in memory) to grow without bound, thus consuming not only server processes but also server memory.

URLField redirection

The regular expression which validates URLs is used to check the supplied URL before issuing a check to verify that it exists, but if that URL issues a redirect in response to the request, no validation of the resulting redirected URL is performed, including basic checks for supported protocols (HTTP, HTTPS, and FTP).

This creates a small window for an attacker to gain knowledge of, for example, server layout; a redirect to a file:// URL, for example, will tell an attacker whether a given file exists locally on the server.

Additionally, although the initial request issued by Django uses the HEAD method for HTTP/HTTPS, the request to the target of the redirect is issued using GET. This may create further issues for systems which implicitly trust GET requests from the local machine/network.

Host header cache poisoning

In several places, Django itself -- independent of the developer -- generates full URLs (for example, when issuing HTTP redirects). Currently this uses the value of the HTTP Host header from the request to construct the URL, which opens a potential cache-poisoning vector: an attacker can submit a request with a Host header of his or her choice, receive a response which constructs URLs using that Host header, and -- if that response is cached -- further requests will be served out of cache using URLs containing the attacker's host of choice.

https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/ 2011-09-09 2011-09-13 2011-11-01
roundcube -- XSS vulnerability roundcube 0.5.4,1

RoundCube development Team reports:

We just published a new release which fixes a recently reported XSS vulnerability as an update to the stable 0.5 branch. Please update your installations with this new version or patch them with the fix which is also published in the downloads section or our sourceforge.net page.

and:

During one of pen-tests I found that _mbox parameter is not properly sanitized and reflected XSS attack is possible.

CVE-2011-2937 2011-08-09 2011-09-13
libsndfile -- PAF file processing integer overflow libsndfile 1.0.25

Secunia reports:

Hossein Lotfi has discovered a vulnerability in libsndfile, which can be exploited by malicious people to potentially compromise an application using the library. The vulnerability is caused due to an integer overflow error in the "paf24_init()" function (src/paf.c) when processing Paris Audio (PAF) files. This can be exploited to cause a heap-based buffer overflow via a specially crafted file. Successful exploitation may allow execution of arbitrary code. The vulnerability is confirmed in version 1.0.24. Other versions may also be affected.

CVE-2011-2696 http://secunia.com/advisories/45125/ 2011-07-12 2011-09-12
OpenSSL -- multiple vulnerabilities openssl 1.0.01.0.0_6 0.9.81.0.0 linux-f10-openssl 0.9.80.9.8r

OpenSSL Team reports:

Two security flaws have been fixed in OpenSSL 1.0.0e

Under certain circumstances OpenSSL's internal certificate verification routines can incorrectly accept a CRL whose nextUpdate field is in the past. (CVE-2011-3207)

OpenSSL server code for ephemeral ECDH ciphersuites is not thread-safe, and furthermore can crash if a client violates the protocol by sending handshake messages in incorrect order. (CVE-2011-3210)

CVE-2011-3207 CVE-2011-3210 http://www.openssl.org/news/secadv_20110906.txt 2011-09-06 2011-09-07 2014-04-10
XSS issue in MantisBT mantis 1.2.01.2.7

Net.Edit0r from BlACK Hat Group reported an XSS issue in search.php. All MantisBT users (including anonymous users that are not logged in to public bug trackers) could be impacted by this vulnerability.

ports/160368 CVE-2011-2938 2011-08-18 2011-09-05
security/cfs -- buffer overflow cfs 1.4.1_6

Debian reports:

Zorgon found several buffer overflows in cfsd, a daemon that pushes encryption services into the Unix(tm) file system. We are not yet sure if these overflows can successfully be exploited to gain root access to the machine running the CFS daemon. However, since cfsd can easily be forced to die, a malicious user can easily perform a denial of service attack to it.

CVE-2002-0351 http://www.debian.org/security/2002/dsa-116 2002-03-02 2011-09-04
ca_root_nss -- extraction of explicitly-untrusted certificates into trust bundle ca_root_nss 3.12.11

Matthias Andree reports that the ca-bundle.pl used in older versions of the ca_root_nss FreeBSD port before 3.12.11 did not take the Mozilla/NSS/CKBI untrusted markers into account and would add certificates to the trust bundle that were marked unsafe by Mozilla.

ports/160455 2011-09-04 2011-09-04
nss/ca_root_nss -- fraudulent certificates issued by DigiNotar.nl nss 3.12.11 ca_root_nss 3.12.11 firefox 3.6.*,13.6.22,1 4.0.*,16.0.2,1 seamonkey 2.3.2 linux-firefox 3.6.22,1 thunderbird 3.1.*3.1.14 5.0.*6.0.2 linux-thunderbird 3.1.14 linux-seamonkey 2.3.2

Heather Adkins, Google's Information Security Manager, reported that Google received

[...] reports of attempted SSL man-in-the-middle (MITM) attacks against Google users, whereby someone tried to get between them and encrypted Google services. The people affected were primarily located in Iran. The attacker used a fraudulent SSL certificate issued by DigiNotar, a root certificate authority that should not issue certificates for Google (and has since revoked it). [...]

VASCO Data Security International Inc., owner of DigiNotar, issued a press statement confirming this incident:

On July 19th 2011, DigiNotar detected an intrusion into its Certificate Authority (CA) infrastructure, which resulted in the fraudulent issuance of public key certificate requests for a number of domains, including Google.com. [...] an external security audit concluded that all fraudulently issued certificates were revoked. Recently, it was discovered that at least one fraudulent certificate had not been revoked at the time. [...]

Mozilla, maintainer of the NSS package, from which FreeBSD derived ca_root_nss, stated that they:

revoked our trust in the DigiNotar certificate authority from all Mozilla software. This is not a temporary suspension, it is a complete removal from our trusted root program. Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort.

Three central issues informed our decision:

  1. Failure to notify. [...]
  2. The scope of the breach remains unknown. [...]
  3. The attack is not theoretical.
http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx http://www.mozilla.org/security/announce/2011/mfsa2011-34.html http://googleonlinesecurity.blogspot.com/2011/08/update-on-attempted-man-in-middle.html 2011-07-19 2011-09-03 2011-09-06
apache -- Range header DoS vulnerability apache apache-event apache-itk apache-peruser apache-worker 2.*2.2.20

Apache HTTP server project reports:

A denial of service vulnerability has been found in the way the multiple overlapping ranges are handled by Apache HTTPD server.

CVE-2011-3192 https://people.apache.org/~dirkx/CVE-2011-3192.txt https://svn.apache.org/viewvc?view=revision&revision=1161534 https://svn.apache.org/viewvc?view=revision&revision=1162874 2011-08-24 2011-08-30 2011-09-01
stunnel -- heap corruption vulnerability stunnel 4.404.42

Michal Trojnara reports:

Version 4.42, 2011.08.18, urgency: HIGH:

Fixed a heap corruption vulnerability in versions 4.40 and 4.41. It may possibly be leveraged to perform DoS or remote code execution attacks.

49254 CVE-2011-2940 2011-08-25 2011-08-26
phpMyAdmin -- multiple XSS vulnerabilities phpMyAdmin 3.4.4

The phpMyAdmin development team reports:

Multiple XSS in the Tracking feature.

CVE-2011-3181 2011-08-24 2011-08-24
PHP -- crypt() returns only the salt for MD5 php5 5.3.75.3.7_2

PHP development team reports:

If crypt() is executed with MD5 salts, the return value consists of the salt only. DES and BLOWFISH salts work as expected.

https://bugs.php.net/bug.php?id=55439 2011-08-17 2011-08-23 2011-08-30
php -- multiple vulnerabilities php5 php5-sockets 5.3.7

PHP development team reports:

Security Enhancements and Fixes in PHP 5.3.7:

  • Updated crypt_blowfish to 1.2. (CVE-2011-2483)
  • Fixed crash in error_log(). Reported by Mateusz Kocielski
  • Fixed buffer overflow on overlog salt in crypt().
  • Fixed bug #54939 (File path injection vulnerability in RFC1867 File upload filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)
  • Fixed stack buffer overflow in socket_connect(). (CVE-2011-1938)
  • Fixed bug #54238 (use-after-free in substr_replace()). (CVE-2011-1148)
49241 CVE-2011-2483 CVE-2011-2202 CVE-2011-1938 CVE-2011-1148 2011-08-18 2011-08-20
rubygem-rails -- multiple vulnerabilities rubygem-rails 3.0.10

SecurityFocus reports:

Ruby on Rails is prone to multiple vulnerabilities including SQL-injection, information-disclosure, HTTP-header-injection, security-bypass and cross-site scripting issues.

49179 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6a1e473744bc389b http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/6ffc93bde0298768 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b9130749b74ea12 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195 2011-08-16 2011-08-19
dovecot -- denial of service vulnerability dovecot 1.2.17 2.02.0.13

Timo Sirainen reports:

Fixed potential crashes and other problems when parsing header names that contained NUL characters.

47930 CVE-2011-1929 2011-05-25 2011-08-19
OTRS -- Vulnerabilities in OTRS-Core allows read access to any file on local file system otrs 2.1.*3.0.10

OTRS Security Advisory reports:

  • An attacker with valid session and admin permissions could get read access to any file on the servers local operating system. For this it would be needed minimum one installed OTRS package.
CVE-2011-2746 http://otrs.org/advisory/OSA-2011-03-en/ 2011-08-16 2011-08-18
mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.20,1 5.0.*,16.0,1 seamonkey 2.3 linux-firefox 3.6.20,1 thunderbird 3.1.12 linux-thunderbird 3.1.12

The Mozilla Project reports:

MFSA 2011-29 Security issues addressed in Firefox 6

MFSA 2011-28 Security issues addressed in Firefox 3.6.20

http://www.mozilla.org/security/announce/2011/mfsa2011-29.html http://www.mozilla.org/security/announce/2011/mfsa2011-30.html CVE-2011-2982 CVE-2011-0084 CVE-2011-2981 CVE-2011-2378 CVE-2011-2984 CVE-2011-2980 CVE-2011-2983 CVE-2011-2989 CVE-2011-2991 CVE-2011-2992 CVE-2011-2985 CVE-2011-2993 CVE-2011-2988 CVE-2011-2987 CVE-2011-0084 CVE-2011-2990 CVE-2011-2986 2011-08-16 2011-08-16
Samba -- cross site scripting and request forgery vulnerabilities samba34 3.4.*3.4.14 samba35 3.5.*3.5.10

Samba security advisory reports:

All current released versions of Samba are vulnerable to a cross-site request forgery in the Samba Web Administration Tool (SWAT). By tricking a user who is authenticated with SWAT into clicking a manipulated URL on a different web page, it is possible to manipulate SWAT.

All current released versions of Samba are vulnerable to a cross-site scripting issue in the Samba Web Administration Tool (SWAT). On the "Change Password" field, it is possible to insert arbitrary content into the "user" field.

48901 48899 CVE-2011-2522 CVE-2011-2694 2011-07-27 2011-08-16
isc-dhcp-server -- server halt upon processing certain packets isc-dhcp31-server 3.1.ESV_1,1 isc-dhcp41-server 4.1.e_2,2 isc-dhcp42-server 4.2.2

ISC reports:

A pair of defects cause the server to halt upon processing certain packets. The patch is to properly discard or process those packets.

CVE-2011-2748 CVE-2011-2749 2011-08-10 2011-08-13
bugzilla -- multiple vulnerabilities bugzilla 2.4.*3.6.6 4.0.*4.0.2

A Bugzilla Security Advisory reports:

The following security issues have been discovered in Bugzilla:

  • Internet Explorer 8 and older, and Safari before 5.0.6 do content sniffing when viewing a patch in "Raw Unified" mode, which could trigger a cross-site scripting attack due to the execution of malicious code in the attachment.
  • It is possible to determine whether or not certain group names exist while creating or updating bugs.
  • Attachment descriptions with a newline in them could lead to the injection of crafted headers in email notifications sent to the requestee or the requester when editing an attachment flag.
  • If an attacker has access to a user's session, he can modify that user's email address without that user being notified of the change.
  • Temporary files for uploaded attachments are not deleted on Windows, which could let a user with local access to the server read them.
  • Up to Bugzilla 3.4.11, if a BUGLIST cookie is compromised, it can be used to inject HTML code when viewing a bug report, leading to a cross-site scripting attack.

All affected installations are encouraged to upgrade as soon as possible.

CVE-2011-2379 CVE-2011-2380 CVE-2011-2979 CVE-2011-2381 CVE-2011-2978 CVE-2011-2977 CVE-2011-2976 https://bugzilla.mozilla.org/show_bug.cgi?id=637981 https://bugzilla.mozilla.org/show_bug.cgi?id=653477 https://bugzilla.mozilla.org/show_bug.cgi?id=674497 https://bugzilla.mozilla.org/show_bug.cgi?id=657158 https://bugzilla.mozilla.org/show_bug.cgi?id=670868 https://bugzilla.mozilla.org/show_bug.cgi?id=660502 https://bugzilla.mozilla.org/show_bug.cgi?id=660053 2011-08-04 2011-08-13
dtc -- multiple vulnerabilities dtc 0.32.9

Ansgar Burchardt reports:

Ansgar Burchardt discovered several vulnerabilities in DTC, a web control panel for admin and accounting hosting services: The bw_per_moth.php graph contains an SQL injection vulnerability; insufficient checks in bw_per_month.php can lead to bandwidth usage information disclosure; after a registration, passwords are sent in cleartext email messages and Authenticated users could delete accounts using an obsolete interface which was incorrectly included in the package.

CVE-2011-0434 CVE-2011-0435 CVE-2011-0436 CVE-2011-0437 http://www.debian.org/security/2011/dsa-2179 2011-03-02 2011-08-13
libXfont -- possible local privilege escalation libXfont 1.4.4_1,1

Tomas Hoger reports:

The compress/ LZW decompress implentation does not correctly handle compressed streams that contain code words that were not yet added to the decompression table. This may lead to arbitrary memory corruption. Successfull exploitation may possible lead to a local privilege escalation.

CVE-2011-2895 https://bugzilla.redhat.com/show_bug.cgi?id=725760 2011-07-26 2011-08-11 2012-03-13
freetype2 -- execute arbitrary code or cause denial of service freetype2 2.4.6

Vincent Danen reports:

Due to an error within the t1_decoder_parse_charstrings() function (src/psaux/t1decode.c) and can be exploited to corrupt memory by tricking a user into processing a specially-crafted postscript Type1 font in an application that uses the freetype library.

CVE-2011-0226 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0226 2011-07-19 2011-08-11
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r289 linux-f10-flashplugin 10.3r183.5

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player 10.3.181.36 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.25 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

CVE-2011-2130 CVE-2011-2134 CVE-2011-2135 CVE-2011-2136 CVE-2011-2137 CVE-2011-2138 CVE-2011-2139 CVE-2011-2140 CVE-2011-2414 CVE-2011-2415 CVE-2011-2416 CVE-2011-2417 CVE-2011-2425 https://www.adobe.com/support/security/bulletins/apsb11-21.html 2011-05-13 2011-08-10 2012-11-05
libsoup -- unintentionally allow access to entire local filesystem libsoup 2.32.2_3

Dan Winship reports:

Fixed a security hole that caused some SoupServer users to unintentionally allow accessing the entire local filesystem when they thought they were only providing access to a single directory.

CVE-2011-2054 http://mail.gnome.org/archives/ftp-release-list/2011-July/msg00176.html https://bugzilla.gnome.org/show_bug.cgi?id=653258 2011-06-23 2011-07-28
phpmyadmin -- multiple vulnerabilities phpMyAdmin 3.4.3.2

The phpMyAdmin development team reports:

XSS in table Print view.

Via a crafted MIME-type transformation parameter, an attacker can perform a local file inclusion.

In the 'relational schema' code a parameter was not sanitized before being used to concatenate a class name.

The end result is a local file inclusion vulnerability and code execution.

It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code.

This is very similar to PMASA-2011-5, documented in 7e4e5c53-a56c-11e0-b180-00216aa06fc2

CVE-2011-2642 CVE-2011-2643 http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php 2011-07-23 2011-07-24 2011-07-28
opensaml2 -- unauthenticated login opensaml2 02.4.3

OpenSAML developer reports:

The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called "wrapping attack" that allows a remote, unauthenticated attacker to craft specially formed messages that can be successfully verified, but contain arbitrary content.

CVE-2011-1411 https://groups.google.com/a/shibboleth.net/group/announce/browse_thread/thread/cf3e0d76afbb57d9 2011-07-25 2011-07-25
rsync -- incremental recursion memory corruption vulnerability rsync 3.03.0.8

rsync development team reports:

Fixed a data-corruption issue when preserving hard-links without preserving file ownership, and doing deletions either before or during the transfer (CVE-2011-1097). This fixes some assert errors in the hard-linking code, and some potential failed checksums (via -c) that should have matched.

CVE-2011-1097 https://bugzilla.samba.org/show_bug.cgi?id=7936 2011-04-08 2011-07-20
BIND -- Remote DoS against authoritative and recursive servers bind96 9.6.3.1.ESV.R4.3 bind97 9.7.3.3 bind98 9.8.0.4

ISC reports:

A defect in the affected BIND 9 versions allows an attacker to remotely cause the "named" process to exit using a specially crafted packet.

This defect affects both recursive and authoritative servers.

CVE-2011-2464 https://www.isc.org/software/bind/advisories/cve-2011-2464 2011-07-05 2011-07-05
BIND -- Remote DoS with certain RPZ configurations bind98 9.8.0.4

ISC reports:

Two defects were discovered in ISC's BIND 9.8 code. These defects only affect BIND 9.8 servers which have recursion enabled and which use a specific feature of the software known as Response Policy Zones (RPZ) and where the RPZ zone contains a specific rule/action pattern.

CVE-2011-2465 https://www.isc.org/software/bind/advisories/cve-2011-2465 2011-07-05 2011-07-05
phpmyadmin -- multiple vulnerabilities phpMyAdmin 3.4.3.1

The phpMyAdmin development team reports:

It was possible to manipulate the PHP session superglobal using some of the Swekey authentication code. This could open a path for other attacks.

An unsanitized key from the Servers array is written in a comment of the generated config. An attacker can modify this key by modifying the SESSION superglobal array. This allows the attacker to close the comment and inject code.

Through a possible bug in PHP running on Windows systems a NULL byte can truncate the pattern string allowing an attacker to inject the /e modifier causing the preg_replace function to execute its second argument as PHP code.

Fixed filtering of a file path in the MIME-type transformation code, which allowed for directory traversal.

CVE-2011-2505 CVE-2011-2506 CVE-2011-2507 CVE-2011-2508 http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php 2011-07-02 2011-07-03 2011-07-28
Asterisk -- multiple vulnerabilities asterisk14 1.4.*1.4.41.2 asterisk16 1.6.*1.6.2.18.2 asterisk18 1.8.*1.8.4.4

The Asterisk Development Team reports:

AST-2011-008: If a remote user sends a SIP packet containing a NULL, Asterisk assumes available data extends past the null to the end of the packet when the buffer is actually truncated when copied. This causes SIP header parsing to modify data past the end of the buffer altering unrelated memory structures. This vulnerability does not affect TCP/TLS connections.

AST-2011-009: A remote user sending a SIP packet containing a Contact header with a missing left angle bracket causes Asterisk to access a null pointer.

AST-2011-010: A memory address was inadvertently transmitted over the network via IAX2 via an option control frame and the remote party would try to access it.

Possible enumeration of SIP users due to differing authentication responses.

CVE-2011-2529 CVE-2011-2535 CVE-2011-2536 http://downloads.asterisk.org/pub/security/AST-2011-008.html http://downloads.asterisk.org/pub/security/AST-2011-009.html http://downloads.asterisk.org/pub/security/AST-2011-010.html http://downloads.asterisk.org/pub/security/AST-2011-011.html 2011-06-24 2011-06-25 2011-06-29
ejabberd -- remote denial of service vulnerability ejabberd 2.1.7

It's reported in CVE advisory that:

expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2011-1753 http://www.ejabberd.im/ejabberd-2.1.7 2011-04-27 2011-06-24
mozilla -- multiple vulnerabilities firefox 3.5.*,13.5.20,1 3.6.*,13.6.18,1 4.0.*,15.0,1 linux-firefox 3.6.18,1 thunderbird 3.1.11 linux-thunderbird 3.1.11

The Mozilla Project reports:

MFSA 2011-19 Miscellaneous memory safety hazards (rv:3.0/1.9.2.18)

MFSA 2011-20 Use-after-free vulnerability when viewing XUL document with script disabled

MFSA 2011-21 Memory corruption due to multipart/x-mixed-replace images

MFSA 2011-22 Integer overflow and arbitrary code execution in Array.reduceRight()

MFSA 2011-23 Multiple dangling pointer vulnerabilities

MFSA 2011-24 Cookie isolation error

MFSA 2011-25 Stealing of cross-domain images using WebGL textures

MFSA 2011-26 Multiple WebGL crashes

MFSA 2011-27 XSS encoding hazard with inline SVG

MFSA 2011-28 Non-whitelisted site can trigger xpinstall

http://www.mozilla.org/security/announce/2011/mfsa2011-19.html http://www.mozilla.org/security/announce/2011/mfsa2011-20.html http://www.mozilla.org/security/announce/2011/mfsa2011-21.html http://www.mozilla.org/security/announce/2011/mfsa2011-22.html http://www.mozilla.org/security/announce/2011/mfsa2011-23.html http://www.mozilla.org/security/announce/2011/mfsa2011-24.html http://www.mozilla.org/security/announce/2011/mfsa2011-25.html http://www.mozilla.org/security/announce/2011/mfsa2011-26.html http://www.mozilla.org/security/announce/2011/mfsa2011-27.html http://www.mozilla.org/security/announce/2011/mfsa2011-28.html 2011-06-21 2011-06-21 2011-06-23
Samba -- Denial of service - memory corruption samba34 3.4.*3.4.12 samba35 3.5.*3.5.7

The Samba team reports:

Samba is vulnerable to a denial of service, caused by a memory corruption error related to missing range checks on file descriptors being used in the "FD_SET" macro. By performing a select on a bad file descriptor set, a remote attacker could exploit this vulnerability to cause the application to crash or possibly execute arbitrary code on the system.

CVE-2011-0719 http://www.samba.org/samba/security/CVE-2011-0719.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719 2011-02-28 2011-06-21
Piwik -- remote command execution vulnerability piwik 1.21.5

The Piwik security advisory reports:

The Piwik 1.5 release addresses a critical security vulnerability, which affect all Piwik users that have let granted some access to the "anonymous" user.

Piwik contains a remotely exploitable vulnerability that could allow a remote attacker to execute arbitrary code. Only installations that have granted untrusted view access to their stats (ie. grant "view" access to a website to anonymous) are at risk.

ports/158084 http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/ 2011-06-21 2011-06-21
Dokuwiki -- cross site scripting vulnerability dokuwiki 20110525a

Dokuwiki reports:

We just released a Hotfix Release "2011-05-25a Rincewind". It contains the following changes:

Security fix for a Cross Site Scripting vulnerability. Malicious users could abuse DokuWiki's RSS embedding mechanism to create links containing arbitrary JavaScript. Note: this security problem is present in at least Anteater and Rincewind but probably in older releases as well.

http://www.freelists.org/post/dokuwiki/Hotfix-Release-20110525a-Rincewind 2011-06-14 2011-06-20
linux-flashplugin -- remote code execution vulnerability linux-flashplugin 9.0r289 linux-f10-flashplugin 10.3r181.26

Adobe Product Security Incident Response Team reports:

A critical vulnerability has been identified in Adobe Flash Player 10.3.181.23 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.23 and earlier versions for Android. This memory corruption vulnerability (CVE-2011-2110) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via malicious Web pages.

CVE-2011-2110 http://www.adobe.com/support/security/bulletins/apsb11-18.html 2011-05-13 2011-06-15
ikiwiki -- tty hijacking via ikiwiki-mass-rebuild ikiwiki 3.20110608

The IkiWiki development team reports:

Ludwig Nussel discovered a way for users to hijack root's tty when ikiwiki-mass-rebuild was run. Additionally, there was some potential for information disclosure via symlinks.

CVE-2011-1408 http://ikiwiki.info/security/#index40h2 2011-06-08 2011-06-15
linux-flashplugin -- cross-site scripting vulnerability linux-flashplugin 9.0r289 linux-f10-flashplugin 10.3r181.22

Adobe Product Security Incident Response Team reports:

An important vulnerability has been identified in Adobe Flash Player 10.3.181.16 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.22 and earlier versions for Android. This universal cross-site scripting vulnerability (CVE-2011-2107) could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website. There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message.

CVE-2011-2107 http://www.adobe.com/support/security/bulletins/apsb11-13.html 2011-05-13 2011-06-08
BIND -- Large RRSIG RRsets and Negative Caching DoS bind9-sdb-ldap bind9-sdb-postgresql 9.4.3.4 bind96 9.6.3.1.ESV.R4.1 bind97 9.7.3.1 bind98 9.8.0.2 FreeBSD 7.37.3_6 7.47.4_2 8.18.1_4 8.28.2_2

ISC reports:

A BIND 9 DNS server set up to be a caching resolver is vulnerable to a user querying a domain with very large resource record sets (RRSets) when trying to negatively cache a response. This can cause the BIND 9 DNS server (named process) to crash.

CVE-2011-1910 SA-11:02.bind http://www.isc.org/software/bind/advisories/cve-2011-1910 2011-05-26 2011-06-04
fetchmail -- STARTTLS denial of service fetchmail 6.3.20

Matthias Andree reports:

Fetchmail version 5.9.9 introduced STLS support for POP3, version 6.0.0 added STARTTLS for IMAP. However, the actual S(TART)TLS-initiated in-band SSL/TLS negotiation was not guarded by a timeout.

Depending on the operating system defaults as to TCP stream keepalive mode, fetchmail hangs in excess of one week after sending STARTTLS were observed if the connection failed without notifying the operating system, for instance, through network outages or hard server crashes.

A malicious server that does not respond, at the network level, after acknowledging fetchmail's STARTTLS or STLS request, can hold fetchmail in this protocol state, and thus render fetchmail unable to complete the poll, or proceed to the next server, effecting a denial of service.

SSL-wrapped mode on dedicated ports was unaffected by this problem, so can be used as a workaround.

CVE-2011-1947 http://www.fetchmail.info/fetchmail-SA-2011-01.txt https://gitorious.org/fetchmail/fetchmail/commit/7dc67b8cf06f74aa57525279940e180c99701314 2011-04-28 2011-06-06
asterisk -- Remote crash vulnerability asterisk18 1.8.*1.8.4.2

The Asterisk Development Team reports:

If a remote user initiates a SIP call and the recipient picks up, the remote user can reply with a malformed Contact header that Asterisk will improperly handle and cause a crash due to a segmentation fault.

CVE-2011-2216 http://downloads.asterisk.org/pub/security/AST-2011-007.pdf 2011-06-02 2011-06-02
Subversion -- multiple vulnerabilities subversion 1.6.17 subversion-freebsd 1.6.17

Subversion team reports:

Subversion's mod_dav_svn Apache HTTPD server module will dereference a NULL pointer if asked to deliver baselined WebDAV resources.

This can lead to a DoS. An exploit has been tested, and tools or users have been observed triggering this problem in the wild.

Subversion's mod_dav_svn Apache HTTPD server module may in certain scenarios enter a logic loop which does not exit and which allocates memory in each iteration, ultimately exhausting all the available memory on the server.

This can lead to a DoS. There are no known instances of this problem being observed in the wild, but an exploit has been tested.

Subversion's mod_dav_svn Apache HTTPD server module may leak to remote users the file contents of files configured to be unreadable by those users.

There are no known instances of this problem being observed in the wild, but an exploit has been tested.

CVE-2011-1752 CVE-2011-1783 CVE-2011-1921 2011-05-28 2011-06-02
drupal6 -- multiple vulnerabilities drupal6 6.22

Drupal Team reports:

A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-screen error display at admin / settings / error-reporting. This is the recommended setting for production sites.

When using re-colorable themes, color inputs are not sanitized. Malicious color values can be used to insert arbitrary CSS and script code. Successful exploitation requires the "Administer themes" permission.

http://drupal.org/node/1168756 2011-05-25 2011-05-26
Erlang -- ssh library uses a weak random number generator erlang r14b03

US-CERT reports:

The Erlang/OTP ssh library implements a number of cryptographic operations that depend on cryptographically strong random numbers. Unfortunately the RNG used by the library is not cryptographically strong, and is further weakened by the use of predictable seed material. The RNG (Wichman-Hill) is not mixed with an entropy source.

CVE-2011-0766 http://www.erlang.org/download/otp_src_R14B03.readme https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5 2011-05-25 2011-05-25
Unbound -- an empty error packet handling assertion failure unbound 1.4.10

Unbound developer reports:

NLnet Labs was notified of an error in Unbound's code-path for error replies which is triggered under special conditions. The error causes the program to abort.

CVE-2011-1922 http://unbound.nlnetlabs.nl/downloads/CVE-2011-1922.txt 2011-05-25 2011-05-25
Pubcookie Login Server -- XSS vulnerability pubcookie-login-server 3.3.2d

Nathan Dors, Pubcookie Project reports:

A new non-persistent XSS vulnerability was found in the Pubcookie login server's compiled binary "index.cgi" CGI program. The CGI program mishandles untrusted data when printing responses to the browser. This makes the program vulnerable to carefully crafted requests containing script or HTML. If an attacker can lure an unsuspecting user to visit carefully staged content, the attacker can use it to redirect the user to his or her local Pubcookie login page and attempt to exploit the XSS vulnerability.

http://pubcookie.org/news/20070606-login-secadv.html 2007-05-25 2011-05-23
mod_pubcookie -- Empty Authentication Security Advisory ap20-mod_pubcookie 3.1.03.3.2b

Nathan Dors, Pubcookie Project reports:

An Abuse of Functionality vulnerability in the Pubcookie authentication process was found. This vulnerability allows an attacker to appear as if he or she were authenticated using an empty userid when such a userid isn't expected. Unauthorized access to web content and applications may result where access is restricted to users who can authenticate successfully but where no additional authorization is performed after authentication.

http://pubcookie.org/news/20061106-empty-auth-secadv.html 2006-10-04 2011-05-23
ViewVC -- user-reachable override of cvsdb row limit viewvc 1.1.11

ViewVC.org reports:

Security fix: remove user-reachable override of cvsdb row limit.

http://viewvc.tigris.org/source/browse/*checkout*/viewvc/branches/1.1.x/CHANGES 2011-05-17 2011-05-23
Apache APR -- DoS vulnerabilities apr1 1.4.5.1.3.12

The Apache Portable Runtime Project reports:

A flaw was discovered in the apr_fnmatch() function in the Apache Portable Runtime (APR) library 1.4.4 (or any backported versions that contained the upstream fix for CVE-2011-0419). This could cause httpd workers to enter a hung state (100% CPU utilization).

apr-util 1.3.11 could cause crashes with httpd's mod_authnz_ldap in some situations.

47929 CVE-2011-1928 CVE-2011-0419 http://www.apache.org/dist/apr/Announcement1.x.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1928 2011-05-19 2011-05-23
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r289 linux-f10-flashplugin 10.3r181.14

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player 10.2.159.1 and earlier versions (Adobe Flash Player 10.2.154.28 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.2.157.51 and earlier versions for Android. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports of malware attempting to exploit one of the vulnerabilities, CVE-2011-0627, in the wild via a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment targeting the Windows platform. However, to date, Adobe has not obtained a sample that successfully completes an attack.

CVE-2011-0579 CVE-2011-0618 CVE-2011-0619 CVE-2011-0620 CVE-2011-0621 CVE-2011-0622 CVE-2011-0623 CVE-2011-0624 CVE-2011-0625 CVE-2011-0626 CVE-2011-0627 http://www.adobe.com/support/security/bulletins/apsb11-12.html 2011-01-20 2011-05-23
Opera -- code injection vulnerability through broken frameset handling opera11.11 opera-devel11.11 linux-opera11.11

Opera Software ASA reports:

Fixed an issue with framesets that could allow execution of arbitrary code, as reported by an anonymous contributor working with the SecuriTeam Secure Disclosure program.

http://www.opera.com/docs/changelogs/unix/1111/ http://www.opera.com/support/kb/view/992/ 2011-05-18 2011-05-23
pureftpd -- multiple vulnerabilities pure-ftpd 1.0.32

Pure-FTPd development team reports:

Support for braces expansion in directory listings has been disabled -- Cf. CVE-2011-0418.

Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411. If you're using TLS, upgrading is recommended.

46767 CVE-2011-0418 CVE-2011-1575 2011-04-01 2011-05-23
Exim -- remote code execution and information disclosure exim 4.704.76

Release notes for Exim 4.76 says:

Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to a format-string attack -- SECURITY: remote arbitrary code execution.

DKIM signature header parsing was double-expanded, second time unintentionally subject to list matching rules, letting the header cause arbitrary Exim lookups (of items which can occur in lists, *not* arbitrary string expansion). This allowed for information disclosure.

Also, impact assessment was redone shortly after the original announcement:

Further analysis revealed that the second security was more severe than I realised at the time that I wrote the announcement. The second security issue has been assigned CVE-2011-1407 and is also a remote code execution flaw. For clarity: both issues were introduced with 4.70.

CVE-2011-1764 CVE-2011-1407 https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html http://bugs.exim.org/show_bug.cgi?id=1106 2011-05-10 2011-05-14
Apache APR -- DoS vulnerabilities apr1 1.4.4.1.3.11

The Apache Portable Runtime Project reports:

Note especially a security fix to APR 1.4.4, excessive CPU consumption was possible due to an unconstrained, recursive invocation of apr_fnmatch, as apr_fnmatch processed '*' wildcards. Reimplement apr_fnmatch() from scratch using a non-recursive algorithm now has improved compliance with the fnmatch() spec. (William Rowe)

CVE-2011-0419 http://www.apache.org/dist/apr/Announcement1.x.html 2011-05-10 2011-05-12
Zend Framework -- potential SQL injection when using PDO_MySql ZendFramework 1.11.6

The Zend Framework team reports:

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue.

http://framework.zend.com/security/advisory/ZF2011-02 http://zend-framework-community.634137.n4.nabble.com/Zend-Framework-1-11-6-and-1-10-9-released-td3503741.html 2011-05-06 2011-05-13
mediawiki -- multiple vulnerabilities mediawiki 1.16.5

Mediawiki reports:

(Bug 28534) XSS vulnerability for IE 6 clients. This is the third attempt at fixing bug 28235.

(Bug 28639) Potential privilege escalation when $wgBlockDisablesLogin is enabled.

https://bugzilla.wikimedia.org/show_bug.cgi?id=28534 https://bugzilla.wikimedia.org/show_bug.cgi?id=28639 http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_5/phase3/RELEASE-NOTES 2011-04-14 2011-05-12
Postfix -- memory corruption vulnerability postfix postfix-base 2.8.*,12.8.3,1 2.7.*,12.7.4,1 2.6.*,12.6.10,1 2.5.*,22.5.13,2 2.4.16,1 postfix-current postfix-current-base 2.9.20110501,4

The Postfix SMTP server has a memory corruption error, when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN (ANONYMOUS is not affected, but should not be used for other reasons). This memory corruption is known to result in a program crash (SIGSEV).

CVE-2011-1720 http://www.postfix.org/CVE-2011-1720.html 2011-05-09 2011-05-09
Mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.17,1 3.5.*,13.5.19,1 4.0.*,14.0.1,1 libxul 1.9.2.*1.9.2.17 linux-firefox 3.6.17,1 linux-firefox-devel 3.5.19 linux-seamonkey 2.0.*2.0.14 seamonkey 2.0.*2.0.14

The Mozilla Project reports:

MFSA 2011-12 Miscellaneous memory safety hazards

MFSA 2011-13 Multiple dangling pointer vulnerabilities

MFSA 2011-14 Information stealing via form history

MFSA 2011-15 Escalation of privilege through Java Embedding Plugin

MFSA 2011-16 Directory traversal in resource: protocol

MFSA 2011-17 WebGLES vulnerabilities

MFSA 2011-18 XSLT generate-id() function heap address leak

http://www.mozilla.org/security/announce/2011/mfsa2011-12.html http://www.mozilla.org/security/announce/2011/mfsa2011-13.html http://www.mozilla.org/security/announce/2011/mfsa2011-14.html http://www.mozilla.org/security/announce/2011/mfsa2011-15.html http://www.mozilla.org/security/announce/2011/mfsa2011-16.html http://www.mozilla.org/security/announce/2011/mfsa2011-17.html http://www.mozilla.org/security/announce/2011/mfsa2011-18.html 2011-04-28 2011-04-29
Asterisk -- multiple vulnerabilities asterisk14 1.4.*1.4.40.1 asterisk16 1.6.*1.6.2.17.3 asterisk18 1.8.*1.8.3.3

The Asterisk Development Team reports:

It is possible for a user of the Asterisk Manager Interface to bypass a security check and execute shell commands when they should not have that ability. Sending the "Async" header with the "Application" header during an Originate action, allows authenticated manager users to execute shell commands. Only users with the "system" privilege should be able to do this.

On systems that have the Asterisk Manager Interface, Skinny, SIP over TCP, or the built in HTTP server enabled, it is possible for an attacker to open as many connections to asterisk as he wishes. This will cause Asterisk to run out of available file descriptors and stop processing any new calls. Additionally, disk space can be exhausted as Asterisk logs failures to open new file descriptors.

CVE-2011-1507 http://downloads.asterisk.org/pub/security/AST-2011-005.pdf http://downloads.asterisk.org/pub/security/AST-2011-006.pdf 2011-04-21 2011-04-21
VLC -- Heap corruption in MP4 demultiplexer vlc 1.0.01.1.9

VideoLAN project reports:

When parsing some MP4 (MPEG-4 Part 14) files, insufficient buffer size might lead to corruption of the heap.

http://www.videolan.org/security/sa1103.html 2011-04-07 2011-04-17
linux-flashplugin -- remote code execution vulnerability linux-flashplugin 9.0r289 linux-f10-flashplugin 10.2r159.1

Adobe Product Security Incident Response Team reports:

A critical vulnerability exists in Flash Player 10.2.153.1 and earlier versions (Adobe Flash Player 10.2.154.25 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris, Adobe Flash Player 10.2.156.12 and earlier versions for Android, and the Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.2) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems.

This vulnerability (CVE-2011-0611) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a malicious Web page or a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment, targeting the Windows platform. At this time, Adobe is not aware of any attacks via PDF targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.

CVE-2011-0611 http://www.adobe.com/support/security/advisories/apsa11-02.html 2011-01-20 2011-04-17
rt -- multiple vulnerabilities rt36 3.6.11 rt38 3.8.10

Best Practical reports:

In the process of preparing the release of RT 4.0.0, we performed an extensive security audit of RT's source code. During this audit, several vulnerabilities were found which affect earlier releases of RT.

CVE-2011-1685 CVE-2011-1686 CVE-2011-1687 CVE-2011-1688 CVE-2011-1689 CVE-2011-1690 http://secunia.com/advisories/44189 2011-04-14 2011-04-17
krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285] krb5 1.71.7.2 1.81.8.4 1.9

An advisory published by the MIT Kerberos team says:

The password-changing capability of the MIT krb5 administration daemon (kadmind) has a bug that can cause it to attempt to free() an invalid pointer under certain error conditions. This can cause the daemon to crash or induce the execution of arbitrary code (which is believed to be difficult). No exploit that executes arbitrary code is known to exist, but it is easy to trigger a denial of service manually.

Some platforms detect attempted freeing of invalid pointers and protectively terminate the process, preventing arbitrary code execution on those platforms.

CVE-2011-0285 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt 2011-04-12 2011-04-14
krb5 -- MITKRB5-SA-2011-003, KDC vulnerable to double-free when PKINIT enabled krb5 1.71.7.2 1.81.8.4 1.9

An advisory published by the MIT Kerberos team says:

The MIT Kerberos 5 Key Distribution Center (KDC) daemon is vulnerable to a double-free condition if the Public Key Cryptography for Initial Authentication (PKINIT) capability is enabled, resulting in daemon crash or arbitrary code execution (which is believed to be difficult).

An unauthenticated remote attacker can induce a double-free event, causing the KDC daemon to crash (denial of service), or to execute arbitrary code. Exploiting a double-free event to execute arbitrary code is believed to be difficult.

CVE-2011-0284 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt 2011-03-15 2011-04-14
krb5 -- MITKRB5-SA-2011-002, KDC vulnerable to hang when using LDAP back end krb5 1.71.7.2 1.81.8.4 1.9

An advisory published by the MIT Kerberos team says:

The MIT krb5 Key Distribution Center (KDC) daemon is vulnerable to denial of service attacks from unauthenticated remote attackers. CVE-2011-0281 and CVE-2011-0282 occur only in KDCs using LDAP back ends, but CVE-2011-0283 occurs in all krb5-1.9 KDCs.

Exploit code is not known to exist, but the vulnerabilities are easy to trigger manually. The trigger for CVE-2011-0281 has already been disclosed publicly, but that fact might not be obvious to casual readers of the message in which it was disclosed. The triggers for CVE-2011-0282 and CVE-2011-0283 have not yet been disclosed publicly, but they are also trivial.

CVE-2011-0281: An unauthenticated remote attacker can cause a KDC configured with an LDAP back end to become completely unresponsive until restarted.

CVE-2011-0282: An unauthenticated remote attacker can cause a KDC configured with an LDAP back end to crash with a null pointer dereference.

CVE-2011-0283: An unauthenticated remote attacker can cause a krb5-1.9 KDC with any back end to crash with a null pointer dereference.

CVE-2011-0281 CVE-2011-0282 CVE-2011-0283 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt 2011-02-08 2011-04-14
krb5 -- MITKRB5-SA-2011-001, kpropd denial of service krb5 1.71.7.2 1.81.8.4 1.9

An advisory published by the MIT Kerberos team says:

The MIT krb5 KDC database propagation daemon (kpropd) is vulnerable to a denial-of-service attack triggered by invalid network input. If a kpropd worker process receives invalid input that causes it to exit with an abnormal status, it can cause the termination of the listening process that spawned it, preventing the slave KDC it was running on from receiving database updates from the master KDC.

Exploit code is not known to exist, but the vulnerabilities are easy to trigger manually.

An unauthenticated remote attacker can cause kpropd running in standalone mode (the "-S" option) to terminate its listening process, preventing database propagations to the KDC host on which it was running. Configurations where kpropd runs in incremental propagation mode ("iprop") or as an inetd server are not affected.

CVE-2010-4022 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt 2011-02-08 2011-04-14
xrdb -- root hole via rogue hostname xrdb 1.0.6_1

Matthias Hopf reports:

By crafting hostnames with shell escape characters, arbitrary commands can be executed in a root environment when a display manager reads in the resource database via xrdb.

These specially crafted hostnames can occur in two environments:

Systems are affected are: systems set their hostname via DHCP, and the used DHCP client allows setting of hostnames with illegal characters. And systems that allow remote logins via xdmcp.

CVE-2011-0465 http://lists.freedesktop.org/archives/xorg-announce/2011-April/001636.html 2011-04-05 2011-04-14
OTRS -- Several XSS attacks possible otrs 2.3.*3.0.7

OTRS Security Advisory reports:

  • Several XSS attacks possible: An attacker could trick a logged in user to following a prepared URL inside of the OTRS system which causes a page to be shown that possibly includes malicious !JavaScript code because of incorrect escaping during the generation of the HTML page.
CVE-2011-1518 http://otrs.org/advisory/OSA-2011-01-en/ 2011-03-12 2011-04-12
isc-dhcp-client -- dhclient does not strip or escape shell meta-characters isc-dhcp31-client 3.1.ESV_1,1 isc-dhcp41-client 4.1.e,2

ISC reports:

ISC dhclient did not strip or escape certain shell meta-characters in responses from the dhcp server (like hostname) before passing the responses on to dhclient-script. Depending on the script and OS, this can result in execution of exploit code on the client.

CVE-2011-0997 107886 2011-04-05 2011-04-10
tinyproxy -- ACL lists ineffective when range is configured tinyproxy 1.8.2_2,1

When including a line to allow a network of IP addresses, the access to tinyproxy 56 is actually allowed for all IP addresses.

CVE-2011-1499 https://banu.com/bugzilla/show_bug.cgi?id=90 2010-05-18 2011-04-08
quagga -- two DoS vulnerabilities quagga 0.99.17_6

Quagga developers report:

Quagga 0.99.18 has been released. This release fixes 2 denial of services in bgpd, which can be remotely triggered by malformed AS-Pathlimit or Extended-Community attributes. These issues have been assigned CVE-2010-1674 and CVE-2010-1675. Support for AS-Pathlimit has been removed with this release.

CVE-2010-1674 CVE-2010-1675 http://www.quagga.net/news2.php?y=2011&m=3&d=21#id1300723200 2010-04-30 2011-04-01
gdm -- privilege escalation vulnerability gdm 2.30.5_2

Sebastian Krahmer reports:

It was discovered that the GNOME Display Manager (gdm) cleared the cache directory, which is owned by an unprivileged user, with the privileges of the root user. A race condition exists in gdm where a local user could take advantage of this by writing to the cache directory between ending the session and the signal to clean up the session, which could lead to the execution of arbitrary code as the root user.

CVE-2011-0727 http://mail.gnome.org/archives/distributor-list/2011-March/msg00008.html https://bugzilla.redhat.com/show_bug.cgi?id=688323 2011-03-28 2011-03-29
php -- ZipArchive segfault with FL_UNCHANGED on empty archive php5-zip 5.3.6

US-CERT/NIST reports:

The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (application crash) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.

CVE-2011-0421 2011-03-20 2011-03-25
php -- crash on crafted tag in exif php5-exif 5.3.6

US-CERT/NIST reports:

exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.

CVE-2011-0708 2011-03-20 2011-03-25
linux-flashplugin -- remote code execution vulnerability linux-flashplugin 9.0r289 linux-f8-flashplugin linux-f10-flashplugin 10.2r153

Adobe Product Security Incident Response Team reports:

A critical vulnerability exists in Adobe Flash Player 10.2.152.33 and earlier versions (Adobe Flash Player 10.2.154.18 and earlier for Chrome users) for Windows, Macintosh, Linux and Solaris operating systems, Adobe Flash Player 10.1.106.16 and earlier versions for Android, and the Authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions of Reader and Acrobat for Windows and Macintosh operating systems.

This vulnerability (CVE-2011-0609) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via a Flash (.swf) file embedded in a Microsoft Excel (.xls) file delivered as an email attachment.

CVE-2011-0609 http://www.adobe.com/support/security/advisories/apsa11-01.html 2011-01-20 2011-03-24
mozilla -- update to HTTPS certificate blacklist firefox 3.6.*,13.6.16,1 3.5.*,13.5.18,1 libxul 1.9.2.*1.9.2.16 linux-firefox 3.6.16,1 linux-firefox-devel 3.5.18 linux-seamonkey 2.0.*2.0.13 seamonkey 2.0.*2.0.13

The Mozilla Project reports:

MFSA 2011-11 Update to HTTPS certificate blacklist

http://www.mozilla.org/security/announce/2011/mfsa2011-11.html 2011-03-22 2011-03-24
postfix -- plaintext command injection with SMTP over TLS postfix postfix-base 2.7.*,12.7.3,1 2.6.*,12.6.9,1 2.5.*,22.5.12,2 2.4.*,12.4.16,1 postfix-current postfix-current-base 2.9.20100120,4

Wietse Venema has discovered a software flaw that allows an attacker to inject client commands into an SMTP session during the unprotected plaintext SMTP protocol phase, such that the server will execute those commands during the SMTP- over-TLS protocol phase when all communication is supposed to be protected.

CVE-2011-0411 http://www.postfix.org/CVE-2011-0411.html http://secunia.com/advisories/43646/ 2011-03-07 2011-03-19
hiawatha -- integer overflow in Content-Length header parsing hiawatha 7.4_1

Hugo Leisink reports:

A bug has been found in version 7.4 of the Hiawatha webserver, which could lead to a server crash. This is caused by an integer overflow in the routine that reads the HTTP request. A too large value of the Content-Length HTTP header results in an overflow.

http://www.hiawatha-webserver.org/weblog/16 http://secunia.com/advisories/43660/ http://securityvulns.com/Zdocument902.html http://packetstormsecurity.org/files/99021/Hiawatha-WebServer-7.4-Denial-Of-Service.html http://seclists.org/bugtraq/2011/Mar/65 2011-02-25 2011-03-17
asterisk -- Multiple Vulnerabilities asterisk16 1.6.*1.6.2.17.1 asterisk18 1.8.*1.8.3.1

The Asterisk Development Team reports:

The releases of Asterisk 1.6.1.23, 1.6.2.17.1, and 1.8.3.1 resolve two issues:

  • Resource exhaustion in Asterisk Manager Interface (AST-2011-003)
  • Remote crash vulnerability in TCP/TLS server (AST-2011-004)

The issues and resolutions are described in the AST-2011-003 and AST-2011-004 security advisories.

http://downloads.asterisk.org/pub/security/AST-2011-003.html http://downloads.asterisk.org/pub/security/AST-2011-004.html 2011-03-01 2011-03-16
avahi -- denial of service avahi avahi-app avahi-autoipd avahi-gtk avahi-libdns avahi-qt3 avahi-qt4 avahi-sharp 0.6.29

Avahi developers reports:

A vulnerability has been reported in Avahi, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error when processing certain UDP packets, which can be exploited to trigger an infinite loop by e.g. sending an empty packet to port 5353/UDP.

CVE-2011-1002 CVE-2010-2244 http://secunia.com/advisories/43361/ https://bugzilla.redhat.com/show_bug.cgi?id=667187 2011-02-21 2011-03-13
mailman -- XSS vulnerability mailman 2.1.14_1

CVE reports:

Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.

CVE-2011-0707 http://mail.python.org/pipermail/mailman-announce/2011-February/000157.html 2011-02-13 2011-03-10
redmine -- XSS vulnerability redmine 1.01.1.2

Jean-Philippe Lang reports:

This maintenance release for 1.1.x users includes 13 bug fixes since 1.1.1 and a security fix (XSS vulnerability affecting all Redmine versions from 1.0.1 to 1.1.1).

http://www.redmine.org/news/53 2011-03-07 2011-03-07
subversion -- remote HTTP DoS vulnerability subversion 1.61.6.15 1.51.6.9 subversion-freebsd 1.61.6.15 1.51.6.9

Subversion project reports:

Subversion HTTP servers up to 1.5.9 (inclusive) or 1.6.15 (inclusive) are vulnerable to a remotely triggerable NULL-pointer dereference.

CVE-2011-0715 2011-02-27 2011-03-05
mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.14,1 3.5.*,13.5.17,1 libxul 1.9.2.*1.9.2.14 linux-firefox 3.6.14,1 linux-firefox-devel 3.5.17 linux-seamonkey 2.0.*2.0.12 linux-thunderbird 3.13.1.8 seamonkey 2.0.*2.0.12 thunderbird 3.1.8

The Mozilla Project reports:

MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)

MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true

MFSA 2011-03 Use-after-free error in JSON.stringify

MFSA 2011-04 Buffer overflow in JavaScript upvarMap

MFSA 2011-05 Buffer overflow in JavaScript atom map

MFSA 2011-06 Use-after-free error using Web Workers

MFSA 2011-07 Memory corruption during text run construction (Windows)

MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents

MFSA 2011-09 Crash caused by corrupted JPEG image

MFSA 2011-10 CSRF risk with plugins and 307 redirects

CVE-2010-1585 CVE-2011-0051 CVE-2011-0053 CVE-2011-0054 CVE-2011-0055 CVE-2011-0056 CVE-2011-0057 CVE-2011-0058 CVE-2011-0059 CVE-2011-0061 CVE-2011-0062 https://www.mozilla.org/security/announce/2011/mfsa2011-01.html https://www.mozilla.org/security/announce/2011/mfsa2011-02.html https://www.mozilla.org/security/announce/2011/mfsa2011-03.html https://www.mozilla.org/security/announce/2011/mfsa2011-04.html https://www.mozilla.org/security/announce/2011/mfsa2011-05.html https://www.mozilla.org/security/announce/2011/mfsa2011-06.html https://www.mozilla.org/security/announce/2011/mfsa2011-07.html https://www.mozilla.org/security/announce/2011/mfsa2011-08.html https://www.mozilla.org/security/announce/2011/mfsa2011-09.html https://www.mozilla.org/security/announce/2011/mfsa2011-10.html 2011-03-01 2011-03-01
openldap -- two security bypass vulnerabilities openldap-server 2.4.02.4.24

Secunia reports:

Two vulnerabilities have been reported in OpenLDAP, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerabilities are reported in versions prior to 2.4.24.

http://secunia.com/advisories/43331/ 2011-02-14 2011-02-25
asterisk -- Exploitable Stack and Heap Array Overflows asterisk14 1.4.*1.4.39.2 asterisk16 1.6.*1.6.2.16.2 asterisk18 1.8.*1.8.2.4

The Asterisk Development Team reports:

The releases of Asterisk 1.4.39.2, 1.6.1.22, 1.6.2.16.2, and 1.8.2.4 resolve an issue that when decoding UDPTL packets, multiple heap based arrays can be made to overflow by specially crafted packets. Systems configured for T.38 pass through or termination are vulnerable. The issue and resolution are described in the AST-2011-002 security advisory.

http://downloads.asterisk.org/pub/security/AST-2011-002.html http://secunia.com/advisories/43429/ 2011-02-21 2011-02-22
PivotX -- administrator password reset vulnerability pivotx 2.2.4

US CERT reports:

PivotX contains a vulnerability that allows an attacker to change the password of any account just by guessing the username. Version 2.2.4 has been reported to not be affected. This vulnerability is being exploited in the wild and users should immediately upgrade to 2.2.5 or later. Mitigation steps for users that have been compromised have been posted to the PivotX Support Community.

CVE-2011-1035 2011-02-18 2011-02-20
tomcat -- Cross-site scripting vulnerability tomcat 5.5.05.5.32 tomcat 6.0.06.0.30 tomcat 7.0.07.0.6

The Tomcat security team reports:

The HTML Manager interface displayed web applciation provided data, such as display names, without filtering. A malicious web application could trigger script execution by an administartive user when viewing the manager pages.

CVE-2011-0013 http://tomcat.apache.org/security-5.html#Fixed_in_Apache_Tomcat_5.5.32 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.30 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.6 2010-11-12 2011-02-15 2011-09-30
phpMyAdmin -- multiple vulnerabilities phpMyAdmin 3.3.9.2 phpMyAdmin211 2.11.11.3

phpMyAdmin team reports:

It was possible to create a bookmark which would be executed unintentionally by other users.

When the files README, ChangeLog or LICENSE have been removed from their original place (possibly by the distributor), the scripts used to display these files can show their full path, leading to possible further attacks.

http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php 2011-02-08 2011-02-11
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r289 linux-f8-flashplugin linux-f10-flashplugin 10.2r152

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

CVE-2011-0558 CVE-2011-0559 CVE-2011-0560 CVE-2011-0561 CVE-2011-0571 CVE-2011-0572 CVE-2011-0573 CVE-2011-0574 CVE-2011-0575 CVE-2011-0577 CVE-2011-0578 CVE-2011-0607 CVE-2011-0608 http://www.adobe.com/support/security/bulletins/apsb11-02.html 2011-02-08 2011-02-11
mupdf -- Remote System Access mupdf 0.8

Secunia reports:

The vulnerability is caused due to an error within the "closedctd()" function in fitz/filt_dctd.c when processing PDF files containing certain malformed JPEG images. This can be exploited to cause a stack corruption by e.g. tricking a user into opening a specially crafted PDF file.

46027 http://secunia.com/advisories/43020/ 2011-01-26 2011-02-10
rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability rubygem-mail 2.2.15

Secunia reports:

Input passed via an email from address is not properly sanitised in the "deliver()" function (lib/mail/network/delivery_methods/sendmail.rb) before being used as a command line argument. This can be exploited to inject arbitrary shell commands.

46021 CVE-2011-0739 http://secunia.com/advisories/43077/ http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1 2011-01-25 2011-02-10
plone -- Remote Security Bypass plone 2.53 plone3 33.3

Plone developer reports:

This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still in place, and it does not grant access to other applications running on the same Zope instance.

46102 CVE-2011-0720 http://plone.org/products/plone/security/advisories/cve-2011-0720 2011-02-02 2011-02-10
exim -- local privilege escalation exim exim-ldap exim-ldap2 exim-mysql exim-postgresql exim-sa-exim 4.74

exim.org reports:

CVE-2011-0017 - check return value of setuid/setgid. This is a privilege escalation vulnerability whereby the Exim run-time user can cause root to append content of the attacker's choosing to arbitrary files.

CVE-2011-0017 ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74 2011-01-31 2011-02-10
openoffice.org -- Multiple vulnerabilities openoffice.org 3.3.0

OpenOffice.org Security Team reports:

Fixed in OpenOffice.org 3.3

http://www.openoffice.org/security/bulletin.html http://secunia.com/advisories/40775/ 2010-08-04 2011-02-10
webkit-gtk2 -- Multiple vurnabilities. webkit-gtk2 1.2.7

Gustavo Noronha Silva reports:

This release has essentially security fixes. Refer to the WebKit/gtk/NEWS file inside the tarball for details. We would like to thank the Red Hat security team (Huzaifa Sidhpurwala in particular) and Michael Gilbert from Debian for their help in checking (and pushing!) security issues affecting the WebKitGTK+ stable branch for this release.

CVE-2010-2901 CVE-2010-4040 CVE-2010-4042 CVE-2010-4199 CVE-2010-4492 CVE-2010-4493 CVE-2010-4578 CVE-2011-0482 CVE-2011-0778 https://bugs.webkit.org/show_bug.cgi?id=48328 https://bugs.webkit.org/show_bug.cgi?id=50710 https://bugs.webkit.org/show_bug.cgi?id=50840 https://bugs.webkit.org/show_bug.cgi?id=50932 https://bugs.webkit.org/show_bug.cgi?id=51993 https://bugs.webkit.org/show_bug.cgi?id=53265 https://bugs.webkit.org/show_bug.cgi?id=53276 http://permalink.gmane.org/gmane.os.opendarwin.webkit.gtk/405 2011-02-08 2011-02-10
awstats -- arbitrary commands execution vulnerability awstats 7.0,1 awstats-devel 0

Awstats change log reports:

  • Security fix (Traverse directory of LoadPlugin)
  • Security fix (Limit config to defined directory to avoid access to external config file via a nfs or webdav link).
CVE-2010-4367 http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html http://awstats.sourceforge.net/docs/awstats_changelog.txt 2010-05-01 2011-02-10
opera -- multiple vulnerabilities opera opera-devel linux-opera 11.01

Opera reports:

Opera 11.01 is a recommended upgrade offering security and stability enhancements.

The following security vulnerabilities have been fixed:

  • Removed support for "javascript:" URLs in CSS -o-link values, to make it easier for sites to filter untrusted CSS.
  • Fixed an issue where large form inputs could allow execution of arbitrary code, as reported by Jordi Chancel; see our advisory.
  • Fixed an issue which made it possible to carry out clickjacking attacks against internal opera: URLs; see our advisory.
  • Fixed issues which allowed web pages to gain limited access to files on the user's computer; see our advisory.
  • Fixed an issue where email passwords were not immediately deleted when deleting private data; see our advisory.
CVE-2011-0450 CVE-2011-0681 CVE-2011-0682 CVE-2011-0683 CVE-2011-0684 CVE-2011-0685 CVE-2011-0686 CVE-2011-0687 http://www.opera.com/support/kb/view/982/ http://www.opera.com/support/kb/view/983/ http://www.opera.com/support/kb/view/984/ http://secunia.com/advisories/43023 2011-01-26 2011-02-10
django -- multiple vulnerabilities py23-django py24-django py25-django py26-django py27-django py30-django py31-django 1.21.2.5 1.11.1.4 py23-django-devel py24-django-devel py25-django-devel py26-django-devel py27-django-devel py30-django-devel py31-django-devel 15470,1

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.5 and Django 1.1.4 -- to remedy three security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.

http://www.djangoproject.com/weblog/2011/feb/08/security/ 2011-02-08 2011-02-09
mediawiki -- multiple vulnerabilities mediawiki 1.16.2

Medawiki reports:

An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in ".php" which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected. Despite these mitigating factors, all users are advised to upgrade, since there is a risk of complete server compromise. MediaWiki 1.8.0 and later is affected.

Security researcher mghack discovered a CSS injection vulnerability. For Internet Explorer and similar browsers, this is equivalent to an XSS vulnerability, that is to say, it allows the compromise of wiki user accounts. For other browsers, it allows private data such as IP addresses and browsing patterns to be sent to a malicious external web server. It affects all versions of MediaWiki. All users are advised to upgrade.

CVE-2011-0047 https://bugzilla.wikimedia.org/show_bug.cgi?id=27094 https://bugzilla.wikimedia.org/show_bug.cgi?id=27093 http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_2/phase3/RELEASE-NOTES http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html 2011-02-01 2011-02-09
wordpress -- SQL injection vulnerability wordpress 3.0.2,1 de-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 3.0.2

Vendor reports:

SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.

CVE-2010-4257 http://www.cvedetails.com/cve/CVE-2010-4257/ 2010-11-16 2011-02-05 2011-02-09
vlc -- Insufficient input validation in MKV demuxer vlc 1.1.7

VLC team reports:

When parsing an invalid MKV (Matroska or WebM) file, input validation are insufficient.

http://www.videolan.org/security/sa1102.html 2011-01-26 2011-02-02
maradns -- denial of service when resolving a long DNS hostname maradns 1.4.06

MaraDNS developer Sam Trenholme reports:

... a mistake in allocating an array of integers, allocating it in bytes instead of sizeof(int) units. This resulted in a buffer being too small, allowing it to be overwritten. The impact of this programming error is that MaraDNS can be crashed by sending MaraDNS a single "packet of death". Since the data placed in the overwritten array can not be remotely controlled (it is a list of increasing integers), there is no way to increase privileges exploiting this bug.

45966 CVE-2011-0520 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610834 2011-01-23 2011-01-31
isc-dhcp-server -- DHCPv6 crash isc-dhcp41-server 4.1.2,1

ISC reports:

When the DHCPv6 server code processes a message for an address that was previously declined and internally tagged as abandoned it can trigger an assert failure resulting in the server crashing. This could be used to crash DHCPv6 servers remotely. This issue only affects DHCPv6 servers. DHCPv4 servers are unaffected.

CVE-2011-0413 http://www.isc.org/software/dhcp/advisories/cve-2011-0413 http://www.kb.cert.org/vuls/id/686084 2011-01-26 2011-01-28
bugzilla -- multiple serious vulnerabilities bugzilla 2.14.*3.6.4

A Bugzilla Security Advisory reports:

This advisory covers three security issues that have recently been fixed in the Bugzilla code:

  • A weakness in Bugzilla could allow a user to gain unauthorized access to another Bugzilla account.
  • A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages in Bugzilla.
  • If you put a harmful "javascript:" or "data:" URL into Bugzilla's "URL" field, then there are multiple situations in which Bugzilla will unintentionally make that link clickable.
  • Various pages lack protection against cross-site request forgeries.

All affected installations are encouraged to upgrade as soon as possible.

25425 CVE-2010-4568 CVE-2010-2761 CVE-2010-4411 CVE-2010-4572 CVE-2010-4567 CVE-2010-0048 CVE-2011-0046 https://bugzilla.mozilla.org/show_bug.cgi?id=621591 https://bugzilla.mozilla.org/show_bug.cgi?id=619594 https://bugzilla.mozilla.org/show_bug.cgi?id=591165 https://bugzilla.mozilla.org/show_bug.cgi?id=621572 https://bugzilla.mozilla.org/show_bug.cgi?id=619588 https://bugzilla.mozilla.org/show_bug.cgi?id=628034 https://bugzilla.mozilla.org/show_bug.cgi?id=621090 https://bugzilla.mozilla.org/show_bug.cgi?id=621105 https://bugzilla.mozilla.org/show_bug.cgi?id=621107 https://bugzilla.mozilla.org/show_bug.cgi?id=621108 https://bugzilla.mozilla.org/show_bug.cgi?id=621109 https://bugzilla.mozilla.org/show_bug.cgi?id=621110 2011-01-24 2011-01-25
dokuwiki -- multiple privilege escalation vulnerabilities dokuwiki 20101107a

Dokuwiki reports:

This security update fixes problems in the XMLRPC interface where ACLs where not checked correctly sometimes, making it possible to access and write information that should not have been accessible/writable. This only affects users who have enabled the XMLRPC interface (default is off) and have enabled XMLRPC access for users who can't access/write all content anyway (default is nobody, see http://www.dokuwiki.org/config:xmlrpcuser for details).

This update also includes a fix for a problem in the general ACL checking function that could be exploited to gain access to restricted pages and media files in rare conditions (when you had rights for an id you could get the same rights on ids where one character has been replaced by a ".").

http://bugs.dokuwiki.org/index.php?do=details&task_id=2136 2011-01-16 2011-01-24
asterisk -- Exploitable Stack Buffer Overflow asterisk14 1.4.*1.4.39.1 asterisk16 1.6.*1.6.2.16.1 asterisk18 1.8.*1.8.2.2

The Asterisk Development Team reports:

The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully crafted caller ID information. The issue and resolution are described in the AST-2011-001 security advisory.

http://downloads.asterisk.org/pub/security/AST-2011-001.pdf 2011-01-18 2011-01-19
tarsnap -- cryptographic nonce reuse tarsnap 1.0.221.0.27

Colin Percival reports:

In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value is not incremented after each chunk is encrypted. (The CTR counter is correctly incremented after each 16 bytes of data was processed, but this counter is reset to zero for each new chunk.)

Note that since the Tarsnap client-server protocol is encrypted, being able to intercept Tarsnap client-server traffic does not provide an attacker with access to the data.

http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html 2011-01-18 2011-01-19
MoinMoin -- cross-site scripting vulnerabilities moinmoin 1.9.3

The MoinMoin developers reports:

Fix XSS in Despam action (CVE-2010-0828)

Fix XSS issues

  • by escaping template name in messages
  • by fixing other places that had similar issues
39110 CVE-2010-0828 http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg 2010-04-05 2011-01-11
tor -- remote code execution and crash tor 0.2.1.29 tor-devel 0.2.2.21.a

The Tor Project reports:

A remote heap overflow vulnerability that can allow remote code execution. Other fixes address a variety of assert and crash bugs, most of which we think are hard to exploit remotely. All Tor users should upgrade.

45832 CVE-2011-0427 ports/154099 http://archives.seul.org/or/announce/Jan-2011/msg00000.html https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog 2011-01-15 2011-01-17
sudo -- local privilege escalation sudo 1.7.01.7.4.5

Todd Miller reports:

Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo's -g option (run as group), if allowed by the sudoers file. A flaw exists in sudo's password checking logic that allows a user to run a command with only the group changed without being prompted for a password.

CVE-2011-0010 http://www.sudo.ws/sudo/alerts/runas_group_pw.html http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=609641 2011-01-11 2011-01-13
subversion -- multiple DoS subversion 1.6.15 subversion-freebsd 1.6.15

Entry for CVE-2010-4539 says:

The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.

Entry for CVE-2010-4644 says:

Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.

45655 CVE-2010-4539 CVE-2010-4644 2011-01-02 2011-01-13
php -- multiple vulnerabilities php5 5.3.5 php52 5.2.17

PHP developers reports:

Security Enhancements and Fixes in PHP 5.3.5:

  • Fixed bug #53632 (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645)

Security Enhancements and Fixes in PHP 5.2.17:

  • Fixed bug #53632 (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645)
CVE-2010-4645 2011-01-06 2011-01-09 2011-01-09
exim -- local privilege escalation exim 4.73

David Woodhouse reports:

Secondly a privilege escalation where the trusted 'exim' user is able to tell Exim to use arbitrary config files, in which further ${run ...} commands will be invoked as root.

CVE-2010-4345 http://www.exim.org/lurker/message/20101209.022730.dbb6732d.en.html https://bugzilla.redhat.com/show_bug.cgi?id=661756#c3 2010-12-10 2011-01-08
mediawiki -- Clickjacking vulnerabilities mediawiki 1.161.16.1 1.151.15.5_1

Clickjacking vulnerabilities:

Clickjacking is a type of vulnerability discovered in 2008, which is similar to CSRF. The attack involves displaying the target webpage in a iframe embedded in a malicious website. Using CSS, the submit button of the form on the targeit webpage is made invisible, and then overlaid with some button or link on the malicious website that encourages the user to click on it.

https://bugzilla.wikimedia.org/show_bug.cgi?id=26561 2011-01-04 2011-01-06
webkit-gtk2 -- Multiple vulnerabilities webkit-gtk2 1.2.6

Gustavo Noronha Silva reports:

The patches to fix the following CVEs are included with help from Huzaifa Sidhpurwala from the Red Hat security team.

CVE-2010-1791 CVE-2010-3812 CVE-2010-3813 CVE-2010-4197 CVE-2010-4198 CVE-2010-4204 CVE-2010-4206 CVE-2010-4577 http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS 2010-12-28 2010-12-30
django -- multiple vulnerabilities py23-django py24-django py25-django py26-django py27-django py30-django py31-django 1.21.2.4 1.11.1.3 py23-django-devel py24-django-devel py25-django-devel py26-django-devel py27-django-devel py30-django-devel py31-django-devel 15032,1

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.

Information leakage in Django administrative interface

The Django administrative interface, django.contrib.admin supports filtering of displayed lists of objects by fields on the corresponding models, including across database-level relationships. This is implemented by passing lookup arguments in the querystring portion of the URL, and options on the ModelAdmin class allow developers to specify particular fields or relationships which will generate automatic links for filtering.

Denial-of-service attack in password-reset mechanism

Django's bundled authentication framework, django.contrib.auth, offers views which allow users to reset a forgotten password. The reset mechanism involves generating a one-time token composed from the user's ID, the timestamp of the reset request converted to a base36 integer, and a hash derived from the user's current password hash (which will change once the reset is complete, thus invalidating the token).

45562 45563 https://bugzilla.redhat.com/show_bug.cgi?id=665373 http://secunia.com/advisories/42715/ 2010-12-22 2010-12-29
Drupal Views plugin -- cross-site scripting drupal6-views 2.12

Drupal security team reports:

The Views module provides a flexible method for Drupal site designers to control how lists and tables of content are presented. Under certain circumstances, Views could display parts of the page path without escaping, resulting in a relected Cross Site Scripting (XSS) vulnerability. An attacker could exploit this to gain full administrative access.

Mitigating factors: This vulnerability only occurs with a specific combination of configuration options for a specific View, but this combination is used in the default Views provided by some additional modules. A malicious user would need to get an authenticated administrative user to visit a specially crafted URL.

CVE-2010-4521 http://drupal.org/node/999380 2010-12-15 2010-12-28
redmine -- multiple vulnerabilities redmine 1.0.5

Jean-Philippe Lang reports:

This release also fixes 3 security issues reported by joernchen of Phenoelit:

  • logged in users may be able to access private data (affected versions: 1.0.x)
  • persistent XSS vulnerability in textile formatter (affected versions: all previous releases)
  • remote command execution in bazaar repository adapter (affected versions: 0.9.x, 1.0.x)
http://www.redmine.org/news/49 2010-12-23 2010-12-23
tor -- remote crash and potential remote code execution tor 0.2.1.28 tor-devel 0.2.2.20-alpha

The Tor Project reports:

Remotely exploitable bug that could be used to crash instances of Tor remotely by overflowing on the heap. Remote-code execution hasn't been confirmed, but can't be ruled out. Everyone should upgrade.

45500 CVE-2010-1676 ports/153326 http://archives.seul.org/or/announce/Dec-2010/msg00000.html http://archives.seul.org/or/talk/Dec-2010/msg00167.html https://gitweb.torproject.org/tor.git/blob/release-0.2.1:/ChangeLog https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ChangeLog 2010-12-17 2010-12-22
YUI JavaScript library -- JavaScript injection exploits in Flash components yahoo-ui 2.8.2

The YUI team reports:

A security-related defect was introduced in the YUI 2 Flash component infrastructure beginning with the YUI 2.4.0 release. This defect allows JavaScript injection exploits to be created against domains that host affected YUI .swf files.

CVE-2010-4207 CVE-2010-4208 CVE-2010-4209 http://www.yuiblog.com/blog/2010/10/25/yui-2-8-2-security-update/ http://secunia.com/advisories/41955 http://www.openwall.com/lists/oss-security/2010/11/07/1 http://yuilibrary.com/support/2.8.2/ 2010-10-25 2010-12-15
php-zip -- multiple Denial of Service vulnerabilities php5-zip 5.3.4 php52-zip 5.2.15

The following DoS conditions in Zip extension were fixed in PHP 5.3.4 and PHP 5.2.15:

  • Fixed crash in zip extract method (possible CWE-170).

  • The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.

CVE-2010-3709 http://www.php.net/releases/5_3_4.php http://www.php.net/releases/5_2_15.php http://securityreason.com/achievement_securityalert/90 2010-12-13 2011-01-13
php-filter -- Denial of Service php5-filter 5.3.4 php52-filter 5.2.15

The following DoS condition in filter extension was fixed in PHP 5.3.4 and PHP 5.2.15:

Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.

CVE-2010-3710 http://www.php.net/releases/5_3_4.php http://www.php.net/releases/5_2_15.php 2010-12-13 2011-01-13
php-imap -- Denial of Service php5-imap 5.3.4 php52-imap 5.2.15

The following DoS condition in IMAP extension was fixed in PHP 5.3.4 and PHP 5.2.15:

A remote user can send specially crafted IMAP user name or password data to trigger a double free memory error in 'ext/imap/php_imap.c' and cause the target service to crash.

It may be possible to execute arbitrary code. However, code execution was not confirmed.

CVE-2010-4150 http://www.php.net/releases/5_3_4.php http://www.php.net/releases/5_2_15.php 2010-12-13 2011-01-13
pecl-phar -- format string vulnerability pecl-phar 0

Entry for CVE-2010-2094 says:

Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.

PECL source code for PHAR extension shares the same code, so it is vulnerable too.

CVE-2010-2094 http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.htm http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.htm http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.htm http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html 2010-12-13 2011-01-13
php -- NULL byte poisoning php5 5.3.4 php52 5.2.17_12

PHP-specific version of NULL-byte poisoning was briefly described by ShAnKaR:

Poison NULL byte vulnerability for perl CGI applications was described in [1]. ShAnKaR noted, that same vulnerability also affects different PHP applications.

PHP developers report that branch 5.3 received a fix:

Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243).

CVE-2006-7243 http://www.securityfocus.com/archive/1/archive/1/445788/100/0/threaded http://artofhacking.com/files/phrack/phrack55/P55-07.TXT 2010-12-10 2011-01-13 2012-11-25
php -- open_basedir bypass php5 5.3.4 php52 5.2.15

MITRE reports:

fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.

44723 CVE-2010-3436 2010-12-10 2011-01-13
php -- corruption of $GLOBALS and $this variables via extract() method php5 5.3.4 php52 5.2.15

Off-by-one error in the sanity validator for the extract() method allowed attackers to replace the values of $GLOBALS and $this when mode EXTR_OVERWRITE was used.

http://www.mail-archive.com/php-cvs@lists.php.net/msg47722.html http://www.php.net/releases/5_2_15.php 2010-12-10 2011-01-13
mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.13,1 3.5.*,13.5.16,1 libxul 1.9.2.*1.9.2.13 linux-firefox 3.6.13,1 linux-firefox-devel 3.5.16 linux-seamonkey 2.0.*2.0.11 linux-thunderbird 3.13.1.7 seamonkey 2.0.*2.0.11 thunderbird 3.03.0.11 3.13.1.7

The Mozilla Project reports:

MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)

MFSA 2010-75 Buffer overflow while line breaking after document.write with long string

MFSA 2010-76 Chrome privilege escalation with window.open and isindex element

MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree

MFSA 2010-78 Add support for OTS font sanitizer

MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh

MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver

MFSA 2010-81 Integer overflow vulnerability in NewIdArray

MFSA 2010-82 Incomplete fix for CVE-2010-0179

MFSA 2010-83 Location bar SSL spoofing using network error page

MFSA 2010-84 XSS hazard in multiple character encodings

CVE-2010-3766 CVE-2010-3767 CVE-2010-3768 CVE-2010-3769 CVE-2010-3770 CVE-2010-3771 CVE-2010-3772 CVE-2010-3773 CVE-2010-3774 CVE-2010-3775 CVE-2010-3776 CVE-2010-3777 CVE-2010-3778 http://www.mozilla.org/security/announce/2010/mfsa2010-74.html http://www.mozilla.org/security/announce/2010/mfsa2010-75.html http://www.mozilla.org/security/announce/2010/mfsa2010-76.html http://www.mozilla.org/security/announce/2010/mfsa2010-77.html http://www.mozilla.org/security/announce/2010/mfsa2010-78.html http://www.mozilla.org/security/announce/2010/mfsa2010-79.html http://www.mozilla.org/security/announce/2010/mfsa2010-80.html http://www.mozilla.org/security/announce/2010/mfsa2010-81.html http://www.mozilla.org/security/announce/2010/mfsa2010-82.html http://www.mozilla.org/security/announce/2010/mfsa2010-83.html http://www.mozilla.org/security/announce/2010/mfsa2010-84.html 2010-12-09 2010-12-10
krb5 -- client impersonation vulnerability krb5 1.7.01.7.2

The MIT Kerberos team reports:

MIT krb5 KDC may issue tickets not requested by a client, based on an attacker-chosen KrbFastArmoredReq.

An authenticated remote attacker that controls a legitimate service principal could obtain a valid service ticket to itself containing valid KDC-generated authorization data for a client whose TGS-REQ it has intercepted. The attacker could then use this ticket for S4U2Proxy to impersonate the targeted client even if the client never authenticated to the subverted service. The vulnerable configuration is believed to be rare.

45122 CVE-2010-4021 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt http://osvdb.org/69607 2010-11-30 2010-12-09
krb5 -- RFC 3961 key-derivation checksum handling vulnerability krb5 1.8.01.8.3

The MIT Kerberos team reports:

MIT krb5 (releases incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH and AD-KDC-ISSUED authorization data.

An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the AD-SIGNEDPATH signature if the TGT key is RC4, allowing it to use self-generated "evidence" tickets for S4U2Proxy, instead of tickets obtained from the user or with S4U2Self. Configurations using RC4 for the TGT key are believed to be rare.

An authenticated remote attacker has a 1/256 chance of forging AD-KDC-ISSUED signatures on authdata elements in tickets having an RC4 service key, resulting in privilege escalation against a service that relies on these signatures. There are no known uses of the KDC-ISSUED authdata container at this time.

45117 CVE-2010-4020 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt http://osvdb.org/69608 2010-11-30 2010-12-09
krb5 -- unkeyed PAC checksum handling vulnerability krb5 1.7.01.7.2

The MIT Kerberos team reports:

MIT krb5 incorrectly accepts an unkeyed checksum for PAC signatures.

An authenticated remote attacker can forge PACs if using a KDC that does not filter client-provided PAC data. This can result in privilege escalation against a service that relies on PAC contents to make authorization decisions.

45116 CVE-2010-1324 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt http://osvdb.org/69609 2010-11-30 2010-12-09
krb5 -- multiple checksum handling vulnerabilities krb5 1.7.01.7.2 1.8.01.8.3

The MIT Kerberos team reports:

MIT krb incorrectly accepts an unkeyed checksum with DES session keys for version 2 (RFC 4121) of the GSS-API krb5 mechanism.

An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted pre-existing application session uses a DES session key.

MIT krb5 KDC incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying the req-checksum in a KrbFastArmoredReq.

An unauthenticated remote attacker has a 1/256 chance of swapping a client-issued KrbFastReq into a different KDC-REQ, if the armor key is RC4. The consequences are believed to be minor.

45116 CVE-2010-1324 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt http://osvdb.org/69609 2010-11-30 2010-12-09
krb5 -- multiple checksum handling vulnerabilities krb5 1.3.01.7.2 1.8.01.8.3

The MIT Kerberos team reports:

MIT krb5 clients incorrectly accept an unkeyed checksums in the SAM-2 preauthentication challenge.

An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token.

MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying KRB-SAFE messages.

An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages.

45118 CVE-2010-1323 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt http://osvdb.org/69610 2010-11-30 2010-12-09
chromium -- multiple vulnerabilities chromium 15.0.874.121

Google Chrome Releases reports:

Fixed in 15.0.874.121:
[103259] High CVE-2011-3900: Out-of-bounds write in v8. Credit to Christian Holler.

Fixed in 15.0.874.120:
[100465] High CVE-2011-3892: Double free in Theora decoder. Credit to Aki Helin of OUSPG.
[100492] [100543] Medium CVE-2011-3893: Out of bounds reads in MKV and Vorbis media handlers. Credit to Aki Helin of OUSPG.
[101172] High CVE-2011-3894: Memory corruption regression in VP8 decoding. Credit to Andrew Scherkus of the Chromium development community.
[101458] High CVE-2011-3895: Heap overflow in Vorbis decoder. Credit to Aki Helin of OUSPG.
[101624] High CVE-2011-3896: Buffer overflow in shader variable mapping. Credit to Ken "strcpy" Russell of the Chromium development community.
[102242] High CVE-2011-3897: Use-after-free in editing. Credit to pa_kt reported through ZDI (ZDI-CAN-1416).
[102461] Low CVE-2011-3898: Failure to ask for permission to run applets in JRE7. Credit to Google Chrome Security Team (Chris Evans).

Fixed in 15.0.874.102:
[86758] High CVE-2011-2845: URL bar spoof in history handling. Credit to Jordi Chancel.
[88949] Medium CVE-2011-3875: URL bar spoof with drag+drop of URLs. Credit to Jordi Chancel.
[90217] Low CVE-2011-3876: Avoid stripping whitespace at the end of download filenames. Credit to Marc Novak.
[91218] Low CVE-2011-3877: XSS in appcache internals page. Credit to Google Chrome Security Team (Tom Sepez) plus independent discovery by Juho Nurminen.
[94487] Medium CVE-2011-3878: Race condition in worker process initialization. Credit to miaubiz.
[95374] Low CVE-2011-3879: Avoid redirect to chrome scheme URIs. Credit to Masato Kinugawa.
[95992] Low CVE-2011-3880: Don't permit as a HTTP header delimiter. Credit to Vladimir Vorontsov, ONsec company.
[96047] [96885] [98053] [99512] [99750] High CVE-2011-3881: Cross-origin policy violations. Credit to Sergey Glazunov.
[96292] High CVE-2011-3882: Use-after-free in media buffer handling. Credit to Google Chrome Security Team (Inferno).
[96902] High CVE-2011-3883: Use-after-free in counter handling. Credit to miaubiz.
[97148] High CVE-2011-3884: Timing issues in DOM traversal. Credit to Brian Ryner of the Chromium development community.
[97599] [98064] [98556] [99294] [99880] [100059] High CVE-2011-3885: Stale style bugs leading to use-after-free. Credit to miaubiz.
[98773] [99167] High CVE-2011-3886: Out of bounds writes in v8. Credit to Christian Holler.
[98407] Medium CVE-2011-3887: Cookie theft with javascript URIs. Credit to Sergey Glazunov.
[99138] High CVE-2011-3888: Use-after-free with plug-in and editing. Credit to miaubiz.
[99211] High CVE-2011-3889: Heap overflow in Web Audio. Credit to miaubiz.
[99553] High CVE-2011-3890: Use-after-free in video source handling. Credit to Ami Fischman of the Chromium development community.
[100332] High CVE-2011-3891: Exposure of internal v8 functions. Credit to Steven Keuchel of the Chromium development community plus independent discovery by Daniel Divricean.

Fixed in 14.0.835.202:
[93788] High CVE-2011-2876: Use-after-free in text line box handling. Credit to miaubiz.
[95072] High CVE-2011-2877: Stale font in SVG text handling. Credit to miaubiz.
[95671] High CVE-2011-2878: Inappropriate cross-origin access to the window prototype. Credit to Sergey Glazunov.
[96150] High CVE-2011-2879: Lifetime and threading issues in audio node handling. Credit to Google Chrome Security Team (Inferno).
[97451] [97520] [97615] High CVE-2011-2880: Use-after-free in the v8 bindings. Credit to Sergey Glazunov.
[97784] High CVE-2011-2881: Memory corruption with v8 hidden objects. Credit to Sergey Glazunov.
[98089] Critical CVE-2011-3873: Memory corruption in shader translator. Credit to Zhenyao Mo of the Chromium development community.

Fixed in 14.0.835.163:
[49377] High CVE-2011-2835: Race condition in the certificate cache. Credit to Ryan Sleevi of the Chromium development community.
[51464] Low CVE-2011-2836: Infobar the Windows Media Player plug-in to avoid click-free access to the system Flash. Credit to electronixtar.
[Linux only] [57908] Low CVE-2011-2837: Use PIC / pie compiler flags. Credit to wbrana.
[75070] Low CVE-2011-2838: Treat MIME type more authoritatively when loading plug-ins. Credit to Michal Zalewski of the Google Security Team.
[76771] High CVE-2011-2839: Crash in v8 script object wrappers. Credit to Kostya Serebryany of the Chromium development community.
[78427] [83031] Low CVE-2011-2840: Possible URL bar spoofs with unusual user interaction. Credit to kuzzcc.
[78639] High CVE-2011-2841: Garbage collection error in PDF. Credit to Mario Gomes.
[82438] Medium CVE-2011-2843: Out-of-bounds read with media buffers. Credit to Kostya Serebryany of the Chromium development community.
[85041] Medium CVE-2011-2844: Out-of-bounds read with mp3 files. Credit to Mario Gomes.
[89219] High CVE-2011-2846: Use-after-free in unload event handling. Credit to Arthur Gerkis.
[89330] High CVE-2011-2847: Use-after-free in document loader. Credit to miaubiz.
[89564] Medium CVE-2011-2848: URL bar spoof with forward button. Credit to Jordi Chancel.
[89795] Low CVE-2011-2849: Browser NULL pointer crash with WebSockets. Credit to Arthur Gerkis.
[89991] Medium CVE-2011-3234: Out-of-bounds read in box handling. Credit to miaubiz.
[90134] Medium CVE-2011-2850: Out-of-bounds read with Khmer characters. Credit to miaubiz.
[90173] Medium CVE-2011-2851: Out-of-bounds read in video handling. Credit to Google Chrome Security Team (Inferno).
[91120] High CVE-2011-2852: Off-by-one in v8. Credit to Christian Holler.
[91197] High CVE-2011-2853: Use-after-free in plug-in handling. Credit to Google Chrome Security Team (SkyLined).
[92651] [94800] High CVE-2011-2854: Use-after-free in ruby / table style handing. Credit to Slawomir Blazek, and independent later discoveries by miaubiz and Google Chrome Security Team (Inferno).
[92959] High CVE-2011-2855: Stale node in stylesheet handling. Credit to Arthur Gerkis.
[93416] High CVE-2011-2856: Cross-origin bypass in v8. Credit to Daniel Divricean.
[93420] High CVE-2011-2857: Use-after-free in focus controller. Credit to miaubiz.
[93472] High CVE-2011-2834: Double free in libxml XPath handling. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.
[93497] Medium CVE-2011-2859: Incorrect permissions assigned to non-gallery pages. Credit to Bernhard "Bruhns" Brehm of Recurity Labs.
[93587] High CVE-2011-2860: Use-after-free in table style handling. Credit to miaubiz.
[93596] Medium CVE-2011-2861: Bad string read in PDF. Credit to Aki Helin of OUSPG.
[93906] High CVE-2011-2862: Unintended access to v8 built-in objects. Credit to Sergey Glazunov.
[95563] Medium CVE-2011-2864: Out-of-bounds read with Tibetan characters. Credit to Google Chrome Security Team (Inferno).
[95625] Medium CVE-2011-2858: Out-of-bounds read with triangle arrays. Credit to Google Chrome Security Team (Inferno).
[95917] Low CVE-2011-2874: Failure to pin a self-signed cert for a session. Credit to Nishant Yadant of VMware and Craig Chamberlain (@randomuserid).
High CVE-2011-2875: Type confusion in v8 object sealing. Credit to Christian Holler.

Fixed in 13.0.782.215:
[89402] High CVE-2011-2821: Double free in libxml XPath handling. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.
[82552] High CVE-2011-2823: Use-after-free in line box handling. Credit to Google Chrome Security Team (SkyLined) and independent later discovery by miaubiz.
[88216] High CVE-2011-2824: Use-after-free with counter nodes. Credit to miaubiz.
[88670] High CVE-2011-2825: Use-after-free with custom fonts. Credit to wushi of team509 reported through ZDI (ZDI-CAN-1283), plus indepdendent later discovery by miaubiz.
[87453] High CVE-2011-2826: Cross-origin violation with empty origins. Credit to Sergey Glazunov.
[90668] High CVE-2011-2827: Use-after-free in text searching. Credit to miaubiz.
[91517] High CVE-2011-2828: Out-of-bounds write in v8. Credit to Google Chrome Security Team (SkyLined).
[32-bit only] [91598] High CVE-2011-2829: Integer overflow in uniform arrays. Credit to Sergey Glazunov.
[Linux only] [91665] High CVE-2011-2839: Buggy memset() in PDF. Credit to Aki Helin of OUSPG.

Fixed in 13.0.782.107:
[75821] Medium CVE-2011-2358: Always confirm an extension install via a browser dialog. Credit to Sergey Glazunov.
[78841] High CVE-2011-2359: Stale pointer due to bad line box tracking in rendering. Credit to miaubiz and Martin Barbella.
[79266] Low CVE-2011-2360: Potential bypass of dangerous file prompt. Credit to kuzzcc.
[79426] Low CVE-2011-2361: Improve designation of strings in the basic auth dialog. Credit to kuzzcc.
[Linux only] [81307] Medium CVE-2011-2782: File permissions error with drag and drop. Credit to Evan Martin of the Chromium development community.
[83273] Medium CVE-2011-2783: Always confirm a developer mode NPAPI extension install via a browser dialog. Credit to Sergey Glazunov.
[83841] Low CVE-2011-2784: Local file path disclosure via GL program log. Credit to kuzzcc.
[84402] Low CVE-2011-2785: Sanitize the homepage URL in extensions. Credit to kuzzcc.
[84600] Low CVE-2011-2786: Make sure the speech input bubble is always on-screen. Credit to Olli Pettay of Mozilla.
[84805] Medium CVE-2011-2787: Browser crash due to GPU lock re-entrancy issue. Credit to kuzzcc.
[85559] Low CVE-2011-2788: Buffer overflow in inspector serialization. Credit to Mikolaj Malecki.
[85808] Medium CVE-2011-2789: Use after free in Pepper plug-in instantiation. Credit to Mario Gomes and kuzzcc.
[86502] High CVE-2011-2790: Use-after-free with floating styles. Credit to miaubiz.
[86900] High CVE-2011-2791: Out-of-bounds write in ICU. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.
[87148] High CVE-2011-2792: Use-after-free with float removal. Credit to miaubiz.
[87227] High CVE-2011-2793: Use-after-free in media selectors. Credit to miaubiz.
[87298] Medium CVE-2011-2794: Out-of-bounds read in text iteration. Credit to miaubiz.
[87339] Medium CVE-2011-2795: Cross-frame function leak. Credit to Shih Wei-Long.
[87548] High CVE-2011-2796: Use-after-free in Skia. Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium development community.
[87729] High CVE-2011-2797: Use-after-free in resource caching. Credit to miaubiz.
[87815] Low CVE-2011-2798: Prevent a couple of internal schemes from being web accessible. Credit to sirdarckcat of the Google Security Team.
[87925] High CVE-2011-2799: Use-after-free in HTML range handling. Credit to miaubiz.
[88337] Medium CVE-2011-2800: Leak of client-side redirect target. Credit to Juho Nurminen.
[88591] High CVE-2011-2802: v8 crash with const lookups. Credit to Christian Holler.
[88827] Medium CVE-2011-2803: Out-of-bounds read in Skia paths. Credit to Google Chrome Security Team (Inferno).
[88846] High CVE-2011-2801: Use-after-free in frame loader. Credit to miaubiz.
[88889] High CVE-2011-2818: Use-after-free in display box rendering. Credit to Martin Barbella.
[89142] High CVE-2011-2804: PDF crash with nested functions. Credit to Aki Helin of OUSPG.
[89520] High CVE-2011-2805: Cross-origin script injection. Credit to Sergey Glazunov.
[90222] High CVE-2011-2819: Cross-origin violation in base URI handling. Credit to Sergey Glazunov.

Fixed in 12.0.742.112:
[77493] Medium CVE-2011-2345: Out-of-bounds read in NPAPI string handling. Credit to Philippe Arteau.
[84355] High CVE-2011-2346: Use-after-free in SVG font handling. Credit to miaubiz.
[85003] High CVE-2011-2347: Memory corruption in CSS parsing. Credit to miaubiz.
[85102] High CVE-2011-2350: Lifetime and re-entrancy issues in the HTML parser. Credit to miaubiz.
[85177] High CVE-2011-2348: Bad bounds check in v8. Credit to Aki Helin of OUSPG.
[85211] High CVE-2011-2351: Use-after-free with SVG use element. Credit to miaubiz.
[85418] High CVE-2011-2349: Use-after-free in text selection. Credit to miaubiz.

Fixed in 12.0.742.91:
[73962] [79746] High CVE-2011-1808: Use-after-free due to integer issues in float handling. Credit to miaubiz.
[75496] Medium CVE-2011-1809: Use-after-free in accessibility support. Credit to Google Chrome Security Team (SkyLined).
[75643] Low CVE-2011-1810: Visit history information leak in CSS. Credit to Jesse Mohrland of Microsoft and Microsoft Vulnerability Research (MSVR).
[76034] Low CVE-2011-1811: Browser crash with lots of form submissions. Credit to "DimitrisV22".
[77026] Medium CVE-2011-1812: Extensions permission bypass. Credit to kuzzcc.
[78516] High CVE-2011-1813: Stale pointer in extension framework. Credit to Google Chrome Security Team (Inferno).
[79362] Medium CVE-2011-1814: Read from uninitialized pointer. Credit to Eric Roman of the Chromium development community.
[79862] Low CVE-2011-1815: Extension script injection into new tab page. Credit to kuzzcc.
[80358] Medium CVE-2011-1816: Use-after-free in developer tools. Credit to kuzzcc.
[81916] Medium CVE-2011-1817: Browser memory corruption in history deletion. Credit to Collin Payne.
[81949] High CVE-2011-1818: Use-after-free in image loader. Credit to miaubiz.
[83010] Medium CVE-2011-1819: Extension injection into chrome:// pages. Credit to Vladislavas Jarmalis, plus subsequent independent discovery by Sergey Glazunov.
[83275] High CVE-2011-2332: Same origin bypass in v8. Credit to Sergey Glazunov.
[83743] High CVE-2011-2342: Same origin bypass in DOM. Credit to Sergey Glazunov.

Fixed in 11.0.696.71:
[72189] Low CVE-2011-1801: Pop-up blocker bypass. Credit to Chamal De Silva.
[82546] High CVE-2011-1804: Stale pointer in floats rendering. Credit to Martin Barbella.
[82873] Critical CVE-2011-1806: Memory corruption in GPU command buffer. Credit to Google Chrome Security Team (Cris Neckar).
[82903] Critical CVE-2011-1807: Out-of-bounds write in blob handling. Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium development community.

Fixed in 11.0.696.68:
[64046] High CVE-2011-1799: Bad casts in Chromium WebKit glue. Credit to Google Chrome Security Team (SkyLined).
[80608] High CVE-2011-1800: Integer overflows in SVG filters. Credit to Google Chrome Security Team (Cris Neckar).

Fixed in 11.0.696.57:
[61502] High CVE-2011-1303: Stale pointer in floating object handling. Credit to Scott Hess of the Chromium development community and Martin Barbella.
[70538] Low CVE-2011-1304: Pop-up block bypass via plug-ins. Credit to Chamal De Silva.
[Linux / Mac only] [70589] Medium CVE-2011-1305: Linked-list race in database handling. Credit to Kostya Serebryany of the Chromium development community.
[71586] Medium CVE-2011-1434: Lack of thread safety in MIME handling. Credit to Aki Helin.
[72523] Medium CVE-2011-1435: Bad extension with "tabs" permission can capture local files. Credit to Cole Snodgrass.
[Linux only] [72910] Low CVE-2011-1436: Possible browser crash due to bad interaction with X. Credit to miaubiz.
[73526] High CVE-2011-1437: Integer overflows in float rendering. Credit to miaubiz.
[74653] High CVE-2011-1438: Same origin policy violation with blobs. Credit to kuzzcc.
[Linux only] [74763] High CVE-2011-1439: Prevent interference between renderer processes. Credit to Julien Tinnes of the Google Security Team.
[75186] High CVE-2011-1440: Use-after-free with <ruby> tag and CSS. Credit to Jose A. Vazquez.
[75347] High CVE-2011-1441: Bad cast with floating select lists. Credit to Michael Griffiths.
[75801] High CVE-2011-1442: Corrupt node trees with mutation events. Credit to Sergey Glazunov and wushi of team 509.
[76001] High CVE-2011-1443: Stale pointers in layering code. Credit to Martin Barbella.
[Linux only] [76542] High CVE-2011-1444: Race condition in sandbox launcher. Credit to Dan Rosenberg.
Medium CVE-2011-1445: Out-of-bounds read in SVG. Credit to wushi of team509.
[76666] [77507] [78031] High CVE-2011-1446: Possible URL bar spoofs with navigation errors and interrupted loads. Credit to kuzzcc.
[76966] High CVE-2011-1447: Stale pointer in drop-down list handling. Credit to miaubiz.
[77130] High CVE-2011-1448: Stale pointer in height calculations. Credit to wushi of team509.
[77346] High CVE-2011-1449: Use-after-free in WebSockets. Credit to Marek Majkowski.
Low CVE-2011-1450: Dangling pointers in file dialogs. Credit to kuzzcc.
[77463] High CVE-2011-1451: Dangling pointers in DOM id map. Credit to Sergey Glazunov.
[77786] Medium CVE-2011-1452: URL bar spoof with redirect and manual reload. Credit to Jordi Chancel.
[79199] High CVE-2011-1454: Use-after-free in DOM id handling. Credit to Sergey Glazunov.
[79361] Medium CVE-2011-1455: Out-of-bounds read with multipart-encoded PDF. Credit to Eric Roman of the Chromium development community.
[79364] High CVE-2011-1456: Stale pointers with PDF forms. Credit to Eric Roman of the Chromium development community.

Fixed in 10.0.648.205:
[75629] Critical CVE-2011-1301: Use-after-free in the GPU process. Credit to Google Chrome Security Team (Inferno).
[78524] Critical CVE-2011-1302: Heap overflow in the GPU process. Credit to Christoph Diehl.

Fixed in 10.0.648.204:
[72517] High CVE-2011-1291: Buffer error in base string handling. Credit to Alex Turpin.
[73216] High CVE-2011-1292: Use-after-free in the frame loader. Credit to Slawomir Blazek.
[73595] High CVE-2011-1293: Use-after-free in HTMLCollection. Credit to Sergey Glazunov.
[74562] High CVE-2011-1294: Stale pointer in CSS handling. Credit to Sergey Glazunov.
[74991] High CVE-2011-1295: DOM tree corruption with broken node parentage. Credit to Sergey Glazunov.
[75170] High CVE-2011-1296: Stale pointer in SVG text handling. Credit to Sergey Glazunov.

Fixed in 10.0.648.133:
[75712] High Memory corruption in style handling. Credit to Vincenzo Iozzo, Ralf Philipp Weinmann and Willem Pinckaers reported through ZDI.

Fixed in 10.0.648.127:
[42765] Low Possible to navigate or close the top location in a sandboxed frame. Credit to sirdarckcat of the Google Security Team.
[Linux only] [49747] Low Work around an X server bug and crash with long messages. Credit to Louis Lang.
[Linux only] [66962] Low Possible browser crash with parallel print()s. Credit to Aki Helin of OUSPG.
[69187] Medium Cross-origin error message leak. Credit to Daniel Divricean.
[69628] High Memory corruption with counter nodes. Credit to Martin Barbella.
[70027] High Stale node in box layout. Credit to Martin Barbella.
[70336] Medium Cross-origin error message leak with workers. Credit to Daniel Divricean.
[70442] High Use after free with DOM URL handling. Credit to Sergey Glazunov.
[Linux only] [70779] Medium Out of bounds read handling unicode ranges. Credit to miaubiz.
[70877] High Same origin policy bypass in v8. Credit to Daniel Divricean.
[70885] [71167] Low Pop-up blocker bypasses. Credit to Chamal de Silva.
[71763] High Use-after-free in document script lifetime handling. Credit to miaubiz.
[71788] High Out-of-bounds write in the OGG container. Credit to Google Chrome Security Team (SkyLined); plus subsequent independent discovery by David Weston of Microsoft and MSVR.
[72028] High Stale pointer in table painting. Credit to Martin Barbella.
[73026] High Use of corrupt out-of-bounds structure in video code. Credit to Tavis Ormandy of the Google Security Team.
[73066] High Crash with the DataView object. Credit to Sergey Glazunov.
[73134] High Bad cast in text rendering. Credit to miaubiz.
[73196] High Stale pointer in WebKit context code. Credit to Sergey Glazunov.
[73716] Low Leak of heap address in XSLT. Credit to Google Chrome Security Team (Chris Evans).
[73746] High Stale pointer with SVG cursors. Credit to Sergey Glazunov.
[74030] High DOM tree corruption with attribute handling. Credit to Sergey Glazunov.
[74662] High Corruption via re-entrancy of RegExp code. Credit to Christian Holler.
[74675] High Invalid memory access in v8. Credit to Christian Holler.

Fixed in 9.0.597.107:
[54262] High URL bar spoof. Credit to Jordi Chancel.
[63732] High Crash with javascript dialogs. Credit to Sergey Radchenko.
[68263] High Stylesheet node stale pointer. Credit to Sergey Glazunov.
[68741] High Stale pointer with key frame rule. Credit to Sergey Glazunov.
[70078] High Crash with forms controls. Credit to Stefan van Zanden.
[70244] High Crash in SVG rendering. Credit to Slawomir Blazek.
[64-bit Linux only] [70376] Medium Out-of-bounds read in pickle deserialization. Credit to Evgeniy Stepanov of the Chromium development community.
[71114] High Stale node in table handling. Credit to Martin Barbella.
[71115] High Stale pointer in table rendering. Credit to Martin Barbella.
[71296] High Stale pointer in SVG animations. Credit to miaubiz.
[71386] High Stale nodes in XHTML. Credit to wushi of team509.
[71388] High Crash in textarea handling. Credit to wushi of team509.
[71595] High Stale pointer in device orientation. Credit to Sergey Glazunov.
[71717] Medium Out-of-bounds read in WebGL. Credit to miaubiz.
[71855] High Integer overflow in textarea handling. Credit to miaubiz.
[71960] Medium Out-of-bounds read in WebGL. Credit to Google Chrome Security Team (Inferno).
[72214] High Accidental exposure of internal extension functions. Credit to Tavis Ormandy of the Google Security Team.
[72437] High Use-after-free with blocked plug-ins. Credit to Chamal de Silva.
[73235] High Stale pointer in layout. Credit to Martin Barbella.

Fixed in 9.0.597.94:
[67234] High Stale pointer in animation event handling. Credit to Rik Cabanier.
[68120] High Use-after-free in SVG font faces. Credit to miaubiz.
[69556] High Stale pointer with anonymous block handling. Credit to Martin Barbella.
[69970] Medium Out-of-bounds read in plug-in handling. Credit to Bill Budge of Google.
[70456] Medium Possible failure to terminate process on out-of-memory condition. Credit to David Warren of CERT/CC.

Fixed in 9.0.597.84:
[Mac only] [42989] Low Minor sandbox leak via stat(). Credit to Daniel Cheng of the Chromium development community.
[55831] High Use-after-free in image loading. Credit to Aki Helin of OUSPG.
[59081] Low Apply some restrictions to cross-origin drag + drop. Credit to Google Chrome Security Team (SkyLined) and the Google Security Team (Michal Zalewski, David Bloom).
[62791] Low Browser crash with extension with missing key. Credit to Brian Kirchoff.
[64051] High Crashing when printing in PDF event handler. Credit to Aki Helin of OUSPG.
[65669] Low Handle merging of autofill profiles more gracefully. Credit to Google Chrome Security Team (Inferno).
[Mac only] [66931] Low Work around a crash in the Mac OS 10.5 SSL libraries. Credit to Dan Morrison.
[68244] Low Browser crash with bad volume setting. Credit to Matthew Heidermann.
[69195] Critical Race condition in audio handling. Credit to the gamers of Reddit!

Fixed in 8.0.552.237:
[58053] Medium Browser crash in extensions notification handling. Credit to Eric Roman of the Chromium development community.
[65764] High Bad pointer handling in node iteration. Credit to Sergey Glazunov.
[66334] High Crashes when printing multi-page PDFs. Credit to Google Chrome Security Team (Chris Evans).
[66560] High Stale pointer with CSS + canvas. Credit to Sergey Glazunov.
[66748] High Stale pointer with CSS + cursors. Credit to Jan Tosovsk.
[67100] High Use after free in PDF page handling. Credit to Google Chrome Security Team (Chris Evans).
[67208] High Stack corruption after PDF out-of-memory condition. Credit to Jared Allar of CERT.
[67303] High Bad memory access with mismatched video frame sizes. Credit to Aki Helin of OUSPG; plus independent discovery by Google Chrome Security Team (SkyLined) and David Warren of CERT.
[67363] High Stale pointer with SVG use element. Credited anonymously; plus indepdent discovery by miaubiz.
[67393] Medium Uninitialized pointer in the browser triggered by rogue extension. Credit to kuzzcc.
[68115] High Vorbis decoder buffer overflows. Credit to David Warren of CERT.
[68170] High Buffer overflow in PDF shading. Credit to Aki Helin of OUSPG.
[68178] High Bad cast in anchor handling. Credit to Sergey Glazunov.
[68181] High Bad cast in video handling. Credit to Sergey Glazunov.
[68439] High Stale rendering node after DOM node removal. Credit to Martin Barbella; plus independent discovery by Google Chrome Security Team (SkyLined).
[68666] Critical Stale pointer in speech handling. Credit to Sergey Glazunov.

Fixed in 8.0.552.224:
[64-bit Linux only] [56449] High Bad validation for message deserialization on 64-bit builds. Credit to Lei Zhang of the Chromium development community.
[60761] Medium Bad extension can cause browser crash in tab handling. Credit to kuzzcc.
[63529] Low Browser crash with NULL pointer in web worker handling. Credit to Nathan Weizenbaum of Google.
[63866] Medium Out-of-bounds read in CSS parsing. Credit to Chris Rohlf.
[64959] High Stale pointers in cursor handling. Credit to Slawomir Blazek and Sergey Glazunov.

Fixed in 8.0.552.215:
[17655] Low Possible pop-up blocker bypass. Credit to Google Chrome Security Team (SkyLined).
[55745] Medium Cross-origin video theft with canvas. Credit to Nirankush Panchbhai and Microsoft Vulnerability Research (MSVR).
[56237] Low Browser crash with HTML5 databases. Credit to Google Chrome Security Team (Inferno).
[58319] Low Prevent excessive file dialogs, possibly leading to browser crash. Credit to Cezary Tomczak (gosu.pl).
[59554] High Use after free in history handling. Credit to Stefan Troger.
[Linux / Mac] [59817] Medium Make sure the "dangerous file types" list is uptodate with the Windows platforms. Credit to Billy Rios of the Google Security Team.
[61701] Low Browser crash with HTTP proxy authentication. Credit to Mohammed Bouhlel.
[61653] Medium Out-of-bounds read regression in WebM video support. Credit to Google Chrome Security Team (Chris Evans), based on earlier testcases from Mozilla and Microsoft (MSVR).
[62127] High Crash due to bad indexing with malformed video. Credit to miaubiz.
[62168] Medium Possible browser memory corruption via malicious privileged extension. Credit to kuzzcc.
[62401] High Use after free with SVG animations. Credit to Slawomir Blazek.
[63051] Medium Use after free in mouse dragging event handling. Credit to kuzzcc.
[63444] High Double free in XPath handling. Credit to Yang Dingning from NCNIPC, Graduate University of Chinese Academy of Sciences.

Fixed in 7.0.517.44:
[51602] High Use-after-free in text editing. Credit to David Bloom of the Google Security Team, Google Chrome Security Team (Inferno) and Google Chrome Security Team (Cris Neckar).
[55257] High Memory corruption with enormous text area. Credit to wushi of team509.
[58657] High Bad cast with the SVG use element. Credit to the kuzzcc.
[58731] High Invalid memory read in XPath handling. Credit to Bui Quang Minh from Bkis (www.bkis.com).
[58741] High Use-after-free in text control selections. Credit to "vkouchna".
[Linux only] [59320] High Integer overflows in font handling. Credit to Aki Helin of OUSPG.
[60055] High Memory corruption in libvpx. Credit to Christoph Diehl.
[60238] High Bad use of destroyed frame object. Credit to various developers, including "gundlach".
[60327] [60769] [61255] High Type confusions with event objects. Credit to "fam.lam" and Google Chrome Security Team (Inferno).
[60688] High Out-of-bounds array access in SVG handling. Credit to wushi of team509.

Fixed in 7.0.517.43:
[48225] [51727] Medium Possible autofill / autocomplete profile spamming. Credit to Google Chrome Security Team (Inferno).
[48857] High Crash with forms. Credit to the Chromium development community.
[50428] Critical Browser crash with form autofill. Credit to the Chromium development community.
[51680] High Possible URL spoofing on page unload. Credit to kuzzcc; plus independent discovery by Jordi Chancel.
[53002] Low Pop-up block bypass. Credit to kuzzcc.
[53985] Medium Crash on shutdown with Web Sockets. Credit to the Chromium development community.
[Linux only] [54132] Low Bad construction of PATH variable. Credit to Dan Rosenberg, Virtual Security Research.
[54500] High Possible memory corruption with animated GIF. Credit to Simon Schaak.
[Linux only] [54794] High Failure to sandbox worker processes on Linux. Credit to Google Chrome Security Team (Chris Evans).
[56451] High Stale elements in an element map. Credit to Michal Zalewski of the Google Security Team.

http://googlechromereleases.blogspot.com/search/label/Stable%20updates CVE-2011-1290 CVE-2011-1291 CVE-2011-1292 CVE-2011-1293 CVE-2011-1294 CVE-2011-1295 CVE-2011-1296 CVE-2011-1301 CVE-2011-1302 CVE-2011-1303 CVE-2011-1304 CVE-2011-1305 CVE-2011-1434 CVE-2011-1435 CVE-2011-1436 CVE-2011-1437 CVE-2011-1438 CVE-2011-1439 CVE-2011-1440 CVE-2011-1441 CVE-2011-1442 CVE-2011-1443 CVE-2011-1444 CVE-2011-1445 CVE-2011-1446 CVE-2011-1447 CVE-2011-1448 CVE-2011-1449 CVE-2011-1450 CVE-2011-1451 CVE-2011-1452 CVE-2011-1454 CVE-2011-1455 CVE-2011-1456 CVE-2011-1799 CVE-2011-1800 CVE-2011-1801 CVE-2011-1804 CVE-2011-1806 CVE-2011-1807 CVE-2011-1808 CVE-2011-1809 CVE-2011-1810 CVE-2011-1811 CVE-2011-1812 CVE-2011-1813 CVE-2011-1814 CVE-2011-1815 CVE-2011-1816 CVE-2011-1817 CVE-2011-1818 CVE-2011-1819 CVE-2011-2332 CVE-2011-2342 CVE-2011-2345 CVE-2011-2346 CVE-2011-2347 CVE-2011-2348 CVE-2011-2349 CVE-2011-2350 CVE-2011-2351 CVE-2011-2358 CVE-2011-2359 CVE-2011-2360 CVE-2011-2361 CVE-2011-2782 CVE-2011-2783 CVE-2011-2784 CVE-2011-2785 CVE-2011-2786 CVE-2011-2787 CVE-2011-2788 CVE-2011-2789 CVE-2011-2790 CVE-2011-2791 CVE-2011-2792 CVE-2011-2793 CVE-2011-2794 CVE-2011-2795 CVE-2011-2796 CVE-2011-2797 CVE-2011-2798 CVE-2011-2799 CVE-2011-2800 CVE-2011-2801 CVE-2011-2802 CVE-2011-2803 CVE-2011-2804 CVE-2011-2805 CVE-2011-2818 CVE-2011-2819 CVE-2011-2821 CVE-2011-2823 CVE-2011-2824 CVE-2011-2825 CVE-2011-2826 CVE-2011-2827 CVE-2011-2828 CVE-2011-2829 CVE-2011-2834 CVE-2011-2835 CVE-2011-2836 CVE-2011-2837 CVE-2011-2838 CVE-2011-2839 CVE-2011-2840 CVE-2011-2841 CVE-2011-2842 CVE-2011-2843 CVE-2011-2844 CVE-2011-2845 CVE-2011-2846 CVE-2011-2847 CVE-2011-2848 CVE-2011-2849 CVE-2011-2850 CVE-2011-2851 CVE-2011-2852 CVE-2011-2853 CVE-2011-2854 CVE-2011-2855 CVE-2011-2856 CVE-2011-2857 CVE-2011-2858 CVE-2011-2859 CVE-2011-2860 CVE-2011-2861 CVE-2011-2862 CVE-2011-2864 CVE-2011-2874 CVE-2011-2875 CVE-2011-2876 CVE-2011-2877 CVE-2011-2878 CVE-2011-2879 CVE-2011-2880 CVE-2011-2881 CVE-2011-3234 CVE-2011-3873 CVE-2011-3873 CVE-2011-3875 CVE-2011-3876 CVE-2011-3877 CVE-2011-3878 CVE-2011-3879 CVE-2011-3880 CVE-2011-3881 CVE-2011-3882 CVE-2011-3883 CVE-2011-3884 CVE-2011-3885 CVE-2011-3886 CVE-2011-3887 CVE-2011-3888 CVE-2011-3889 CVE-2011-3890 CVE-2011-3891 CVE-2011-3892 CVE-2011-3893 CVE-2011-3894 CVE-2011-3895 CVE-2011-3896 CVE-2011-3897 CVE-2011-3898 CVE-2011-3900 2010-10-19 2010-12-07 2011-11-17
proftpd -- Compromised source packages backdoor proftpd 1.3.3c_2

The ProFTPD Project team reports:

The security issue is caused due to the distribution of compromised ProFTPD 1.3.3c source code packages via the project's main FTP server and all of the mirror servers, which contain a backdoor allowing remote root access.

http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org http://secunia.com/advisories/42449 2010-11-28 2010-12-04
phpMyAdmin -- XSS attack in database search phpMyAdmin 3.3.8.1 phpMyAdmin211 2.11.11.1

phpMyAdmin team reports:

It was possible to conduct a XSS attack using spoofed request on the db search script.

ports/152685 ports/152686 CVE-2010-4329 http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php 2010-11-29 2010-11-30
isc-dhcp-server -- Empty link-address denial of service isc-dhcp41-server 4.1.04.1.2

ISC reports:

If the server receives a DHCPv6 packet containing one or more Relay-Forward messages, and none of them supply an address in the Relay-Forward link-address field, then the server will crash. This can be used as a single packet crash attack vector.

CVE-2010-3611 http://www.isc.org/software/dhcp/advisories/cve-2010-3611 http://www.kb.cert.org/vuls/id/102047 2010-11-02 2010-11-24
OpenTTD -- Denial of service (server/client) via invalid read openttd 1.0.01.0.5

The OpenTTD Team reports:

When a client disconnects, without sending the "quit" or "client error" message, the server has a chance of reading and writing a just freed piece of memory. The writing can only happen while the server is sending the map. Depending on what happens directly after freeing the memory there is a chance of segmentation fault, and thus a denial of service.

CVE-2010-4168 http://security.openttd.org/en/CVE-2010-4168 2010-11-20 2010-11-23
horde-base -- XSS: VCARD attachments vulnerability horde-base 3.3.11

The Horde team reports:

The major changes compared to Horde version 3.3.10 are:

* Fixed XSS vulnerability when viewing details of a vCard.

http://article.gmane.org/gmane.comp.horde.announce/532 http://bugs.horde.org/ticket/9357 2010-11-02 2010-11-23
proftpd -- remote code execution vulnerability proftpd 1.3.3c

Tippingpoint reports:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ProFTPD. Authentication is not required to exploit this vulnerability.

The flaw exists within the proftpd server component which listens by default on TCP port 21. When reading user input if a TELNET_IAC escape sequence is encountered the process miscalculates a buffer length counter value allowing a user controlled copy of data to a stack buffer. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the proftpd process.

44562 CVE-2010-4221 http://www.zerodayinitiative.com/advisories/ZDI-10-229/ 2010-11-02 2010-11-23
openssl -- TLS extension parsing race condition openssl 1.0.0_2

OpenSSL Team reports:

Rob Hulswit has found a flaw in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack.

Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected.

In particular the Apache HTTP server (which never uses OpenSSL internal caching) and Stunnel (which includes its own workaround) are NOT affected.

CVE-2010-3864 http://openssl.org/news/secadv_20101116.txt 2010-10-08 2010-11-17
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r289 linux-f8-flashplugin linux-f10-flashplugin 10.1r102

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player 10.1.85.3 and earlier versions for Windows, Macintosh, Linux, and Solaris, and Adobe Flash Player 10.1.95.1 for Android. These vulnerabilities, including CVE-2010-3654 referenced in Security Advisory APSA10-05, could cause the application to crash and could potentially allow an attacker to take control of the affected system.

CVE-2010-3636 CVE-2010-3637 CVE-2010-3638 CVE-2010-3639 CVE-2010-3640 CVE-2010-3641 CVE-2010-3642 CVE-2010-3643 CVE-2010-3644 CVE-2010-3645 CVE-2010-3646 CVE-2010-3647 CVE-2010-3648 CVE-2010-3649 CVE-2010-3650 CVE-2010-3652 CVE-2010-3654 CVE-2010-3676 http://www.adobe.com/support/security/bulletins/apsb10-26.html http://www.adobe.com/support/security/advisories/apsa10-05.html 2010-09-28 2010-11-06
Wireshark -- DoS in the BER-based dissectors wireshark 1.31.4.1 1.01.2.12 wireshark-lite 1.31.4.1 1.01.2.12 tshark 1.31.4.1 1.01.2.12 tshark-lite 1.31.4.1 1.01.2.12

Secunia reports:

A vulnerability has been discovered in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an infinite recursion error in the "dissect_unknown_ber()" function in epan/dissectors/packet-ber.c and can be exploited to cause a stack overflow e.g. via a specially crafted SNMP packet.

The vulnerability is confirmed in version 1.4.0 and reported in version 1.2.11 and prior and version 1.4.0 and prior.

CVE-2010-3445 http://www.wireshark.org/lists/wireshark-announce/201010/msg00002.html http://www.wireshark.org/lists/wireshark-announce/201010/msg00001.html 2010-09-16 2010-11-05
Mailman -- cross-site scripting in web interface mailman 2.1.14

Secunia reports:

Two vulnerabilities have been reported in Mailman, which can be exploited by malicious users to conduct script insertion attacks.

Certain input passed via the list descriptions is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation requires "list owner" permissions.

43187 CVE-2010-3089 http://secunia.com/advisories/41265 2010-09-14 2010-11-03
OTRS -- Multiple XSS and denial of service vulnerabilities otrs 2.3.*2.4.9

OTRS Security Advisory reports:

  • Multiple Cross Site Scripting issues: Missing HTML quoting allows authenticated agents or customers to inject HTML tags. This vulnerability allows an attacker to inject script code into the OTRS web-interface which will be loaded and executed in the browsers of system users.
  • Possible Denial of Service Attack: Perl's regular expressions consume 100% CPU time on the server if an agent or customer views an affected article. To exploit this vulnerability the malicious user needs to send extremely large HTML emails to your system address.

AgentTicketZoom is vulnerable to XSS attacks from HTML e-mails:

Whenever a customer sends an HTML e-mail and RichText is enabled in OTRS, javascript contained in the email can do everything in the OTRS agent interface that the agent himself could do.

Most relevant is that this type of exploit can be used in such a way that the agent won't even detect he is being exploited.

CVE-2010-2080 CVE-2010-4071 http://otrs.org/advisory/OSA-2010-02-en/ http://otrs.org/advisory/OSA-2010-03-en/ 2010-09-15 2010-11-03
mozilla -- Heap buffer overflow mixing document.write and DOM insertion firefox 3.6.*,13.6.12,1 3.5.*,13.5.15,1 libxul 1.9.2.*1.9.2.12 linux-firefox 3.6.12,1 linux-firefox-devel 3.5.15 linux-seamonkey 2.0.10 linux-thunderbird 3.1.6 seamonkey 2.0.*2.0.10 thunderbird 3.03.0.10 3.13.1.6

The Mozilla Project reports:

MFSA 2010-73 Heap buffer overflow mixing document.write and DOM insertion

CVE-2010-3765 http://www.mozilla.org/security/announce/2010/mfsa2010-73.html 2010-10-27 2010-10-28
opera -- multiple vulnerabilities opera 10.63

The Opera Desktop Team reports:

  • Fixed an issue that allowed cross-domain checks to be bypassed, allowing limited data theft using CSS, as reported by Isaac Dawson.
  • Fixed an issue where manipulating the window could be used to spoof the page address.
  • Fixed an issue with reloads and redirects that could allow spoofing and cross-site scripting.
  • Fixed an issue that allowed private video streams to be intercepted, as reported by Nirankush Panchbhai of Microsoft Vulnerability Research.
  • Fixed an issue that caused JavaScript to run in the wrong security context after manual interaction.
http://www.opera.com/support/kb/view/971/ http://www.opera.com/support/kb/view/972/ http://www.opera.com/support/kb/view/973/ http://www.opera.com/support/kb/view/974/ http://www.opera.com/support/kb/view/976/ 2010-10-12 2010-10-26
bzip2 -- integer overflow vulnerability bzip2 1.0.6

Secunia reports:

A vulnerability has been reported in bzip2, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

The vulnerability is caused due to an integer overflow in the "BZ2_decompress()" function in decompress.c and can be exploited to cause a crash or potentially execute arbitrary code.

SA-10:08.bzip2 ports/151364 CVE-2010-0405 43331 http://www.openwall.com/lists/oss-security/2010/09/21/4 http://secunia.com/advisories/41452 2010-09-21 2010-10-25
FreeBSD -- Integer overflow in bzip2 decompression FreeBSD 6.46.4_11 7.17.1_14 7.37.3_3 8.08.0_5 8.18.1_1

Problem Description:

When decompressing data, the run-length encoded values are not adequately sanity-checked, allowing for an integer overflow.

SA-10:08.bzip2 2010-09-20 2010-10-24
FreeBSD -- Lost mbuf flag resulting in data corruption FreeBSD 7.17.1_13 7.37.3_2 8.08.0_4 8.18.1

Problem Description:

The read-only flag is not correctly copied when a mbuf buffer reference is duplicated. When the sendfile(2) system call is used to transmit data over the loopback interface, this can result in the backing pages for the transmitted file being modified, causing data corruption.

SA-10:07.mbuf 2010-07-13 2010-10-24
FreeBSD -- Unvalidated input in nfsclient FreeBSD 7.27.2_8 7.37.3_1 8.08.0_3

Problem Description:

The NFS client subsystem fails to correctly validate the length of a parameter provided by the user when a filesystem is mounted.

SA-10:06.nfsclient 2010-05-27 2010-10-24
FreeBSD -- OPIE off-by-one stack overflow FreeBSD 6.46.4_10 7.17.1_12 7.27.2_8 7.37.3_1 8.08.0_3

Problem Description:

A programming error in the OPIE library could allow an off-by-one buffer overflow to write a single zero byte beyond the end of an on-stack buffer.

SA-10:05.opie 2010-05-27 2010-10-24
FreeBSD -- Insufficient environment sanitization in jail(8) FreeBSD 8.08.0_3

Problem Description:

The jail(8) utility does not change the current working directory while imprisoning. The current working directory can be accessed by its descendants.

SA-10:04.jail 2010-05-27 2010-10-24
FreeBSD -- ZFS ZIL playback with insecure permissions FreeBSD 7.17.1_10 7.27.2_6 8.08.0_2

Problem Description:

When replaying setattr transaction, the replay code would set the attributes with certain insecure defaults, when the logged transaction did not touch these attributes.

SA-10:03.zfs 2010-01-06 2010-10-24
FreeBSD -- ntpd mode 7 denial of service FreeBSD 6.36.3_15 6.46.4_9 7.17.1_10 7.27.2_6 8.08.0_2

Problem Description:

If ntpd receives a mode 7 (MODE_PRIVATE) request or error response from a source address not listed in either a 'restrict ... noquery' or a 'restrict ... ignore' section it will log the even and send a mode 7 error response.

SA-10:02.ntpd 2010-01-06 2010-10-24
FreeBSD -- BIND named(8) cache poisoning with DNSSEC validation FreeBSD 6.36.3_15 6.46.4_9 7.17.1_10 7.27.2_6 8.08.0_2

Problem Description:

If a client requests DNSSEC records with the Checking Disabled (CD) flag set, BIND may cache the unvalidated responses. These responses may later be returned to another client that has not set the CD flag.

SA-10:01.bind 2010-01-06 2010-10-24
FreeBSD -- Inappropriate directory permissions in freebsd-update(8) FreeBSD 6.36.3_14 6.46.4_8 7.17.1_9 7.27.2_5 8.08.0_1

Problem Description:

When downloading updates to FreeBSD via 'freebsd-update fetch' or 'freebsd-update upgrade', the freebsd-update(8) utility copies currently installed files into its working directory (/var/db/freebsd-update by default) both for the purpose of merging changes to configuration files and in order to be able to roll back installed updates.

The default working directory used by freebsd-update(8) is normally created during the installation of FreeBSD with permissions which allow all local users to see its contents, and freebsd-update(8) does not take any steps to restrict access to files stored in said directory.

SA-09:17.freebsd-update 2009-12-03 2010-10-24
FreeBSD -- Improper environment sanitization in rtld(1) FreeBSD 7.17.1_9 7.27.2_5 8.08.0_1

Problem Description:

When running setuid programs rtld will normally remove potentially dangerous environment variables. Due to recent changes in FreeBSD environment variable handling code, a corrupt environment may result in attempts to unset environment variables failing.

SA-09:16.rtld 2009-12-03 2010-10-24
FreeBSD -- SSL protocol flaw FreeBSD 6.36.3_14 6.46.4_8 7.17.1_9 7.27.2_5 8.08.0_1

Problem Description:

The SSL version 3 and TLS protocols support session renegotiation without cryptographically tying the new session parameters to the old parameters.

SA-09:15.ssl 2009-12-03 2010-10-24
monotone -- remote denial of service in default setup monotone 0.48.1

The monotone developers report:

Running "mtn ''" or "mtn ls ''" doesn't cause an internal error anymore. In monotone 0.48 and earlier this behavior could be used to crash a server remotely (but only if it was configured to allow execution of remote commands).

ports/151665 http://www.monotone.ca/NEWS http://www.thomaskeller.biz/blog/2010/10/22/monotone-0-48-1-released-please-update-your-servers/ 2010-10-21 2010-10-24
mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.11,1 3.5.*,13.5.14,1 libxul 1.9.2.*1.9.2.11 linux-firefox 3.6.11,1 linux-firefox-devel 3.5.14 seamonkey 2.0.*2.0.9 thunderbird 3.03.0.9 3.13.1.5

The Mozilla Project reports:

MFSA 2010-64 Miscellaneous memory safety hazards (rv:1.9.2.11/ 1.9.1.14)

MFSA 2010-65 Buffer overflow and memory corruption using document.write

MFSA 2010-66 Use-after-free error in nsBarProp

MFSA 2010-67 Dangling pointer vulnerability in LookupGetterOrSetter

MFSA 2010-68 XSS in gopher parser when parsing hrefs

MFSA 2010-69 Cross-site information disclosure via modal calls

MFSA 2010-70 SSL wildcard certificate matching IP addresses

MFSA 2010-71 Unsafe library loading vulnerabilities

MFSA 2010-72 Insecure Diffie-Hellman key exchange

CVE-2010-3170 CVE-2010-3173 CVE-2010-3174 CVE-2010-3175 CVE-2010-3176 CVE-2010-3177 CVE-2010-3178 CVE-2010-3179 CVE-2010-3180 CVE-2010-3181 CVE-2010-3182 CVE-2010-3183 http://www.mozilla.org/security/announce/2010/mfsa2010-64.html http://www.mozilla.org/security/announce/2010/mfsa2010-65.html http://www.mozilla.org/security/announce/2010/mfsa2010-66.html http://www.mozilla.org/security/announce/2010/mfsa2010-67.html http://www.mozilla.org/security/announce/2010/mfsa2010-68.html http://www.mozilla.org/security/announce/2010/mfsa2010-69.html http://www.mozilla.org/security/announce/2010/mfsa2010-70.html http://www.mozilla.org/security/announce/2010/mfsa2010-71.html http://www.mozilla.org/security/announce/2010/mfsa2010-72.html 2010-10-19 2010-10-20
Webkit-gtk2 -- Multiple Vulnabilities webkit-gtk2 1.2.5

Gustavo Noronha Silva reports:

The patches to fix the following CVEs are included with help from Vincent Danen and other members of the Red Hat security team:

CVE-2010-1780 CVE-2010-1807 CVE-2010-1812 CVE-2010-1814 CVE-2010-1815 CVE-2010-3113 CVE-2010-3114 CVE-2010-3115 CVE-2010-3116 CVE-2010-3255 CVE-2010-3257 CVE-2010-3259 http://gitorious.org/webkitgtk/stable/blobs/master/WebKit/gtk/NEWS 2010-10-01 2010-10-19
apr -- multiple vunerabilities apr1 1.4.2.1.3.10 apr0 0.9.19.0.9.19

Secunia reports:

Multiple vulnerabilities have been reported in APR-util, which can be exploited by malicious people to cause a DoS (Denial of Service).

Two XML parsing vulnerabilities exist in the bundled version of expat.

An error within the "apr_brigade_split_line()" function in buckets/apr_brigade.c can be exploited to cause high memory consumption.

43673 CVE-2009-3560 CVE-2009-3720 CVE-2010-1623 http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 http://secunia.com/advisories/41701 2010-10-02 2010-10-06 2010-10-20
phpmyfaq -- cross site scripting vulnerabilities phpmyfaq 2.6.9

The phpMyFAQ project reports:

The phpMyFAQ Team has learned of a security issue that has been discovered in phpMyFAQ 2.6.x: phpMyFAQ doesn't sanitize some variables in different pages correctly. With a properly crafted URL it is e.g. possible to inject JavaScript code into the output of a page, which could result in the leakage of domain cookies (f.e. session identifiers)..

ports/151055 http://www.phpmyfaq.de/advisory_2010-09-28.php 2010-09-28 2010-10-02
horde-gollem -- XSS vulnerability horde-gollem 1.1.2

The Horde team reports:

The major changes compared to Gollem version H3 (1.1.1) are:

* Fixed an XSS vulnerability in the file viewer.

http://article.gmane.org/gmane.comp.horde.announce/523 http://git.horde.org/diff.php/gollem/docs/CHANGES?rt=horde&r1=1.114.2.55&r2=1.114.2.59&ty=h http://bugs.horde.org/ticket/9191 2010-08-21 2010-09-28
horde-imp -- XSS vulnerability horde-imp 4.2,14.3.8,1 4.3.8

The Horde team reports:

Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability.

The major changes compared to IMP version H3 (4.3.7) are:

* Fixed an XSS vulnerability in the Fetchmail configuration.

http://article.gmane.org/gmane.comp.horde.announce/516 http://git.horde.org/diff.php/imp/docs/CHANGES?rt=horde&r1=1.699.2.424&r2=1.699.2.430&ty=h 2010-09-28 2010-09-28 2011-09-23
horde-base -- XSS and CSRF vulnerabilities horde-base 3.3.9

The Horde team reports:

Thanks to Naumann IT Security Consulting for reporting the XSS vulnerability.

Thanks to Secunia for releasing an advisory for the new CSRF protection in the preference interface

The major changes compared to Horde version 3.3.8 are:

* Fixed XSS vulnerability in util/icon_browser.php.

* Protected preference forms against CSRF attacks.

http://article.gmane.org/gmane.comp.horde.announce/515 http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.515.2.607&r2=1.515.2.620&ty=h http://secunia.com/advisories/39860/ http://holisticinfosec.org/content/view/145/45/ 2010-06-03 2010-09-28
openx -- remote code execution vulnerability openx 2.8.7

The OpenX project reported:

It has been brought to our attention that there is a vulnerability in the 2.8 downloadable version of OpenX that can result in a server running the downloaded version of OpenX being compromised.

This vulnerability exists in the file upload functionality and allows attackers to upload and execute PHP code of their choice.

http://blog.openx.org/09/security-update/ http://www.h-online.com/security/news/item/Web-sites-distribute-malware-via-hacked-OpenX-servers-1079099.html 2010-09-14 2010-09-26
squid -- Denial of service vulnerability in request handling squid 3.0.13.0.25_3 3.1.0.13.1.8

Squid security advisory 2010:3 reports:

Due to an internal error in string handling Squid is vulnerable to a denial of service attack when processing specially crafted requests.

This problem allows any trusted client to perform a denial of service attack on the Squid service.

CVE-2010-3072 http://www.squid-cache.org/Advisories/SQUID-2010_3.txt 2010-08-30 2010-09-24
linux-flashplugin -- remote code execution linux-flashplugin 9.0r283 linux-f8-flashplugin linux-f10-flashplugin 10.1r85

Adobe Product Security Incident Response Team reports:

A critical vulnerability exists in Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris, and Adobe Flash Player 10.1.92.10 for Android. This vulnerability also affects Adobe Reader 9.3.4 and earlier versions for Windows, Macintosh and UNIX, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh. This vulnerability (CVE-2010-2884) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against Adobe Flash Player on Windows. Adobe is not aware of any attacks exploiting this vulnerability against Adobe Reader or Acrobat to date.

CVE-2010-2884 http://www.adobe.com/support/security/advisories/apsa10-03.html 2010-09-14 2010-09-22
django -- cross-site scripting vulnerability py23-django py24-django py25-django py26-django py30-django py31-django 1.21.2.2 py23-django-devel py24-django-devel py25-django-devel py26-django-devel py30-django-devel py31-django-devel 13698,1

Django project reports:

The provided template tag for inserting the CSRF token into forms -- {% csrf_token %} -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped, into the outgoing HTML of the form, enabling cross-site scripting (XSS) attacks.

43116 CVE-2010-3082 http://xforce.iss.net/xforce/xfdb/61729 2010-09-13 2010-09-17
webkit-gtk2 -- Multiple vulnerabilities webkit-gtk2 1.2.4

Gustavo Noronha Silva reports:

With help from Vincent Danen and other members of the Red Hat security team, the following CVE's where fixed.

CVE-2010-1781 CVE-2010-1782 CVE-2010-1784 CVE-2010-1785 CVE-2010-1786 CVE-2010-1787 CVE-2010-1788 CVE-2010-1790 CVE-2010-1792 CVE-2010-1793 CVE-2010-2647 CVE-2010-2648 CVE-2010-3119 http://gitorious.org/webkitgtk/stable/commit/9d07fda89aab7105962d933eef32ca15dda610d8 2010-09-7 2010-09-10
vim6 -- heap-based overflow while parsing shell metacharacters vim6 vim6+ruby 6.2.4296.3.62

Description for CVE-2008-3432 says:

Heap-based buffer overflow in the mch_expand_wildcards function in os_unix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.

CVE-2008-3432 http://www.openwall.com/lists/oss-security/2008/07/15/4 2008-07-31 2010-09-09
mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.9,1 3.5.*,13.5.12,1 libxul 1.9.2.*1.9.2.9 linux-firefox 3.6.9,1 linux-firefox-devel 3.5.12 seamonkey 2.0.*2.0.7 thunderbird 3.03.0.7 3.13.1.3

The Mozilla Project reports:

MFSA 2010-49 Miscellaneous memory safety hazards (rv:1.9.2.9/ 1.9.1.12)

MFSA 2010-50 Frameset integer overflow vulnerability

MFSA 2010-51 Dangling pointer vulnerability using DOM plugin array

MFSA 2010-52 Windows XP DLL loading vulnerability

MFSA 2010-53 Heap buffer overflow in nsTextFrameUtils::TransformText

MFSA 2010-54 Dangling pointer vulnerability in nsTreeSelection

MFSA 2010-55 XUL tree removal crash and remote code execution

MFSA 2010-56 Dangling pointer vulnerability in nsTreeContentView

MFSA 2010-57 Crash and remote code execution in normalizeDocument

MFSA 2010-58 Crash on Mac using fuzzed font in data: URL

MFSA 2010-59 SJOW creates scope chains ending in outer object

MFSA 2010-60 XSS using SJOW scripted function

MFSA 2010-61 UTF-7 XSS by overriding document charset using object type attribute

MFSA 2010-62 Copy-and-paste or drag-and-drop into designMode document allows XSS

MFSA 2010-63 Information leak via XMLHttpRequest statusText

CVE-2010-2762 CVE-2010-2763 CVE-2010-2764 CVE-2010-2765 CVE-2010-2766 CVE-2010-2767 CVE-2010-2768 CVE-2010-2769 CVE-2010-2770 CVE-2010-2760 CVE-2010-3131 CVE-2010-3166 CVE-2010-3167 CVE-2010-3168 CVE-2010-3169 http://www.mozilla.org/security/announce/2010/mfsa2010-49.html http://www.mozilla.org/security/announce/2010/mfsa2010-50.html http://www.mozilla.org/security/announce/2010/mfsa2010-51.html http://www.mozilla.org/security/announce/2010/mfsa2010-52.html http://www.mozilla.org/security/announce/2010/mfsa2010-53.html http://www.mozilla.org/security/announce/2010/mfsa2010-54.html http://www.mozilla.org/security/announce/2010/mfsa2010-55.html http://www.mozilla.org/security/announce/2010/mfsa2010-56.html http://www.mozilla.org/security/announce/2010/mfsa2010-57.html http://www.mozilla.org/security/announce/2010/mfsa2010-58.html http://www.mozilla.org/security/announce/2010/mfsa2010-59.html http://www.mozilla.org/security/announce/2010/mfsa2010-60.html http://www.mozilla.org/security/announce/2010/mfsa2010-61.html http://www.mozilla.org/security/announce/2010/mfsa2010-62.html http://www.mozilla.org/security/announce/2010/mfsa2010-63.html 2010-09-07 2010-09-08 2010-09-15
sudo -- Flaw in Runas group matching sudo 1.7.01.7.4.4

Todd Miller reports:

Beginning with sudo version 1.7.0 it has been possible to grant permission to run a command using a specified group via sudo -g option (run as group). A flaw exists in the logic that matches Runas groups in the sudoers file when the -u option is also specified (run as user). This flaw results in a positive match for the user specified via -u so long as the group specified via -g is allowed by the sudoers file.

Exploitation of the flaw requires that Sudo be configured with sudoers entries that contain a Runas group. Entries that do not contain a Runas group, or only contain a Runas user are not affected.

CVE-2010-2956 http://www.sudo.ws/sudo/alerts/runas_group.html 2010-09-07 2010-09-07
lftp -- multiple HTTP client download filename vulnerability lftp 4.0.6

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

CVE-2010-2251 https://bugzilla.redhat.com/show_bug.cgi?id=591580 2010-06-09 2010-09-03
wget -- multiple HTTP client download filename vulnerability wget wget-devel 1.12_1

GNU Wget version 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

CVE-2010-2252 https://bugzilla.redhat.com/show_bug.cgi?id=602797 2010-06-09 2010-09-03
p5-libwww -- possibility to remote servers to create file with a .(dot) character p5-libwww 5.835

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a `.' (dot) character, which allows remote servers to create or overwrite files via a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

CVE-2010-2253 http://cpansearch.perl.org/src/GAAS/libwww-perl-5.836/Changes 2010-06-09 2010-08-31
quagga -- stack overflow and DoS vulnerabilities quagga 0.99.17

The Red Hat security team reported two vulnerabilities:

A stack buffer overflow flaw was found in the way Quagga's bgpd daemon processed Route-Refresh messages. A configured Border Gateway Protocol (BGP) peer could send a Route-Refresh message with specially-crafted Outbound Route Filtering (ORF) record, which would cause the master BGP daemon (bgpd) to crash or, possibly, execute arbitrary code with the privileges of the user running bgpd.

A NULL pointer dereference flaw was found in the way Quagga's bgpd daemon parsed paths of autonomous systems (AS). A configured BGP peer could send a BGP update AS path request with unknown AS type, which could lead to denial of service (bgpd daemon crash).

http://www.openwall.com/lists/oss-security/2010/08/24/3 http://www.quagga.net/news2.php?y=2010&m=8&d=19#id1282241100 2010-08-24 2010-08-25
bugzilla -- information disclosure, denial of service bugzilla 2.17.13.6.2

A Bugzilla Security Advisory reports:

  • Remote Information Disclosure: An unprivileged user is normally not allowed to view other users' group membership. But boolean charts let the user use group-based pronouns, indirectly disclosing group membership. This security fix restricts the use of pronouns to groups the user belongs to.
  • Notification Bypass: Normally, when a user is impersonated, he receives an email informing him that he is being impersonated, containing the identity of the impersonator. However, it was possible to impersonate a user without this notification being sent.
  • Remote Information Disclosure: An error message thrown by the "Reports" and "Duplicates" page confirmed the non-existence of products, thus allowing users to guess confidential product names. (Note that the "Duplicates" page was not vulnerable in Bugzilla 3.6rc1 and above though.)
  • Denial of Service: If a comment contained the phrases "bug X" or "attachment X", where X was an integer larger than the maximum 32-bit signed integer size, PostgreSQL would throw an error, and any page containing that comment would not be viewable. On most Bugzillas, any user can enter a comment on any bug, so any user could have used this to deny access to one or all bugs. Bugzillas running on databases other than PostgreSQL are not affected.
CVE-2010-2756 CVE-2010-2757 CVE-2010-2758 CVE-2010-2759 https://bugzilla.mozilla.org/show_bug.cgi?id=417048 https://bugzilla.mozilla.org/show_bug.cgi?id=450013 https://bugzilla.mozilla.org/show_bug.cgi?id=577139 https://bugzilla.mozilla.org/show_bug.cgi?id=519835 https://bugzilla.mozilla.org/show_bug.cgi?id=583690 2010-08-05 2010-08-24
OpenTTD -- Denial of service (server) via infinite loop openttd 1.0.11.0.3

The OpenTTD Team reports:

When multiple commands are queued (at the server) for execution in the next game tick and an client joins the server can get into an infinite loop. With the default settings triggering this bug is difficult (if not impossible), however the larger value of the "frame_freq" setting is easier it is to trigger the bug.

CVE-2010-2534 http://security.openttd.org/en/CVE-2010-2534 2010-06-27 2010-08-22
corkscrew -- buffer overflow vulnerability corkscrew 2.0

The affected corkscrew versions use sscanf calls without proper bounds checking. In the authentication file parsing routine this can cause an exploitable buffer overflow condition. A similar but issue exists in the server response code but appears to be non-exploitable.

http://people.freebsd.org/~niels/issues/corkscrew-20100821.txt 2010-08-21 2010-08-21
phpmyadmin -- Several XSS vulnerabilities phpMyAdmin 3.3.5.1 phpMyAdmin211 2.11.10.1

phpMyAdmin Team reports:

It was possible to conduct a XSS attack using crafted URLs org POST parameters on several pages.

CVE-2010-3056 http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php 2010-08-09 2010-08-21
slim -- insecure PATH assignment slim 1.3.2

SLiM assigns logged on users a PATH in which the current working directory ("./") is included. This PATH can allow unintentional code execution through planted binaries and has therefore been fixed SLiM version 1.3.2.

CVE-2010-2945 http://seclists.org/oss-sec/2010/q3/198 2010-05-12 2010-08-19 2010-08-20
ruby -- UTF-7 encoding XSS vulnerability in WEBrick ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.7.248_3,1 1.9.*,11.9.1.430,1

The official ruby site reports:

WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not.

40895 CVE-2010-0541 http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/ 2010-08-16 2010-08-17 2010-08-20
isolate -- local root exploit isolate 20100717

Isolate currently suffers from some bad security bugs! These are local root privilege escalation bugs. Thanks to the helpful person who reported them (email Chris if you want credit!). We're working to fix them ASAP, but until then, isolate is unsafe and you should uninstall it. Sorry!

ports/148911 http://code.google.com/p/isolate/ 2010-07-29 2010-08-13
vlc -- invalid id3v2 tags may lead to invalid memory dereferencing vlc 0.9.0,31.1.2_1,3

VideoLAN project reports:

VLC fails to perform sufficient input validation when trying to extract some meta-informations about input media through ID3v2 tags. In the failure case, VLC attempt dereference an invalid memory address, and a crash will ensure.

CVE-2010-2937 http://www.videolan.org/security/sa1004.html 2010-07-29 2010-08-14
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r280 linux-f8-flashplugin linux-f10-flashplugin 10.1r82

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player version 10.1.53.64 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

CVE-2010-0209 CVE-2010-2188 CVE-2010-2213 CVE-2010-2214 CVE-2010-2215 CVE-2010-2216 http://www.adobe.com/support/security/bulletins/apsb10-16.html 2010-01-06 2010-08-13
opera -- multiple vulnerabilities opera 10.61

The Opera Destkop Team reports:

  • Fixed an issue where heap buffer overflow in HTML5 canvas could be used to execute arbitrary code, as reported by Kuzzcc.
  • Fixed an issue where unexpected changes in tab focus could be used to run programs from the Internet, as reported by Jakob Balle and Sven Krewitt of Secunia.
  • Fixed an issue where news feed preview could subscribe to feeds without interaction, as reported by Alexios Fakos.
http://www.opera.com/support/search/view/966/ http://www.opera.com/support/search/view/967/ http://www.opera.com/support/search/view/968/ 2010-08-12 2010-08-13
firefox -- Dangling pointer crash regression from plugin parameter array fix firefox 3.6.*,13.6.8,1 linux-firefox 3.6.8,1

The Mozilla Project reports:

MFSA 2010-48 Dangling pointer crash regression from plugin parameter array fix

CVE-2010-2755 https://www.mozilla.org/security/announce/2010/mfsa2010-48.html 2010-07-20 2010-08-09
Piwik -- Local File Inclusion Vulnerability piwik 0.60.6.3

Piwik versions 0.6 through 0.6.3 are vulnerable to arbitrary, remote file inclusion using a directory traversal pattern infinite a crafted request for a data renderer.

A vulnerability has been reported in Piwik, which can before exploited by malicious people to disclose potentially sensitive information. Input passed to unspecified parameters when requesting a data renderer is not properly verified before being used to include files. This can be exploited to includes arbitrary files from local resources via directory traversal attacks.

CVE-2010-2786 http://secunia.com/advisories/40703 2010-07-28 2010-08-04
libmspack -- infinite loop denial of service libmspack 0.0.20060920 cabextract 1.3

There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable.

Secunia reports:

The vulnerability is caused due to an error when copying data from an uncompressed block (block type 0) and can be exploited to trigger an infinite loop by tricking an application using the library into processing specially crafted MS-ZIP archives.

http://secunia.com/advisories/40719/ 2010-07-26 2010-07-30
apache -- Remote DoS bug in mod_cache and mod_dav apache 2.2.02.2.16

Apache ChangeLog reports:

mod_dav, mod_cache: Fix Handling of requests without a path segment.

CVE-2010-1452 http://www.apache.org/dist/httpd/CHANGES_2.2.16 https://issues.apache.org/bugzilla/show_bug.cgi?id=49246 http://svn.apache.org/viewvc?view=revision&revision=966349 2010-07-21 2010-07-26
git -- buffer overflow vulnerability git 1.5.61.7.1.1_1

Greg Brockman reports:

If an attacker were to create a crafted working copy where the user runs any git command, the attacker could force execution of arbitrary code.

CVE-2010-2542 http://git.kernel.org/?p=git/git.git;a=commit;h=3c9d0414ed2db0167e6c828b547be8fc9f88fccc http://www.openwall.com/lists/oss-security/2010/07/22/1 2010-07-20 2010-07-23
codeigniter -- file upload class vulnerability codeigniter 1.7.2_1

Derek Jones reports:

A fix has been implemented for a security flaw in CodeIgniter 1.7.2. All applications using the File Upload class should install the patch to ensure that their application is not subject to a vulnerability.

http://codeigniter.com/news/codeigniter_1.7.2_security_patch/ http://www.phpframeworks.com/news/p/16365/codeigniter-1-7-2-security-patch 2010-07-12 2010-07-21
mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.7,1 3.5.*,13.5.11,1 linux-firefox 3.6.7,1 linux-firefox-devel 3.5.11 seamonkey 2.0.*2.0.6 thunderbird 3.03.0.6

The Mozilla Project reports:

MFSA 2010-34 Miscellaneous memory safety hazards (rv:1.9.2.7/ 1.9.1.11)

MFSA 2010-35 DOM attribute cloning remote code execution vulnerability

MFSA 2010-36 Use-after-free error in NodeIterator

MFSA 2010-37 Plugin parameter EnsureCachedAttrParamArrays remote code execution vulnerability

MFSA 2010-38 Arbitrary code execution using SJOW and fast native function

MFSA 2010-39 nsCSSValue::Array index integer overflow

MFSA 2010-40 nsTreeSelection dangling pointer remote code execution vulnerability

MFSA 2010-41 Remote code execution using malformed PNG image

MFSA 2010-42 Cross-origin data disclosure via Web Workers and importScripts

MFSA 2010-43 Same-origin bypass using canvas context

MFSA 2010-44 Characters mapped to U+FFFD in 8 bit encodings cause subsequent character to vanish

MFSA 2010-45 Multiple location bar spoofing vulnerabilities

MFSA 2010-46 Cross-domain data theft using CSS

MFSA 2010-47 Cross-origin data leakage from script filename in error messages

CVE-2010-0654 CVE-2010-1205 CVE-2010-1206 CVE-2010-1207 CVE-2010-1208 CVE-2010-1209 CVE-2010-1210 CVE-2010-1211 CVE-2010-1212 CVE-2010-1213 CVE-2010-1214 CVE-2010-1215 CVE-2010-2751 CVE-2010-2752 CVE-2010-2753 CVE-2010-2754 http://www.mozilla.org/security/announce/2010/mfsa2010-34.html http://www.mozilla.org/security/announce/2010/mfsa2010-35.html http://www.mozilla.org/security/announce/2010/mfsa2010-36.html http://www.mozilla.org/security/announce/2010/mfsa2010-37.html http://www.mozilla.org/security/announce/2010/mfsa2010-38.html http://www.mozilla.org/security/announce/2010/mfsa2010-39.html http://www.mozilla.org/security/announce/2010/mfsa2010-40.html http://www.mozilla.org/security/announce/2010/mfsa2010-41.html http://www.mozilla.org/security/announce/2010/mfsa2010-42.html http://www.mozilla.org/security/announce/2010/mfsa2010-43.html http://www.mozilla.org/security/announce/2010/mfsa2010-44.html http://www.mozilla.org/security/announce/2010/mfsa2010-45.html http://www.mozilla.org/security/announce/2010/mfsa2010-46.html http://www.mozilla.org/security/announce/2010/mfsa2010-47.html 2010-07-20 2010-07-21
vte -- Classic terminal title set+query attack vte 0.24.3

Kees Cook reports:

Janne Snabb discovered that applications using VTE, such as gnome-terminal, did not correctly filter window and icon title request escape codes. If a user were tricked into viewing specially crafted output in their terminal, a remote attacker could execute arbitrary commands with user privileges.

CVE-2010-2713 http://www.securityfocus.com/archive/1/512388 2010-07-15 2010-07-18
webkit-gtk2 -- Multiple vulnerabilities webkit-gtk2 1.2.3

Gustavo Noronha reports:

Debian's Michael Gilbert has done a great job going through all CVEs released about WebKit, and including patches in the Debian package. 1.2.3 includes all of the commits from trunk to fix those, too.

CVE-2010-1386 CVE-2010-1392 CVE-2010-1405 CVE-2010-1407 CVE-2010-1416 CVE-2010-1417 CVE-2010-1418 CVE-2010-1421 CVE-2010-1422 CVE-2010-1501 CVE-2010-1664 CVE-2010-1665 CVE-2010-1758 CVE-2010-1759 CVE-2010-1760 CVE-2010-1761 CVE-2010-1762 CVE-2010-1767 CVE-2010-1770 CVE-2010-1771 CVE-2010-1772 CVE-2010-1773 CVE-2010-1774 CVE-2010-2264 http://blog.kov.eti.br/?p=116 2010-07-16 2010-07-18
redmine -- multiple vulnerabilities redmine 0.9.6

Eric Davis reports:

This security release addresses some security vulnerabilities found in the advanced subversion integration module (Redmine.pm perl script).

http://www.redmine.org/news/41 2010-07-08 2010-07-10
bogofilter -- heap underrun on malformed base64 input bogofilter 1.2.1_2 bogofilter-sqlite 1.2.1_1 bogofilter-tc 1.2.1_1

Julius Plenz reports:

I found a bug in the base64_decode function which may cause memory corruption when the function is executed on a malformed base64 encoded string.

If a string starting with an equal-sign is passed to the base64_decode function it triggers a memory corruption that in some cases makes bogofilter crash.

CVE-2010-2494 http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01 2010-06-28 2010-07-06
bugzilla -- information disclosure bugzilla 2.17.13.6.1

A Bugzilla Security Advisory reports:

  • Normally, information about time-tracking (estimated hours, actual hours, hours worked, and deadlines) is restricted to users in the "time-tracking group". However, any user was able, by crafting their own search URL, to search for bugs based using those fields as criteria, thus possibly exposing sensitive time-tracking information by a user seeing that a bug matched their search.
  • If $use_suexec was set to "1" in the localconfig file, then the localconfig file's permissions were set as world-readable by checksetup.pl. This allowed any user with local shell access to see the contents of the file, including the database password and the site_wide_secret variable used for CSRF protection.
CVE-2010-1204 CVE-2010-0180 https://bugzilla.mozilla.org/show_bug.cgi?id=309952 https://bugzilla.mozilla.org/show_bug.cgi?id=561797 2010-06-24 2010-07-05
kvirc -- multiple vulnerabilities kvirc kvirc-devel 4.0.0

Two security vulnerabilities have been discovered:

Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.

Directory traversal vulnerability in the DCC functionality in KVIrc 3.4 and 4.0 allows remote attackers to overwrite arbitrary files via unknown vectors.

CVE-2010-2451 CVE-2010-2452 http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html 2010-05-17 2010-06-30
png -- libpng decompression buffer overflow png 1.4.3

The PNG project describes the problem in an advisory:

Several versions of libpng through 1.4.2 (and through 1.2.43 in the older series) contain a bug whereby progressive applications such as web browsers (or the rpng2 demo app included in libpng) could receive an extra row of image data beyond the height reported in the header, potentially leading to an out-of-bounds write to memory (depending on how the application is written) and the possibility of execution of an attacker's code with the privileges of the libpng user (including remote compromise in the case of a libpng-based browser visiting a hostile web site).

41174 CVE-2010-1205 http://www.libpng.org/pub/png/libpng.html 2010-03-30 2010-06-28 2010-06-28
moodle -- multiple vulnerabilities moodle 1.9.9

The Moodle release notes report multiple vulnerabilities which could allow cross site scripting, XSS attacks, unauthorised deletion of attempts in some instances.

http://docs.moodle.org/en/Moodle_1.9.9_release_notes 2010-06-08 2010-06-28
mDNSResponder -- corrupted stack crash when parsing bad resolv.conf mDNSResponder 214

Juli Mallett reports:

mdnsd will crash on some systems with a corrupt stack and once that's fixed it will still leak a file descriptor when parsing resolv.conf. The crash is because scanf is used with %10s for a buffer that is only 10 chars long. The buffer size needs increased to 11 chars to hold the trailing NUL. To fix the leak, an fclose needs added.

ports/147007 2010-05-26 2010-06-27
opera -- Data URIs can be used to allow cross-site scripting opera 10.11 opera-devel 10.20_2,1

The Opera Desktop Team reports:

Data URIs are allowed to run scripts that manipulate pages from the site that directly opened them. In some cases, the opening site is not correctly detected. In these cases, Data URIs may erroneously be able to run scripts so that they interact with sites that did not directly cause them to be opened.

http://www.opera.com/support/kb/view/955/ 2010-06-21 2010-06-25
cacti -- multiple vulnerabilities cacti 0.8.7f

Multiple vulnerabilities have been reported to exist in older version of Cacti. The release notes of Cacti 0.8.7f summarizes the problems as follows:

  • SQL injection and shell escaping issues
  • Cross-site scripting issues
  • Cacti Graph Viewer SQL injection vulnerability
http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html http://www.cacti.net/release_notes_0_8_7f.php http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php http://www.vupen.com/english/advisories/2010/1204 2010-05-24 2010-06-24
mozilla -- multiple vulnerabilities firefox 3.6.*,13.6.4,1 3.5.*,13.5.10,1 linux-firefox-devel 3.5.10 seamonkey 2.0.*2.0.5 thunderbird 3.03.0.5

Mozilla Project reports:

MFSA 2010-33 User tracking across sites using Math.random()

MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present

MFSA 2010-31 focus() behavior can be used to inject or steal keystrokes

MFSA 2010-30 Integer Overflow in XSLT Node Sorting

MFSA 2010-29 Heap buffer overflow in nsGenericDOMDataNode::SetTextInternal

MFSA 2010-28 Freed object reuse across plugin instances

MFSA 2010-27 Use-after-free error in nsCycleCollector::MarkRoots()

MFSA 2010-26 Crashes with evidence of memory corruption (rv:1.9.2.4/ 1.9.1.10)

MFSA 2010-25 Re-use of freed object due to scope confusion

CVE-2008-5913 CVE-2010-0183 CVE-2010-1121 CVE-2010-1125 CVE-2010-1197 CVE-2010-1199 CVE-2010-1196 CVE-2010-1198 CVE-2010-1200 CVE-2010-1201 CVE-2010-1202 CVE-2010-1203 http://www.mozilla.org/security/announce/2010/mfsa2010-33.html http://www.mozilla.org/security/announce/2010/mfsa2010-32.html http://www.mozilla.org/security/announce/2010/mfsa2010-31.html http://www.mozilla.org/security/announce/2010/mfsa2010-30.html http://www.mozilla.org/security/announce/2010/mfsa2010-29.html http://www.mozilla.org/security/announce/2010/mfsa2010-28.html http://www.mozilla.org/security/announce/2010/mfsa2010-27.html http://www.mozilla.org/security/announce/2010/mfsa2010-26.html http://www.mozilla.org/security/announce/2010/mfsa2010-25.html 2010-06-22 2010-06-23
ziproxy -- security vulnerability in PNG decoder ziproxy 3.1.0 3.1.1

Daniel Mealha Cabrita reports:

Fixed security vulnerability (heap-related) in PNG decoder. (new bug from 3.1.0)

http://ziproxy.sourceforge.net/#news http://sourceforge.net/mailarchive/message.php?msg_name=201006150731.30474.dancab%40gmx.net 2010-06-15 2010-06-15
tiff -- Multiple integer overflows tiff 3.9.4 linux-tiff linux-f10-tiff 3.9.4

Tielei Wang:

Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.

CVE-2009-2347 http://www.remotesensing.org/libtiff/v3.9.4.html http://www.ocert.org/advisories/ocert-2009-012.html 2009-05-22 2010-06-16
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r277 linux-f8-flashplugin linux-f10-flashplugin 10.1r53

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player version 10.0.45.2 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

CVE-2008-4546 CVE-2009-3793 CVE-2010-1297 CVE-2010-2160 CVE-2010-2161 CVE-2010-2162 CVE-2010-2163 CVE-2010-2164 CVE-2010-2165 CVE-2010-2166 CVE-2010-2167 CVE-2010-2169 CVE-2010-2170 CVE-2010-2171 CVE-2010-2172 CVE-2010-2173 CVE-2010-2174 CVE-2010-2175 CVE-2010-2176 CVE-2010-2177 CVE-2010-2178 CVE-2010-2179 CVE-2010-2180 CVE-2010-2181 CVE-2010-2182 CVE-2010-2183 CVE-2010-2184 CVE-2010-2185 CVE-2010-2186 CVE-2010-2187 CVE-2010-2188 CVE-2010-2189 http://www.adobe.com/support/security/bulletins/apsb10-14.html 2008-10-02 2010-06-14
tiff -- buffer overflow vulnerability tiff 3.9.3 linux-tiff 3.9.3

Kevin Finisterre reports:

Multiple integer overflows in the handling of TIFF files may result in a heap buffer overflow. Opening a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution. The issues are addressed through improved bounds checking. Credit to Kevin Finisterre of digitalmunition.com for reporting these issues.

CVE-2010-1411 http://www.remotesensing.org/libtiff/v3.9.3.html http://support.apple.com/kb/HT4196 2010-04-15 2010-06-12
sudo -- Secure path vulnerability sudo 1.7.2.7

Todd Miller reports:

Most versions of the C library function getenv() return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell (bash), do their own environment parsing and may choose the last instance of a variable rather than the first one.

An attacker may manipulate the environment of the process that executes Sudo such that a second PATH variable is present. When Sudo runs a bash script, it is this second PATH variable that is used by bash, regardless of whether or not Sudo has overwritten the first instance of PATH. This may allow an attacker to subvert the program being run under Sudo and execute commands he/she would not otherwise be allowed to run.

CVE-2010-1646 http://sudo.ws/sudo/alerts/secure_path.html 2010-06-02 2010-06-02
ziproxy -- atypical huge picture files vulnerability ziproxy 3.0.1

Ziproxy 3.0.1 release fixes a security vulnerability related to atypical huge picture files (>4GB of size once expanded).

40344 CVE-2010-1513 http://ziproxy.sourceforge.net/#news http://secunia.com/advisories/39941 http://sourceforge.net/mailarchive/message.php?msg_name=201005210019.37119.dancab%40gmx.net 2010-05-20 2010-05-28
mediawiki -- two security vulnerabilities mediawiki 1.15.4

Two security vulnerabilities were discovered:

Noncompliant CSS parsing behaviour in Internet Explorer allows attackers to construct CSS strings which are treated as safe by previous versions of MediaWiki, but are decoded to unsafe strings by Internet Explorer.

A CSRF vulnerability was discovered in our login interface. Although regular logins are protected as of 1.15.3, it was discovered that the account creation and password reset reset features were not protected from CSRF. This could lead to unauthorised access to private wikis.

http://secunia.com/advisories/39922/ http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html 2010-05-28 2010-06-02
redmine -- multiple vulnerabilities redmine 0.9.4

The Redmine release announcement reports that several cross side scripting vulnerabilities and a potential data disclosure vulnerability have been fixed in the latest release.

http://www.redmine.org/news/39 2010-05-01 2010-05-14
wireshark -- DOCSIS dissector denial of service wireshark 1.2.6_1

A vulnerability found in the DOCSIS dissector can cause Wireshark to crash when a malformed packet trace file is opened. This means that an attacker will have to trick a victim into opening such a trace file before being able to crash the application

CVE-2010-1455 http://www.wireshark.org/security/wnpa-sec-2010-03.html http://www.wireshark.org/security/wnpa-sec-2010-04.html 2010-05-05 2010-05-07
piwik -- cross site scripting vulnerability piwik 0.5.5

The Piwik security advisory reports:

A non-persistent, cross-site scripting vulnerability (XSS) was found in Piwik's Login form that reflected the form_url parameter without being properly escaped or filtered.

CVE-2010-1453 http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/ 2010-04-15 2010-05-07
spamass-milter -- remote command execution vulnerability spamass-milter 0.3.1_8

The spamassassin milter plugin contains a vulnerability that can allow remote attackers to execute commands on affected systems.

The vulnerability can be exploited trough a special-crafted email header when the plugin was started with the '-x' (expand) flag.

CVE-2010-1132 http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html http://xforce.iss.net/xforce/xfdb/56732 2010-03-07 2010-05-06
mediawiki -- authenticated CSRF vulnerability mediawiki 1.15.3

A MediaWiki security announcement reports:

MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website.

If the wiki is configured to allow user scripts, say with "$wgAllowUserJs = true" in LocalSettings.php, then the attacker can proceed to mount a phishing-style attack against the victim to obtain their password.

CVE-2010-1150 http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html https://bugzilla.wikimedia.org/show_bug.cgi?id=23076 2010-04-07 2010-05-05
lxr -- multiple XSS vulnerabilities lxr 0.9.6

Dan Rosenberg reports:

There are several cross-site scripting vulnerabilities in LXR. These vulnerabilities could allow an attacker to execute scripts in a user's browser, steal cookies associated with vulnerable domains, redirect the user to malicious websites, etc.

CVE-2009-4497 ports/146337 http://secunia.com/advisories/38117 http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com 2010-01-05 2010-05-05
vlc -- unintended code execution with specially crafted data vlc 1.0.6

VideoLAN project reports:

VLC media player suffers from various vulnerabilities when attempting to parse malformatted or overly long byte streams.

39629 http://www.videolan.org/security/sa1003.html 2010-04-19 2010-05-01 2010-05-05
joomla -- multiple vulnerabilities joomla15 1.5.11.5.15

Joomla! reported the following vulnerabilities:

If a user entered a URL with a negative query limit or offset, a PHP notice would display revealing information about the system..

The migration script in the Joomla! installer does not check the file type being uploaded. If the installation application is present, an attacker could use it to upload malicious files to a server.

Session id doesn't get modified when user logs in. A remote site may be able to forward a visitor to the Joomla! site and set a specific cookie. If the user then logs in, the remote site can use that cookie to authenticate as that user.

When a user requests a password reset, the reset tokens were stored in plain text in the database. While this is not a vulnerability in itself, it allows user accounts to be compromised if there is an extension on the site with an SQL injection vulnerability.

http://developer.joomla.org/security/news/308-20100423-core-password-reset-tokens.html http://developer.joomla.org/security/news/309-20100423-core-sessation-fixation.html http://developer.joomla.org/security/news/310-20100423-core-installer-migration-script.html http://developer.joomla.org/security/news/311-20100423-core-negative-values-for-limit-and-offset.html 2010-04-23 2010-04-26
cacti -- SQL injection and command execution vulnerabilities cacti 0.8.7e4

Bonsai information security reports:

A Vulnerability has been discovered in Cacti, which can be exploited by any user to conduct SQL Injection attacks. Input passed via the "export_item_id" parameter to "templates_export.php" script is not properly sanitized before being used in a SQL query.

The same source also reported a command execution vulnerability. This second issue can be exploited by Cacti users who have the rights to modify device or graph configurations.

CVE-2010-1431 ports/146021 http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-sql-injection-0104.php http://www.debian.org/security/2010/dsa-2039 2010-04-21 2010-04-24 2013-06-16
moodle -- multiple vulnerabilities moodle 1.9.8

The Moodle release notes report multiple vulnerabilities which could allow remote attackers to perform, amongst others, cross site scripting, user enumeration and SQL injection attacks.

http://docs.moodle.org/en/Moodle_1.9.8_release_notes 2010-03-25 2010-04-24
tomcat -- information disclosure vulnerability tomcat 5.5.05.5.30 6.0.06.0.27

The Apache software foundation reports:

The "WWW-Authenticate" header for BASIC and DIGEST authentication includes a realm name. If a <realm-name> element is specified for the application in web.xml it will be used. However, a <realm-name> is not specified then Tomcat will generate one.

In some circumstances this can expose the local hostname or IP address of the machine running Tomcat.

CVE-2010-1157 ports/146022 http://seclists.org/bugtraq/2010/Apr/200 2010-04-22 2010-04-24
krb5 -- KDC double free vulnerability krb5 1.71.7.2 1.81.8.2

The MIT Kerberos team reports:

An authenticated remote attacker can crash the KDC by inducing the KDC to perform a double free. Under some circumstances on some platforms, this could also allow malicious code execution.

CVE-2010-1320 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-004.txt 2010-04-20 2010-04-21
e107 -- code execution and XSS vulnerabilities e107 0.7.20

Secunia Research reported two vulnerabilities in e107:

The first problem affects installations that have the Content Manager plugin enabled. This plugin does not sanitize the "content_heading" parameter correctly and is therefore vulnerable to a cross site scripting attack.

The second vulnerability is related to the avatar upload functionality. Images containing PHP code can be uploaded and executed.

39540 CVE-2010-0996 CVE-2010-0997 ports/145885 http://e107.org/comment.php?comment.news.864 http://secunia.com/secunia_research/2010-43/ http://secunia.com/secunia_research/2010-44/ http://xforce.iss.net/xforce/xfdb/57932 2010-04-15 2010-04-20
fetchmail -- denial of service vulnerability fetchmail 4.6.3 6.3.16

Fetchmail developer Matthias Andree reported a vulnerability that allows remote attackers to crash the application when it is runs in verbose mode.

Fetchmail before release 6.3.17 did not properly sanitize external input (mail headers and UID). When a multi-character locale (such as UTF-8) was in use, this could cause memory exhaustion and thus a denial of service.

CVE-2010-1167 ports/145857 http://gitorious.org/fetchmail/fetchmail/commit/ec06293 http://seclists.org/oss-sec/2010/q2/76 2010-04-18 2010-04-20
pidgin -- multiple remote denial of service vulnerabilities pidgin 2.6.6 libpurple 2.6.6

Three denial of service vulnerabilities where found in pidgin and allow remote attackers to crash the application. The developers summarized these problems as follows:

Pidgin can become unresponsive when displaying large numbers of smileys

Certain nicknames in group chat rooms can trigger a crash in Finch

Failure to validate all fields of an incoming message can trigger a crash

38294 CVE-2010-0277 CVE-2010-0420 CVE-2010-0423 http://pidgin.im/news/security/?id=43 http://pidgin.im/news/security/?id=44 http://pidgin.im/news/security/?id=45 2010-02-18 2010-04-20
png -- libpng decompression denial of service png 1.2.43 1.4.1

A vulnerability in libpng can result in denial of service conditions when a remote attacker tricks a victim to open a specially-crafted PNG file.

The PNG project describes the problem in an advisory:

Because of the efficient compression method used in Portable Network Graphics (PNG) files, a small PNG file can expand tremendously, acting as a "decompression bomb".

Malformed PNG chunks can consume a large amount of CPU and wall-clock time and large amounts of memory, up to all memory available on a system

38478 576029 CVE-2010-0205 http://libpng.sourceforge.net/ADVISORY-1.4.1.html http://secunia.com/advisories/38774 http://xforce.iss.net/xforce/xfdb/56661 2010-02-27 2010-04-20
curl -- libcurl buffer overflow vulnerability curl 7.10.5 7.20.0

The cURL project reports in a security advisory:

Using the affected libcurl version to download compressed content over HTTP, an application can ask libcurl to automatically uncompress data. When doing so, libcurl can wrongly send data up to 64K in size to the callback which thus is much larger than the documented maximum size.

An application that blindly trusts libcurl's max limit for a fixed buffer size or similar is then a possible target for a buffer overflow vulnerability.

CVE-2010-0734 http://curl.haxx.se/docs/adv_20100209.html http://www.debian.org/security/2010/dsa-2023 http://www.openwall.com/lists/oss-security/2010/02/09/5 2010-02-09 2010-04-19
ejabberd -- queue overload denial of service vulnerability ejabberd 2.1.3

The Red Hat security response team reports:

A remotely exploitable DoS from XMPP client to ejabberd server via too many "client2server" messages (causing the message queue on the server to get overloaded, leading to server crash) has been found.

38003 CVE-2010-0305 http://secunia.com/advisories/38337 http://support.process-one.net/browse/EJAB-1173 http://www.openwall.com/lists/oss-security/2010/01/29/1 http://xforce.iss.net/xforce/xfdb/56025 2010-01-29 2010-04-19
irssi -- multiple vulnerabilities irssi 0.8.15 zh-irssi 0.8.15 irssi-devel 20100325

Two vulnerabilities have found in irssi. The first issue could allow man-in-the-middle attacks due to a missing comparison of SSL server hostnames and the certificate domain names (e.g. CN).

A second vulnerability, related to the nick matching code, could be triggered by remote attackers in order to crash an irssi client when leaving a channel.

CVE-2010-1155 CVE-2010-1156 http://xforce.iss.net/xforce/xfdb/57790 http://xforce.iss.net/xforce/xfdb/57791 2010-04-16 2010-04-19
krb5 -- remote denial of service vulnerability krb5 1.6.3_9

An authenticated remote attacker can causing a denial of service by using a newer version of the kadmin protocol than the server supports.

The MIT Kerberos team also reports the cause:

The Kerberos administration daemon (kadmind) can crash due to referencing freed memory.

39247 CVE-2010-0629 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt 2010-04-06 2010-04-18
krb5 -- multiple denial of service vulnerabilities krb5 1.71.7_2

Two vulnerabilities in krb5 can be used by remote attackers in denial of service attacks. The MIT security advisories report this as follows:

An unauthenticated remote attacker can send an invalid request to a KDC process that will cause it to crash due to an assertion failure, creating a denial of service.

An unauthenticated remote attacker could cause a GSS-API application, including the Kerberos administration daemon (kadmind) to crash.

38260 38904 CVE-2010-0283 CVE-2010-0628 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt 2010-02-16 2010-04-19 2013-06-16
mahara -- sql injection vulnerability mahara 1.1.8

The Debian security team reports:

It was discovered that mahara, an electronic portfolio, weblog, and resume builder is not properly escaping input when generating a unique username based on a remote user name from a single sign-on application. An attacker can use this to compromise the mahara database via crafted user names.

39253 CVE-2010-0400 http://www.debian.org/security/2010/dsa-2030 2010-04-06 2010-04-18
sudo -- Privilege escalation with sudoedit sudo 1.7.2.6

Todd Miller reports:

Sudo's command matching routine expects actual commands to include one or more slash ('/') characters. The flaw is that sudo's path resolution code did not add a "./" prefix to commands found in the current working directory. This creates an ambiguity between a "sudoedit" command found in the cwd and the "sudoedit" pseudo-command in the sudoers file. As a result, a user may be able to run an arbitrary command named "sudoedit" in the current working directory. For the attack to be successful, the PATH environment variable must include "." and may not include any other directory that contains a "sudoedit" command.

CVE-2010-1163 http://www.sudo.ws/pipermail/sudo-announce/2010-April/000093.html http://www.sudo.ws/sudo/alerts/sudoedit_escalate2.html 2010-04-09 2010-04-15
KDM -- local privilege escalation vulnerability kdebase 3.5.10_6 kdebase-workspace 4.3.5_1

KDE Security Advisory reports:

KDM contains a race condition that allows local attackers to make arbitrary files on the system world-writeable. This can happen while KDM tries to create its control socket during user login. A local attacker with a valid local account can under certain circumstances make use of this vulnerability to execute arbitrary code as root.

CVE-2010-0436 http://www.kde.org/info/security/advisory-20100413-1.txt 2010-04-13 2010-04-14 2010-04-14
dojo -- cross-site scripting and other vulnerabilities dojo 1.4.2

The Dojo Toolkit team reports:

Some PHP files did not properly escape input.

Some files could operate like "open redirects". A bad actor could form an URL that looks like it came from a trusted site, but the user would be redirected or load content from the bad actor's site.

A file exposed a more serious cross-site scripting vulnerability with the possibility of executing code on the domain where the file exists.

The Dojo build process defaulted to copying over tests and demos, which are normally not needed and just increased the number of files that could be targets of attacks.

http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html http://packetstormsecurity.org/1003-exploits/dojo-xss.txt http://secunia.com/advisories/38964 http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ 2010-03-11 2010-04-06
Zend Framework -- security issues in bundled Dojo library ZendFramework 1.10.3

The Zend Framework team reports:

Several files in the bundled Dojo library were identified as having potential exploits, and the Dojo team also advised disabling or removing any PHP scripts in the Dojo library tree when deploying to production.

http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ http://framework.zend.com/security/advisory/ZF2010-07 http://osdir.com/ml/bugtraq.security/2010-03/msg00133.html http://packetstormsecurity.org/1003-exploits/dojo-xss.txt http://secunia.com/advisories/38964 http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/ 2010-04-01 2010-04-06
firefox -- Re-use of freed object due to scope confusion firefox 3.6,13.6.3,1

Mozilla Project reports:

MFSA 2009-25 Re-use of freed object due to scope confusion

CVE-2010-1121 http://www.mozilla.org/security/announce/2010/mfsa2010-25.html 2010-04-01 2010-04-05
mozilla -- multiple vulnerabilities seamonkey 2.02.0.4 thunderbird 3.03.0.4 firefox 3.5.*,13.5.9,1 3.*,13.0.19,1 linux-firefox 3.0.19,1 linux-firefox-devel 3.5.9 nss linux-f10-nss 3.12.5

Mozilla Project reports:

MFSA 2010-24 XMLDocument::load() doesn't check nsIContentPolicy

MFSA 2010-23 Image src redirect to mailto: URL opens email editor

MFSA 2010-22 Update NSS to support TLS renegotiation indication

MFSA 2010-21 Arbitrary code execution with Firebug XMLHttpRequestSpy

MFSA 2010-20 Chrome privilege escalation via forced URL drag and drop

MFSA 2010-19 Dangling pointer vulnerability in nsPluginArray

MFSA 2010-18 Dangling pointer vulnerability in nsTreeContentView

MFSA 2010-17 Remote code execution with use-after-free in nsTreeSelection

MFSA 2010-16 Crashes with evidence of memory corruption (rv:1.9.2.2/ 1.9.1.9/ 1.9.0.19)

CVE-2010-0181 CVE-2009-3555 CVE-2010-0179 CVE-2010-0178 CVE-2010-0177 CVE-2010-0176 CVE-2010-0175 CVE-2010-0174 CVE-2010-0173 http://www.mozilla.org/security/announce/2010/mfsa2010-24.html http://www.mozilla.org/security/announce/2010/mfsa2010-23.html http://www.mozilla.org/security/announce/2010/mfsa2010-22.html http://www.mozilla.org/security/announce/2010/mfsa2010-21.html http://www.mozilla.org/security/announce/2010/mfsa2010-20.html http://www.mozilla.org/security/announce/2010/mfsa2010-19.html http://www.mozilla.org/security/announce/2010/mfsa2010-18.html http://www.mozilla.org/security/announce/2010/mfsa2010-17.html http://www.mozilla.org/security/announce/2010/mfsa2010-16.html 2010-03-30 2010-03-30
postgresql -- bitsubstr overflow postgresql-server 7.47.4.28 8.08.0.24 8.18.1.20 8.28.2.16 8.38.3.10 8.48.4.3

BugTraq reports:

PostgreSQL is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application.

37973 CVE-2010-0442 2010-01-27 2010-03-25
gtar -- buffer overflow in rmt client gtar 1.22_3

Jakob Lell reports:

The rmt client implementation of GNU Tar/Cpio contains a heap-based buffer overflow which possibly allows arbitrary code execution.

The problem can be exploited when using an untrusted/compromised rmt server.

CVE-2010-0624 http://www.agrs.tu-berlin.de/index.php?id=78327 2010-03-24 2010-03-24
firefox -- WOFF heap corruption due to integer overflow firefox 3.6,13.6.2,1

Mozilla Project reports:

MFSA 2010-08 WOFF heap corruption due to integer overflow

CVE-2010-1028 http://www.mozilla.org/security/announce/2010/mfsa2010-08.html 2010-03-22 2010-03-23
mozilla -- multiple vulnerabilities seamonkey linux-seamonkey 1.1.19 thunderbird linux-thunderbird 2.0.0.24

Mozilla Project reports:

MFSA 2010-07 Fixes for potentially exploitable crashes ported to the legacy branch

MFSA 2010-06 Scriptable plugin execution in SeaMonkey mail

MFSA 2009-68 NTLM reflection vulnerability

MFSA 2009-62 Download filename spoofing with RTL override

MFSA 2009-59 Heap buffer overflow in string to number conversion

MFSA 2009-49 TreeColumns dangling pointer vulnerability

CVE-2010-0161 CVE-2010-0163 CVE-2009-3075 CVE-2009-3072 CVE-2009-2463 CVE-2009-3385 CVE-2009-3983 CVE-2009-3376 CVE-2009-0689 CVE-2009-3077 http://www.mozilla.org/security/announce/2010/mfsa2010-07.html http://www.mozilla.org/security/announce/2010/mfsa2010-06.html http://www.mozilla.org/security/announce/2009/mfsa2009-68.html http://www.mozilla.org/security/announce/2009/mfsa2009-62.html http://www.mozilla.org/security/announce/2009/mfsa2009-59.html http://www.mozilla.org/security/announce/2009/mfsa2009-49.html 2010-03-16 2010-03-19
egroupware -- two vulnerabilities egroupware 1.6.003

Egroupware Team report:

Nahuel Grisolia from CYBSEC S.A. Security Systems found two security problems in EGroupware:

Serious remote command execution (allowing to run arbitrary command on the web server by simply issuing a HTTP request!).

A reflected cross-site scripting (XSS).

Both require NO valid EGroupware account and work without being logged in!

38609 http://secunia.com/advisories/38859/ http://www.egroupware.org/Home?category_id=95&item=93 2010-03-09 2010-03-11
drupal -- multiple vulnerabilities drupal5 5.22 drupal6 6.16

Drupal Team reports:

A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attack. The exploit can only be conducted on sites not yet installed.

The API function drupal_goto() is susceptible to a phishing attack. An attacker could formulate a redirect in a way that gets the Drupal site to send the user to an arbitrarily provided URL. No user submitted data will be sent to that URL.

Locale module and dependent contributed modules do not sanitize the display of language codes, native and English language names properly. While these usually come from a preselected list, arbitrary administrator input is allowed. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer languages' permission.

Under certain circumstances, a user with an open session that is blocked can maintain his/her session on the Drupal site, despite being blocked.

http://drupal.org/node/731710 2010-03-03 2010-03-08
sudo -- Privilege escalation with sudoedit sudo 1.7.2.4

Todd Miller reports:

When sudo performs its command matching, there is a special case for pseudo-commands in the sudoers file (currently, the only pseudo-command is sudoedit). Unlike a regular command, pseudo-commands do not begin with a slash ('/'). The flaw is that sudo's the matching code would only check against the list of pseudo-commands if the user-specified command also contained no slashes. As a result, if the user ran "sudo ./sudoedit" the normal matching code path was followed, which uses stat(2) to verify that the user-specified command matches the one in sudoers. In this case, it would compare the "./sudoedit" specified by the user with "sudoedit" from the sudoers file, resulting in a positive match.

http://www.sudo.ws/pipermail/sudo-announce/2010-February/000092.html http://www.sudo.ws/sudo/alerts/sudoedit_escalate.html http://secunia.com/advisories/38659 CVE-2010-0426 38362 2010-01-29 2010-03-01
openoffice.org -- multiple vulnerabilities openoffice.org 3.2.0 3.2.200101013.2.20100203 3.3.200101013.3.20100207

OpenOffice.org Security Team reports:

Fixed in OpenOffice.org 3.2

CVE-2006-4339: Potential vulnerability from 3rd party libxml2 libraries

CVE-2009-0217: Potential vulnerability from 3rd party libxmlsec libraries

CVE-2009-2493: OpenOffice.org 3 for Windows bundles a vulnerable version of MSVC Runtime

CVE-2009-2949: Potential vulnerability related to XPM file processing

CVE-2009-2950: Potential vulnerability related to GIF file processing

CVE-2009-3301/2: Potential vulnerability related to MS-Word document processing

http://www.openoffice.org/security/bulletin.html http://www.openoffice.org/security/cves/CVE-2006-4339.html http://www.openoffice.org/security/cves/CVE-2009-0217.html http://www.openoffice.org/security/cves/CVE-2009-2493.html http://www.openoffice.org/security/cves/CVE-2009-2949.html http://www.openoffice.org/security/cves/CVE-2009-2950.html http://www.openoffice.org/security/cves/CVE-2009-3301-3302.html CVE-2006-4339 CVE-2009-0217 CVE-2009-2493 CVE-2009-2949 CVE-2009-2950 CVE-2009-3301 CVE-2009-3302 2006-08-24 2010-02-25 2010-02-27
mozilla -- multiple vulnerabilities firefox 3.5.*,13.5.8,1 3.*,13.0.18,1 linux-firefox 3.0.18,1 linux-firefox-devel 3.5.8 seamonkey 2.0.*2.0.3 thunderbird 3.03.0.2

Mozilla Project reports:

MFSA 2010-05 XSS hazard using SVG document and binary Content-Type

MFSA 2010-04 XSS due to window.dialogArguments being readable cross-domain

MFSA 2010-03 Use-after-free crash in HTML parser

MFSA 2010-02 Web Worker Array Handling Heap Corruption Vulnerability

MFSA 2010-01 Crashes with evidence of memory corruption (rv:1.9.1.8/ 1.9.0.18)

CVE-2010-0159 CVE-2010-0160 CVE-2009-1571 CVE-2009-3988 CVE-2010-0162 http://www.mozilla.org/security/announce/2010/mfsa2010-01.html http://www.mozilla.org/security/announce/2010/mfsa2010-02.html http://www.mozilla.org/security/announce/2010/mfsa2010-03.html http://www.mozilla.org/security/announce/2010/mfsa2010-04.html http://www.mozilla.org/security/announce/2010/mfsa2010-05.html 2010-02-17 2010-02-18 2010-02-28
lighttpd -- denial of service vulnerability lighttpd 1.4.26

Lighttpd security advisory reports:

If you send the request data very slow (e.g. sleep 0.01 after each byte), lighttpd will easily use all available memory and die (especially for parallel requests), allowing a DoS within minutes.

38036 CVE-2010-0295 http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2010_01.txt 2010-02-02 2010-02-16
squid -- Denial of Service vulnerability in HTCP squid 2.7.12.7.7_4 3.0.13.0.24

Squid security advisory 2010:2 reports:

Due to incorrect processing Squid is vulnerable to a denial of service attack when receiving specially crafted HTCP packets.

This problem allows any machine to perform a denial of service attack on the Squid service when its HTCP port is open.

CVE-2010-0639 http://www.squid-cache.org/Advisories/SQUID-2010_2.txt 2010-02-12 2010-02-14 2010-05-02
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r262 linux-f8-flashplugin linux-f10-flashplugin 10.0r45

Adobe Product Security Incident Response Team reports:

A critical vulnerability has been identified in Adobe Flash Player version 10.0.42.34 and earlier. This vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. This update also resolves a potential Denial of Service issue (CVE-2010-0187).

CVE-2010-0186 CVE-2010-0187 http://www.adobe.com/support/security/bulletins/apsb10-06.html 2010-02-11 2010-02-13
gnome-screensaver -- Multiple monitor hotplug issues gnome-screensaver 2.28.3

Ray Strode reports:

Under certain circumstances it is possible to circumvent the security of screen locking functionality of gnome-screensaver by changing the systems physical monitor configuration.

gnome-screensaver can lose its keyboard grab when locked, exposing the system to intrusion by adding and removing monitors.

CVE-2010-0414 CVE-2010-0422 https://bugzilla.gnome.org/show_bug.cgi?id=609337 https://bugzilla.gnome.org/show_bug.cgi?id=609789 2010-02-08 2010-02-13
fetchmail -- heap overflow on verbose X.509 display fetchmail 6.3.116.3.14

Matthias Andree reports:

In verbose mode, fetchmail prints X.509 certificate subject and issuer information to the user, and counts and allocates a malloc() buffer for that purpose.

If the material to be displayed contains characters with high bit set and the platform treats the "char" type as signed, this can cause a heap buffer overrun because non-printing characters are escaped as \xFF..FFnn, where nn is 80..FF in hex.

38088 CVE-2010-0562 http://www.fetchmail.info/fetchmail-SA-2010-01.txt https://lists.berlios.de/pipermail/fetchmail-announce/2010-February/000073.html 2010-02-04 2010-02-12
wireshark -- LWRES vulnerability wireshark wireshark-lite 1.2.6

Wireshark project reports:

Babi discovered several buffer overflows in the LWRES dissector.

It may be possible to make Wireshark crash remotely or by convincing someone to read a malformed packet trace file.

CVE-2010-0304 http://secunia.com/advisories/38257/ http://www.wireshark.org/security/wnpa-sec-2010-02.html 2010-01-27 2010-02-10
otrs -- SQL injection otrs 2.4.7

OTRS Security Advisory reports:

Missing security quoting for SQL statements allows agents and customers to manipulate SQL queries. So it's possible for authenticated users to inject SQL queries via string manipulation of statements.

A malicious user may be able to manipulate SQL queries to read or modify records in the database. This way it could also be possible to get access to more permissions (e. g. administrator permissions).

To use this vulnerability the malicious user needs to have a valid Agent- or Customer-session.

CVE-2010-0438 http://otrs.org/advisory/OSA-2010-01-en/ 2010-02-08 2010-02-08 2010-05-02
apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long) apache 1.3.42 apache+mod_perl 1.3.42 apache+ipv6 1.3.42 apache_fp 0 ru-apache 1.3.42+30.23 ru-apache+mod_ssl 1.3.42 apache+ssl 1.3.42.1.57_2 apache+mod_ssl apache+mod_ssl+ipv6 apache+mod_ssl+mod_accel apache+mod_ssl+mod_accel+ipv6 apache+mod_ssl+mod_accel+mod_deflate apache+mod_ssl+mod_accel+mod_deflate+ipv6 apache+mod_ssl+mod_deflate apache+mod_ssl+mod_deflate+ipv6 apache+mod_ssl+mod_snmp apache+mod_ssl+mod_snmp+mod_accel apache+mod_ssl+mod_snmp+mod_accel+ipv6 apache+mod_ssl+mod_snmp+mod_deflate apache+mod_ssl+mod_snmp+mod_deflate+ipv6 apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 1.3.41+2.8.27_2

Apache ChangeLog reports:

Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0010 http://www.security-database.com/detail.php?alert=CVE-2010-0010 http://security-tracker.debian.org/tracker/CVE-2010-0010 http://www.vupen.com/english/Reference-CVE-2010-0010.php 2009-06-30 2010-02-03 2010-02-03
squid -- Denial of Service vulnerability in DNS handling squid 2.7.12.7.7_3 3.0.13.0.23 3.1.0.13.1.0.15_2

Squid security advisory 2010:1 reports:

Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted DNS packets.

This problem allows any trusted client or external server who can determine the squid receiving port to perform a short-term denial of service attack on the Squid service.

CVE-2010-0308 http://www.squid-cache.org/Advisories/SQUID-2010_1.txt 2010-01-14 2010-02-01 2010-05-02
bugzilla -- information leak bugzilla 3.3.13.4.5

A Bugzilla Security Advisory reports:

When moving a bug from one product to another, an intermediate page is displayed letting you select the groups the bug should be restricted to in the new product. However, a regression in the 3.4.x series made it ignore all groups which are not available in both products. As a workaround, you had to move the bug to the new product first and then restrict it to the desired groups, in two distinct steps, which could make the bug temporarily public.

CVE-2009-3387 http://www.bugzilla.org/security/3.0.10/ 2010-01-31 2010-02-01
irc-ratbox -- multiple vulnerabilities ircd-ratbox 2.2.9 ircd-ratbox-devel 3.0.6

SecurityFocus reports:

The first affects the /quote HELP module and allows a user to trigger an IRCD crash on some platforms.

The second affects the /links processing module when the flatten_links configuration option is not enabled.

CVE-2009-4016 CVE-2010-0300 http://www.debian.org/security/2010/dsa-1980 http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000890.html http://lists.ratbox.org/pipermail/ircd-ratbox/2010-January/000891.html 2010-01-25 2010-01-28
dokuwiki -- multiple vulnerabilities dokuwiki 20091225_2

Dokuwiki reports:

The plugin does no checks against cross-site request forgeries (CSRF) which can be exploited to e.g. change the access control rules by tricking a logged in administrator into visiting a malicious web site.

The bug allows listing the names of arbitrary file on the webserver - not their contents. This could leak private information about wiki pages and server structure.

CVE-2010-0288 CVE-2010-0287 CVE-2010-0289 http://bugs.splitbrain.org/index.php?do=details&task_id=1847 http://bugs.splitbrain.org/index.php?do=details&task_id=1853 2010-01-17 2010-01-18 2010-05-02
Zend Framework -- multiple vulnerabilities ZendFramework 1.9.7

The Zend Framework team reports:

Potential XSS or HTML Injection vector in Zend_Json.

Potential XSS vector in Zend_Service_ReCaptcha_MailHide.

Potential MIME-type Injection in Zend_File_Transfer Executive Summary.

Potential XSS vector in Zend_Filter_StripTags when comments allowed.

Potential XSS vector in Zend_Dojo_View_Helper_Editor.

Potential XSS vectors due to inconsistent encodings.

XSS vector in Zend_Filter_StripTags.

LFI vector in Zend_View::setScriptPath() and render().

http://framework.zend.com/security/advisory/ZF2010-06 http://framework.zend.com/security/advisory/ZF2010-05 http://framework.zend.com/security/advisory/ZF2010-04 http://framework.zend.com/security/advisory/ZF2010-03 http://framework.zend.com/security/advisory/ZF2010-02 http://framework.zend.com/security/advisory/ZF2010-01 http://framework.zend.com/security/advisory/ZF2009-02 http://framework.zend.com/security/advisory/ZF2009-01 2009-12-31 2010-01-11
powerdns-recursor -- multiple vulnerabilities powerdns-recursor 3.1.7.2

PowerDNS Security Advisory reports:

PowerDNS Recursor up to and including 3.1.7.1 can be brought down and probably exploited.

PowerDNS Recursor up to and including 3.1.7.1 can be spoofed into accepting bogus data

37650 37653 CVE-2009-4010 CVE-2009-4009 2010-01-06 2010-01-09
PEAR -- Net_Ping and Net_Traceroute remote arbitrary command injection pear-Net_Ping 2.4.5 pear-Net_Traceroute 0.21.2

PEAR Security Advisory reports:

Multiple remote arbitrary command injections have been found in the Net_Ping and Net_Traceroute.

When input from forms are used directly, the attacker could pass variables that would allow him to execute remote arbitrary command injections.

37093 37094 CVE-2009-4024 CVE-2009-4025 http://pear.php.net/advisory20091114-01.txt 2009-11-14 2010-01-04
drupal -- multiple cross-site scripting drupal5 5.21 drupal6 6.15

Drupal Team reports:

The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the contact module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access.

The Menu module does not correctly handle certain user input when displaying the menu administration overview. Users privileged to create new menus can insert arbitrary HTML and script code into the menu module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access.

CVE-2009-4370 http://drupal.org/node/661586 2009-12-16 2009-12-25 2010-05-02
fuser -- missing user's privileges check fuser 1142334561_2

Denis Barov reports:

sysutils/fuser allows user to send any signal to any process when installed with suid bit.

ports/141852 2009-09-15 2009-12-21
monkey -- improper input validation vulnerability monkey 0.9.3

Census Labs reports:

We have discovered a remotely exploitable "improper input validation" vulnerability in the Monkey web server that allows an attacker to perform denial of service attacks by repeatedly crashing worker threads that process HTTP requests.

http://census-labs.com/news/2009/12/14/monkey-httpd/ http://groups.google.com/group/monkeyd/browse_thread/thread/055b4e9b83973861/ 2009-12-14 2009-12-21
php -- multiple vulnerabilities php5 5.2.12

PHP developers reports:

This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.12:

  • Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)
  • Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)
  • Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion, identified by Bogdan Calin. (CVE-2009-4017, Ilia)
  • Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check, identified by Stefan Esser. (CVE-2009-4143, Stas)
  • Fixed bug #49785 (insufficient input string validation of htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot com)
CVE-2009-3557 CVE-2009-3558 CVE-2009-4017 CVE-2009-4142 CVE-2009-4143 http://www.php.net/releases/5_2_12.php 2009-12-17 2009-12-17
postgresql -- multiple vulnerabilities postgresql-client postgresql-server 7.47.4.27 8.08.0.23 8.18.1.19 8.28.2.15 8.38.3.9 8.48.4.2

PostgreSQL project reports:

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

CVE-2009-4034 CVE-2009-4136 2009-11-20 2009-12-17
tptest -- pwd Remote Stack Buffer Overflow tptest 0

SecurityFocus reports:

TPTEST is prone to a remote stack-based buffer-overflow vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

33785 2009-02-16 2009-12-17
mozilla -- multiple vulnerabilities firefox 3.5.*,13.5.6,1 3.*,13.0.16,1 linux-firefox 3.0.16,1 seamonkey linux-seamonkey 2.0.1 thunderbird 3.03.0.1

Mozilla Project reports:

MFSA 2009-71 GeckoActiveXObject exception messages can be used to enumerate installed COM objects

MFSA 2009-70 Privilege escalation via chrome window.opener

MFSA 2009-69 Location bar spoofing vulnerabilities

MFSA 2009-68 NTLM reflection vulnerability

MFSA 2009-67 Integer overflow, crash in libtheora video library

MFSA 2009-66 Memory safety fixes in liboggplay media library

MFSA 2009-65 Crashes with evidence of memory corruption (rv:1.9.1.6/ 1.9.0.16)

CVE-2009-3388 CVE-2009-3389 CVE-2009-3979 CVE-2009-3980 CVE-2009-3981 CVE-2009-3982 CVE-2009-3983 CVE-2009-3984 CVE-2009-3985 CVE-2009-3986 http://www.mozilla.org/security/announce/2009/mfsa2009-71.html http://www.mozilla.org/security/announce/2009/mfsa2009-70.html http://www.mozilla.org/security/announce/2009/mfsa2009-69.html http://www.mozilla.org/security/announce/2009/mfsa2009-68.html http://www.mozilla.org/security/announce/2009/mfsa2009-67.html http://www.mozilla.org/security/announce/2009/mfsa2009-66.html http://www.mozilla.org/security/announce/2009/mfsa2009-65.html 2009-12-16 2009-12-16 2010-01-21
freeradius -- remote packet of death vulnerability freeradius 1.1.8

freeRADIUS Vulnerability Notifications reports:

2009.09.09 v1.1.7 - Anyone who can send packets to the server can crash it by sending a Tunnel-Password attribute in an Access-Request packet. This vulnerability is not otherwise exploitable. We have released 1.1.8 to correct this vulnerability.

This issue is similar to the previous Tunnel-Password issue noted below. The vulnerable versions are 1.1.3 through 1.1.7. Version 2.x is not affected.

CVE-2009-3111 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3111 http://freeradius.org/security.html http://www.milw0rm.com/exploits/9642 2009-09-09 2009-12-14 2009-12-14
pligg -- Cross-Site Scripting and Cross-Site Request Forgery pligg 1.0.3b

secunia reports:

Russ McRee has discovered some vulnerabilities in Pligg, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.

Input passed via the "Referer" HTTP header to various scripts (e.g. admin/admin_config.php, admin/admin_modules.php, delete.php, editlink.php, submit.php, submit_groups.php, user_add_remove_links.php, and user_settings.php) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. create an arbitrary user with administrative privileges if a logged-in administrative user visits a malicious web site.

CVE-2009-4786 CVE-2009-4787 CVE-2009-4788 http://secunia.com/advisories/37349/ http://www.pligg.com/blog/775/pligg-cms-1-0-3-release/ 2009-12-02 2009-12-12 2010-05-02
piwik -- php code execution piwik 0.5.1

secunia reports:

Stefan Esser has reported a vulnerability in Piwik, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the core/Cookie.php script using "unserialize()" with user controlled input. This can be exploited to e.g. execute arbitrary PHP code via the "__wakeup()" or "__destruct()" methods of a serialized object passed via an HTTP cookie.

CVE-2009-4137 http://secunia.com/advisories/37649/ http://www.sektioneins.de/de/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/index.html http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/ 2009-12-10 2009-12-11 2010-05-02
dovecot -- Insecure directory permissions dovecot 1.2.*1.2.8

Dovecot author reports:

Dovecot v1.2.x had been creating base_dir (and its parents if necessary) with 0777 permissions. The base_dir's permissions get changed to 0755 automatically at startup, but you may need to chmod the parent directories manually.

CVE-2009-3897 37084 http://secunia.com/advisories/37443 2009-11-20 2009-12-10
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r260 linux-f8-flashplugin linux-f10-flashplugin 10.0r42

Adobe Product Security Incident Response Team reports:

Critical vulnerabilities have been identified in Adobe Flash Player version 10.0.32.18 and earlier. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

CVE-2009-3794 CVE-2009-3796 CVE-2009-3797 CVE-2009-3798 CVE-2009-3799 CVE-2009-3800 CVE-2009-3951 http://www.zerodayinitiative.com/advisories/ZDI-09-092/ http://www.zerodayinitiative.com/advisories/ZDI-09-093/ http://www.adobe.com/support/security/bulletins/apsb09-19.html 2009-07-14 2009-12-09
ruby -- heap overflow vulnerability ruby 1.9.1,11.9.1.376,1

The official ruby site reports:

There is a heap overflow vulnerability in String#ljust, String#center and String#rjust. This has allowed an attacker to run arbitrary code in some rare cases.

CVE-2009-4124 http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/ 2009-11-30 2009-12-09
rt -- Session fixation vulnerability rt 3.8.6

Secunia reports:

A vulnerability has been reported in RT, which can be exploited by malicious people to conduct session fixation attacks. The vulnerability is caused due to an error in the handling of sessions and can be exploited to hijack another user's session by tricking the user into logging in after following a specially crafted link.

37162 CVE-2009-3585 2009-12-01 2009-12-09
expat2 -- Parser crash with specially formatted UTF-8 sequences expat2 linux-f10-expat 2.0.1_1

CVE reports:

The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read.

CVE-2009-3720 2009-01-17 2009-12-08
expat2 -- buffer over-read and crash expat2 2.0.1_1

CVE reports:

The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c.

CVE-2009-3560 2009-10-05 2009-12-08
opera -- multiple vulnerabilities opera 10.10.20091120 linux-opera 10.10

Opera Team reports:

  • Fixed a heap buffer overflow in string to number conversion
  • Fixed an issue where error messages could leak onto unrelated sites
  • Fixed a moderately severe issue, as reported by Chris Evans of the Google Security Team; details will be disclosed at a later date.
CVE-2009-0689 CVE-2009-4071 http://www.opera.com/support/kb/view/941/ http://www.opera.com/support/kb/view/942/ 2009-11-23 2009-12-01 2010-05-02
libtool -- Library Search Path Privilege Escalation Issue libtool 2.2.6b

Secunia.com

Do not attempt to load an unqualified module.la file from the current directory (by default) since doing so is insecure and is not compliant with the documentation.

CVE-2009-3736 http://secunia.com/advisories/37414/ http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html 2009-11-25 2009-11-28 2010-05-02
libvorbis -- multiple vulnerabilities libvorbis 1.2.3_1,3

The Ubuntu security team reports:

It was discovered that libvorbis did not correctly handle certain malformed vorbis files. If a user were tricked into opening a specially crafted vorbis file with an application that uses libvorbis, an attacker could cause a denial of service or possibly execute arbitrary code with the user's privileges.

CVE-2008-1420 CVE-2009-3379 2009-11-24 2009-11-24
bugzilla -- information leak bugzilla 3.3.13.4.4

A Bugzilla Security Advisory reports:

When a bug is in a group, none of its information (other than its status and resolution) should be visible to users outside that group. It was discovered that as of 3.3.2, Bugzilla was showing the alias of the bug (a very short string used as a shortcut for looking up the bug) to users outside of the group, if the protected bug ended up in the "Depends On" or "Blocks" list of any other bug.

CVE-2009-3386 http://www.bugzilla.org/security/3.4.3/ 2009-11-18 2009-11-23
cacti -- cross-site scripting issues cacti 0.8.7e4

The cacti development team reports:

The Cross-Site Scripting patch has been posted.

This patch addresses cross-site scripting issues reported by Moritz Naumann.

CVE-2009-4032 http://docs.cacti.net/#cross-site_scripting_fixes 2009-11-21 2009-11-23 2010-05-02
wordpress -- multiple vulnerabilities wordpress 2.8.6,1 de-wordpress 2.8.6

secunia reports:

The security issue is caused due to the wp_check_filetype() function in /wp-includes/functions.php improperly validating uploaded files. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script with multiple extensions.

Successful exploitation of this vulnerability requires that Apache is not configured to handle the mime-type for media files with an e.g. "gif", "jpg", "png", "tif", "wmv" extension.

Input passed via certain parameters to press-this.php is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

CVE-2009-3890 CVE-2009-3891 http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/ http://secunia.com/advisories/37332/ 2009-11-12 2009-11-14 2010-05-02
p5-HTML-Parser -- denial of service p5-HTML-Parser 3.63

CVE reports:

The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.

36807 CVE-2009-3627 http://secunia.com/advisories/37155 2009-10-23 2009-11-06
gd -- '_gdGetColors' remote buffer overflow vulnerability gd 2.0.35_2,1 php5-gd 5.2.11_2 php4-gd 4.4.9_4

CVE reports:

The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.0, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293.

36712 CVE-2009-3546 http://secunia.com/advisories/37069 http://secunia.com/advisories/37080 2009-10-15 2009-11-05 2010-06-17
typo3 -- multiple vulnerabilities in TYPO3 Core typo3 4.2.10

TYPO3 develop team reports:

Affected versions: TYPO3 versions 4.0.13 and below, 4.1.12 and below, 4.2.9 and below, 4.3.0beta1 and below.

SQL injection, Cross-site scripting (XSS), Information disclosure, Frame hijacking, Remote shell command execution and Insecure Install Tool authentication/session handling.

36801 CVE-2009-3628 CVE-2009-3629 CVE-2009-3630 CVE-2009-3631 CVE-2009-3632 CVE-2009-3633 CVE-2009-3634 CVE-2009-3635 CVE-2009-3636 http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/ http://secunia.com/advisories/37122/ 2009-10-22 2009-11-05
vlc -- stack overflow in MPA, AVI and ASF demuxer vlc 0.5.01.0.2

VideoLAN reports:

When parsing a MP4, ASF or AVI file with an overly deep box structure, a stack overflow might occur. It would overwrite the return address and thus redirect the execution flow.

If successful, a malicious third party could trigger execution of arbitrary code within the context of the VLC media player.

http://www.videolan.org/security/sa0901.html 2009-09-14 2009-11-03
KDE -- multiple vulnerabilities kdebase-runtime 4.0.*4.3.1_2 kdelibs 4.0.*4.3.1_5

oCERT reports:

Ark input sanitization errors: The KDE archiving tool, Ark, performs insufficient validation which leads to specially crafted archive files, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites.

IO Slaves input sanitization errors: KDE protocol handlers perform insufficient input validation, an attacker can craft malicious URI that would trigger JavaScript execution. Additionally the 'help://' protocol handler suffer from directory traversal. It should be noted that the scope of this issue is limited as the malicious URIs cannot be embedded in Internet hosted content.

KMail input sanitization errors: The KDE mail client, KMail, performs insufficient validation which leads to specially crafted email attachments, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites.

The exploitation of these vulnerabilities is unlikely according to Portcullis and KDE but the execution of active content is nonetheless unexpected and might pose a threat.

http://www.ocert.org/advisories/ocert-2009-015.html 2009-10-30 2009-11-02
opera -- multiple vulnerabilities opera 10.01.20091019 linux-opera 10.01

Opera Team Reports:

  • Fixed an issue where certain domain names could allow execution of arbitrary code, as reported by Chris Weber of Casaba Security
  • Fixed an issue where scripts can run on the feed subscription page, as reported by Inferno
CVE-2009-3831 http://www.opera.com/support/kb/view/938/ http://www.opera.com/support/kb/view/939/ 2009-10-28 2009-10-31 2010-05-02
Enhanced cTorrent -- stack-based overflow ctorrent 3.3.2_2

Securityfocus reports:

cTorrent and dTorrent are prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Successful exploits allow remote attackers to execute arbitrary machine code in the context of a vulnerable application. Failed exploit attempts will likely result in denial-of-service conditions.

34584 CVE-2009-1759 http://sourceforge.net/tracker/?func=detail&aid=2782875&group_id=202532&atid=981959 2009-10-15 2009-10-28
mozilla -- multiple vulnerabilities firefox 3.5.*,13.5.4,1 3.*,13.0.15,1 linux-firefox 3.0.15 seamonkey linux-seamonkey 2.0

Mozilla Foundation reports:

MFSA 2009-64 Crashes with evidence of memory corruption (rv:1.9.1.4/ 1.9.0.15)

MFSA 2009-63 Upgrade media libraries to fix memory safety bugs

MFSA 2009-62 Download filename spoofing with RTL override

MFSA 2009-61 Cross-origin data theft through document.getSelection()

MFSA 2009-59 Heap buffer overflow in string to number conversion

MFSA 2009-57 Chrome privilege escalation in XPCVariant::VariantDataToJS()

MFSA 2009-56 Heap buffer overflow in GIF color map parser

MFSA 2009-55 Crash in proxy auto-configuration regexp parsing

MFSA 2009-54 Crash with recursive web-worker calls

MFSA 2009-53 Local downloaded file tampering

MFSA 2009-52 Form history vulnerable to stealing

CVE-2009-3380 CVE-2009-3381 CVE-2009-3382 CVE-2009-3383 CVE-2009-3379 CVE-2009-3378 CVE-2009-3377 CVE-2009-3376 CVE-2009-3375 CVE-2009-1563 CVE-2009-3374 CVE-2009-3373 CVE-2009-3372 CVE-2009-3371 CVE-2009-3274 CVE-2009-3370 http://www.mozilla.org/security/announce/2009/mfsa2009-64.html http://www.mozilla.org/security/announce/2009/mfsa2009-63.html http://www.mozilla.org/security/announce/2009/mfsa2009-62.html http://www.mozilla.org/security/announce/2009/mfsa2009-61.html http://www.mozilla.org/security/announce/2009/mfsa2009-59.html http://www.mozilla.org/security/announce/2009/mfsa2009-57.html http://www.mozilla.org/security/announce/2009/mfsa2009-56.html http://www.mozilla.org/security/announce/2009/mfsa2009-55.html http://www.mozilla.org/security/announce/2009/mfsa2009-54.html http://www.mozilla.org/security/announce/2009/mfsa2009-53.html http://www.mozilla.org/security/announce/2009/mfsa2009-52.html 2009-10-27 2009-10-28 2009-12-14
elinks -- buffer overflow vulnerability elinks 0.11.4

SecurityFocus reports:

ELinks is prone to an off-by-one buffer-overflow vulnerability because the application fails to accurately reference the last element of a buffer.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

36574 CVE-2008-7224 http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347 2006-07-29 2009-10-25
squidGuard -- multiple vulnerabilities squidGuard 1.4_2

SquidGuard website reports:

Patch 20091015 fixes one buffer overflow problem in sgLog.c when overlong URLs are requested. SquidGuard will then go into emergency mode were no blocking occurs. This is not required in this situation.

Patch 20091019 fixes two bypass problems with URLs which length is close to the limit defined by MAX_BUF (default: 4096) in squidGuard and MAX_URL (default: 4096 in squid 2.x and 8192 in squid 3.x) in squid. For this kind of URLs the proxy request exceeds MAX_BUF causing squidGuard to complain about not being able to parse the squid request. Increasing the buffer limit to be higher than the one defined in MAX_URL solves the issue.

CVE-2009-3700 CVE-2009-3826 http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091015 http://www.squidguard.org/Downloads/Patches/1.4/Readme.Patch-20091019 2009-10-15 2009-10-22 2010-05-06
Xpdf -- Multiple Vulnerabilities xpdf 3.02_11

SecurityFocus reports:

Some vulnerabilities have been reported in Xpdf, which can be exploited by malicious people to potentially compromise a user's system.

1) Multiple integer overflows in "SplashBitmap::SplashBitmap()" can be exploited to cause heap-based buffer overflows.

2) An integer overflow error in "ObjectStream::ObjectStream()" can be exploited to cause a heap-based buffer overflow.

3) Multiple integer overflows in "Splash::drawImage()" can be exploited to cause heap-based buffer overflows.

4) An integer overflow error in "PSOutputDev::doImageL1Sep()" can be exploited to cause a heap-based buffer overflow when converting a PDF document to a PS file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code by tricking a user into opening a specially crafted PDF file.

http://www.securityfocus.com/archive/1/507261 http://secunia.com/advisories/37053/ 2009-10-14 2009-10-20
django -- denial-of-service attack py23-django py24-django py25-django py26-django py30-django py31-django 1.1.1 py23-django-devel py24-django-devel py25-django-devel py26-django-devel py30-django-devel py31-django-devel 11603,1

Django project reports:

Django's forms library includes field types which perform regular-expression-based validation of email addresses and URLs. Certain addresses/URLs could trigger a pathological performance case in these regular expression, resulting in the server process/thread becoming unresponsive, and consuming excessive CPU over an extended period of time. If deliberately triggered, this could result in an effectively denial-of-service attack.

CVE-2009-3695 http://www.djangoproject.com/weblog/2009/oct/09/security/ 2009-10-09 2009-10-16 2010-05-02
phpmyadmin -- XSS and SQL injection vulnerabilities phpMyAdmin 3.2.2.1 phpMyAdmin211 2.11.9.6

phpMyAdmin Team reports:

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted MySQL table name.

SQL injection vulnerability allows remote attackers to inject SQL via various interface parameters of the PDF schema generator feature.

CVE-2009-3696 CVE-2009-3697 http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php 2009-10-13 2009-10-13
php5 -- Multiple security issues php5 5.2.11

Vendor reports

Security Enhancements and Fixes in PHP 5.2.11: Fixed certificate validation inside php_openssl_apply_verification_policy. Fixed sanity check for the color index in imagecolortransparent. Added missing sanity checks around exif processing. Fixed bug 44683 popen crashes when an invalid mode is passed.

http://www.php.net/releases/5_2_11.php CVE-2009-3291 CVE-2009-3292 CVE-2009-3293 2009-09-17 2009-10-12
virtualbox -- privilege escalation virtualbox 3.0.51.r22902_2

Sun reports:

A security vulnerability in the VBoxNetAdpCtl configuration tool for certain Sun VirtualBox 3.0 packages may allow local unprivileged users who are authorized to run VirtualBox to execute arbitrary commands with root privileges.

CVE-2009-3692 http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1 http://secunia.com/advisories/36929 2009-10-07 2009-10-07 2010-05-02
FreeBSD -- Devfs / VFS NULL pointer race condition FreeBSD 6.36.3_13 6.46.4_7 7.17.1_8 7.27.2_4

Problem Description:

Due to the interaction between devfs and VFS, a race condition exists where the kernel might dereference a NULL pointer.

Impact:

Successful exploitation of the race condition can lead to local kernel privilege escalation, kernel data corruption and/or crash.

To exploit this vulnerability, an attacker must be able to run code with user privileges on the target system.

Workaround:

An errata note, FreeBSD-EN-09:05.null has been released simultaneously to this advisory, and contains a kernel patch implementing a workaround for a more broad class of vulnerabilities. However, prior to those changes, no workaround is available.

SA-09:14.devfs 2009-10-02 2009-10-06
FreeBSD -- kqueue pipe race conditions FreeBSD 6.36.4_7 6.46.3_13

Problem Description

A race condition exists in the pipe close() code relating to kqueues, causing use-after-free for kernel memory, which may lead to an exploitable NULL pointer vulnerability in the kernel, kernel memory corruption, and other unpredictable results.

Impact:

Successful exploitation of the race condition can lead to local kernel privilege escalation, kernel data corruption and/or crash.

To exploit this vulnerability, an attacker must be able to run code on the target system.

Workaround

An errata notice, FreeBSD-EN-09:05.null has been released simultaneously to this advisory, and contains a kernel patch implementing a workaround for a more broad class of vulnerabilities. However, prior to those changes, no workaround is available.

SA-09:13.pipe 2009-10-02 2009-10-06
mybb -- multiple vulnerabilities mybb 1.4.9

mybb team reports:

Input passed via avatar extensions is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by uploading specially named avatars.

The script allows to sign up with usernames containing zero width space characters, which can be exploited to e.g. conduct spoofing attacks.

36460 http://dev.mybboard.net/issues/464 http://dev.mybboard.net/issues/418 http://secunia.com/advisories/36803 http://blog.mybboard.net/2009/09/21/mybb-1-4-9-released-security-update/ 2009-09-21 2009-09-30
drupal -- multiple vulnerabilities drupal5 5.20 drupal6 6.14

Drupal Team reports:

The core OpenID module does not correctly implement Form API for the form that allows one to link user accounts with OpenID identifiers. A malicious user is therefore able to use cross site request forgeries to add attacker controlled OpenID identities to existing accounts. These OpenID identities can then be used to gain access to the affected accounts.

The OpenID module is not a compliant implementation of the OpenID Authentication 2.0 specification. An implementation error allows a user to access the account of another user when they share the same OpenID 2.0 provider.

File uploads with certain extensions are not correctly processed by the File API. This may lead to the creation of files that are executable by Apache. The .htaccess that is saved into the files directory by Drupal should normally prevent execution. The files are only executable when the server is configured to ignore the directives in the .htaccess file.

Drupal doesn't regenerate the session ID when an anonymous user follows the one time login link used to confirm email addresses and reset forgotten passwords. This enables a malicious user to fix and reuse the session id of a victim under certain circumstances.

http://drupal.org/node/579482 http://secunia.com/advisories/36787/ http://secunia.com/advisories/36786/ http://secunia.com/advisories/36781/ http://secunia.com/advisories/36776/ http://secunia.com/advisories/36785/ 2009-09-17 2009-09-22
fwbuilder -- security issue in temporary file handling fwbuilder 3.0.7

Firewall Builder release notes reports:

Vadim Kurland (vadim.kurland@fwbuilder.org) reports:

Fwbuilder and libfwbuilder 3.0.4 through to 3.0.6 generate iptables scripts with a security issue when also used to generate static routing configurations.

CVE-2009-4664 http://www.fwbuilder.org/docs/firewall_builder_release_notes.html#3.0.7 2009-09-18 2009-09-18 2010-05-02
bugzilla -- two SQL injections, sensitive data exposure bugzilla 3.3.13.4.2

A Bugzilla Security Advisory reports:

  • It is possible to inject raw SQL into the Bugzilla database via the "Bug.create" and "Bug.search" WebService functions.
  • When a user would change his password, his new password would be exposed in the URL field of the browser if he logged in right after changing his password.
CVE-2009-3125 CVE-2009-3165 CVE-2009-3166 http://www.bugzilla.org/security/3.0.8/ 2009-09-11 2009-09-17
horde-base -- multiple vulnerabilities horde-base 3.3.5

The Horde team reports:

An error within the form library when handling image form fields can be exploited to overwrite arbitrary local files.

An error exists within the MIME Viewer library when rendering unknown text parts. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if malicious data is viewed.

The preferences system does not properly sanitise numeric preference types. This can be exploited to execute arbitrary HTML and script code in a user's browser session in contact of an affected site.

http://bugs.horde.org/ticket/?id=8311 http://bugs.horde.org/ticket/?id=8399 http://secunia.com/advisories/36665/ http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.558&r2=1.515.2.559 2009-05-28 2009-09-14 2009-09-22
nginx -- remote denial of service vulnerability nginx 0.7.62 nginx-devel 0.8.15

nginx development team reports:

A segmentation fault might occur in worker process while specially crafted request handling.

CVE-2009-2629 http://nginx.net/CHANGES http://lists.debian.org/debian-security-announce/2009/msg00205.html 2009-09-14 2009-09-14 2009-09-15
ikiwiki -- insufficient blacklisting in teximg plugin ikiwiki 3.1415926

The IkiWiki development team reports:

IkiWikis teximg plugin's blacklisting of insecure TeX commands is insufficient; it can be bypassed and used to read arbitrary files.

CVE-2009-2944 http://ikiwiki.info/security/#index35h2 2009-08-28 2009-09-13
xapian-omega -- cross-site scripting vulnerability xapian-omega 1.0.16

Olly Betts reports:

There's a cross-site scripting issue in Omega - exception messages don't currently get HTML entities escaped, but can contain CGI parameter values in some cases.

CVE-2009-2947 http://lists.xapian.org/pipermail/xapian-discuss/2009-September/007115.html 2009-09-09 2009-09-13
mozilla firefox -- multiple vulnerabilities firefox 3.5.*,13.5.3,1 3.*,13.0.13,1

Mozilla Foundation reports:

MFSA 2009-51 Chrome privilege escalation with FeedWriter

MFSA 2009-50 Location bar spoofing via tall line-height Unicode characters

MFSA 2009-49 TreeColumns dangling pointer vulnerability

MFSA 2009-48 Insufficient warning for PKCS11 module installation and removal

MFSA 2009-47 Crashes with evidence of memory corruption (rv:1.9.1.3/1.9.0.14)

CVE-2009-3069 CVE-2009-3070 CVE-2009-3071 CVE-2009-3072 CVE-2009-3073 CVE-2009-3074 CVE-2009-3075 CVE-2009-3076 CVE-2009-3077 CVE-2009-3078 CVE-2009-3079 http://www.mozilla.org/security/announce/2009/mfsa2009-47.html http://www.mozilla.org/security/announce/2009/mfsa2009-48.html http://www.mozilla.org/security/announce/2009/mfsa2009-49.html http://www.mozilla.org/security/announce/2009/mfsa2009-50.html http://www.mozilla.org/security/announce/2009/mfsa2009-51.html http://secunia.com/advisories/36671/2/ 2009-09-10 2009-09-10
cyrus-imapd -- Potential buffer overflow in Sieve cyrus-imapd 2.2.02.2.13_6 2.3.02.3.14_2

The Cyrus IMAP Server ChangeLog states:

Fixed CERT VU#336053 - Potential buffer overflow in Sieve.

CVE-2009-2632 36296 http://www.kb.cert.org/vuls/id/336053 http://www.debian.org/security/2009/dsa-1881 2009-09-02 2009-09-09 2009-09-14
silc-toolkit -- Format string vulnerabilities silc-toolkit 1.1.9

SILC Changlog reports:

An unspecified format string vulnerability exists in silc-toolkit.

CVE-2009-3051 http://silcnet.org/docs/changelog/SILC%20Toolkit%201.1.10 http://www.openwall.com/lists/oss-security/2009/09/03/5 2009-08-07 2009-09-08
opera -- multiple vulnerabilities opera 10.00.20090830 opera-devel 10.00.b3_1,1 linux-opera 10.00

Opera Team Reports:

  • Issue where sites using revoked intermediate certificates might be shown as secure
  • Issue where the collapsed address bar didn't show the current domain
  • Issue where pages could trick users into uploading files
  • Some IDNA characters not correctly displaying in the address bar
  • Issue where Opera accepts nulls and invalid wild-cards in certificates
http://www.opera.com/support/search/view/929/ http://www.opera.com/support/search/view/930/ http://www.opera.com/support/search/view/931/ http://www.opera.com/support/search/view/932/ http://www.opera.com/support/search/view/934/ 2009-09-01 2009-09-04 2009-10-29
dnsmasq -- TFTP server remote code injection vulnerability dnsmasq 2.50

Simon Kelley reports:

Fix security problem which allowed any host permitted to do TFTP to possibly compromise dnsmasq by remote buffer overflow when TFTP enabled.

Fix a problem which allowed a malicious TFTP client to crash dnsmasq.

36121 36120 CVE-2009-2957 CVE-2009-2958 http://www.coresecurity.com/content/dnsmasq-vulnerabilities https://rhn.redhat.com/errata/RHSA-2009-1238.html 2009-08-31 2009-09-02
apache22 -- several vulnerabilities apache 2.2.02.2.12

Apache ChangeLog reports:

CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.

CVE-2009-1195: Prevent the "Includes" Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.

CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.

CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.

CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).

CVE-2009-1891 CVE-2009-1195 CVE-2009-1890 CVE-2009-1191 CVE-2009-0023 CVE-2009-1955 CVE-2009-1956 2009-07-28 2009-08-25
pidgin -- MSN overflow parsing SLP messages pidgin libpurple finch 2.5.9

Secunia reports:

A vulnerability has been reported in Pidgin, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to an error in the "msn_slplink_process_msg()" function when processing MSN SLP messages and can be exploited to corrupt memory.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions 2.5.8 and prior. Other versions may also be affected.

CVE-2009-2694 http://secunia.com/advisories/36384/ http://www.pidgin.im/news/security/?id=34 2009-08-18 2009-08-20
GnuTLS -- multiple vulnerabilities gnutls 2.6.6 gnutls-devel 2.7.8

SecurityFocus reports:

GnuTLS is prone to multiple remote vulnerabilities:

  • A remote code-execution vulnerability.
  • A denial-of-service vulnerability.
  • A signature-generation vulnerability.
  • A signature-verification vulnerability.

An attacker can exploit these issues to potentially execute arbitrary code, trigger denial-of-service conditions, carry out attacks against data signed with weak signatures, and cause clients to accept expired or invalid certificates from servers.

CVE-2009-1415 CVE-2009-1416 CVE-2009-1417 34783 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 2009-05-21 2009-08-17
GnuTLS -- improper SSL certificate verification gnutls 2.8.3 gnutls-devel 2.9.0

GnuTLS reports:

By using a NUL byte in CN/SAN fields, it was possible to fool GnuTLS into 1) not printing the entire CN/SAN field value when printing a certificate and 2) cause incorrect positive matches when matching a hostname against a certificate.

CVE-2009-2730 http://article.gmane.org/gmane.network.gnutls.general/1733 http://secunia.com/advisories/36266 2009-08-11 2009-08-17
memcached -- memcached stats maps Information Disclosure Weakness memcached 1.2.8

Secunia reports:

A weakness has been reported in memcached, which can be exploited by malicious people to disclose system information.

The weakness is caused due to the application disclosing the content of /proc/self/maps if a stats maps command is received. This can be exploited to disclose e.g. the addresses of allocated memory regions.

CVE-2009-1255 http://secunia.com/advisories/34915/ 2009-04-29 2009-08-17
wordpress -- remote admin password reset vulnerability wordpress 2.8.4,1 de-wordpress 2.8.4 wordpress-mu 2.8.4a

WordPress reports:

A specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner.

CVE-2009-2762 http://wordpress.org/development/2009/08/2-8-4-security-release/ http://www.milw0rm.com/exploits/9410 2009-08-10 2009-08-12 2010-05-02
fetchmail -- improper SSL certificate subject verification fetchmail 6.3.11

Matthias Andree reports:

Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates.

Applications that would treat such X.509 strings as NUL-terminated C strings (rather than strings that contain an explicit length field) would only check the part up to and excluding the NUL character, so that certificate names such as www.good.example\0www.bad.example.com would be mistaken as a certificate name for www.good.example. fetchmail also had this design and implementation flaw.

CVE-2009-2666 http://www.fetchmail.info/fetchmail-SA-2009-01.txt 2009-08-06 2009-08-11 2009-08-13
joomla15 -- com_mailto Timeout Issue joomla15 1.5.14

Joomla! Security Center reports:

In com_mailto, it was possible to bypass timeout protection against sending automated emails.

http://developer.joomla.org/security.html http://secunia.com/advisories/36097/ 2009-07-22 2009-08-07 2009-08-11
subversion -- heap overflow vulnerability subversion subversion-freebsd p5-subversion py-subversion 1.6.4

A Subversion Security Advisory reports:

Subversion clients and servers have multiple heap overflow issues in the parsing of binary deltas. This is related to an allocation vulnerability in the APR library used by Subversion.

Clients with commit access to a vulnerable server can cause a remote heap overflow; servers can cause a heap overflow on vulnerable clients that try to do a checkout or update.

This can lead to a DoS (an exploit has been tested) and to arbitrary code execution (no exploit tested, but the possibility is clear).

CVE-2009-2411 http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt 2009-08-06 2009-08-06 2009-08-07
bugzilla -- product name information leak bugzilla 3.3.43.4.1

A Bugzilla Security Advisory reports:

Normally, users are only supposed to see products that they can file bugs against in the "Product" drop-down on the bug-editing page. Instead, users were being shown all products, even those that they normally could not see. Any user who could edit any bug could see all product names.

http://www.bugzilla.org/security/3.4/ 2009-07-30 2009-08-05
mozilla -- multiple vulnerabilities firefox linux-firefox 3.*,1 3.*,13.0.13,1 3.5.*,13.5.2,1 linux-firefox-devel 3.5.2 seamonkey linux-seamonkey 1.1.18 linux-seamonkey-devel 0 thunderbird linux-thunderbird 2.0.0.23

Mozilla Project reports:

MFSA 2009-38: Data corruption with SOCKS5 reply containing DNS name longer than 15 characters

MFSA 2009-42: Compromise of SSL-protected communication

MFSA 2009-43: Heap overflow in certificate regexp parsing

MFSA 2009-44: Location bar and SSL indicator spoofing via window.open() on invalid URL

MFSA 2009-45: Crashes with evidence of memory corruption (rv:1.9.1.2/1.9.0.13)

MFSA 2009-46: Chrome privilege escalation due to incorrectly cached wrapper

CVE-2009-2404 CVE-2009-2408 CVE-2009-2454 CVE-2009-2470 http://www.mozilla.org/security/announce/2009/mfsa2009-38.html http://www.mozilla.org/security/announce/2009/mfsa2009-42.html http://www.mozilla.org/security/announce/2009/mfsa2009-43.html http://www.mozilla.org/security/announce/2009/mfsa2009-44.html http://www.mozilla.org/security/announce/2009/mfsa2009-45.html http://www.mozilla.org/security/announce/2009/mfsa2009-46.html 2009-08-03 2009-08-04 2009-09-04
silc-client -- Format string vulnerability silc-client silc-irssi-client 1.1.8

SILC changelog reports:

An unspecified format string vulnerability exists in silc-client.

CVE-2009-3051 http://silcnet.org/docs/changelog/SILC%20Client%201.1.8 2009-07-31 2009-08-04 2010-05-02
SquirrelMail -- Plug-ins compromise squirrelmail-multilogin-plugin 2.3.42.3.4_2

Problem Description:

The SquirrelMail Web Server has been compromised, and three plugins are affected.

The port of squirrelmail-sasql-plugin is safe (right MD5), and change_pass is not in the FreeBSD ports tree, but multilogin has a wrong MD5.

http://sourceforge.net/mailarchive/message.php?msg_name=4A727634.3080008%40squirrelmail.org http://squirrelmail.org/index.php 2009-07-31 2009-08-02
BIND -- Dynamic update message remote DoS bind9 9.3.6.1.1 bind9-sdb-postgresql bind9-sdb-ldap 9.4.3.3 FreeBSD 6.36.3_12 6.46.4_6 7.17.1_7 7.27.2_3

Problem Description:

When named(8) receives a specially crafted dynamic update message an internal assertion check is triggered which causes named(8) to exit.

To trigger the problem, the dynamic update message must contains a record of type "ANY" and at least one resource record set (RRset) for this fully qualified domain name (FQDN) must exist on the server.

Impact:

An attacker which can send DNS requests to a nameserver can cause it to exit, thus creating a Denial of Service situation.

Workaround:

No generally applicable workaround is available, but some firewalls may be able to prevent nsupdate DNS packets from reaching the nameserver.

NOTE WELL: Merely configuring named(8) to ignore dynamic updates is NOT sufficient to protect it from this vulnerability.

CVE-2009-0696 SA-09:12.bind http://www.kb.cert.org/vuls/id/725188 https://www.isc.org/node/474 2009-07-28 2009-08-01 2009-08-04
mono -- XML signature HMAC truncation spoofing mono 2.4.2.2

Secunia reports:

A security issue has been reported in Mono, which can be exploited by malicious people to conduct spoofing attacks.

The security issue is caused due to an error when processing certain XML signatures.

CVE-2009-0217 http://secunia.com/advisories/35852/ http://www.kb.cert.org/vuls/id/466161 2009-07-15 2009-07-29
squid -- several remote denial of service vulnerabilities squid 3.0.13.0.17 3.1.0.13.1.0.12

Squid security advisory 2009:2 reports:

Due to incorrect buffer limits and related bound checks Squid is vulnerable to a denial of service attack when processing specially crafted requests or responses.

Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted responses.

These problems allow any trusted client or external server to perform a denial of service attack on the Squid service.

Squid-2.x releases are not affected.

CVE-2009-2621 CVE-2009-2622 http://www.squid-cache.org/Advisories/SQUID-2009_2.txt 2009-07-27 2009-07-27 2009-08-06
mozilla -- corrupt JIT state after deep return from native function firefox 3.5.*,13.5.1,1

Mozilla Project reports:

Firefox user zbyte reported a crash that we determined could result in an exploitable memory corruption problem. In certain cases after a return from a native function, such as escape(), the Just-in-Time (JIT) compiler could get into a corrupt state. This could be exploited by an attacker to run arbitrary code such as installing malware.

This vulnerability does not affect earlier versions of Firefox which do not support the JIT feature.

CVE-2009-2477 http://www.mozilla.org/security/announce/2009/mfsa2009-41.html http://www.kb.cert.org/vuls/id/443060 2009-07-16 2009-07-17 2010-05-02
isc-dhcp-client -- Stack overflow vulnerability isc-dhcp31-client 3.1.1 isc-dhcp30-client 3.0.7_1

US-CERT reports:

The ISC DHCP dhclient application contains a stack buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code with root privileges.

CVE-2009-0692 https://www.isc.org/node/468 http://secunia.com/advisories/35785 http://www.kb.cert.org/vuls/id/410676 2009-07-14 2009-07-15 2009-07-21
drupal -- multiple vulnerabilities drupal5 5.19 drupal6 6.13

The Drupal Security Team reports:

Cross-site scripting

The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

User signatures have no separate input format, they use the format of the comment with which they are displayed. A user will no longer be able to edit a comment when an administrator changes the comment's input format to a format that is not accessible to the user. However they will still be able to modify their signature, which will then be processed by the new input format.

If the new format is very permissive, via their signature, the user may be able to insert arbitrary HTML and script code into pages or, when the PHP filter is enabled for the new format, execute PHP code. This issue affects Drupal 6.x only.

When an anonymous user fails to login due to mistyping his username or password, and the page he is on contains a sortable table, the (incorrect) username and password are included in links on the table. If the user visits these links the password may then be leaked to external sites via the HTTP referer.

In addition, if the anonymous user is enticed to visit the site via a specially crafted URL while the Drupal page cache is enabled, a malicious user might be able to retrieve the (incorrect) username and password from the page cache.

CVE-2009-2372 CVE-2009-2374 CVE-2009-2373 http://drupal.org/node/507572 http://secunia.com/advisories/35681 2009-07-01 2009-07-13 2010-05-02
nfsen -- remote command execution nfsen 1.3.2

nfsen reports:

Due to double input checking, a remote command execution security bug exists in all NfSen versions 1.3 and 1.3.1. Users are requested to update to nfsen-1.3.2.

http://sourceforge.net/forum/forum.php?forum_id=967583 2009-06-18 2009-07-03
phpmyadmin -- XSS vulnerability phpMyAdmin 3.2.0.1

The phpMyAdmin project reports:

It was possible to conduct an XSS attack via a crafted SQL bookmark.

All 3.x releases on which the "bookmarks" feature is active are affected, previous versions are not.

CVE-2009-2284 http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php 2009-06-30 2009-06-30 2010-05-02
nagios -- Command Injection Vulnerability nagios 3.0.6_1 nagios2 2.12_3 nagios-devel 3.1.0_1

Secunia reports:

A vulnerability has been reported in Nagios, which can be exploited by malicious users to potentially compromise a vulnerable system.

Input passed to the "ping" parameter in statuswml.cgi is not properly sanitised before being used to invoke the ping command. This can be exploited to inject and execute arbitrary shell commands.

Successful exploitation requires access to the ping feature of the WAP interface.

CVE-2009-2288 http://secunia.com/advisories/35543 http://tracker.nagios.org/view.php?id=15 2009-05-29 2009-06-30 2009-07-13
tor-devel -- DNS resolution vulnerability tor-devel 0.2.1.15-rc

The Tor Project reports:

A malicious exit relay could convince a controller that the client's DNS question resolves to an internal IP address.

https://git.torproject.org/checkout/tor/master/ChangeLog 2009-06-20 2009-06-23
cscope -- multiple buffer overflows cscope 15.7a

Secunia reports:

Some vulnerabilities have been reported in Cscope, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to various boundary errors, which can be exploited to cause buffer overflows when parsing specially crafted files or directories.

34805 CVE-2009-0148 http://secunia.com/advisories/34978 2009-05-31 2009-06-16
cscope -- buffer overflow cscope 15.6

SecurityFocus reports:

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

34832 CVE-2009-1577 http://cscope.cvs.sourceforge.net/viewvc/cscope/cscope/src/find.c?view=log#rev1.19 2009-05-31 2009-06-16
joomla -- multiple vulnerabilities joomla15 1.5.11

Secunia reports:

Some vulnerabilities have been reported in Joomla!, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks.

Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site when the malicious data is displayed.

Certain unspecified input passed to the user view of the com_users core component is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Input passed via certain parameters to the "JA_Purity" template is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2009-1938 CVE-2009-1939 CVE-2009-1940 http://secunia.com/advisories/35278/ http://www.joomla.org/announcements/release-news/5235-joomla-1511-security-release-now-available.html 2009-06-03 2009-06-16 2010-05-02
pidgin -- multiple vulnerabilities pidgin libpurple finch 2.5.6

Secunia reports:

Some vulnerabilities and weaknesses have been reported in Pidgin, which can be exploited by malicious people to cause a DoS or to potentially compromise a user's system.

A truncation error in the processing of MSN SLP messages can be exploited to cause a buffer overflow.

A boundary error in the XMPP SOCKS5 "bytestream" server when initiating an outgoing file transfer can be exploited to cause a buffer overflow.

A boundary error exists in the implementation of the "PurpleCircBuffer" structure. This can be exploited to corrupt memory and cause a crash via specially crafted XMPP or Sametime packets.

A boundary error in the "decrypt_out()" function can be exploited to cause a stack-based buffer overflow with 8 bytes and crash the application via a specially crafted QQ packet.

35067 CVE-2009-1373 CVE-2009-1374 CVE-2009-1375 CVE-2009-1376 http://secunia.com/advisories/35194/ http://www.pidgin.im/news/security/?id=29 http://www.pidgin.im/news/security/?id=30 http://www.pidgin.im/news/security/?id=32 2009-06-03 2009-06-16
git -- denial of service vulnerability git 1.6.3.2_1

SecurityFocus reports:

Git is prone to a denial-of-service vulnerability because it fails to properly handle some client requests.

Attackers can exploit this issue to cause a daemon process to enter an infinite loop. Repeated exploits may consume excessive system resources, resulting in a denial of service condition.

35338 CVE-2009-2108 https://www.redhat.com/archives/fedora-security-list/2009-June/msg00000.html http://article.gmane.org/gmane.comp.version-control.git/120724 2009-06-04 2009-06-15 2010-05-02
ruby -- BigDecimal denial of service vulnerability ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.7.160_1,1

The official ruby site reports:

A denial of service (DoS) vulnerability was found on the BigDecimal standard library of Ruby. Conversion from BigDecimal objects into Float numbers had a problem which enables attackers to effectively cause segmentation faults.

An attacker can cause a denial of service by causing BigDecimal to parse an insanely large number, such as:

BigDecimal("9E69999999").to_s("F")

35278 CVE-2009-1904 http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/ 2009-06-09 2009-06-13 2010-05-02
mozilla -- multiple vulnerabilities firefox 2.0.0.20_8,1 3.*,13.0.11,1 linux-firefox linux-firefox-devel 3.0.11 thunderbird linux-thunderbird 2.0.0.22 seamonkey linux-seamonkey 1.1.17

Mozilla Foundation reports:

MFSA 2009-32 JavaScript chrome privilege escalation

MFSA 2009-31 XUL scripts bypass content-policy checks

MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar

MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null

MFSA 2009-28 Race condition while accessing the private data of a NPObject JS wrapper class object

MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests

MFSA 2009-26 Arbitrary domain cookie access by local file: resources

MFSA 2009-25 URL spoofing with invalid unicode characters

MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)

CVE-2009-1392 CVE-2009-1832 CVE-2009-1833 CVE-2009-1834 CVE-2009-1835 CVE-2009-1836 CVE-2009-1837 CVE-2009-1838 CVE-2009-1839 CVE-2009-1840 CVE-2009-1841 http://www.mozilla.org/security/announce/2009/mfsa2009-24.html http://www.mozilla.org/security/announce/2009/mfsa2009-25.html http://www.mozilla.org/security/announce/2009/mfsa2009-26.html http://www.mozilla.org/security/announce/2009/mfsa2009-27.html http://www.mozilla.org/security/announce/2009/mfsa2009-28.html http://www.mozilla.org/security/announce/2009/mfsa2009-29.html http://www.mozilla.org/security/announce/2009/mfsa2009-30.html http://www.mozilla.org/security/announce/2009/mfsa2009-31.html http://www.mozilla.org/security/announce/2009/mfsa2009-32.html http://secunia.com/advisories/35331/ 2009-06-11 2009-06-12 2009-12-12
apr -- multiple vulnerabilities apr 1.3.5.1.3.7 apache 2.2.02.2.11_5 2.0.02.0.63_3

Secunia reports:

Some vulnerabilities have been reported in APR-util, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service).

A vulnerability is caused due to an error in the processing of XML files and can be exploited to exhaust all available memory via a specially crafted XML file containing a predefined entity inside an entity definition.

A vulnerability is caused due to an error within the "apr_strmatch_precompile()" function in strmatch/apr_strmatch.c, which can be exploited to crash an application using the library.

RedHat reports:

A single NULL byte buffer overflow flaw was found in apr-util's apr_brigade_vprintf() function.

35221 CVE-2009-1955 CVE-2009-1956 CVE-2009-0023 http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3 http://secunia.com/advisories/35284/ https://bugzilla.redhat.com/show_bug.cgi?id=3D504390 2009-06-05 2009-06-08
dokuwiki -- Local File Inclusion with register_globals on dokuwiki 20090214_2 dokuwiki-devel 0

DokuWiki reports:

A security hole was discovered which allows an attacker to include arbitrary files located on the attacked DokuWiki installation. The included file is executed in the PHP context. This can be escalated by introducing malicious code through uploading file via the media manager or placing PHP code in editable pages.

CVE-2009-1960 http://bugs.splitbrain.org/index.php?do=details&task_id=1700 2009-05-26 2009-06-04 2010-05-02
openssl -- denial of service in DTLS implementation openssl 0.9.80.9.8k_1 linux-f10-openssl 0.9.8f0.9.8m

Secunia reports:

Some vulnerabilities have been reported in OpenSSL, which can be exploited by malicious people to cause a DoS.

The library does not limit the number of buffered DTLS records with a future epoch. This can be exploited to exhaust all available memory via specially crafted DTLS packets.

An error when processing DTLS messages can be exploited to exhaust all available memory by sending a large number of out of sequence handshake messages.

CVE-2009-1377 CVE-2009-1378 http://secunia.com/advisories/35128/ 2009-05-18 2009-05-30 2014-04-10
eggdrop -- denial of service vulnerability eggdrop 1.6.19_2

Secunia reports:

The vulnerability is caused due to an error in the processing of private messages within the server module (/mod/server.mod/servrmsg.c). This can be exploited to cause a crash by sending a specially crafted message to the bot.

34985 CVE-2009-1789 http://www.eggheads.org/news/2009/05/14/35 http://secunia.com/advisories/35104/ 2009-05-15 2009-05-30
wireshark -- PCNFSD Dissector Denial of Service Vulnerability ethereal ethereal-lite tethereal tethereal-lite wireshark wireshark-lite 1.0.8

Secunia reports:

A vulnerability has been reported in Wireshark, which can be exploited by malicious people to cause a DoS.

The vulnerability is caused due to an error in the PCNFSD dissector and can be exploited to cause a crash via a specially crafted PCNFSD packet.

CVE-2009-1829 http://secunia.com/advisories/35201/ http://www.wireshark.org/security/wnpa-sec-2009-03.html 2009-05-21 2009-05-30 2010-05-02
libsndfile -- multiple vulnerabilities libsndfile 1.0.20

Secunia reports:

Two vulnerabilities have been reported in libsndfile, which can be exploited by malicious people to compromise an application using the library.

A boundary error exists within the "voc_read_header()" function in src/voc.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted VOC file.

A boundary error exists within the "aiff_read_header()" function in src/aiff.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted AIFF file.

CVE-2009-1788 CVE-2009-1791 http://secunia.com/advisories/35076/ http://www.trapkit.de/advisories/TKADV2009-006.txt 2009-05-15 2009-05-30
slim -- local disclosure of X authority magic cookie slim 1.3.1_3

Secunia reports:

A security issue has been reported in SLiM, which can be exploited by malicious, local users to disclose sensitive information.

The security issue is caused due to the application generating the X authority file by passing the X authority cookie via the command line to "xauth". This can be exploited to disclose the X authority cookie by consulting the process list and e.g. gain access the user's display.

35015 CVE-2009-1756 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529306 2009-05-20 2009-05-30
ntp -- stack-based buffer overflow ntp 4.2.4p7

US-CERT reports:

ntpd contains a stack buffer overflow which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system or create a denial of service.

35017 CVE-2009-0159 CVE-2009-1252 http://www.kb.cert.org/vuls/id/853097 2009-05-06 2009-05-20
imap-uw -- University of Washington IMAP c-client Remote Format String Vulnerability imap-uw 2007e

SecurityFocus reports:

University of Washington IMAP c-client is prone to a remote format-string vulnerability because the software fails to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function.

33795 2009-02-17 2009-05-21 2009-05-22
nsd -- buffer overflow vulnerability nsd 3.2.2 nsd2 2.3.7_1

NLnet Labs:

A one-byte buffer overflow has been reported in NSD. The problem affects all versions 2.0.0 to 3.2.1. The bug allows a carefully crafted exploit to bring down your DNS server. It is highly unlikely that this one byte overflow can lead to other (system) exploits.

CVE-2009-1755 http://www.nlnetlabs.nl/publications/NSD_vulnerability_announcement.html 2009-05-19 2009-05-19 2009-05-22
libxine -- multiple vulnerabilities libxine 1.1.16.3

xine developers report:

  • Fix another possible int overflow in the 4XM demuxer. (ref. TKADV2009-004, CVE-2009-0385)
  • Fix an integer overflow in the Quicktime demuxer.
CVE-2009-0385 CVE-2009-1274 http://trapkit.de/advisories/TKADV2009-004.txt http://trapkit.de/advisories/TKADV2009-005.txt http://sourceforge.net/project/shownotes.php?release_id=660071 2009-04-04 2009-05-17
libxine -- multiple vulnerabilities libxine 1.1.16.2

Multiple vulnerabilities were fixed in libxine 1.1.16.2.

Tobias Klein reports:

FFmpeg contains a type conversion vulnerability while parsing malformed 4X movie files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of FFmpeg or an application using the FFmpeg library.

Note: A similar issue also affects xine-lib < version 1.1.16.2.

xine developers report:

  • Fix broken size checks in various input plugins (ref. CVE-2008-5239).
  • More malloc checking (ref. CVE-2008-5240).
CVE-2009-0698 CVE-2008-5234 CVE-2008-5240 http://trapkit.de/advisories/TKADV2009-004.txt http://sourceforge.net/project/shownotes.php?release_id=660071 2009-02-15 2009-05-17
php -- ini database truncation inside dba_replace() function php4-dba 4.4.9_1 php5-dba 5.2.7

securityfocus research reports:

A bug that leads to the emptying of the INI file contents if the database key was not found exists in PHP dba extension in versions 5.2.6, 4.4.9 and earlier.

Function dba_replace() are not filtering strings key and value. There is a possibility for the destruction of the file.

CVE-2008-7068 http://www.securityfocus.com/archive/1/498746/30/0/threaded http://securityreason.com/achievement_securityalert/58 2008-11-28 2009-05-16 2013-06-16
libwmf -- embedded GD library Use-After-Free vulnerability libwmf 0.2.8.4_3

Secunia reports:

A vulnerability has been reported in libwmf, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise an application using the library.

The vulnerability is caused due to a use-after-free error within the embedded GD library, which can be exploited to cause a crash or potentially to execute arbitrary code via a specially crafted WMF file.

34792 CVE-2009-1364 https://bugzilla.redhat.com/show_bug.cgi?id=496864 https://rhn.redhat.com/errata/RHSA-2009-0457.html http://secunia.com/advisories/34901/ 2009-05-05 2009-05-16
libwmf -- integer overflow vulnerability libwmf 0.2.8.4_3

Secunia reports:

infamous41md has reported a vulnerability in libwmf, which potentially can be exploited by malicious people to compromise an application using the vulnerable library.

The vulnerability is caused due to an integer overflow error when allocating memory based on a value taken directly from a WMF file without performing any checks. This can be exploited to cause a heap-based buffer overflow when a specially crafted WMF file is processed.

18751 CVE-2006-3376 http://secunia.com/advisories/20921/ 2006-07-03 2009-05-16
moinmoin -- cross-site scripting vulnerabilities moinmoin 1.8.3

Secunia reports:

Input passed via multiple parameters to action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

CVE-2009-1482 http://secunia.com/advisories/34821/ http://moinmo.in/SecurityFixes 2009-04-21 2009-05-16
mod_perl -- cross-site scripting mod_perl 1.31 mod_perl2 2.05

Secunia reports:

Certain input passed to the "Apache::Status" and "Apache2::Status" modules is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected website.

CVE-2009-0796 http://secunia.com/advisories/34597 2009-02-28 2009-05-16 2009-05-16
drupal -- cross-site scripting drupal5 5.18 drupal6 6.12

The Drupal Security Team reports:

When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.

Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the <meta http-equiv="Content-Type" /> tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This enables attackers to execute cross site scripting attacks with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting contained an incomplete fix for the issue. HTML exports of books are still vulnerable, which means that anyone with edit permissions for pages in outlines is able to insert arbitrary HTML and script code in these exports.

Additionally, the taxonomy module allows users with the 'administer taxonomy' permission to inject arbitrary HTML and script code in the help text of any vocabulary.

http://drupal.org/node/461886 http://secunia.com/advisories/35045 2009-05-13 2009-05-14 2009-05-16
cyrus-sasl -- buffer overflow vulnerability cyrus-sasl 2.1.23

US-CERT reports:

The sasl_encode64() function converts a string into base64. The Cyrus SASL library contains buffer overflows that occur because of unsafe use of the sasl_encode64() function.

CVE-2009-0688 http://www.kb.cert.org/vuls/id/238019 2009-04-08 2009-05-15
moinmoin -- multiple cross site scripting vulnerabilities moinmoin 1.8.2

Secunia reports:

Some vulnerabilities have been reported in MoinMoin, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to multiple parameters in action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

Certain input passed to security/antispam.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

CVE-2009-0260 CVE-2009-0312 http://moinmo.in/SecurityFixes http://secunia.com/advisories/33593 2009-01-21 2009-05-13
ghostscript -- buffer overflow vulnerability ghostscript8 ghostscript8-nox11 8.64

SecurityFocus reports:

Ghostscript is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it into a finite-sized buffer.

Exploiting this issue allows remote attackers to overwrite a sensitive memory buffer with arbitrary data, potentially allowing them to execute malicious machine code in the context of the affected application. This vulnerability may facilitate the compromise of affected computers.

34340 CVE-2008-6679 2009-02-03 2009-05-13
pango -- integer overflow pango linux-pango linux-f8-pango linux-f10-pango 1.24

oCERT reports:

Pango suffers from a multiplicative integer overflow which may lead to a potentially exploitable, heap overflow depending on the calling conditions.

For example, this vulnerability is remotely reachable in Firefox by creating an overly large document.location value but only results in a process-terminating, allocation error (denial of service).

The affected function is pango_glyph_string_set_size. An overflow check when doubling the size neglects the overflow possible on the subsequent allocation.

34870 CVE-2009-1194 http://secunia.com/advisories/35021/ 2009-02-22 2009-05-13 2009-10-01
wireshark -- multiple vulnerabilities ethereal ethereal-lite tethereal tethereal-lite wireshark wireshark-lite 1.0.7

Wireshark team reports:

Wireshark 1.0.7 fixes the following vulnerabilities:

  • The PROFINET dissector was vulnerable to a format string overflow. (Bug 3382) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1210.
  • The Check Point High-Availability Protocol (CPHAP) dissector could crash. (Bug 3269) Versions affected: 0.9.6 to 1.0.6; CVE-2009-1268.
  • Wireshark could crash while loading a Tektronix .rf5 file. (Bug 3366) Versions affected: 0.99.6 to 1.0.6, CVE-2009-1269.
34291 34457 CVE-2009-1210 CVE-2009-1268 CVE-2009-1269 http://www.wireshark.org/security/wnpa-sec-2009-02.html http://secunia.com/advisories/34542 2009-04-06 2009-05-09 2009-05-13
cups -- remote code execution and DNS rebinding cups-base 1.3.10

Gentoo security team summarizes:

The following issues were reported in CUPS:

  • iDefense reported an integer overflow in the _cupsImageReadTIFF() function in the "imagetops" filter, leading to a heap-based buffer overflow (CVE-2009-0163).
  • Aaron Siegel of Apple Product Security reported that the CUPS web interface does not verify the content of the "Host" HTTP header properly (CVE-2009-0164).
  • Braden Thomas and Drew Yao of Apple Product Security reported that CUPS is vulnerable to CVE-2009-0146, CVE-2009-0147 and CVE-2009-0166, found earlier in xpdf and poppler.

A remote attacker might send or entice a user to send a specially crafted print job to CUPS, possibly resulting in the execution of arbitrary code with the privileges of the configured CUPS user -- by default this is "lp", or a Denial of Service. Furthermore, the web interface could be used to conduct DNS rebinding attacks.

34571 34665 34568 CVE-2009-0163 CVE-2009-0164 CVE-2009-0146 CVE-2009-0147 CVE-2009-0166 http://www.cups.org/articles.php?L582 2009-05-05 2009-05-07 2009-05-13
FreeBSD -- remotely exploitable crash in OpenSSL FreeBSD 6.36.3_10 6.46.4_4 7.07.0_12 7.17.1_5

Problem Description

The function ASN1_STRING_print_ex does not properly validate the lengths of BMPString or UniversalString objects before attempting to print them.

Impact

An application which attempts to print a BMPString or UniversalString which has an invalid length will crash as a result of OpenSSL accessing invalid memory locations. This could be used by an attacker to crash a remote application.

Workaround

No workaround is available, but applications which do not use the ASN1_STRING_print_ex function (either directly or indirectly) are not affected.

SA-09:08.openssl CVE-2009-0590 2009-03-25 2009-05-07 2009-05-13
quagga -- Denial of Service quagga 0.99.11_3

Debian Security Team reports:

It was discovered that Quagga, an IP routing daemon, could no longer process the Internet routing table due to broken handling of multiple 4-byte AS numbers in an AS path. If such a prefix is received, the BGP daemon crashes with an assert failure leading to a denial of service.

34656 http://lists.quagga.net/pipermail/quagga-dev/2009-April/006541.html CVE-2009-1572 2009-05-04 2009-05-06 2009-05-07
openfire -- Openfire No Password Changes Security Bypass openfire 3.6.4

Secunia reports:

A vulnerability has been reported in Openfire which can be exploited by malicious users to bypass certain security restrictions. The vulnerability is caused due to Openfire not properly respecting the no password changes setting which can be exploited to change passwords by sending jabber:iq:auth passwd_change requests to the server.

CVE-2009-1596 http://secunia.com/advisories/34984/ http://www.igniterealtime.org/issues/browse/JM-1532 http://www.igniterealtime.org/community/message/190288#190288 2009-05-04 2009-05-04 2010-05-02
drupal -- cross site scripting drupal5 5.17 drupal6 6.11

Drupal Security Team reports:

When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.

Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the meta http-equiv="Content-Type" tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This behaviour enables malicious users to insert and execute Javascript in the context of the website if site visitors are allowed to post content.

In addition, Drupal core also has a very limited information disclosure vulnerability under very specific conditions. If a user is tricked into visiting the site via a specially crafted URL and then submits a form (such as the search box) from that page, the information in their form submission may be directed to a third-party site determined by the URL and thus disclosed to the third party. The third party site may then execute a CSRF attack against the submitted form.

CVE-2009-1575 CVE-2009-1576 http://drupal.org/node/449078 2009-04-30 2009-04-30 2010-05-02
mozilla -- multiple vulnerabilities firefox 2.0.0.20_7,1 3.*,13.0.9,1 linux-firefox linux-firefox-devel 3.0.9 linux-seamonkey-devel 0 seamonkey linux-seamonkey 1.1.17 thunderbird linux-thunderbird 2.0.0.22

Mozilla Foundation reports:

MFSA 2009-22: Firefox allows Refresh header to redirect to javascript: URIs

MFSA 2009-21: POST data sent to wrong site when saving web page with embedded frame

MFSA 2009-20: Malicious search plugins can inject code into arbitrary sites

MFSA 2009-19: Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString

MFSA 2009-18: XSS hazard using third-party stylesheets and XBL bindings

MFSA 2009-17: Same-origin violations when Adobe Flash loaded via view-source: scheme

MFSA 2009-16: jar: scheme ignores the content-disposition: header on the inner URI

MFSA 2009-15: URL spoofing with box drawing character

MFSA 2009-14 Crashes with evidence of memory corruption (rv:1.9.0.9)

34656 CVE-2009-1303 CVE-2009-1306 CVE-2009-1307 CVE-2009-1308 CVE-2009-1309 CVE-2009-1312 CVE-2009-1311 CVE-2009-1302 CVE-2009-1304 CVE-2009-1305 CVE-2009-1310 http://www.mozilla.org/security/announce/2009/mfsa2009-22.html http://www.mozilla.org/security/announce/2009/mfsa2009-21.html http://www.mozilla.org/security/announce/2009/mfsa2009-20.html http://www.mozilla.org/security/announce/2009/mfsa2009-19.html http://www.mozilla.org/security/announce/2009/mfsa2009-18.html http://www.mozilla.org/security/announce/2009/mfsa2009-17.html http://www.mozilla.org/security/announce/2009/mfsa2009-16.html http://www.mozilla.org/security/announce/2009/mfsa2009-15.html http://www.mozilla.org/security/announce/2009/mfsa2009-14.html 2009-04-21 2009-04-22 2009-12-12
poppler -- Poppler Multiple Vulnerabilities poppler 0.10.6

Secunia reports:

Some vulnerabilities have been reported in Poppler which can be exploited by malicious people to potentially compromise an application using the library.

http://secunia.com/advisories/34746/ 2009-04-17 2009-04-18
xpdf -- multiple vulnerabilities xpdf 3.02_11

Secunia reports:

Some vulnerabilities have been reported in Xpdf, which can be exploited by malicious people to potentially compromise a user's system.

A boundary error exists when decoding JBIG2 symbol dictionary segments. This can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code.

Multiple integer overflows in the JBIG2 decoder can be exploited to potentially execute arbitrary code.

Multiple boundary errors in the JBIG2 decoder can be exploited to cause buffer overflows and potentially execute arbitrary code.

Multiple errors in the JBIG2 decoder can be exploited can be exploited to free arbitrary memory and potentially execute arbitrary code.

Multiple unspecified input validation errors in the JBIG2 decoder can be exploited to potentially execute arbitrary code.

CVE-2009-0146 CVE-2009-0147 CVE-2009-0166 CVE-2009-0799 CVE-2009-0800 CVE-2009-1179 CVE-2009-1180 CVE-2009-1181 CVE-2009-1182 CVE-2009-1183 http://secunia.com/advisories/34291 http://www.vupen.com/english/advisories/2009/1065 2009-04-16 2009-04-18 2009-04-18
freetype2 -- multiple vulnerabilities freetype2 2.3.9_1

Secunia reports:

Some vulnerabilities have been reported in FreeType, which can be exploited by malicious people to potentially compromise an application using the library.

An integer overflow error within the "cff_charset_compute_cids()" function in cff/cffload.c can be exploited to potentially cause a heap-based buffer overflow via a specially crafted font.

Multiple integer overflow errors within validation functions in sfnt/ttcmap.c can be exploited to bypass length validations and potentially cause buffer overflows via specially crafted fonts.

An integer overflow error within the "ft_smooth_render_generic()" function in smooth/ftsmooth.c can be exploited to potentially cause a heap-based buffer overflow via a specially crafted font.

CVE-2009-0946 http://secunia.com/advisories/34723/ 2009-04-16 2009-04-18
ejabberd -- cross-site scripting vulnerability ejabberd 2.0.4

SecurityFocus reports:

The ejabberd application is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

34133 CVE-2009-0934 2009-03-16 2009-04-17
ziproxy -- multiple vulnerability ziproxy 2.7.0

Ziproxy Developers reports:

Multiple HTTP proxy implementations are prone to an information-disclosure vulnerability related to the interpretation of the 'Host' HTTP header. Specifically, this issue occurs when the proxy makes a forwarding decision based on the 'Host' HTTP header instead of the destination IP address.

Attackers may exploit this issue to obtain sensitive information such as internal intranet webpages. Additional attacks may also be possible.

33858 CVE-2009-0804 http://www.kb.cert.org/vuls/id/MAPG-7N9GN8 2009-02-23 2009-04-15
phpmyadmin -- insufficient output sanitizing when generating configuration file phpMyAdmin 3.1.3.2

phpMyAdmin Team reports:

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. Combined with ability to save files on server, this can allow unauthenticated users to execute arbitrary PHP code. This issue is on different parameters than PMASA-2009-3 and it was missed out of our radar because it was not existing in 2.11.x branch.

CVE-2009-1285 http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php 2009-04-14 2009-04-15 2010-05-02
drupal6-cck -- cross-site scripting drupal6-cck 2.2

Drupal CCK plugin developer reports:

The Node reference and User reference sub-modules, which are part of the Content Construction Kit (CCK) project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate referenced users are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site scripting (XSS) attack may lead to a malicious user gaining full administrative access.

34172 CVE-2009-1069 http://drupal.org/node/406520 2009-03-23 2009-04-11 2010-05-02
pivot-weblog -- file deletion vulnerability pivot-weblog 1.40.7

Secunia reports:

A vulnerability has been discovered in Pivot, which can be exploited by malicious people to delete certain files.

Input passed to the "refkey" parameter in extensions/bbclone_tools/count.php is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the web server via directory traversal sequences passed within the "refkey" parameter.

NOTE: Users with the "Advanced" user level are able to include and execute uploaded PHP code via the "pivot_path" parameter in extensions/bbclone_tools/getkey.php when extensions/bbclone_tools/hr_conf.php can be deleted.

34160 http://secunia.com/advisories/34302/ 2009-03-18 2009-03-27
phpmyadmin -- insufficient output sanitizing when generating configuration file phpMyAdmin211 2.11.9.5 phpMyAdmin 3.1.3.1

phpMyAdmin reports:

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

CVE-2009-1151 http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php 2009-03-24 2009-03-25 2010-05-02
amarok -- multiple vulnerabilities amarok 1.4.10_3

Secunia reports:

Tobias Klein has reported some vulnerabilities in Amarok, which potentially can be exploited by malicious people to compromise a user's system.

Two integer overflow errors exist within the "Audible::Tag::readTag()" function in src/metadata/audible/audibletag.cpp. These can be exploited to cause heap-based buffer overflows via specially crafted Audible Audio files.

Two errors within the "Audible::Tag::readTag()" function in src/metadata/audible/audibletag.cpp can be exploited to corrupt arbitrary memory via specially crafted Audible Audio files.

33210 CVE-2009-0135 CVE-2009-0136 http://www.debian.org/security/2009/dsa-1706 http://secunia.com/advisories/33505 2009-01-12 2009-03-23
wireshark -- multiple vulnerabilities ethereal ethereal-lite tethereal tethereal-lite wireshark wireshark-lite 1.0.6

Vendor reports:

On non-Windows systems Wireshark could crash if the HOME environment variable contained sprintf-style string formatting characters. Wireshark could crash while reading a malformed NetScreen snoop file. Wireshark could crash while reading a Tektronix K12 text capture file.

CVE-2009-0599 CVE-2009-0600 CVE-2009-0601 http://www.wireshark.org/security/wnpa-sec-2009-01.html 2009-02-06 2009-03-22 2010-05-02
netatalk -- arbitrary command execution in papd daemon netatalk 2.0.3_5,1

Secunia reports:

A vulnerability has been reported in Netatalk, which potentially can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to the papd daemon improperly sanitising several received parameters before passing them in a call to popen(). This can be exploited to execute arbitrary commands via a specially crafted printing request.

Successful exploitation requires that a printer is configured to pass arbitrary values as parameters to a piped command.

32925 CVE-2008-5718 http://secunia.com/advisories/33227/ http://www.openwall.com/lists/oss-security/2009/01/13/3 2008-12-19 2009-03-18 2009-03-18
gstreamer-plugins-good -- multiple memory overflows gstreamer-plugins-good 0.10.9,30.10.12,3

Secunia reports:

Tobias Klein has reported some vulnerabilities in GStreamer Good Plug-ins, which can potentially be exploited by malicious people to compromise a vulnerable system.

A boundary error occurs within the "qtdemux_parse_samples()" function in gst/gtdemux/qtdemux.c when performing QuickTime "ctts" Atom parsing. This can be exploited to cause a heap-based buffer overflow via a specially crafted QuickTime media file.

An array indexing error exists in the "qtdemux_parse_samples()" function in gst/gtdemux/qtdemux.c when performing QuickTime "stss" Atom parsing. This can be exploited to corrupt memory via a specially crafted QuickTime media file.

A boundary error occurs within the "qtdemux_parse_samples()" function in gst/gtdemux/qtdemux.c when performing QuickTime "stts" Atom parsing. This can be exploited to cause a heap-based buffer overflow via a specially crafted QuickTime media file.

CVE-2009-0386 CVE-2009-0387 CVE-2009-0397 http://secunia.com/advisories/33650/ http://trapkit.de/advisories/TKADV2009-003.txt http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html 2009-01-22 2009-03-16
libsndfile -- CAF processing integer overflow vulnerability libsndfile 1.0.19

Secunia reports:

The vulnerability is caused due to an integer overflow error in the processing of CAF description chunks. This can be exploited to cause a heap-based buffer overflow by tricking the user into processing a specially crafted CAF audio file.

CVE-2009-0186 http://secunia.com/advisories/33980/ 2009-03-03 2009-03-16
ffmpeg -- 4xm processing memory corruption vulnerability ffmpeg 2008.07.27_9

Secunia reports:

Tobias Klein has reported a vulnerability in FFmpeg, which potentially can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to a signedness error within the "fourxm_read_header()" function in libavformat/4xm.c. This can be exploited to corrupt arbitrary memory via a specially crafted 4xm file.

33502 CVE-2009-0385 http://secunia.com/advisories/33711/ http://trapkit.de/advisories/TKADV2009-004.txt 2009-01-28 2009-03-16
roundcube -- webmail script insertion and php code injection roundcube 0.2.1,1

Secunia reports:

Some vulnerabilities have been reported in RoundCube Webmail, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct script insertion attacks and compromise a vulnerable system.

The HTML "background" attribute within e.g. HTML emails is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if a malicious email is viewed.

Input passed via a vCard is not properly sanitised before being used in a call to "preg_replace()" with the "e" modifier in program/include/rcube_vcard.php. This can be exploited to inject and execute arbitrary PHP code by e.g. tricking a user into importing a malicious vCard file.

CVE-2009-0413 http://secunia.com/advisories/33622/ http://sourceforge.net/forum/forum.php?forum_id=927958 http://trac.roundcube.net/changeset/2245 http://trac.roundcube.net/ticket/1485689 2009-01-21 2009-03-16 2009-03-26
proftpd -- multiple sql injection vulnerabilities proftpd proftpd-mysql 1.3.2 proftpd-devel 1.3.20080922

Secunia reports:

Some vulnerabilities have been reported in ProFTPD, which can be exploited by malicious people to conduct SQL injection attacks.

The application improperly sets the character encoding prior to performing SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code in an environment using a multi-byte character encoding.

An error exists in the "mod_sql" module when processing e.g. user names containing '%' characters. This can be exploited to bypass input sanitation routines and manipulate SQL queries by injecting arbitrary SQL code.

CVE-2009-0542 CVE-2009-0543 http://secunia.com/advisories/33842/ http://bugs.proftpd.org/show_bug.cgi?id=3173 http://bugs.proftpd.org/show_bug.cgi?id=3124 http://milw0rm.com/exploits/8037 2009-02-06 2009-03-16
zabbix -- php frontend multiple vulnerabilities zabbix 1.6.2_1,1 zabbix-agent 1.6.2_1,2

Secunia reports:

Some vulnerabilities have been reported in the ZABBIX PHP frontend, which can be exploited by malicious people to conduct cross-site request forgery attacks and malicious users to disclose sensitive information and compromise a vulnerable system.

Input appended to and passed via the "extlang" parameter to the "calc_exp2()" function in include/validate.inc.php is not properly sanitised before being used. This can be exploited to inject and execute arbitrary PHP code.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. create users by enticing a logged in administrator to visit a malicious web page.

Input passed to the "srclang" parameter in locales.php (when "next" is set to a non-NULL value) is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.

http://secunia.com/advisories/34091/ http://www.ush.it/team/ush/hack-zabbix_162/adv.txt 2009-03-04 2009-03-16 2009-03-23
php-mbstring -- php mbstring buffer overflow vulnerability php4-mbstring 4.4.9 php5-mbstring 5.2.9

SecurityFocus reports:

PHP is prone to a buffer-overflow vulnerability because it fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffers. The issue affects the 'mbstring' extension included in the standard distribution.

An attacker can exploit this issue to execute arbitrary machine code in the context of the affected webserver. Failed exploit attempts will likely crash the webserver, denying service to legitimate users.

32948 CVE-2008-5557 2008-12-21 2009-03-16
phppgadmin -- directory traversal with register_globals enabled phppgadmin 4.2.2

Secunia reports:

Dun has discovered a vulnerability in phpPgAdmin, which can be exploited by malicious people to disclose sensitive information.

Input passed via the "_language" parameter to libraries/lib.inc.php is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.

32670 CVE-2008-5587 http://secunia.com/advisories/33014 2008-12-08 2009-03-16
opera -- multiple vulnerabilities opera linux-opera 9.64

Opera Team reports:

An unspecified error in the processing of JPEG images can be exploited to trigger a memory corruption.

An error can be exploited to execute arbitrary script code in a different domain via unspecified plugins.

An unspecified error has a "moderately severe" impact. No further information is available.

CVE-2009-0914 CVE-2009-0915 http://www.opera.com/docs/changelogs/freebsd/964/ http://secunia.com/advisories/34135/ 2009-03-15 2009-03-15 2010-05-02
epiphany -- untrusted search path vulnerability epiphany 2.24.2.1

CVE Mitre reports:

Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).

CVE-2008-5985 CVE-2008-5983 2009-01-26 2009-03-11
apache -- Cross-site scripting vulnerability apache 2.2.02.2.9_2 2.0.02.0.63_2

CVE Mitre reports:

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

CVE-2008-2939 http://www.rapid7.com/advisories/R7-0033.jsp 2008-07-25 2009-03-11
pngcrush -- libpng Uninitialised Pointer Arrays Vulnerability pngcrush 1.6.14

Secunia reports:

A vulnerability has been reported in Pngcrush, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to the use of vulnerable libpng code.

33827 CVE-2009-0040 http://secunia.com/advisories/33976 http://xforce.iss.net/xforce/xfdb/48819 2009-02-19 2009-03-04
curl -- cURL/libcURL Location: Redirect URLs Security Bypass curl 5.117.19.4

Secunia reports:

The security issue is caused due to cURL following HTTP Location: redirects to e.g. scp:// or file:// URLs which can be exploited by a malicious HTTP server to overwrite or disclose the content of arbitrary local files and potentially execute arbitrary commands via specially crafted redirect URLs.

CVE-2009-0037 http://secunia.com/advisories/34138/ 2009-03-03 2009-03-04
Zend Framework -- Local File Inclusion vulnerability in Zend_View::render() ZendFramework 1.7.5

Matthew Weier O'Phinney reports:

A potential Local File Inclusion (LFI) vulnerability exists in the Zend_View::render() method. If user input is used to specify the script path, then it is possible to trigger the LFI.

Note that Zend Framework applications that never call the Zend_View::render() method with a user-supplied parameter are not affected by this vulnerability.

http://framework.zend.com/issues/browse/ZF-5748 2009-02-11 2009-02-18
dia -- remote command execution vulnerability dia 0.96.1_6,1

Security Focus reports:

An attacker could exploit this issue by enticing an unsuspecting victim to execute the vulnerable application in a directory containing a malicious Python file. A successful exploit will allow arbitrary Python commands to run within the privileges of the currently logged-in user.

33448 CVE-2008-5984 http://secunia.com/advisories/33672 2009-01-26 2009-02-17
pycrypto -- ARC2 module buffer overflow py-pycrypto 2.0.1_2

Dwayne C. Litzenberger reports:

pycrypto is exposed to a buffer overflow issue because it fails to adequately verify user-supplied input. This issue resides in the ARC2 module. This issue can be triggered with specially crafted ARC2 keys in excess of 128 bytes.

http://lists.dlitz.net/pipermail/pycrypto/2009q1/000062.html 2009-02-06 2009-02-15
varnish -- Varnish HTTP Request Parsing Denial of Service varnish 2.0.1

SecurityFocus reports:

Varnish is prone to a remote denial-of-service vulnerability because the application fails to handle certain HTTP requests.

Successfully exploiting this issue allows remote attackers to crash the affected application denying further service to legitimate users.

33712 http://secunia.com/advisories/33852/ http://varnish.projects.linpro.no/wiki/WikiStart 2008-10-17 2009-02-14 2009-02-15
tor -- multiple vulnerabilities tor 0.2.0.34 tor-devel 0.2.12-alpha

Secunia reports:

Some vulnerabilities have been reported in Tor, where one has an unknown impact and others can be exploited by malicious people to cause a DoS.

An error when running Tor as a directory authority can be exploited to trigger the execution of an infinite loop.

An unspecified error exists when running on Windows systems prior to Windows XP. No further information is currently available.

CVE-2009-0936 CVE-2009-0937 CVE-2009-0938 http://secunia.com/advisories/33880/ http://archives.seul.org/or/announce/Feb-2009/msg00000.html 2009-02-10 2009-02-13 2009-03-20
firefox -- multiple vulnerabilities firefox 2.0.0.20_3,1 3.*,13.0.6,1 linux-firefox linux-firefox-devel 3.0.6 linux-seamonkey-devel 0 seamonkey linux-seamonkey 1.1.15 thunderbird linux-thunderbird 2.0.0.21

Mozilla Foundation reports:

MFSA 2009-06: Directives to not cache pages ignored

MFSA 2009-05: XMLHttpRequest allows reading HTTPOnly cookies

MFSA 2009-04: Chrome privilege escalation via local .desktop files

MFSA 2009-03: Local file stealing with SessionStore

MFSA 2009-02: XSS using a chrome XBL method and window.eval

MFSA 2009-01: Crashes with evidence of memory corruption (rv:1.9.0.6)

CVE-2009-0352 CVE-2009-0353 CVE-2009-0354 CVE-2009-0355 CVE-2009-0356 CVE-2009-0357 CVE-2009-0358 http://www.mozilla.org/security/announce/2009/mfsa2009-01.html http://www.mozilla.org/security/announce/2009/mfsa2009-02.html http://www.mozilla.org/security/announce/2009/mfsa2009-03.html http://www.mozilla.org/security/announce/2009/mfsa2009-04.html http://www.mozilla.org/security/announce/2009/mfsa2009-05.html http://www.mozilla.org/security/announce/2009/mfsa2009-06.html http://secunia.com/advisories/33799/ 2009-02-04 2009-02-11 2009-12-12
codeigniter -- arbitrary script execution in the new Form Validation class codeigniter 1.7.01.7.1

znirkel reports:

The eval() function in _reset_post_array crashes when posting certain data. By passing in carefully-crafted input data, the eval() function could also execute malicious PHP code.

Note that CodeIgniter applications that either do not use the new Form Validation class or use the old Validation class are not affected by this vulnerability.

http://codeigniter.com/bug_tracker/bug/6068/ 2008-11-28 2009-02-11
pyblosxom -- atom flavor multiple XML injection vulnerabilities pyblosxom 1.5.r3

Security Focus reports:

PyBlosxom is prone to multiple XML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied XML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

33676 2009-02-09 2009-02-11
typo3 -- cross-site scripting and information disclosure typo3 4.2.6

Secunia reports:

Some vulnerabilities have been reported in Typo3, which can be exploited by malicious people to conduct cross-site scripting attacks and disclose sensitive information.

Input passed via unspecified fields to the backend user interface is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

An error in the "jumpUrl" mechanism can be exploited to read arbitrary files from local resources by disclosing a hash secret used to restrict file access.

CVE-2009-0815 CVE-2009-0816 http://secunia.com/advisories/33829/ http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/ 2009-02-10 2009-02-11 2010-05-02
amaya -- multiple buffer overflow vulnerabilities amaya 0

Secunia reports:

A boundary error when processing "div" HTML tags can be exploited to cause a stack-based buffer overflow via an overly long "id" parameter.

A boundary error exists when processing overly long links. This can be exploited to cause a stack-based buffer overflow by tricking the user into e.g. editing a malicious link.

A boundary error when processing e.g. a "bdo" HTML tag having an overly long "dir" attribute can be exploited to cause a stack-based buffer overflow.

A boundary error when processing "input" HTML tags can be exploited to cause a stack-based buffer overflow via an overly long e.g. "type" attribute.

CVE-2008-5282 CVE-2009-0323 http://secunia.com/advisories/32848/ http://www.bmgsec.com.au/advisory/41/ http://www.bmgsec.com.au/advisory/40/ http://milw0rm.com/exploits/7467 http://www.coresecurity.com/content/amaya-buffer-overflows 2008-11-25 2009-02-09
websvn -- multiple vulnerabilities websvn 2.1.0

Secunia reports:

Some vulnerabilities have been reported in WebSVN, which can be exploited by malicious users to disclose sensitive information, and by malicious people to conduct cross-site scripting attacks and manipulate data.

Input passed in the URL to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Input passed to the "rev" parameter in rss.php is not properly sanitised before being used. This can be exploited to overwrite arbitrary files via directory traversal attacks.

Access to restricted repositories is not properly enforced, which can be exploited to disclose potentially sensitive information by accessing the repository via "listing.php" and using the "compare with previous" and "show changed files" links.

CVE-2008-5918 CVE-2008-5919 CVE-2009-0240 http://secunia.com/advisories/32338/ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191 http://www.gulftech.org/?node=research&article_id=00132-10202008 2008-10-23 2009-02-09
phplist -- local file inclusion vulnerability phplist 2.10.9

Secunia reports:

Input passed to the "_SERVER[ConfigFile]" parameter in admin/index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

CVE-2009-0422 http://secunia.com/advisories/33533/ 2009-01-15 2009-02-09
squid -- remote denial of service vulnerability squid 2.7.12.7.6 3.0.13.0.13

Squid security advisory 2009:1 reports:

Due to an internal error Squid is vulnerable to a denial of service attack when processing specially crafted requests.

This problem allows any client to perform a denial of service attack on the Squid service.

CVE-2009-0478 http://www.squid-cache.org/Advisories/SQUID-2009_1.txt http://secunia.com/advisories/33731/ 2009-02-04 2009-02-09 2009-02-10
typo3 -- multiple vulnerabilities typo3 4.2.4

Secunia reports:

Some vulnerabilities have been reported in Typo3, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and session fixation attacks, and compromise a vulnerable system.

The "Install tool" system extension uses insufficiently random entropy sources to generate an encryption key, resulting in weak security.

The authentication library does not properly invalidate supplied session tokens, which can be exploited to hijack a user's session.

Certain unspecified input passed to the "Indexed Search Engine" system extension is not properly sanitised before being used to invoke commands. This can be exploited to inject and execute arbitrary shell commands.

Input passed via the name and content of files to the "Indexed Search Engine" system extension is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Certain unspecified input passed to the Workspace module is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Note: It is also reported that certain unspecified input passed to test scripts of the "ADOdb" system extension is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected website.

CVE-2009-0255 CVE-2009-0256 CVE-2009-0257 CVE-2009-0258 http://secunia.com/advisories/33617/ http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/ 2009-02-07 2009-02-09 2013-06-19
sudo -- certain authorized users could run commands as any user sudo 1.6.91.6.9.20

Todd Miller reports:

A bug was introduced in Sudo's group matching code in version 1.6.9 when support for matching based on the supplemental group vector was added. This bug may allow certain users listed in the sudoers file to run a command as a different user than their access rule specifies.

33517 CVE-2009-0034 http://www.gratisoft.us/pipermail/sudo-announce/2009-February/000085.html 2009-02-04 2009-02-06
drupal -- multiple vulnerabilities drupal5 5.15 drupal6 6.9

Drupal Team reports:

The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content (a node). In that proces the existing node's content is copied into the new node's submission form.

The module contains a flaw that allows a user with the 'translate content' permission to potentially bypass normal viewing access restrictions, for example allowing the user to see the content of unpublished nodes even if they do not have permission to view unpublished nodes.

When user profile pictures are enabled, the default user profile validation function will be bypassed, possibly allowing invalid user names or e-mail addresses to be submitted.

http://drupal.org/node/358957 http://secunia.com/advisories/33550/ http://secunia.com/advisories/33500/ http://secunia.com/advisories/33542/ 2009-01-14 2009-02-04
perl -- Directory Permissions Race Condition perl 5.8.05.8.9

Secunia reports:

Paul Szabo has reported a vulnerability in Perl File::Path::rmtree, which potentially can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a race condition in the way File::Path::rmtree handles directory permissions when cleaning up directories. This can be exploited by replacing an existing sub directory in the directory tree with a symbolic link to an arbitrary file.

Successful exploitation may allow changing permissions of arbitrary files, if root uses an application using the vulnerable code to delete files in a directory having a world-writable sub directory.

CVE-2005-0448 http://www.ubuntulinux.org/usn/usn-94-1 http://secunia.com/advisories/14531/ 2005-03-09 2009-02-03
moinmoin -- multiple cross site scripting vulnerabilities moinmoin 1.8.1

Secunia reports:

Input passed to multiple parameters in action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

Certain input passed to security/antispam.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

CVE-2009-0260 CVE-2009-0312 http://secunia.com/advisories/33593/ http://hg.moinmo.in/moin/1.8/file/c76d50dac855 http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad http://moinmo.in/SecurityFixes#moin1.8.1 2009-01-21 2009-01-30
ganglia -- buffer overflow vulnerability ganglia-monitor-core ganglia-monitor-webfrontend 3.1.1

Secunia reports:

Spike Spiegel has discovered a vulnerability in Ganglia which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the process_path function in gmetad/server.c. This can be exploited to cause a stack-based buffer overflow by e.g. sending a specially crafted message to the gmetad service.

The vulnerability is confirmed in version 3.1.1. Other versions may also be affected.

CVE-2009-0241 http://secunia.com/advisories/33506 2009-01-26 2009-01-30 2009-01-30
tor -- unspecified memory corruption vulnerability tor 0.2.0.33 tor-devel 0.2.1.11-alpha

Secunia reports:

A vulnerability with an unknown impact has been reported in Tor.

The vulnerability is caused due to an unspecified error and can be exploited to trigger a heap corruption. No further information is currently available.

CVE-2009-0414 http://secunia.com/advisories/33635/ http://archives.seul.org/or/announce/Jan-2009/msg00000.html 2009-01-22 2009-01-29 2010-05-02
glpi -- SQL Injection glpi 0.71.4

The GLPI project reports:

Input passed via unspecified parameters is not properly sanitised before being used in SQL queries. This can be exploited to manipulateSQL queries by injecting arbitrary SQL code.

http://www.glpi-project.org/spip.php?page=annonce&id_breve=161&lang=en https://mail.gna.org/public/glpi-news/2009-01/msg00002.html https://dev.indepnet.net/glpi/ticket/1224 http://secunia.com/advisories/33680/ 2009-01-25 2009-01-28
openfire -- multiple vulnerabilities openfire 3.6.3

Core Security Technologies reports:

Multiple cross-site scripting vulnerabilities have been found which may lead to arbitrary remote code execution on the server running the application due to unauthorized upload of Java plugin code.

32935 32937 32938 32939 32940 32943 32944 32945 CVE-2009-0496 CVE-2009-0497 http://www.coresecurity.com/content/openfire-multiple-vulnerabilities 2009-01-08 2009-01-25 2010-05-02
ipset-tools -- Denial of Service Vulnerabilities ipsec-tools 0.7.1

SecurityFocus reports:

IPsec-Tools is affected by multiple remote denial-of-service vulnerabilities because the software fails to properly handle certain network packets.

A successful attack allows a remote attacker to crash the software, denying further service to legitimate users.

30657 CVE-2008-3651 CVE-2008-3652 http://marc.info/?l=ipsec-tools-devel&m=121688914101709&w=2 2008-07-28 2009-01-21
Teamspeak Server -- Directory Traversal Vulnerability teamspeak_server 2.0.23.17

SecurityFocus reports:

TeamSpeak is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

33256 http://www.securityfocus.com/bid/33256 2009-01-14 2009-01-20
optipng -- arbitrary code execution via crafted BMP image optipng 0.6.2

Secunia reports:

A vulnerability has been reported in OptiPNG, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the BMP reader and can be exploited to cause a buffer overflow by tricking a user into processing a specially crafted file.

Successful exploitation may allow execution of arbitrary code.

CVE-2008-5101 http://secunia.com/advisories/32651 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399 http://optipng.sourceforge.net/ 2008-11-11 2009-01-19
git -- gitweb privilege escalation git 1.6.0.6

Git maintainers report:

gitweb has a possible local privilege escalation bug that allows a malicious repository owner to run a command of his choice by specifying diff.external configuration variable in his repository and running a crafted gitweb query.

32967 http://marc.info/?l=git&m=122975564100860&w=2 http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.6.0.6.txt 2008-12-20 2009-01-19
gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability gtar 1.19

SecurityFocus reports:

GNUs tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the alloca() function.

Successfully exploiting this issue allows attackers to crash the affected utilities and possibly to execute code but this has not been confirmed.

26445 CVE-2007-4476 http://www.securityfocus.com/bid/26445/ 2007-11-14 2009-01-15
mplayer -- vulnerability in STR files processor mplayer mplayer-esound mplayer-gtk mplayer-gtk-esound mplayer-gtk2 mplayer-gtk2-esound 0.99.11_10

Secunia reports:

The vulnerability is caused due to a boundary error within the "str_read_packet()" function in libavformat/psxstr.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted STR file.

CVE-2008-3162 30157 http://secunia.com/advisories/30994 https://roundup.mplayerhq.hu/roundup/ffmpeg/issue311 2008-07-09 2009-01-15
cgiwrap -- XSS Vulnerability cgiwrap 4.0_2

Secunia reports:

A vulnerability has been reported in CGIWrap, which can be exploited by malicious people to conduct cross-site scripting attacks.

The vulnerability is caused due to the application generating error messages without specifying a charset. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation may require that the victim uses Internet Explorer or a browser based on Internet Explorer components.

CVE-2008-2852 http://secunia.com/advisories/30765 http://cgiwrap.sourceforge.net/changes.html 2008-06-19 2009-01-13
nagios -- web interface privilege escalation vulnerability nagios 3.0.5 nagios2 2.12_2

securityfocus reports:

An attacker with low-level privileges may exploit this issue to bypass authorization and cause arbitrary commands to run within the context of the Nagios server. This may aid in further attacks.

CVE-2008-5027 32156 http://secunia.com/advisories/33320 http://www.ubuntu.com/usn/USN-698-1 http://www.nagios.org/development/history/nagios-3x.php 2008-11-06 2009-01-12 2009-01-15
pdfjam -- insecure temporary files pdfjam 1.20_4

Secunia reports:

Some security issues have been reported in PDFjam, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

The security issues are caused due to the "pdf90", "pdfjoin", and "pdfnup" scripts using temporary files in an insecure manner. This can be exploited to overwrite arbitrary files via symlink attacks.

CVE-2008-5743 https://bugzilla.novell.com/show_bug.cgi?id=459031 http://secunia.com/advisories/33278 2008-12-05 2009-01-11
verlihub -- insecure temporary file usage and arbitrary command execution verlihub 0.9.8.d.r2_2,1

securityfocus reports:

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

Verlihub is prone to a remote command-execution vulnerability because it fails to sufficiently validate user input.

Successfully exploiting this issue would allow an attacker to execute arbitrary commands on an affected computer in the context of the affected application.

CVE-2008-5705 CVE-2008-5706 32889 32420 http://milw0rm.com/exploits/7183 2008-11-22 2009-01-11
mysql -- empty bit-string literal denial of service mysql-server 5.05.0.66 5.15.1.26 6.06.0.6

MySQL reports:

The vulnerability is caused due to an error when processing an empty bit-string literal and can be exploited to crash the server via a specially crafted SQL statement.

CVE-2008-3963 http://bugs.mysql.com/bug.php?id=35658 http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-66.html http://dev.mysql.com/doc/refman/5.1/en/news-5-1-26.html http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html http://secunia.com/advisories/31769 2008-09-11 2009-01-11
mysql -- privilege escalation and overwrite of the system table information mysql-server 4.14.1.24 5.05.0.51 5.15.1.23 6.06.0.4

MySQL reports:

Using RENAME TABLE against a table with explicit DATA DIRECTORY and INDEX DIRECTORY options can be used to overwrite system table information by replacing the symbolic link points. the file to which the symlink points.

CVE-2007-5969 26765 http://bugs.mysql.com/bug.php?id=32111 2007-11-14 2009-01-11
mysql -- remote dos via malformed password packet mysql-server 4.14.1.24 5.05.0.44 5.15.1.20

MySQL reports:

A malformed password packet in the connection protocol could cause the server to crash.

CVE-2007-3780 25017 http://bugs.mysql.com/bug.php?id=28984 2007-07-15 2009-01-11
mysql -- renaming of arbitrary tables by authenticated users mysql-server 4.14.1.23 5.05.0.42 5.15.1.18

MySQL reports:

The requirement of the DROP privilege for RENAME TABLE was not enforced.

CVE-2007-2691 24016 http://bugs.mysql.com/bug.php?id=27515 2007-05-14 2009-01-11
imap-uw -- imap c-client buffer overflow imap-uw 2007e

SANS reports:

The University of Washington IMAP library is a library implementing the IMAP mail protocol. University of Washington IMAP is exposed to a buffer overflow issue that occurs due to a boundary error within the rfc822_output_char function in the c-client library. The University of Washington IMAP library versions prior to 2007e are affected.

CVE-2008-5514 http://www.washington.edu/imap/documentation/RELNOTES.html 2008-12-16 2009-01-11 2010-05-02
imap-uw -- local buffer overflow vulnerabilities imap-uw 2007d

SANS reports:

University of Washington "tmail" and "dmail" are mail deliver agents. "tmail" and "dmail" are exposed to local buffer overflow issues because they fail to perform adequate boundary checks on user-supplied data.

CVE-2008-5514 http://www.washington.edu/imap/documentation/RELNOTES.html http://www.sans.org/newsletters/risk/display.php?v=7&i=45#08.45.22 2008-10-29 2009-01-11 2010-05-02
libcdaudio -- remote buffer overflow and code execution libcdaudio 0.99.12p2_2

securityfocus reports:

The 'libcdaudio' library is prone to a remote heap code in the context of an application that uses the library. Failed attacks will cause denial-of-service conditions.

A buffer-overflow in Grip occurs when the software processes a response to a CDDB query that has more than 16 matches.

To exploit this issue, an attacker must be able to influence the response to a CDDB query, either by controlling a malicious CDDB server or through some other means. Successful exploits will allow arbitrary code to run.

CVE-2008-5030 CVE-2005-0706 32122 12770 2008-11-05 2009-01-11
FreeBSD -- netgraph / bluetooth privilege escalation FreeBSD 6.36.3_7 6.46.4_1 7.07.0_7

Problem Description:

Some function pointers for netgraph and bluetooth sockets are not properly initialized.

Impact:

A local user can cause the FreeBSD kernel to execute arbitrary code. This could be used by an attacker directly; or it could be used to gain root privilege or to escape from a jail.

Workaround:

No workaround is available, but systems without local untrusted users are not vulnerable. Furthermore, systems are not vulnerable if they have neither the ng_socket nor ng_bluetooth kernel modules loaded or compiled into the kernel.

Systems with the security.jail.socket_unixiproute_only sysctl set to 1 (the default) are only vulnerable if they have local untrusted users outside of jails.

If the command

# kldstat -v | grep ng_

produces no output, the system is not vulnerable.

SA-08:13.protosw 2008-12-23 2009-01-05
FreeBSD -- Cross-site request forgery in ftpd(8) FreeBSD 6.36.3_7 6.46.4_1 7.07.0_7

Problem Description:

The ftpd(8) server splits long commands into several requests. This may result in the server executing a command which is hidden inside another very long command.

Impact:

This could, with a specifically crafted command, be used in a cross-site request forgery attack.

FreeBSD systems running ftpd(8) server could act as a point of privilege escalation in an attack against users using web browser to access trusted FTP sites.

Workaround:

No workaround is available, but systems not running FTP servers are not vulnerable. Systems not running the FreeBSD ftp(8) server are not affected, but users of other ftp daemons are advised to take care since several other ftp daemons are known to have related bugs.

CVE-2008-4247 SA-08:12.ftpd 2008-12-23 2009-01-05
FreeBSD -- IPv6 Neighbor Discovery Protocol routing vulnerability FreeBSD 6.36.3_5 7.07.0_5

Problem Description

IPv6 routers may allow "on-link" IPv6 nodes to create and update the router's neighbor cache and forwarding information. A malicious IPv6 node sharing a common router but on a different physical segment from another node may be able to spoof Neighbor Discovery messages, allowing it to update router information for the victim node.

Impact:

An attacker on a different physical network connected to the same IPv6 router as another node could redirect IPv6 traffic intended for that node. This could lead to denial of service or improper access to private network traffic.

Workaround:

Firewall packet filters can be used to filter incoming Neighbor Solicitation messages but may interfere with normal IPv6 operation if not configured carefully.

Reverse path forwarding checks could be used to make gateways, such as routers or firewalls, drop Neighbor Solicitation messages from nodes with unexpected source addresses on a particular interface.

IPv6 router administrators are encouraged to read RFC 3756 for further discussion of Neighbor Discovery security implications.

CVE-2008-2476 SA-08:10.nd6 2008-10-01 2009-01-05
FreeBSD -- arc4random(9) predictable sequence vulnerability FreeBSD 6.36.3_6 7.07.0_6

Problem Description:

When the arc4random(9) random number generator is initialized, there may be inadequate entropy to meet the needs of kernel systems which rely on arc4random(9); and it may take up to 5 minutes before arc4random(9) is reseeded with secure entropy from the Yarrow random number generator.

Impact:

All security-related kernel subsystems that rely on a quality random number generator are subject to a wide range of possible attacks for the 300 seconds after boot or until 64k of random data is consumed. The list includes:

* GEOM ELI providers with onetime keys. When a provider is configured in a way so that it gets attached at the same time during boot (e.g. it uses the rc subsystem to initialize) it might be possible for an attacker to recover the encrypted data.

* GEOM shsec providers. The GEOM shsec subsytem is used to split a shared secret between two providers so that it can be recovered when both of them are present. This is done by writing the random sequence to one of providers while appending the result of the random sequence on the other host to the original data. If the provider was created within the first 300 seconds after booting, it might be possible for an attacker to extract the original data with access to only one of the two providers between which the secret data is split.

* System processes started early after boot may receive predictable IDs.

* The 802.11 network stack uses arc4random(9) to generate initial vectors (IV) for WEP encryption when operating in client mode and WEP authentication challenges when operating in hostap mode, which may be insecure.

* The IPv4, IPv6 and TCP/UDP protocol implementations rely on a quality random number generator to produce unpredictable IP packet identifiers, initial TCP sequence numbers and outgoing port numbers. During the first 300 seconds after booting, it may be easier for an attacker to execute IP session hijacking, OS fingerprinting, idle scanning, or in some cases DNS cache poisoning and blind TCP data injection attacks.

* The kernel RPC code uses arc4random(9) to retrieve transaction identifiers, which might make RPC clients vulnerable to hijacking attacks.

Workaround:

No workaround is available for affected systems.

CVE-2008-5162 SA-08.11.arc4random 2008-11-24 2009-01-05
xterm -- DECRQSS remote command execution vulnerability xterm 238

SecurityFocus reports:

The xterm program is prone to a remote command-execution vulnerability because it fails to sufficiently validate user input.

Successfully exploiting this issue would allow an attacker to execute arbitrary commands on an affected computer in the context of the affected application.

33060 CVE-2008-2383 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 2008-12-28 2009-01-05 2009-01-06
php5-gd -- uninitialized memory information disclosure vulnerability php5-gd 5.2.8

According to CVE-2008-5498 entry:

Array index error in the "imageRotate" function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the "bgd_color" or "clrBack" argument) for an indexed image.

33002 CVE-2008-5498 http://www.securiteam.com/unixfocus/6G00Y0ANFU.html 2008-12-24 2009-01-05 2009-02-04
awstats -- multiple XSS vulnerabilities awstats 6.9,1 awstats-devel 0

Secunia reports:

Morgan Todd has discovered a vulnerability in AWStats, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed in the URL to awstats.pl is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that the application is running as a CGI script.

CVE-2008-3714 CVE-2008-5080 http://secunia.com/advisories/31519 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495432 2008-03-12 2009-01-04
p5-File-Path -- rmtree allows creation of setuid files p5-File-Path 2.07_1

Jan Lieskovsky reports:

perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to address this)

This vulnerability was fixed in 5.8.4-7 but re-introduced in 5.8.8-1. It's also present in File::Path 2.xx, up to and including 2.07 which has only a partial fix.

CVE-2005-0448 http://www.openwall.com/lists/oss-security/2008/11/28/1 http://www.gossamer-threads.com/lists/perl/porters/233699#233699 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905 2008-11-28 2009-01-03
vim -- multiple vulnerabilities in the netrw module vim vim-lite vim-gtk2 vim-gnome 7.07.2

Jan Minar reports:

Applying the ``D'' to a file with a crafted file name, or inside a directory with a crafted directory name, can lead to arbitrary code execution.

Lack of sanitization throughout Netrw can lead to arbitrary code execution upon opening a directory with a crafted name.

The Vim Netrw Plugin shares the FTP user name and password across all FTP sessions. Every time Vim makes a new FTP connection, it sends the user name and password of the previous FTP session to the FTP server.

CVE-2008-3076 http://www.openwall.com/lists/oss-security/2008/10/16/2 http://www.rdancer.org/vulnerablevim-netrw.html http://www.rdancer.org/vulnerablevim-netrw.v2.html http://www.rdancer.org/vulnerablevim-netrw.v5.html http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html 2008-10-16 2009-01-02
vinagre -- format string vulnerability vinagre 0.5.2

CORE Security Technologies reports:

A format string error has been found on the vinagre_utils_show_error() function that can be exploited via commands issued from a malicious server containing format string specifiers on the VNC name.

In a web based attack scenario, the user would be required to connect to a malicious server. Successful exploitation would then allow the attacker to execute arbitrary code with the privileges of the Vinagre user.

32682 CVE-2008-5660 http://www.coresecurity.com/content/vinagre-format-string http://ftp.gnome.org/pub/GNOME/sources/vinagre/0.5/vinagre-0.5.2.news 2008-12-09 2008-12-31 2010-05-02
twiki -- multiple vulnerabilities twiki 4.2.4,1

Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report:

XSS vulnerability with URLPARAM variable

SEARCH variable allows arbitrary shell command execution

32668 32669 CVE-2008-5304 CVE-2008-5305 http://secunia.com/advisories/33040 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5305 http://www.securitytracker.com/alerts/2008/Dec/1021351.html http://www.securitytracker.com/alerts/2008/Dec/1021352.html https://www.it-isac.org/postings/cyber/alertdetail.php?id=4513 http://xforce.iss.net/xforce/xfdb/45293 2008-12-05 2008-12-30
roundcube -- remote execution of arbitrary code roundcube 0.2.b2,1

Entry for CVE-2008-5619 says:

html2text.php in RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.

CVE-2008-5619 http://trac.roundcube.net/ticket/1485618 2008-12-12 2008-12-30
mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths mysql-server 4.14.1.25 5.05.0.75 5.15.1.28 6.06.0.6

MySQL Team reports:

Additional corrections were made for the symlink-related privilege problem originally addressed. The original fix did not correctly handle the data directory pathname if it contained symlinked directories in its path, and the check was made only at table-creation time, not at table-opening time later.

CVE-2008-2079 CVE-2008-4097 CVE-2008-4098 http://bugs.mysql.com/bug.php?id=32167 http://dev.mysql.com/doc/refman/4.1/en/news-4-1-25.html http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-75.html http://dev.mysql.com/doc/refman/5.1/en/news-5-1-28.html http://dev.mysql.com/doc/refman/6.0/en/news-6-0-6.html http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25 2008-07-03 2008-12-30
mplayer -- twinvq processing buffer overflow vulnerability mplayer mplayer-esound mplayer-gtk mplayer-gtk-esound mplayer-gtk2 mplayer-gtk2-esound 0.99.11_9

A trapkit reports:

MPlayer contains a stack buffer overflow vulnerability while parsing malformed TwinVQ media files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of MPlayer.

CVE-2008-5616 http://secunia.com/advisories/33136/ http://trapkit.de/advisories/TKADV2008-014.txt 2008-12-14 2008-12-30
ampache -- insecure temporary file usage ampache 3.4.3

Secunia reports:

A security issue has been reported in Ampache, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

The security issue is caused due to the "gather-messages.sh" script handling temporary files in an insecure manner. This can be exploited via symlink attacks to overwrite arbitrary files with the privileges of the user running the script.

30875 CVE-2008-3929 http://secunia.com/advisories/31657 2008-12-24 2008-12-26
opera -- multiple vulnerabilities opera linux-opera 9.63

The Opera Team reports:

Manipulating certain text-area contents can cause a buffer overflow, which may be exploited to execute arbitrary code.

Certain HTML constructs can cause the resulting DOM to change unexpectedly, which triggers a crash. To inject code, additional techniques will have to be employed.

Exceptionally long host names in file: URLs can cause a buffer overflow, which may be exploited to execute arbitrary code. Remote Web pages cannot refer to file: URLs, so successful exploitation involves tricking users into manually opening the exploit URL, or a local file that refers to it.

When Opera is previewing a news feed, some scripted URLs are not correctly blocked. These can execute scripts which are able to subscribe the user to any feed URL that the attacker chooses, and can also view the contents of any feeds that the user is subscribed to. These may contain sensitive information.

Built-in XSLT templates incorrectly handle escaped content and can cause it to be treated as markup. If a site accepts content from untrusted users, which it then displays using XSLT as escaped strings, this can allow scripted markup to be injected. The scripts will then be executed in the security context of that site.

CVE-2008-5178 http://www.opera.com/support/kb/view/920/ http://www.opera.com/support/kb/view/921/ http://www.opera.com/support/kb/view/922/ http://www.opera.com/support/kb/view/923/ http://www.opera.com/support/kb/view/924/ http://secunia.com/advisories/32752/ 2008-11-18 2008-12-19
mediawiki -- multiple vulnerabilities mediawiki 1.6.01.6.11 1.12.01.12.3 1.13.01.13.3

The MediaWiki development team reports:

Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Certain unspecified input related to uploads is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious data is opened. Successful exploitation may require that uploads are enabled and the victim uses an Internet Explorer based browser.

Certain SVG scripts are not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when a malicious data is opened. Successful exploitation may require that SVG uploads are enabled and the victim uses a browser supporting SVG scripting.

The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain operations when a logged in user visits a malicious site.

CVE-2008-5249 CVE-2008-5250 CVE-2008-5252 http://secunia.com/advisories/33133/ http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.html 2008-12-15 2008-12-19
drupal -- multiple vulnerabilities drupal5 5.14 drupal6 6.8

The Drupal Project reports:

The update system is vulnerable to Cross site request forgeries. Malicious users may cause the superuser (user 1) to execute old updates that may damage the database.

When an input format is deleted, not all existing content on a site is updated to reflect this deletion. Such content is then displayed unfiltered. This may lead to cross site scripting attacks when harmful tags are no longer stripped from 'malicious' content that was posted earlier.

CVE-2008-6533 http://drupal.org/node/345441 http://secunia.com/advisories/33112/ 2008-12-11 2008-12-19 2010-05-02
mozilla -- multiple vulnerabilities firefox 2.0.0.20,1 3.*,13.0.5,1 linux-firefox 2.0.0.20 seamonkey linux-seamonkey 1.1.14 thunderbird linux-thunderbird 2.0.0.18

The Mozilla Foundation reports:

MFSA 2008-69 XSS vulnerabilities in SessionStore

MFSA 2008-68 XSS and JavaScript privilege escalation

MFSA 2008-67 Escaped null characters ignored by CSS parser

MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters

MFSA 2008-65 Cross-domain data theft via script redirect error message

MFSA 2008-64 XMLHttpRequest 302 response disclosure

MFSA 2008-62 Additional XSS attack vectors in feed preview

MFSA 2008-61 Information stealing via loadBindingDocument

MFSA 2008-60 Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19)

CVE-2008-5500 CVE-2008-5501 CVE-2008-5502 CVE-2008-5503 CVE-2008-5504 CVE-2008-5505 CVE-2008-5506 CVE-2008-5507 CVE-2008-5508 CVE-2008-5510 CVE-2008-5511 CVE-2008-5512 CVE-2008-5513 http://www.mozilla.org/security/announce/2008/mfsa2008-60.html http://www.mozilla.org/security/announce/2008/mfsa2008-61.html http://www.mozilla.org/security/announce/2008/mfsa2008-62.html http://www.mozilla.org/security/announce/2008/mfsa2008-63.html http://www.mozilla.org/security/announce/2008/mfsa2008-64.html http://www.mozilla.org/security/announce/2008/mfsa2008-65.html http://www.mozilla.org/security/announce/2008/mfsa2008-66.html http://www.mozilla.org/security/announce/2008/mfsa2008-67.html http://www.mozilla.org/security/announce/2008/mfsa2008-68.html http://www.mozilla.org/security/announce/2008/mfsa2008-69.html 2008-12-17 2008-12-19
phpmyadmin -- cross-site request forgery vulnerability phpMyAdmin211 2.11.9.4 phpMyAdmin 3.1.1

The phpMyAdmin Team reports:

A logged-in user can be subject of SQL injection through cross site request forgery. Several scripts in phpMyAdmin are vulnerable and the attack can be made through table parameter.

CVE-2008-5621 http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php http://www.milw0rm.com/exploits/7382 http://secunia.com/advisories/33076/ 2008-12-09 2008-12-11 2010-05-02
php5 -- potential magic_quotes_gpc vulnerability php5 5.2.8

PHP Developers reports:

Due to a security bug found in the PHP 5.2.7 release, it has been removed from distribution. The bug affects configurations where magic_quotes_gpc is enabled, because it remains off even when set to on.

CVE-2008-5844 http://www.php.net/archive/2008.php#id2008-12-07-1 2008-12-07 2008-12-08 2010-05-02
wireshark -- SMTP Processing Denial of Service Vulnerability wireshark wireshark-lite ethereal ethereal-lite tethereal tethereal-lite 1.0.4_1

Secunia reports:

A vulnerability has been reported in Wireshark, which can be exploited by malicious people to cause a DoS.

The vulnerability is caused due to an error in the SMTP dissector and can be exploited to trigger the execution of an infinite loop via a large SMTP packet.

CVE-2008-5285 http://secunia.com/advisories/32840/ http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065840.html 2008-11-24 2008-12-07
php -- multiple vulnerabilities php5 5.2.7

Secunia reports:

Some vulnerabilities have been reported in PHP, where some have an unknown impact and others can potentially be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

An input validation error exists within the "ZipArchive::extractTo()" function when extracting ZIP archives. This can be exploited to extract files to arbitrary locations outside the specified directory via directory traversal sequences in a specially crafted ZIP archive.

An error in the included PCRE library can be exploited to cause a buffer overflow.

The problem is that the "BG(page_uid)" and "BG(page_gid)" variables are not initialized. No further information is currently available.

The problem is that the "php_value" order is incorrect for Apache configurations. No further information is currently available.

An error in the GD library can be exploited to cause a crash via a specially crafted font file.

CVE-2008-2371 CVE-2008-2829 CVE-2008-3658 CVE-2008-3659 CVE-2008-3660 http://www.php.net/ChangeLog-5.php#5.2.7 http://www.sektioneins.de/advisories/SE-2008-06.txt http://secunia.com/advisories/30916/ http://secunia.com/advisories/31409/ http://secunia.com/advisories/32964/ 2008-12-04 2008-12-07
mgetty+sendfax -- symlink attack via insecure temporary files mgetty+sendfax 1.1.35_2

Debian reports:

Faxspool in mgetty 1.1.36 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/faxsp.#### temporary file.

CVE-2008-4936 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496403 https://bugs.gentoo.org/show_bug.cgi?id=235806 2008-08-24 2008-12-07
dovecot-managesieve -- Script Name Directory Traversal Vulnerability dovecot-managesieve 0.10.4 0.11.00.11.1

Secunia reports:

The security issue is caused due to an input validation error when processing script names. This can be exploited to read or modify arbitrary files having ".sieve" extensions via directory traversal attacks, with the privileges of the attacker's user id.

CVE-2008-5301 http://www.vupen.com/english/advisories/2008/3190 http://secunia.com/Advisories/32768/ http://dovecot.org/list/dovecot/2008-November/035259.html 2008-11-18 2008-12-07
habari -- Cross-Site Scripting Vulnerability habari 0.5.2

Secunia reports:

Input passed via the "habari_username" parameter when logging in is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2008-4601 http://packetstorm.linuxsecurity.com/0810-exploits/habaricms-xss.txt http://secunia.com/advisories/32311/ 2008-10-17 2008-12-07
vlc -- arbitrary code execution in the RealMedia processor vlc-devel 0.9.8a

Tobias Klein from TrapKit reports:

The VLC media player contains an integer overflow vulnerability while parsing malformed RealMedia (.rm) files. The vulnerability leads to a heap overflow that can be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.

32545 CVE-2008-5276 http://www.trapkit.de/advisories/TKADV2008-013.txt http://www.videolan.org/security/sa0811.html 2008-11-30 2008-12-06 2008-12-07
mantis -- php code execution vulnerability mantis 1.1.4

Secunia reports:

EgiX has discovered a vulnerability in Mantis, which can be exploited by malicious users to compromise a vulnerable system.

Input passed to the "sort" parameter in manage_proj_page.php is not properly sanitised before being used in a "create_function()" call. This can be exploited to execute arbitrary PHP code.

CVE-2008-4687 http://secunia.com/advisories/32314/ 2008-10-17 2008-12-06
mantis -- multiple vulnerabilities mantis 1.1.2

Secunia reports:

Some vulnerabilities have been reported in Mantis, which can be exploited by malicious users to compromise a vulnerable system and malicious people to conduct cross-site scripting and request forgery attacks.

Input passed to the "filter_target" parameter in return_dynamic_filters.php is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

A vulnerability is caused due to the application allowing users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. add a new user with administrative privileges by enticing a logged-in administrator to visit a malicious site.

Input passed to the "value" parameter in adm_config_set.php is not properly sanitised before being used in an "eval()" statement. This can be exploited to e.g. execute arbitrary PHP commands via a specially crafted request.

Input passed to the "language" parameter in account_prefs_update.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

CVE-2008-2276 CVE-2008-3331 CVE-2008-3332 CVE-2008-3333 http://secunia.com/advisories/30270/ 2008-05-15 2008-12-06
squirrelmail -- Cross site scripting vulnerability squirrelmail 1.4.17

Squirrelmail team reports:

An issue was fixed that allowed an attacker to send specially- crafted hyperlinks in a message that could execute cross-site scripting (XSS) when the user viewed the message in SquirrelMail.

CVE-2008-2379 http://secunia.com/Advisories/32143/ http://sourceforge.net/project/shownotes.php?release_id=644750&group_id=311 2008-12-03 2008-12-04
openoffice -- arbitrary code execution vulnerabilities openoffice.org-2 openoffice.org-2-RC openoffice.org-2-devel 2.42.4.2 2.4.20040402

The OpenOffice Team reports:

A security vulnerability with the way OpenOffice 2.x process WMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now.

A security vulnerability with the way OpenOffice 2.x process EMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now.

CVE-2008-2237 CVE-2008-2238 http://www.openoffice.org/security/cves/CVE-2008-2237.html http://www.openoffice.org/security/cves/CVE-2008-2238.html 2008-10-29 2008-11-29
wordpress -- header rss feed script insertion vulnerability wordpress de-wordpress wordpress-mu 2.6.5 zh-wordpress 0

Secunia reports:

Input passed via the HTTP "Host" header is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if malicious data is viewed.

CVE-2008-5278 http://secunia.com/advisories/32882/ http://wordpress.org/development/2008/11/wordpress-265/ 2008-11-26 2008-11-29 2010-05-02
samba -- potential leakage of arbitrary memory contents samba samba3 ja-samba 3.0.29,13.0.32_2,1 samba32-devel 3.2.4_1

Samba Team reports:

Samba 3.0.29 and beyond contain a change to deal with gcc 4 optimizations. Part of the change modified range checking for client-generated offsets of secondary trans, trans2 and nttrans requests. These requests are used to transfer arbitrary amounts of memory from clients to servers and back using small SMB requests and contain two offsets: One offset (A) pointing into the PDU sent by the client and one (B) to direct the transferred contents into the buffer built on the server side. While the range checking for offset (B) is correct, a cut and paste error lets offset (A) pass completely unchecked against overflow.

The buffers passed into trans, trans2 and nttrans undergo higher-level processing like DCE/RPC requests or listing directories. The missing bounds check means that a malicious client can make the server do this higher-level processing on arbitrary memory contents of the smbd process handling the request. It is unknown if that can be abused to pass arbitrary memory contents back to the client, but an important barrier is missing from the affected Samba versions.

CVE-2008-4314 http://www.samba.org/samba/security/CVE-2008-4314.html http://secunia.com/advisories/32813/ 2008-11-27 2008-11-29
hplip -- hpssd Denial of Service hplip 2.8.2_3

Secunia reports:

A security issue has been reported in hplip, which can be exploited by malicious, local users to cause a DoS.

The security issue is caused due to an error within hpssd.py when parsing certain requests. This can be exploited to crash the service by sending specially crafted requests to the default port 2207/TCP.

CVE-2008-2940 CVE-2008-2941 30683 https://rhn.redhat.com/errata/RHSA-2008-0818.html http://secunia.com/advisories/31470 2008-08-14 2008-11-29
cups -- potential buffer overflow in PNG reading code cups-base 1.3.9_2

CUPS reports:

The PNG image reading code did not validate the image size properly, leading to a potential buffer overflow (STR #2974)

CVE-2008-5286 http://www.cups.org/str.php?L2974 http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt http://www.openwall.com/lists/oss-security/2008/11/25/2 2008-10-17 2008-11-29 2008-12-25
imlib2 -- XPM processing buffer overflow vulnerability imlib2 imlib2-nox11 1.4.1.000_1,2

Secunia reports:

A vulnerability has been discovered in imlib2, which can be exploited by malicious people to potentially compromise an application using the library.

The vulnerability is caused due to a pointer arithmetic error within the "load()" function provided by the XPM loader. This can be exploited to cause a heap-based buffer overflow via a specially crafted XPM file.

Successful exploitation may allow execution of arbitrary code.

32371 CVE-2008-5187 http://secunia.com/Advisories/32796/ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15 http://bugzilla.enlightenment.org/show_bug.cgi?id=547 2008-11-20 2008-11-24
streamripper -- multiple buffer overflows streamripper 1.64.0

Secunia reports:

A boundary error exists within http_parse_sc_header() in lib/http.c when parsing an overly long HTTP header starting with "Zwitterion v".

A boundary error exists within http_get_pls() in lib/http.c when parsing a specially crafted pls playlist containing an overly long entry.

A boundary error exists within http_get_m3u() in lib/http.c when parsing a specially crafted m3u playlist containing an overly long "File" entry.

CVE-2008-4829 http://secunia.com/secunia_research/2008-50/ http://streamripper.cvs.sourceforge.net/viewvc/streamripper/sripper_1x/CHANGES?revision=1.196 2008-11-05 2008-11-23
mantis -- session hijacking vulnerability mantis 1.1.3

The mantis Team reports:

When configuring a web application to use only ssl (e. g. by forwarding all http-requests to https), a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Else the cookie will be transferred through http if the victim's browser does a single http-request on the same domain.

CVE-2008-3102 http://www.mantisbt.org/bugs/view.php?id=9524 http://www.mantisbt.org/bugs/view.php?id=9533 http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/ http://int21.de/cve/CVE-2008-3102-mantis.html 2008-10-14 2008-11-22
dovecot -- ACL plugin bypass vulnerabilities dovecot 1.1.4

Timo Sirainen reports in dovecot 1.1.4 release notes:

ACL plugin fixes: Negative rights were actually treated as positive rights. 'k' right didn't prevent creating parent/child/child mailbox. ACL groups weren't working.

31587 CVE-2008-4577 CVE-2008-4578 2008-10-05 2008-11-19
libxml2 -- multiple vulnerabilities libxml2 2.6.32_2

Secunia reports:

Two vulnerabilities have been reported in Libxml2, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise an application using the library.

1) An integer overflow error in the "xmlSAX2Characters()" function can be exploited to trigger a memory corruption via a specially

Successful exploitation may allow execution of arbitrary code, but requires e.g. that the user is tricked into processing an overly large XML file (2GB or more).

2) An integer overflow error in the "xmlBufferResize()" function can be exploited to trigger the execution of an infinite loop. The vulnerabilities are reported in version 2.7.2.

Other versions may also be affected.

CVE-2008-4225 CVE-2008-4226 https://bugzilla.redhat.com/show_bug.cgi?id=470466 https://bugzilla.redhat.com/show_bug.cgi?id=470480 http://secunia.com/Advisories/32773/ 2008-11-18 2008-11-19
openfire -- multiple vulnerabilities openfire 3.6.1

Andreas Kurtz reports:

The jabber server Openfire (<= version 3.6.0a) contains several serious vulnerabilities. Depending on the particular runtime environment these issues can potentially even be used by an attacker to execute code on operating system level.

  1. Authentication bypass - This vulnerability provides an attacker full access to all functions in the admin webinterface without providing any user credentials. The Tomcat filter which is responsible for authentication could be completely circumvented.
  2. SQL injection - It is possible to pass SQL statements to the backend database through a SQL injection vulnerability. Depending on the particular runtime environment and database permissions it is even possible to write files to disk and execute code on operating system level.
  3. Multiple Cross-Site Scripting - Permits arbitrary insertion of HTML- and JavaScript code in login.jsp. An attacker could also manipulate a parameter to specify a destination to which a user will be forwarded to after successful authentication.
CVE-2008-6510 CVE-2008-6511 CVE-2008-6508 CVE-2009-1595 CVE-2008-1728 CVE-2008-6509 http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html http://secunia.com/Advisories/32478/ 2008-11-07 2008-11-19 2010-05-02
syslog-ng2 -- startup directory leakage in the chroot environment syslog-ng2 2.0.9_2 syslog-ng 1.6.12_1

Florian Grandel reports:

I have not had the time to analyze all of syslog-ng code. But by reading the code section near the chroot call and looking at strace results I believe that syslog-ng does not chdir to the chroot jail's location before chrooting into it.

This opens up ways to work around the chroot jail.

CVE-2008-5110 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791 http://www.openwall.com/lists/oss-security/2008/11/17/3 2008-11-15 2008-11-18 2009-07-01
enscript -- arbitrary code execution vulnerability enscript-a4 enscript-letter enscript-letterdj 1.6.4_2

Ulf Harnhammar of Secunia Research reports:

Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.

CVE-2008-3863 CVE-2008-4306 http://secunia.com/secunia_research/2008-41/ 2008-10-22 2008-11-18
gnutls -- X.509 certificate chain validation vulnerability gnutls 2.4.2

SecurityFocus reports:

GnuTLS is prone to a security-bypass vulnerability because the application fails to properly validate chained X.509 certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks by impersonating trusted servers. Unsuspecting users may be under a false sense of security that can aid attackers in launching further attacks.

32232 CVE-2008-4989 http://www.gnu.org/software/gnutls/security.html http://lists.gnu.org/archive/html/gnutls-devel/2008-11/msg00017.html 2008-11-10 2008-11-16
net-snmp -- DoS for SNMP agent via crafted GETBULK request net-snmp 5.45.4.2.1 5.35.3.2.3

Wes Hardaker reports through sourceforge.net forum:

SECURITY ISSUE: A bug in the getbulk handling code could let anyone with even minimal access crash the agent. If you have open access to your snmp agents (bad bad bad; stop doing that!) or if you don't trust everyone that does have access to your agents you should updated immediately to prevent potential denial of service attacks.

Description at cve.mitre.org additionally clarifies:

Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.

CVE-2008-4309 http://sourceforge.net/forum/forum.php?forum_id=882903 http://www.openwall.com/lists/oss-security/2008/10/31/1 http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/tags/Ext-5-2-5-1/net-snmp/agent/snmp_agent.c?r1=17271&r2=17272&pathrev=17272 2008-10-12 2008-11-14 2009-03-23
mozilla -- multiple vulnerabilities firefox 2.0.0.18,1 3.*,13.0.4,1 linux-firefox 2.0.0.18 seamonkey linux-seamonkey 1.1.13 thunderbird linux-thunderbird 2.0.0.18

The Mozilla Foundation reports:

MFSA 2008-58 Parsing error in E4X default namespace

MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals

MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation

MFSA 2008-55 Crash and remote code execution in nsFrameManager

MFSA 2008-54 Buffer overflow in http-index-format parser

MFSA 2008-53 XSS and JavaScript privilege escalation via session restore

MFSA 2008-52 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18)

MFSA 2008-51 file: URIs inherit chrome privileges when opened from chrome

MFSA 2008-50 Crash and remote code execution via __proto__ tampering

MFSA 2008-49 Arbitrary code execution via Flash Player dynamic module unloading

MFSA 2008-48 Image stealing via canvas and HTTP redirect

MFSA 2008-47 Information stealing via local shortcut files

MFSA 2008-46 Heap overflow when canceling newsgroup message

MFSA 2008-44 resource: traversal vulnerabilities

MFSA 2008-43 BOM characters stripped from JavaScript before execution

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution

MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-37 UTF-8 URL stack buffer overflow

CVE-2008-0017 CVE-2008-4582 CVE-2008-5012 CVE-2008-5013 CVE-2008-5014 CVE-2008-5015 CVE-2008-5016 CVE-2008-5017 CVE-2008-5018 CVE-2008-5019 CVE-2008-5021 CVE-2008-5022 CVE-2008-5023 CVE-2008-5024 http://www.mozilla.org/security/announce/2008/mfsa2008-47.html http://www.mozilla.org/security/announce/2008/mfsa2008-48.html http://www.mozilla.org/security/announce/2008/mfsa2008-49.html http://www.mozilla.org/security/announce/2008/mfsa2008-50.html http://www.mozilla.org/security/announce/2008/mfsa2008-51.html http://www.mozilla.org/security/announce/2008/mfsa2008-52.html http://www.mozilla.org/security/announce/2008/mfsa2008-53.html http://www.mozilla.org/security/announce/2008/mfsa2008-54.html http://www.mozilla.org/security/announce/2008/mfsa2008-55.html http://www.mozilla.org/security/announce/2008/mfsa2008-56.html http://www.mozilla.org/security/announce/2008/mfsa2008-57.html http://www.mozilla.org/security/announce/2008/mfsa2008-58.html 2008-11-13 2008-11-13 2008-11-23
faad2 -- heap overflow vulnerability faad2 2.6.1_1,1

CVE reports:

Heap-based buffer overflow in the decodeMP4file function (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MPEG-4 (MP4) file.

CVE-2008-4201 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499899 http://www.gentoo.org/security/en/glsa/glsa-200811-03.xml 2008-09-16 2008-11-12 2008-11-13
emacs -- run-python vulnerability emacs 2222.2_1

Emacs developers report:

The Emacs command `run-python' launches an interactive Python interpreter. After the Python process starts up, Emacs automatically sends it the line:

import emacs

which normally imports a script named emacs.py which is distributed with Emacs. This script, which is typically located in a write-protected installation directory with other Emacs program files, defines various functions to help the Python process communicate with Emacs.

The vulnerability arises because Python, by default, prepends '' to the module search path, so modules are looked for in the current directory. If the current directory is world-writable, an attacker may insert malicious code by adding a fake Python module named emacs.py into that directory.

CVE-2008-3949 http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html 2008-09-05 2008-11-07 2010-05-02
clamav -- off-by-one heap overflow in VBA project parser clamav 0.94.1 clamav-devel 20081105

Advisory from Moritz Jodeit, November 8th, 2008:

ClamAV contains an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the `clamd' process by sending an email with a prepared attachment.

A VBA project file embedded inside an OLE2 office document send as an attachment can trigger the off-by-one.

Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog:

libclamav/vba_extract.c: get_unicode_name off-by-one, bb#1239 reported by Moritz Jodeit >moritz*jodeit.org<

http://www.securityfocus.com/archive/1/498169/30/0/threaded http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog CVE-2008-5050 2008-11-08 2008-11-10
trac -- potential DOS vulnerability trac 0.11.2 ja-trac 0.11.2

Trac development team reports:

0.11.2 is a new stable maintenance release. It contains several security fixes and everyone is recommended to upgrade their installations.

Bug fixes:

Fixes potential DOS vulnerability with certain wiki markup.

http://groups.google.com/group/trac-announce/browse_thread/thread/67f7a22ec818d97d 2008-11-08 2008-11-09
vlc -- cue processing stack overflow vlc 0.8.6.i_2,2 vlc-devel 0.9.6,3

The VLC Team reports:

The VLC media player contains a stack overflow vulnerability while parsing malformed cue files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of VLC media player.

CVE-2008-5032 CVE-2008-5036 http://www.videolan.org/security/sa0810.html http://www.trapkit.de/advisories/TKADV2008-012.txt 2008-11-05 2008-11-08 2010-05-02
opera -- multiple vulnerabilities opera linux-opera 9.62

Opera reports:

When certain parameters are passed to Opera's History Search, they can cause content not to be correctly sanitized. This can allow scripts to be injected into the History Search results page. Such scripts can then run with elevated privileges and interact with Opera's configuration, allowing them to execute arbitrary code.

The links panel shows links in all frames on the current page, including links with JavaScript URLs. When a page is held in a frame, the script is incorrectly executed on the outermost page, not the page where the URL was located. This can be used to execute scripts in the context of an unrelated frame, which allows cross-site scripting.

CVE-2008-4794 http://www.opera.com/support/search/view/906/ http://www.opera.com/support/search/view/907/ 2008-11-03 2008-11-03 2010-05-02
qemu -- Heap overflow in Cirrus emulation qemu qemu-devel 0.9.1_10 0.9.1s.20080101*0.9.1s.20080620_2

Aurelien Jarno reports:

CVE-2008-4539: fix a heap overflow in Cirrus emulation

The code in hw/cirrus_vga.c has changed a lot between CVE-2007-1320 has been announced and the patch has been applied. As a consequence it has wrongly applied and QEMU is still vulnerable to this bug if using VNC.

CVE-2008-4539 http://lists.gnu.org/archive/html/qemu-devel/2008-10/msg01363.html 2008-11-01 2008-11-02
phpmyadmin -- Cross-Site Scripting Vulnerability phpMyAdmin 3.03.0.1.1 2.11.9.3 phpMyAdmin211 2.11.9.3

SecurityFocus reports:

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

31928 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-9 2008-10-30 2008-10-31 2008-10-31
opera -- multiple vulnerabilities opera linux-opera 9.61

Opera reports:

Certain constructs are not escaped correctly by Opera's History Search results. These can be used to inject scripts into the page, which can then be used to look through the user's browsing history, including the contents of the pages they have visited. These may contain sensitive information.

If a link that uses a JavaScript URL triggers Opera's Fast Forward feature, when the user activates Fast Forward, the script should run on the current page. When a page is held in a frame, the script is incorrectly executed on the outermost page, not the page where the URL was located. This can be used to execute scripts in the context of an unrelated frame, which allows cross-site scripting.

When Opera is previewing a news feed, some scripts are not correctly blocked. These scripts are able to subscribe the user to any feed URL that the attacker chooses, and can also view the contents of any feeds that the user is subscribed to. These may contain sensitive information.

CVE-2008-4697 CVE-2008-4698 CVE-2008-4725 http://www.opera.com/support/search/view/903/ http://www.opera.com/support/search/view/904/ http://www.opera.com/support/search/view/905/ 2008-10-17 2008-10-28 2010-05-02
libspf2 -- Buffer overflow libspf2 1.2.8

CVE reports:

Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.

31881 CVE-2008-2469 2008-10-21 2008-10-27
openx -- sql injection vulnerability openx 2.6.2

Secunia reports:

OpenX can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "bannerid" parameter in www/delivery/ac.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

http://secunia.com/advisories/32114/ http://blog.openx.org/10/openx-security-update/ 2008-10-03 2008-10-25
flyspray -- multiple vulnerabilities flyspray 0.9.9.5.1

The Flyspray Project reports:

Flyspray is affected by a Cross Site scripting Vulnerability due to an error escaping PHP's $_SERVER['QUERY_STRING'] superglobal, that can be maliciously used to inject arbitrary code into the savesearch() javascript function.

There is an XSS problem in the history tab, the application fails to sanitize the "details" parameter correctly, leading to the possibility of arbitrary code injection into the getHistory() javascript function.

Flyspray is affected by a Cross Site scripting Vulnerability due missing escaping of SQL error messages. By including HTML code in a query and at the same time causing it to fail by submitting invalid data, an XSS hole can be exploited.

There is an XSS problem in the task history attached to comments, since the application fails to sanitize the old_value and new_value database fields for changed task summaries.

Input passed via the "item_summary" parameter to "index.php?do=details" is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2007-6461 CVE-2008-1165 CVE-2008-1166 http://secunia.com/advisories/29215 2008-02-24 2008-10-25
wordpress -- snoopy "_httpsrequest()" shell command execution vulnerability wordpress de-wordpress wordpress-mu 2.6.3

The Wordpress development team reports:

A vulnerability in the Snoopy library was announced today. WordPress uses Snoopy to fetch the feeds shown in the Dashboard. Although this seems to be a low risk vulnerability for WordPress users, we wanted to get an update out immediately.

31887 http://secunia.com/Advisories/32361/ http://wordpress.org/development/2008/10/wordpress-263/ 2008-10-23 2008-10-24
drupal -- multiple vulnerabilities drupal5 5.12 drupal6 6.6

The Drupal Project reports:

On a server configured for IP-based virtual hosts, Drupal may be caused to include and execute specifically named files outside of its root directory. This bug affects both Drupal 5 and Drupal 6.

The title of book pages is not always properly escaped, enabling users with the "create book content" permission or the permission to edit any node in the book hierarchy to insert arbitrary HTML and script code into pages. Such a Cross site scripting attack may lead to the attacker gaining administrator access. This bug affects Drupal 6.

CVE-2008-6170 http://drupal.org/node/324824 2008-10-22 2008-10-22 2010-05-12
libxine -- denial of service vulnerability libxine 1.1.15

xine team reports:

A new xine-lib version is now available. This release contains some security fixes, notably a DoS via corrupted Ogg files (CVE-2008-3231), some related fixes, and fixes for a few possible buffer overflows.

CVE-2008-3231 http://www.xinehq.de/index.php/news http://xforce.iss.net/xforce/xfdb/44040 2008-07-13 2008-10-19
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.0r124_1

Adobe Product Security Incident Response Team reports:

Potential vulnerabilities have been identified in Adobe Flash Player 9.0.124.0 and earlier that could allow an attacker who successfully exploits these potential vulnerabilities to bypass Flash Player security controls. Adobe recommends users update to the most current version of Flash Player available for their platform.

CVE-2007-6243 CVE-2008-3873 CVE-2007-4324 CVE-2008-4401 CVE-2008-4503 http://www.adobe.com/support/security/bulletins/apsb08-18.html 2008-10-15 2008-10-17
libxml2 -- two vulnerabilities libxml2 2.6.32_1

Secunia reports:

Two vulnerabilities have been reported in Libxml2, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.

1) A recursion error exists when processing certain XML content. This can be exploited to e.g. exhaust all available memory and CPU resources by tricking an application using Libxml2 into processing specially crafted XML documents.

2) A boundary error in the processing of long XML entity names in parser.c can be exploited to cause a heap-based buffer overflow when specially crafted XML content is parsed.

Successful exploitation may allow execution of arbitrary code.

CVE-2008-3281 CVE-2008-3529 2008-08-22 2008-10-15 2008-10-20
drupal -- multiple vulnerabilities drupal5 5.11 drupal6 6.5

The Drupal Project reports:

A logic error in the core upload module validation allowed unprivileged users to attach files to content. Users can view files attached to content which they do not otherwise have access to. If the core upload module is not enabled, your site will not be affected.

A deficiency in the user module allowed users who had been blocked by access rules to continue logging into the site under certain conditions. If you do not use the 'access rules' functionality in core, your site will not be affected.

The BlogAPI module does not implement correct validation for certain content fields, allowing for values to be set for fields which would otherwise be inaccessible on an internal Drupal form. We have hardened these checks in BlogAPI module for this release, but the security team would like to re-iterate that the 'Administer content with BlogAPI' permission should only be given to trusted users. If the core BlogAPI module is not enabled, your site will not be affected.

A weakness in the node module API allowed for node validation to be bypassed in certain circumstances for contributed modules implementing the API. Additional checks have been added to ensure that validation is performed in all cases. This vulnerability only affects sites using one of a very small number of contributed modules, all of which will continue to work correctly with the improved API. None of them were found vulnerable, so our correction is a preventative measure.

CVE-2008-4791 CVE-2008-4792 CVE-2008-4793 http://drupal.org/node/318706 http://secunia.com/advisories/32200/ http://secunia.com/advisories/32201/ http://secunia.com/advisories/32198/ 2008-10-08 2008-10-12 2010-05-12
cups -- multiple vulnerabilities cups-base 1.3.9

The release note of cups 1.3.9 reports:

It contains the following fixes:

  • SECURITY: The HP-GL/2 filter did not range check pen numbers (STR #2911)
  • SECURITY: The SGI image file reader did not range check 16-bit run lengths (STR #2918)
  • SECURITY: The text filter did not range check cpi, lpi, or column values (STR #2919)

Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the affected service.

CVE-2008-3639 CVE-2008-3640 CVE-2008-3641 2008-10-09 2008-10-10
opera -- multiple vulnerabilities opera linux-opera 9.60

Opera reports:

If a malicious page redirects Opera to a specially crafted address (URL), it can cause Opera to crash. Given sufficient address content, the crash could cause execution of code controlled by the attacking page.

Once a Java applet has been cached, if a page can predict the cache path for that applet, it can load the applet from the cache, causing it to run in the context of the local machine. This allows it to read other cache files on the computer or perform other normally more restrictive actions. These files could contain sensitive information, which could then be sent to the attacker.

CVE-2008-4695 CVE-2008-4694 http://www.opera.com/support/search/view/901/ http://www.opera.com/support/search/view/902/ 2008-10-04 2008-10-10 2010-05-12
mysql -- command line client input validation vulnerability mysql-client 5.15.1.28_1 5.05.0.67_1

Thomas Henlich reports:

The mysql command-line client does not quote HTML special characters like < in its output. This allows an attacker who is able to write data into a table to hide or modify records in the output, and to inject potentially dangerous code, e. g. Javascript to perform cross-site scripting or cross-site request forgery attacks.

31486 http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability/ 2007-04-17 2008-10-01 2008-10-10
mplayer -- multiple integer overflows mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.11_7

The oCERT team reports:

The MPlayer multimedia player suffers from a vulnerability which could result in arbitrary code execution and at the least, in unexpected process termination. Three integer underflows located in the Real demuxer code can be used to exploit a heap overflow, a specific video file can be crafted in order to make the stream_read function reading or writing arbitrary amounts of memory.

CVE-2008-3827 http://www.ocert.org/advisories/ocert-2008-013.html 2008-09-30 2008-10-01 2008-10-02
lighttpd -- multiple vulnerabilities lighttpd 1.4.19_3

Lighttpd seurity annoucement:

lighttpd 1.4.19, and possibly other versions before 1.5.0, does not decode the url before matching against rewrite and redirect patterns, which allows attackers to bypass rewrites rules. this can be a security problem in certain configurations if these rules are used to hide certain urls.

lighttpd 1.4.19, and possibly other versions before 1.5.0, does not lowercase the filename after generating it from the url in mod_userdir on case insensitive (file)systems.

As other modules are case sensitive, this may lead to information disclosure; for example if one configured php to handle files ending on ".php", an attacker will get the php source with http://example.com/~user/file.PHP

lighttpd 1.4.19 does not always release a header if it triggered a 400 (Bad Request) due to a duplicate header.

31434 CVE-2008-4298 CVE-2008-4359 CVE-2008-4360 http://www.lighttpd.net/security/lighttpd_sa_2008_05.txt http://www.lighttpd.net/security/lighttpd_sa_2008_06.txt http://www.lighttpd.net/security/lighttpd_sa_2008_07.txt 2008-09-26 2008-09-27 2009-02-22
bitlbee -- account recreation security issues bitlbee 1.2.3

Secunia reports:

Some security issues have been reported in BitlBee, which can be exploited by malicious people to bypass certain security restrictions and hijack accounts.

The security issues are caused due to unspecified errors, which can be exploited to overwrite existing accounts.

CVE-2008-3920 CVE-2008-3969 http://secunia.com/advisories/31633/ 2008-08-27 2008-09-26 2008-10-03
mozilla -- multiple vulnerabilities firefox 2.0.0.17,1 3.*,13.0.2,1 linux-firefox linux-firefox-devel 2.0.0.17 seamonkey linux-seamonkey 1.1.12 thunderbird linux-thunderbird 2.0.0.17 flock linux-flock 2.0 linux-seamonkey-devel 0

The Mozilla Foundation reports:

MFSA 2008-37
UTF-8 URL stack buffer overflow

MFSA 2008-38
nsXMLDocument::OnChannelRedirect() same-origin violation

MFSA 2008-39
Privilege escalation using feed preview page and XSS flaw

MFSA 2008-40
Forced mouse drag

MFSA 2008-41
Privilege escalation via XPCnativeWrapper pollution

MFSA 2008-42
Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)

MFSA 2008-43
BOM characters stripped from JavaScript before execution

MFSA 2008-44
resource: traversal vulnerabilities

MFSA 2008-45
XBM image uninitialized memory reading

CVE-2008-0016 CVE-2008-3835 CVE-2008-3836 CVE-2008-3837 CVE-2008-4058 CVE-2008-4059 CVE-2008-4060 CVE-2008-4061 CVE-2008-4062 CVE-2008-4063 CVE-2008-4064 CVE-2008-4065 CVE-2008-4067 CVE-2008-4068 CVE-2008-4069 http://www.mozilla.org/security/announce/2008/mfsa2008-37.html http://www.mozilla.org/security/announce/2008/mfsa2008-38.html http://www.mozilla.org/security/announce/2008/mfsa2008-39.html http://www.mozilla.org/security/announce/2008/mfsa2008-40.html http://www.mozilla.org/security/announce/2008/mfsa2008-41.html http://www.mozilla.org/security/announce/2008/mfsa2008-42.html http://www.mozilla.org/security/announce/2008/mfsa2008-43.html http://www.mozilla.org/security/announce/2008/mfsa2008-44.html http://www.mozilla.org/security/announce/2008/mfsa2008-45.html 2008-09-24 2008-09-24 2009-12-12
squirrelmail -- Session hijacking vulnerability squirrelmail 1.4.15_1

Hanno Boeck reports:

When configuring a web application to use only ssl (e.g. by forwarding all http-requests to https), a user would expect that sniffing and hijacking the session is impossible.

Though, for this to be secure, one needs to set the session cookie to have the secure flag. Otherwise the cookie will be transferred through HTTP if the victim's browser does a single HTTP request on the same domain.

Squirrelmail does not set that flag. It is fixed in the 1.5 test versions, but current 1.4.15 is vulnerable.

31321 CVE-2008-3663 http://seclists.org/bugtraq/2008/Sep/0239.html 2008-08-12 2008-09-23
proftpd -- Long Command Processing Vulnerability proftpd proftpd-mysql 1.3.2rc2 proftpd-devel 1.3.20080922

Secunia reports:

The vulnerability is caused due to the application truncating an overly long FTP command, and improperly interpreting the remainder string as a new FTP command. This can be exploited to execute arbitrary FTP commands with the privileges of another user by e.g. tricking the user into following malicious link.

CVE-2008-4242 CVE-2008-4247 http://secunia.com/advisories/31930/ http://bugs.proftpd.org/show_bug.cgi?id=3115 2008-09-22 2008-09-23 2010-05-12
phpmyadmin -- Cross-Site Scripting Vulnerability phpMyAdmin 2.11.9.2

Secunia reports:

An error exists in the "PMA_escapeJsString()" function in libraries/js_escape.lib.php, which can be exploited to bypass certain filters and execute arbitrary HTML and script code in a user's browser session in context of an affected site when e.g. Microsoft Internet Explorer is used.

http://secunia.com/Advisories/31974/ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8 2008-09-23 2008-09-23 2008-10-03
gallery -- multiple vulnerabilities gallery 1.5.9 gallery2 2.2.6

Secunia reports:

An error in the handing of ZIP archives with symbolic links can be exploited to disclose the contents of arbitrary files.

Input from uploaded Flash animations is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed.

http://secunia.com/advisories/31912/ http://secunia.com/advisories/31858/ 2008-09-18 2008-09-19 2008-10-03
phpmyadmin -- Code execution vulnerability phpMyAdmin 2.11.9.1

A phpMyAdmin security announcement:

The server_databases.php script was vulnerable to an attack coming from a user who is already logged-on to phpMyAdmin, where he can execute shell code (if the PHP configuration permits commands like exec).

CVE-2008-4096 http://secunia.com/Advisories/31884/ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7 2008-09-15 2008-09-17 2010-05-12
twiki -- Arbitrary code execution in session files twiki 4.2.3

Th1nk3r reports:

The version of TWiki installed on the remote host allows access to the 'configure' script and fails to sanitize the 'image' parameter of that script of directory traversal sequences before returning the file contents when the 'action' parameter is set to 'image'. An unauthenticated attacker can leverage this issue to view arbitrary files on the remote host subject to the privileges of the web server user id. .

CVE-2008-3195 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-3195 http://www.kb.cert.org/vuls/id/362012 https://inspectit.accessitgroup.com/threats/details.cgi?id=34031 http://www.nessus.org/plugins/index.php?view=single&id=34031 2008-08-05 2008-09-14
neon -- NULL pointer dereference in Digest domain support neon28 0.28.3

Joe Orton reports:

A NULL pointer deference in the Digest authentication support in neon versions 0.28.0 through 0.28.2 inclusive allows a malicious server to crash a client application, resulting in possible denial of service.

30710 CVE-2008-3746 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=476571 http://lists.manyfish.co.uk/pipermail/neon/2008-August/000040.html 2008-08-15 2008-09-12
clamav -- CHM Processing Denial of Service clamav 0.94 clamav-devel 20080902

Hanno Boeck reports:

A fuzzing test showed weakness in the chm parser of clamav, which can possibly be exploited. The clamav team has disabled the chm module in older versions though freshclam updates and has released 0.94 with a fixed parser.

CVE-2008-1389 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089 2008-07-09 2008-09-12
horde -- multiple vulnerabilities horde-base 3.2.2

Secunia reports:

Some vulnerabilities have been reported in various Horde products, which can be exploited by malicious people to conduct script insertion attacks

Input via MIME attachment linking is not properly sanitised in the MIME library before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session if e.g. a malicious email is viewed.

Certain unspecified input in HTML messages is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script in a user's browser session if e.g. a malicious HTML email is viewed.

CVE-2008-3823 CVE-2008-3824 http://lists.horde.org/archives/announce/2008/000429.html http://secunia.com/advisories/31842/ 2008-09-10 2008-09-11 2008-10-03
python -- multiple vulnerabilities python24 2.4.5_2 python25 2.5.2_3 python23 0

Secunia reports:

Some vulnerabilities have been reported in Python, where some have unknown impact and others can potentially be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system.

Various integer overflow errors exist in core modules e.g. stringobject, unicodeobject, bufferobject, longobject, tupleobject, stropmodule, gcmodule, mmapmodule.

An integer overflow in the hashlib module can lead to an unreliable cryptographic digest results.

Integer overflow errors in the processing of unicode strings can be exploited to cause buffer overflows on 32-bit systems.

An integer overflow exists in the PyOS_vsnprintf() function on architectures that do not have a "vsnprintf()" function.

An integer underflow error in the PyOS_vsnprintf() function when passing zero-length strings can lead to memory corruption.

CVE-2008-2315 CVE-2008-2316 CVE-2008-3142 CVE-2008-3144 http://bugs.python.org/issue2620 http://bugs.python.org/issue2588 http://bugs.python.org/issue2589 http://secunia.com/advisories/31305 http://mail.python.org/pipermail/python-checkins/2008-July/072276.html http://mail.python.org/pipermail/python-checkins/2008-July/072174.html http://mail.python.org/pipermail/python-checkins/2008-June/070481.html 2008-08-04 2008-09-10
mysql -- MyISAM table privileges security bypass vulnerability mysql-server 6.06.0.5 5.15.1.24 5.05.0.67 4.14.1.22_1

SecurityFocus reports:

MySQL is prone to a security-bypass vulnerability. An attacker can exploit this issue to overwrite existing table files in the MySQL data directory, bypassing certain security restrictions.

29106 CVE-2008-2079 2008-05-05 2008-09-10 2008-10-10
rubygem-rails -- SQL injection vulnerability rubygem-rails 2.2.2

Jonathan Weiss reports, that it is possible to perform an SQL injection in Rails applications via not correctly sanitized :limit and :offset parameters. It is possible to change arbitrary values in affected tables or gain access to the sensitive data.

CVE-2008-4094 http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 2008-09-08 2008-09-10 2010-05-12
wordpress -- remote privilege escalation wordpress de-wordpress wordpress-mu 2.6.2 zh-wordpress 0

The Wordpress development team reports:

With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another users password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.

31068 CVE-2008-4107 http://wordpress.org/development/2008/09/wordpress-262/ 2008-09-08 2008-10-22 2010-05-12
FreeBSD -- Remote kernel panics on IPv6 connections FreeBSD 6.36.3_4 7.07.0_4

Problem Description:

In case of an incoming ICMPv6 'Packet Too Big Message', there is an insufficient check on the proposed new MTU for a path to the destination.

Impact:

When the kernel is configured to process IPv6 packets and has active IPv6 TCP sockets, a specifically crafted ICMPv6 'Packet Too Big Message' could cause the TCP stack of the kernel to panic.

Workaround:

Systems without INET6 / IPv6 support are not vulnerable and neither are systems which do not listen on any IPv6 TCP sockets and have no active IPv6 connections.

Filter ICMPv6 'Packet Too Big Messages' using a firewall, but this will at the same time break PMTU support for IPv6 connections.

CVE-2008-3530 SA-08:09.icmp6 2008-09-03 2008-09-05
FreeBSD -- nmount(2) local arbitrary code execution FreeBSD 6.36.3_4 7.07.0_4

Problem Description:

Various user defined input such as mount points, devices, and mount options are prepared and passed as arguments to nmount(2) into the kernel. Under certain error conditions, user defined data will be copied into a stack allocated buffer stored in the kernel without sufficient bounds checking.

Impact:

If the system is configured to allow unprivileged users to mount file systems, it is possible for a local adversary to exploit this vulnerability and execute code in the context of the kernel.

Workaround:

It is possible to work around this issue by allowing only privileged users to mount file systems by running the following sysctl(8) command:

# sysctl vfs.usermount=0
CVE-2008-3531 SA-08:08.nmount 2008-09-03 2008-09-05
FreeBSD -- amd64 swapgs local privilege escalation FreeBSD 6.36.3_4 7.07.0_4

Problem Description:

If a General Protection Fault happens on a FreeBSD/amd64 system while it is returning from an interrupt, trap or system call, the swapgs CPU instruction may be called one extra time when it should not resulting in userland and kernel state being mixed.

Impact:

A local attacker can by causing a General Protection Fault while the kernel is returning from an interrupt, trap or system call while manipulating stack frames and, run arbitrary code with kernel privileges.

The vulnerability can be used to gain kernel / supervisor privilege. This can for example be used by normal users to gain root privileges, to break out of jails, or bypass Mandatory Access Control (MAC) restrictions.

Workaround:

No workaround is available, but only systems running the 64 bit FreeBSD/amd64 kernels are vulnerable.

Systems with 64 bit capable CPUs, but running the 32 bit FreeBSD/i386 kernel are not vulnerable.

CVE-2008-3890 SA-08:07.amd64 2008-09-03 2008-09-05
opera -- multiple vulnerabilities opera linux-opera 9.52

The Opera Team reports:

Scripts are able to change the addresses of framed pages that come from the same site. Due to a flaw in the way that Opera checks what frames can be changed, a site can change the address of frames on other sites inside any window that it has opened. This allows sites to open pages from other sites, and display misleading information on them.

Custom shortcut and menu commands can be used to activate external applications. In some cases, the parameters passed to these applications are not prepared correctly, and may be created from uninitialized memory. These may be misinterpreted as additional parameters, and depending on the application, this could allow execution of arbitrary code.

Successful exploitation requires convincing the user to modify their shortcuts or menu files appropriately, pointing to an appropriate target application, then to activate that shortcut at an appropriate time. To inject code, additional means will have to be employed.

When insecure pages load content from secure sites into a frame, they can cause Opera to incorrectly report the insecure site as being secure. The padlock icon will incorrectly be shown, and the security information dialog will state that the connection is secure, but without any certificate information.

As a security precaution, Opera does not allow Web pages to link to files on the user's local disk. However, a flaw exists that allows Web pages to link to feed source files on the user's computer. Suitable detection of JavaScript events and appropriate manipulation can unreliably allow a script to detect the difference between successful and unsuccessful subscriptions to these files, to allow it to discover if the file exists or not. In most cases the attempt will fail.

It has been reported that when a user subscribes to a news feed using the feed subscription button, the page address can be changed. This causes the address field not to update correctly. Although this can mean that misleading information can be displayed in the address field, it can only leave the attacking page's address in the address bar, not a trusted third party address.

CVE-2008-4195 CVE-2008-4197 CVE-2008-4198 CVE-2008-4200 http://www.opera.com/support/search/view/893/ http://www.opera.com/support/search/view/894/ http://www.opera.com/support/search/view/895/ http://www.opera.com/support/search/view/896/ http://www.opera.com/support/search/view/897/ 2008-08-20 2008-08-25 2010-05-12
gnutls -- "gnutls_handshake()" Denial of Service gnutls 2.3.52.4.1

Secunia reports:

A vulnerability has been reported in GnuTLS, which can potentially be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a use-after-free error when an application calls "gnutls_handshake()" for an already valid session and can potentially be exploited, e.g. during re-handshakes.

CVE-2008-2377 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947 http://secunia.com/advisories/31505/ 2008-08-15 2008-08-21
joomla -- flaw in the reset token validation joomla15 1.5.6

Joomla project reports:

A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user (lowest id). Typically, this is an administrator user. Note, that changing the first users username may lessen the impact of this exploit (since the person who changed the password does not know the login associated with the new password). However, the only way to completely rectify the issue is to upgrade to 1.5.6 (or patch the /components/com_user/models/reset.php file).

CVE-2008-3681 2008-08-14 2008-08-20 2008-08-20
cdf3 -- Buffer overflow vulnerability cdf3 3.2.1

NASA Goddard Space Flight Center reports:

The libraries for the scientific data file format, Common Data Format (CDF) version 3.2 and earlier, have the potential for a buffer overflow vulnerability when reading specially-crafted (invalid) CDF files. If successful, this could trigger execution of arbitrary code within the context of the CDF-reading program that could be exploited to compromise a system, or otherwise crash the program. While it's unlikely that you would open CDFs from untrusted sources, we recommend everyone upgrade to the latest CDF libraries on their systems, including the IDL and Matlab plugins. Most worrisome is any service that enables the general public to submit CDF files for processing.

The vulnerability is in the CDF library routines not properly checking the length tags on a CDF file before copying data to a stack buffer. Exploitation requires the user to explicitly open a specially-crafted file. CDF users should not open files from untrusted third parties until the patch is applied (and continue then to exercise normal caution for files from untrusted third parties).

CVE-2008-2080 http://cdf.gsfc.nasa.gov/CDF32_buffer_overflow.html 2008-05-15 2008-08-19 2010-05-12
drupal -- multiple vulnerabilities drupal5 5.10 drupal6 6.4

The Drupal Project reports:

A bug in the output filter employed by Drupal makes it possible for malicious users to insert script code into pages (cross site scripting or XSS). A bug in the private filesystem trusts the MIME type sent by the browser, enabling malicious users with the ability to upload files to execute cross site scripting attacks.

The BlogAPI module does not validate the extension of uploaded files, enabling users with the "administer content with blog api" permission to upload harmful files. This bug affects both Drupal 5.x and 6.x.

Drupal forms contain a token to protect against cross site request forgeries (CSRF). The token may not be validated properly for cached forms and forms containing AHAH elements. This bug affects Drupal 6.x.

User access rules can be added or deleted upon accessing a properly formatted URL, making such modifications vulnerable to cross site request forgeries (CSRF). This may lead to unintended addition or deletion of an access rule when a sufficiently privileged user visits a page or site created by a malicious person. This bug affects both Drupal 5.x and 6.x.

The Upload module in Drupal 6 contains privilege escalation vulnerabilities for users with the "upload files" permission. This can lead to users being able to edit nodes which they are normally not allowed to, delete any file to which the webserver has sufficient rights, and download attachments of nodes to which they have no access. Harmful files may also be uploaded via cross site request forgeries (CSRF). These bugs affect Drupal 6.x.

CVE-2008-3740 CVE-2008-3741 CVE-2008-3742 CVE-2008-3743 CVE-2008-3744 CVE-2008-3745 http://secunia.com/advisories/31462/ 2008-08-13 2008-08-18 2010-05-12
ruby -- multiple vulnerabilities in safe level ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.6.287,1 1.9.*,11.9.1.0,1

The official ruby site reports:

Several vulnerabilities in safe level have been discovereds:.

  • untrace_var is permitted at safe level 4;
  • $PROGRAM_NAME may be modified at safe level 4;
  • insecure methods may be called at safe level 1-3;
  • syslog operations are permitted at safe level 4;
  • dl doesn't check taintness, so it could allow attackers to call dangerous functions.
CVE-2008-3655 CVE-2008-3656 CVE-2008-3905 http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/ 2008-08-08 2008-08-16 2010-05-12
ruby -- DoS vulnerability in WEBrick ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.6.111_5,1 1.9.*,11.9.1.0,1

The official ruby site reports:

WEBrick::HTTP::DefaultFileHandler is faulty of exponential time taking requests due to a backtracking regular expression in WEBrick::HTTPUtils.split_header_value.

CVE-2008-3655 CVE-2008-3656 CVE-2008-3905 http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/ 2008-08-08 2008-08-16 2010-05-12
ruby -- DNS spoofing vulnerability ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.6.111_5,1 1.9.*,11.9.1.0,1

The official ruby site reports:

resolv.rb allow remote attackers to spoof DNS answers. This risk can be reduced by randomness of DNS transaction IDs and source ports.

CVE-2008-1447 http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/ 2008-08-08 2008-08-16 2009-02-09
Bugzilla -- Directory Traversal in importxml.pl bugzilla ja-bugzilla 2.22.12.22.4 3.*3.0.4

A Bugzilla Security Advisory reports:

When importing bugs using importxml.pl, the --attach_path option can be specified, pointing to the directory where attachments to import are stored. If the XML file being read by importxml.pl contains a malicious

../relative_path/to/local_file

node, the script follows this relative path and attaches the local file pointed by it to the bug, making the file public. The security fix makes sure the relative path is always ignored.

CVE-2008-4437 https://bugzilla.mozilla.org/show_bug.cgi?id=437169 2008-06-03 2008-08-15 2010-05-12
openvpn-devel -- arbitrary code execution openvpn-devel 2.1.b142.1.r9

James Yonan reports:

Security Fix - affects non-Windows OpenVPN clients running OpenVPN 2.1-beta14 through 2.1-rc8 (OpenVPN 2.0.x clients are NOT vulnerable nor are any versions of the OpenVPN server vulnerable).

An OpenVPN client connecting to a malicious or compromised server could potentially receive an "lladdr" or "iproute" configuration directive from the server which could cause arbitrary code execution on the client. A successful attack requires that (a) the client has agreed to allow the server to push configuration directives to it by including "pull" or the macro "client" in its configuration file, (b) the client succesfully authenticates the server, (c) the server is malicious or has been compromised and is under the control of the attacker, and (d) the client is running a non-Windows OS.

CVE-2008-3459 http://openvpn.net/index.php/documentation/change-log/changelog-21.html 2008-07-31 2008-08-07
phpmyadmin -- cross site request forgery vulnerabilities phpMyAdmin 2.11.7.1

A phpMyAdmin security announcement:

A logged-in user, if abused into clicking a crafted link or loading an attack page, would create a database he did not intend to, or would change his connection character set.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5 http://secunia.com/advisories/31115/ 2008-07-15 2008-07-18 2008-09-17
drupal -- multiple vulnerabilities drupal5 5.8 drupal6 6.3

The Drupal Project reports:

Free tagging taxonomy terms can be used to insert arbitrary script and HTML code (cross site scripting or XSS) on node preview pages. A successful exploit requires that the victim selects a term containing script code and chooses to preview the node. This issue affects Drupal 6.x only. Some values from OpenID providers are output without being properly escaped, allowing malicious providers to insert arbitrary script and HTML code (XSS) into user pages. This issue affects Drupal 6.x only. filter_xss_admin() has been hardened to prevent use of the object HTML tag in administrator input.

Translated strings (5.x, 6.x) and OpenID identities (6.x) are immediately deleted upon accessing a properly formatted URL, making such deletion vulnerable to cross site request forgeries (CSRF). This may lead to unintended deletion of translated strings or OpenID identities when a sufficiently privileged user visits a page or site created by a malicious person.

When contributed modules such as Workflow NG terminate the current request during a login event, user module is not able to regenerate the user's session. This may lead to a session fixation attack, when a malicious user is able to control another users' initial session ID. As the session is not regenerated, the malicious user may use the 'fixed' session ID after the victim authenticates and will have the same access. This issue affects both Drupal 5 and Drupal 6.

Schema API uses an inappropriate placeholder for 'numeric' fields enabling SQL injection when user-supplied data is used for such fields.This issue affects Drupal 6 only.

CVE-2008-3218 CVE-2008-3221 http://drupal.org/node/280571 http://secunia.com/advisories/31028/ 2008-07-9 2008-07-13 2010-05-12
FreeBSD -- DNS cache poisoning FreeBSD 6.36.3_3 7.07.0_3

Problem Description:

The BIND DNS implementation does not randomize the UDP source port when doing remote queries, and the query id alone does not provide adequate randomization.

Impact:

The lack of source port randomization reduces the amount of data the attacker needs to guess in order to successfully execute a DNS cache poisoning attack. This allows the attacker to influence or control the results of DNS queries being returned to users from target systems.

Workaround:

Limiting the group of machines that can do recursive queries on the DNS server will make it more difficult, but not impossible, for this vulnerability to be exploited.

To limit the machines able to perform recursive queries, add an ACL in named.conf and limit recursion like the following:

acl example-acl {
   192.0.2.0/24;
};
options {
	recursion yes;
	allow-recursion { example-acl; };
};
800113 CVE-2008-1447 SA-08:06.bind 2008-07-08 2008-07-13
poppler -- uninitialized pointer poppler 0.8.4_2

Felipe Andres Manzano reports:

The libpoppler pdf rendering library, can free uninitialized pointers, leading to arbitrary code execution. This vulnerability results from memory management bugs in the Page class constructor/destructor.

CVE-2008-2950 http://milw0rm.com/exploits/6032 2008-07-07 2008-07-09
py-pylons -- Path traversal bug py24-pylons 0.9.6.2

Pylons team reports:

The error.py controller uses paste.fileapp to serve the static resources to the browser. The default error.py controller uses os.path.join to combine the id from Routes with the media path. Routes prior to 1.8 double unquoted the PATH_INFO, resulting in FileApp returning files from the filesystem that can be outside of the intended media path directory.

An attacker can craft URL's which utilize the double escaping to pass in a name to the error.py controller which contains a leading slash thus escaping the intended media path and serving files from any location on the filesystem that the Pylons application has access to.

http://wiki.pylonshq.com/display/pylonsdocs/0.9.6.2 2008-05-28 2008-07-04
FreeType 2 -- Multiple Vulnerabilities freetype2 2.3.6

Secunia reports:

  • An integer overflow error exists in the processing of PFB font files. This can be exploited to cause a heap-based buffer overflow via a PFB file containing a specially crafted "Private" dictionary table.
  • An error in the processing of PFB font files can be exploited to trigger the "free()" of memory areas that are not allocated on the heap.
  • An off-by-one error exists in the processing of PFB font files. This can be exploited to cause a one-byte heap-based buffer overflow via a specially crafted PFB file.
  • An off-by-one error exists in the implementation of the "SHC" instruction while processing TTF files. This can be exploited to cause a one-byte heap-based buffer overflow via a specially crafted TTF file.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

29637 29639 29640 29641 CVE-2008-1806 CVE-2008-1807 CVE-2008-1808 http://secunia.com/advisories/30600 http://sourceforge.net/project/shownotes.php?release_id=605780 2008-06-10 2008-07-03
fetchmail -- potential crash in -v -v verbose mode (revised patch) fetchmail 6.3.8_7

Matthias Andree reports:

2008-06-24 1.2 also fixed issue in report_complete (reported by Petr Uzel)

CVE-2008-2711 http://www.fetchmail.info/fetchmail-SA-2008-01.txt 2008-06-24 2008-07-01
phpmyadmin -- Cross Site Scripting Vulnerabilities phpMyAdmin 2.11.7

Secunia report:

Some vulnerabilities have been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via unspecified parameters to files in /libraries is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that "register_globals" is enabled and support for ".htaccess" files is disabled.

CVE-2008-2960 http://secunia.com/advisories/30813/ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4 2008-06-23 2008-06-28 2010-05-12
apache -- multiple vulnerabilities apache 2.2.02.2.9

Apache HTTP server project reports:

The following potential security flaws are addressed:

  • CVE-2008-2364: mod_proxy_http: Better handling of excessive interim responses from origin server to prevent potential denial of service and high memory usage. Reported by Ryujiro Shibuya.
  • CVE-2007-6420: mod_proxy_balancer: Prevent CSRF attacks against the balancer-manager interface
CVE-2007-6420 CVE-2008-2364 http://www.apache.org/dist/httpd/Announcement2.2.html 2008-06-14 2008-06-24
php -- input validation error in safe_mode php5 5.2.6_2

According to Maksymilian Arciemowicz research, it is possible to bypass security restrictions of safe_mode in various functions via directory traversal vulnerability. The attacker can use this attack to gain access to sensitive information. Functions utilizing expand_filepath() may be affected.

It should be noted that this vulnerability is not considered to be serious by the FreeBSD Security Team, since safe_mode and open_basedir are insecure by design and should not be relied upon.

CVE-2008-2665 CVE-2008-2666 29797 http://securityreason.com/achievement_securityalert/54 2008-06-17 2008-06-22 2008-09-04
vim -- Vim Shell Command Injection Vulnerabilities vim vim-lite vim-ruby vim6 vim6-ruby 66.4.10 77.1.315

Rdancer.org reports:

Improper quoting in some parts of Vim written in the Vim Script can lead to arbitrary code execution upon opening a crafted file.

CVE-2008-2712 http://www.rdancer.org/vulnerablevim.html 2008-06-16 2008-06-21
ruby -- multiple integer and buffer overflow vulnerabilities ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.6.111_3,1 ruby_static 1.8.*,1

The official ruby site reports:

Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.

CVE-2008-2726 http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/ 2008-06-19 2008-06-21
fetchmail -- potential crash in -v -v verbose mode fetchmail 6.3.8_6

Matthias Andree reports:

Gunter Nau reported fetchmail crashing on some messages; further debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic dug up that this happened when fetchmail was trying to print, in -v -v verbose level, headers exceeding 2048 bytes. In this situation, fetchmail would resize the buffer and fill in further parts of the message, but forget to reinitialize its va_list typed source pointer, thus reading data from a garbage address found on the stack at addresses above the function arguments the caller passed in; usually that would be the caller's stack frame.

CVE-2008-2711 http://www.fetchmail.info/fetchmail-SA-2008-01.txt 2008-06-13 2008-06-20
xorg -- multiple vulnerabilities xorg-server 1.4.2,1

Matthieu Herrb of X.Org reports:

Several vulnerabilities have been found in the server-side code of some extensions in the X Window System. Improper validation of client-provided data can cause data corruption.

Exploiting these overflows will crash the X server or, under certain circumstances allow the execution of arbitray machine code.

When the X server is running with root privileges (which is the case for the Xorg server and for most kdrive based servers), these vulnerabilities can thus also be used to raise privileges.

All these vulnerabilities, to be exploited successfully, require either an already established connection to a running X server (and normally running X servers are only accepting authenticated connections), or a shell access with a valid user on the machine where the vulnerable server is installed.

CVE-2008-1377 CVE-2008-1379 CVE-2008-2360 CVE-2008-2361 CVE-2008-2362 http://lists.freedesktop.org/archives/xorg/2008-June/036026.html http://secunia.com/advisories/30627/ 2008-06-11 2008-06-15
moinmoin -- superuser privilege escalation moinmoin 1.6.3

MoinMoin team reports:

A check in the userform processing was not working as expected and could be abused for ACL and superuser privilege escalation.

CVE-2008-1937 http://hg.moinmo.in/moin/1.6/rev/f405012e67af 2008-04-20 2008-06-14 2008-06-15
Courier Authentication Library -- SQL Injection courier-authlib 0.60.6

Secunia reports:

A vulnerability has been reported in the Courier Authentication Library, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via e.g. the username to the library is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and e.g. potentially bypass authentication.

Successful exploitation requires that a MySQL database is used for authentication and that a Non-Latin character set is selected.

http://secunia.com/advisories/30591/ 2008-06-10 2008-06-13
ikiwiki -- cleartext passwords ikiwiki 2.48

The ikiwiki development team reports:

Until version 2.48, ikiwiki stored passwords in cleartext in the userdb. That risks exposing all users' passwords if the file is somehow exposed. To pre-emtively guard against that, current versions of ikiwiki store password hashes (using Eksblowfish).

http://ikiwiki.info/security/#index32h2 2008-05-30 2008-06-01
ikiwiki -- empty password security hole ikiwiki 1.342.47_1

The ikiwiki development team reports:

This hole allowed ikiwiki to accept logins using empty passwords to openid accounts that didn't use a password.

Upgrading to a non-vulnerable ikiwiki version immediatly is recommended if your wiki allows both password and openid logins.

CVE-2008-0169 http://ikiwiki.info/security/#index33h2 2008-05-30 2008-05-31 2010-05-12
linux-flashplugin -- unspecified remote code execution vulnerability linux-flashplugin 9.0r124

Adobe Product Security Incident Response Team reports:

An exploit appears to be taking advantage of a known vulnerability, reported by Mark Dowd of the ISS X-Force and wushi of team509, that was resolved in Flash Player 9.0.124.0 (CVE-2007-0071). This exploit does NOT appear to include a new, unpatched vulnerability as has been reported elsewhere - customers with Flash Player 9.0.124.0 should not be vulnerable to this exploit.

29386 CVE-2007-0071 http://blogs.adobe.com/psirt/ 2008-05-27 2008-05-30
Nagios -- Cross Site Scripting Vulnerability nagios 2.12 3.*3.0.2 nagios-devel 3.0.2

Secunia reports:

A vulnerability has been reported in Nagios, which can be exploited by malicious people to conduct cross-site scripting attacks.

29140 CVE-2007-5803 http://secunia.com/advisories/30283 2008-05-20 2008-05-28 2008-09-08
spamdyke -- open relay spamdyke 3.1.8

Spamdyke Team reports:

Fixed smtp_filter() to reject the DATA command if no valid recipients have been specified. Otherwise, a specific scenario could result in every spamdyke installation being used as an open relay. If the remote server connects and gives one or more recipients that are rejected (for relaying or blacklisting), then gives the DATA command, spamdyke will ignore all other commands, assuming that message data is being transmitted. However, because all of the recipients were rejected, qmail will reject the DATA command. From that point on, the remote server can give as many recipients as it likes and spamdyke will ignore them all -- they will not be filtered at all. After that, the remote server can give the DATA command and send the actual message data. Because spamdyke is controlling relaying, the RELAYCLIENT environment variable is set and qmail won't check for relaying either. Thanks to Mirko Buffoni for reporting this one.

CVE-2008-2784 http://www.spamdyke.org/documentation/Changelog.txt 2008-05-21 2008-05-27 2010-05-12
peercast -- arbitrary code execution peercast 0

Nico Golde discovered that PeerCast, a P2P audio and video streaming server, is vulnerable to a buffer overflow in the HTTP Basic Authentication code, allowing a remote attacker to crash PeerCast or execure arbitrary code.

28986 CVE-2008-2040 http://secunia.com/advisories/30020 2008-05-20 2008-05-21
libvorbis -- various security issues libvorbis 1.2.0_2,3

Red Hat reports:

Will Drewry of the Google Security Team reported several flaws in the way libvorbis processed audio data. An attacker could create a carefully crafted [Vorbis] audio file in such a way that it could cause an application linked with libvorbis to crash, or execute arbitrary code when it was opened.

CVE-2008-1419 CVE-2008-1420 CVE-2008-1423 https://rhn.redhat.com/errata/RHSA-2008-0270.html 2008-05-14 2008-05-17
django -- XSS vulnerability py23-django py24-django py25-django 0.96.2 py23-django-devel py24-django-devel py25-django-devel 20080511

Django project reports:

The Django administration application will, when accessed by a user who is not sufficiently authenticated, display a login form and ask the user to provide the necessary credentials before displaying the requested page. This form will be submitted to the URL the user attempted to access, by supplying the current request path as the value of the form's "action" attribute.

The value of the request path was not being escaped, creating an opportunity for a cross-site scripting (XSS) attack by leading a user to a URL which contained URL-encoded HTML and/or JavaScript in the request path.

CVE-2008-2302 http://www.djangoproject.com/weblog/2008/may/14/security/ 2008-05-10 2008-05-14 2010-05-12
vorbis-tools -- Speex header processing vulnerability vorbis-tools 1.2.0_2,3

Secunia reports:

A vulnerability has been reported in vorbis-tools, which can potentially be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error when processing Speex headers, which can be exploited via a specially crafted Speex stream containing a negative "modeID" field in the header.

Successful exploitation may allow execution of arbitrary code.

CVE-2008-1686 http://secunia.com/advisories/29882/ 2008-04-18 2008-05-11
qemu -- "drive_init()" Disk Format Security Bypass qemu qemu-devel 0.9.1_6 0.9.1s.20070101*0.9.1s.20080302_6

Secunia reports:

A vulnerability has been reported in QEMU, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to the "drive_init()" function in vl.c determining the format of a disk from data contained in the disk's header. This can be exploited by a malicious user in a guest system to e.g. read arbitrary files on the host by writing a fake header to a raw formatted disk image.

CVE-2008-2004 http://secunia.com/advisories/30111/ http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html 2008-04-28 2008-05-08
swfdec -- exposure of sensitive information swfdec 0.6.4

Secunia reports:

A vulnerability has been reported in swfdec, which can be exploited by malicious people to disclose sensitive information.

The vulnerability is caused due to swfdec not properly restricting untrusted sandboxes from reading local files, which can be exploited to disclose the content of arbitrary local files by e.g. tricking a user into visiting a malicious website.

CVE-2008-1834 http://secunia.com/advisories/29915 2008-04-09 2008-05-07
mt-daapd -- integer overflow mt-daapd 0.2.4.2

FrSIRT reports:

A vulnerability has been identified in mt-daapd which could be exploited by remote attackers to cause a denial of service or compromise an affected system. This issue is caused by a buffer overflow error in the ws_getpostvars() function when processing a negative Content-Length: header value, which could be exploited by remote unauthenticated attackers to crash an affected application or execute arbitrary code.

CVE-2008-1771 http://secunia.com/advisories/29917 http://www.frsirt.com/english/advisories/2008/1303 2008-04-21 2008-05-02
sdl_image -- buffer overflow vulnerabilities sdl_image 1.2.6_1

Secunia reports:

Two vulnerabilities have been reported in SDL_image, which can be exploited by malicious people to cause a Denial of Service or potentially compromise an application using the library.

A boundary error within the LWZReadByte() function in IMG_gif.c can be exploited to trigger the overflow of a static buffer via a specially crafted GIF file.

A boundary error within the "IMG_LoadLBM_RW()" function in IMG_lbm.c can be exploited to cause a heap-based buffer overflow via a specially crafted IFF ILBM file.

CVE-2007-6697 CVE-2008-0544 http://secunia.com/advisories/28640 2008-01-24 2008-05-02
gnupg -- memory corruption vulnerability gnupg 1.0.01.4.9 2.0.02.0.9

Secunia reports:

A vulnerability has been reported in GnuPG, which can potentially be exploited to compromise a vulnerable system.

The vulnerability is caused due to an error when importing keys with duplicated IDs. This can be exploited to cause a memory corruption when importing keys via --refresh-keys or --import.

Successful exploitation potentially allows execution of arbitrary code, but has not been proven yet.

28487 CVE-2008-1530 http://www.ocert.org/advisories/ocert-2008-1.html http://secunia.com/advisories/29568 https://bugs.g10code.com/gnupg/issue894 2008-03-19 2008-04-26 2008-04-29
extman -- password bypass vulnerability extman 0.2.40.2.4_1

Extmail team reports:

Emergency update #4 fixes a serious security vulnerability.

Successful exploit of this vulnerability would allow attacker to change user's password without knowing it by using specifically crafted HTTP request.

http://www.extmail.org/forum/thread-7260-1-1.html 2008-04-01 2008-04-25
mailman -- script insertion vulnerability ja-mailman mailman mailman-with-htdig 2.1.10

Secunia reports:

A vulnerability has been reported in Mailman, which can be exploited by malicious users to conduct script insertion attacks.

Certain input when editing the list templates and the list info attribute is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious website is accessed.

CVE-2008-0564 27630 http://www.ubuntu.com/usn/usn-586-1 http://secunia.com/advisories/28794 http://sourceforge.net/project/shownotes.php?release_id=593924 2008-02-05 2008-04-25
mksh -- TTY attachment privilege escalation mksh R33d

Secunia reports:

The vulnerability is caused due to an error when attaching to a TTY via the -T command line switch. This can be exploited to execute arbitrary commands with the privileges of the user running mksh via characters previously written to the attached virtual console.

CVE-2008-1845 http://secunia.com/advisories/29803/ http://www.mirbsd.org/mksh.htm#clog 2008-04-14 2008-04-25
serendipity -- multiple cross site scripting vulnerabilities serendipity 1.3.1 serendipity-devel 200804242342

Hanno Boeck reports:

The installer of serendipity 1.3 has various Cross Site Scripting issues. This is considered low priority, as attack scenarios are very unlikely.

Various path fields are not escaped properly, thus filling them with javascript code will lead to XSS. MySQL error messages are not escaped, thus the database host field can also be filled with javascript.

In the referrer plugin of the blog application serendipity, the referrer string is not escaped, thus leading to a permanent XSS.

28885 CVE-2008-1385 CVE-2008-1386 http://int21.de/cve/CVE-2008-1385-s9y.html http://int21.de/cve/CVE-2008-1386-s9y.html http://blog.s9y.org/archives/193-Serendipity-1.3.1-released.html 2008-04-22 2008-04-25
firefox -- javascript garbage collector vulnerability firefox 2.0.0.14,1 linux-firefox linux-firefox-devel 2.0.0.14 seamonkey linux-seamonkey 1.1.10 flock linux-flock 1.1.2 linux-seamonkey-devel 0 thunderbird linux-thunderbird 2.0.0.14

Mozilla Foundation reports:

Fixes for security problems in the JavaScript engine described in MFSA 2008-15 introduced a stability problem, where some users experienced crashes during JavaScript garbage collection. This is being fixed primarily to address stability concerns. We have no demonstration that this particular crash is exploitable but are issuing this advisory because some crashes of this type have been shown to be exploitable in the past.

CVE-2008-1237 CVE-2008-1380 28818 http://secunia.com/advisories/29787 http://www.mozilla.org/security/announce/2008/mfsa2008-20.html 2008-04-16 2008-04-25 2009-12-12
png -- unknown chunk processing uninitialized memory access png 1.2.27

Secunia reports:

Tavis Ormandy has reported a vulnerability in libpng, which can be exploited by malicious people to cause a Denial of Service, disclose potentially sensitive information, or potentially compromise an application using the library.

The vulnerability is caused due to the improper handling of PNG chunks unknown to the library. This can be exploited to trigger the use of uninitialized memory in e.g. a free() call via unknown PNG chunks having a length of zero.

Successful exploitation may allow execution of arbitrary code, but requires that the application calls the png_set_read_user_chunk_fn() function or the png_set_keep_unknown_chunks() function under specific conditions.

CVE-2008-1382 28770 http://secunia.com/advisories/29792 http://libpng.sourceforge.net/Advisory-1.2.26.txt 2008-04-12 2008-04-25 2008-04-29
openfire -- unspecified denial of service openfire 3.5.0

Secunia reports:

A vulnerability has been reported in Openfire, which can be exploited by malicious people to cause a Denial of Service.

The vulnerability is caused due to an unspecified error and can be exploited to cause a Denial of Service.

CVE-2008-1728 28722 http://secunia.com/advisories/29751 http://www.igniterealtime.org/issues/browse/JM-1289 2008-04-10 2008-04-25
php -- integer overflow vulnerability php5 5.2.6

CVE reports:

Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width specifier, related to the php_sprintf_appendstring function in formatted_print.c and probably other functions for formatted strings (aka *printf functions).

CVE-2008-1384 28392 http://securityreason.com/achievement_securityalert/52 2008-03-21 2008-04-25 2008-05-02
python -- Integer Signedness Error in zlib Module python23 2.3.6_1 python24 2.4.5_1 python25 2.5.2_2

Justin Ferguson reports:

Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers insufficient memory allocation and a buffer overflow.

CVE-2008-1721 28715 http://securityreason.com/securityalert/3802 http://bugs.python.org/issue2586 2008-04-10 2008-04-25 2008-04-28
postgresql -- multiple vulnerabilities postgresql postgresql-server 7.37.3.21 7.47.4.19 8.08.0.15 8.18.1.11 8.28.2.6

The PostgreSQL developers report:

PostgreSQL allows users to create indexes on the results of user-defined functions, known as "expression indexes". This provided two vulnerabilities to privilege escalation: (1) index functions were executed as the superuser and not the table owner during VACUUM and ANALYZE, and (2) that SET ROLE and SET SESSION AUTHORIZATION were permitted within index functions. Both of these holes have now been closed.

PostgreSQL allowed malicious users to initiate a denial-of-service by passing certain regular expressions in SQL queries. First, users could create infinite loops using some specific regular expressions. Second, certain complex regular expressions could consume excessive amounts of memory. Third, out-of-range backref numbers could be used to crash the backend.

DBLink functions combined with local trust or ident authentication could be used by a malicious user to gain superuser privileges. This issue has been fixed, and does not affect users who have not installed DBLink (an optional module), or who are using password authentication for local access. This same problem was addressed in the previous release cycle, but that patch failed to close all forms of the loophole.

CVE-2007-6600 CVE-2007-4772 CVE-2007-6067 CVE-2007-4769 CVE-2007-6601 27163 http://www.postgresql.org/about/news.905 2008-01-06 2008-04-24
phpmyadmin -- Shared Host Information Disclosure phpMyAdmin 2.11.5.2

A phpMyAdmin security announcement report:

It is possible to read the contents of any file that the web server's user can access. The exact mechanism to achieve this won't be disclosed. If a user can upload on the same host where phpMyAdmin is running a PHP script that can read files with the rights of the web server's user, the current advisory does not describe an additional threat.

CVE-2008-1924 http://secunia.com/advisories/29944/ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3 2008-04-23 2008-04-24 2008-09-17
phpmyadmin -- Username/Password Session File Information Disclosure phpMyAdmin 2.11.5.1

A phpMyAdmin security announcement report:

phpMyAdmin saves sensitive information like the MySQL username and password and the Blowfish secret key in session data, which might be unprotected on a shared host.

CVE-2008-1567 http://secunia.com/advisories/29613/ http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3 2008-03-31 2008-04-24 2008-09-17
libxine -- array index vulnerability libxine 1.1.12

xine Team reports:

A new xine-lib version is now available. This release contains a security fix (an unchecked array index that could allows remote attackers to execute arbitrary code via a header structure containing a negative offset, which is used to dereference a function pointer.)

CVE-2008-1686 http://www.xinehq.de/index.php/news 2008-04-06 2008-04-24
clamav -- Multiple Vulnerabilities clamav 0.93 clamav-devel 20080415

Secunia reports:

Some vulnerabilities have been reported in ClamAV, which can be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system.

1) A boundary error exists within the "cli_scanpe()" function in libclamav/pe.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted "Upack" executable.

Successful exploitation allows execution of arbitrary code.

2) A boundary error within the processing of PeSpin packed executables in libclamav/spin.c can be exploited to cause a heap-based buffer overflow.

Successful exploitation may allow execution of arbitrary code.

3) An unspecified error in the processing of ARJ files can be exploited to hang ClamAV.

CVE-2008-1100 CVE-2008-1387 http://secunia.com/advisories/29000 2008-04-15 2008-04-15
lighttpd -- OpenSSL Error Queue Denial of Service Vulnerability lighttpd 1.4.19_1

Secunia reports:

A vulnerability has been reported in lighttpd, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to lighttpd not properly clearing the OpenSSL error queue. This can be exploited to close concurrent SSL connections of lighttpd by terminating one SSL connection.

28489 CVE-2008-1531 http://secunia.com/advisories/29649 http://trac.lighttpd.net/trac/ticket/285 2008-04-02 2008-04-13
ikiwiki -- cross site request forging ikiwiki 2.42

The ikiwiki development team reports:

Cross Site Request Forging could be used to construct a link that would change a logged-in user's password or other preferences if they clicked on the link. It could also be used to construct a link that would cause a wiki page to be modified by a logged-in user.

CVE-2008-0165 http://ikiwiki.info/security/#index31h2 2008-04-10 2008-04-13 2010-05-12
postfix-policyd-weight -- working directory symlink vulnerability postfix-policyd-weight 0.1.14.17

postfix-policyd-weight does not check for symlink for its working directory. If the working directory is not already setup by the super root, an unprivileged user can link it to another directories in the system. This results in ownership/permission changes on the target directory.

28480 http://article.gmane.org/gmane.mail.postfix.policyd-weight/815 http://article.gmane.org/gmane.mail.postfix.policyd-weight/823 2008-03-24 2008-04-06
powerdns-recursor -- DNS cache poisoning powerdns-recursor 3.1.5

If the system random number generator can be predicted by its past output, then an attacker may spoof Recursor to accept mallicious data. This leads to DNS cache poisoning and client redirection.

http://doc.powerdns.com/security-policy.html 2008-03-31 2008-04-05
suphp -- multiple local privilege escalation vulnerabilities suphp 0.6.3

Multiple local privilege escalation are found in the symlink verification code. An attacker may use it to run a PHP script with the victim's privilege. This attack is a little harder when suphp operates in paranoid mode. For suphp that runs in owner mode which is the default in ports, immediate upgrade to latest version is advised.

CVE-2008-1614 28568 http://lists.marsching.biz/pipermail/suphp/2008-March/001750.html 2008-03-30 2008-04-05 2010-05-12
opera -- multiple vulnerabilities opera 9.27.20080331 linux-opera 9.27.20080331

Opera Software reports of multiple security issues in Opera. All of them can lead to arbitrary code execution. Details are as the following:

28585 CVE-2008-1761 CVE-2008-1762 http://www.opera.com/support/search/view/881/ http://www.opera.com/support/search/view/882/ 2008-04-03 2008-04-05 2010-05-12
mozilla -- multiple vulnerabilities firefox 2.0.0.13,1 linux-firefox linux-firefox-devel 2.0.0.13 seamonkey linux-seamonkey 1.1.9 flock linux-flock 1.1.1 linux-seamonkey-devel 0 thunderbird linux-thunderbird 2.0.0.14

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2008-19 XUL popup spoofing variant (cross-tab popups)
  • MFSA 2008-18 Java socket connection to any local port via LiveConnect
  • MFSA 2008-17 Privacy issue with SSL Client Authentication
  • MFSA 2008-16 HTTP Referrer spoofing with malformed URLs
  • MFSA 2008-15 Crashes with evidence of memory corruption (rv:1.8.1.13)
  • MFSA 2008-14 JavaScript privilege escalation and arbitrary code execution
28448 CVE-2008-1241 CVE-2008-1240 CVE-2007-4879 CVE-2008-1238 CVE-2008-1236 CVE-2008-1237 CVE-2008-1233 CVE-2008-1234 CVE-2008-1235 2008-03-26 2008-03-30 2009-12-12
silc -- pkcs_decode buffer overflow silc-irssi-client silc-client 1.1.4 silc-server 1.1.2

Core Security Technologies reports:

A remote buffer overflow vulnerability found in a library used by both the SILC server and client to process packets containing cryptographic material may allow an un-authenticated client to executearbitrary code on the server with the privileges of the user account running the server, or a malicious SILC server to compromise client systems and execute arbitrary code with the privileges of the user account running the SILC client program.

28373 http://www.coresecurity.com/?action=item&id=2206 2008-03-25 2008-03-26
bzip2 -- crash with certain malformed archive files bzip2 1.0.5

SecurityFocus reports:

The 'bzip2' application is prone to a remote file-handling vulnerability because the application fails to properly handle malformed files.

Exploit attempts likely result in application crashes.

28286 CVE-2008-1372 https://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/ 2008-03-18 2008-03-20
qemu -- unchecked block read/write vulnerability qemu qemu-devel 0.9.1_2

Ian Jackson reports on the debian-security mailinglist:

When a block device read or write request is made by the guest, nothing checks that the request is within the range supported by the backend, but the code in the backend typically assumes that the request is sensible.

Depending on the backend, this can allow the guest to read and write arbitrary memory locations in qemu, and possibly gain control over the qemu process, escaping from the emulation/virtualisation.

CVE-2008-0928 http://secunia.com/advisories/29172 http://secunia.com/advisories/29081 http://lists.debian.org/debian-security/2008/02/msg00064.html 2008-02-19 2008-03-11
dovecot -- security hole in blocking passdbs dovecot 1.0.13

Dovecot reports:

Security hole in blocking passdbs (MySQL always. PAM, passwd and shadow if blocking=yes) where user could specify extra fields in the password. The main problem here is when specifying "skip_password_check" introduced in v1.0.11 for fixing master user logins, allowing the user to log in as anyone without a valid password.

http://dovecot.org/list/dovecot-news/2008-March/000065.html http://secunia.com/advisories/29295/ 2008-03-09 2008-03-10
mplayer -- multiple vulnerabilities mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.11_2

The Mplayer team reports:

A buffer overflow was found in the code used to extract album titles from CDDB server answers. When parsing answers from the CDDB server, the album title is copied into a fixed-size buffer with insufficient size checks, which may cause a buffer overflow. A malicious database entry could trigger a buffer overflow in the program. That can lead to arbitrary code execution with the UID of the user running MPlayer.

A buffer overflow was found in the code used to escape URL strings. The code used to skip over IPv6 addresses can be tricked into leaving a pointer to a temporary buffer with a non-NULL value; this causes the unescape code to reuse the buffer, and may lead to a buffer overflow if the old buffer is smaller than required. A malicious URL string may be used to trigger a buffer overflow in the program, that can lead to arbitrary code execution with the UID of the user running MPlayer.

A buffer overflow was found in the code used to parse MOV file headers. The code read some values from the file and used them as indexes into as array allocated on the heap without performing any boundary check. A malicious file may be used to trigger a buffer overflow in the program. That can lead to arbitrary code execution with the UID of the user running MPlayer.

CVE-2008-0485 CVE-2008-0486 CVE-2008-0629 CVE-2008-0630 http://secunia.com/advisories/28779 2008-02-05 2008-03-06
ghostscript -- zseticcspace() function buffer overflow vulnerability ghostscript-gpl ghostscript-gpl-nox11 8.61_2

Chris Evans from the Google Security Team reports:

Severity: parsing of evil PostScript file will result in arbitrary code execution.

A stack-based buffer overflow in the zseticcspace() function in zicc.c allows remote arbitrary code execution via a malicious PostScript file (.ps) that contains a long Range array.

28017 CVE-2008-0411 http://scary.beasts.org/security/CESA-2008-001.html 2008-02-28 2008-03-05
phpmyadmin -- SQL injection vulnerability phpMyAdmin 2.11.5

A phpMyAdmin security announcement report:

phpMyAdmin used the $_REQUEST superglobal as a source for its parameters, instead of $_GET and $_POST. This means that on most servers, a cookie with the same name as one of phpMyAdmin's parameters can interfere.

Another application could set a cookie for the root path "/" with a "sql_query" name, therefore overriding the user-submitted sql_query because by default, the $_REQUEST superglobal imports first GET, then POST then COOKIE data.

Mitigation factor

An attacker must trick the victim into visiting a page on the same web server where he has placed code that creates a malicious cookie.

28068 CVE-2008-1149 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1 2008-03-01 2008-03-04 2010-05-12
pcre -- buffer overflow vulnerability pcre 7.6

PCRE developers report:

A character class containing a very large number of characters with codepoints greater than 255 (in UTF-8 mode, of course) caused a buffer overflow.

27786 CVE-2008-0674 http://pcre.org/changelog.txt 2008-01-28 2008-02-29
libxine -- buffer overflow vulnerability libxine 1.1.10.1

xine Team reports:

A new xine-lib version is now available. This release contains a security fix (array index vulnerability which may lead to a stack buffer overflow.

CVE-2008-0486 http://www.xinehq.de/index.php/news 2007-02-08 2008-02-26
coppermine -- multiple vulnerabilities coppermine 1.4.15

Coppermine Security advisory

The development team is releasing a security update for Coppermine in order to counter a recently discovered cross-site-scripting vulnerability.

CVE-2008-0504 CVE-2008-0505 CVE-2008-0506 http://coppermine-gallery.net/forum/index.php?topic=48106.0 http://coppermine-gallery.net/forum/index.php?topic=50103.0 http://secunia.com/advisories/28682/ 2007-11-06 2008-02-25
moinmoin -- multiple vulnerabilities moinmoin 1.6.1

MoinMoin Security advisory

XSS issue in login action

XSS issue in AttachFile action

XSS issue in RenamePage/DeletePage action

XSS issue in gui editor

27404 CVE-2007-0857 CVE-2007-0901 CVE-2007-0902 CVE-2007-2423 CVE-2007-2673 CVE-2008-0780 CVE-2008-0781 CVE-2008-0782 http://moinmo.in/SecurityFixes http://secunia.com/advisories/29010/ 2007-02-08 2008-02-25 2008-02-26
opera -- multiple vulnerabilities opera opera-devel linux-opera 9.26

Opera Software ASA reports about multiple security fixes:

  • Fixed an issue where simulated text inputs could trick users into uploading arbitrary files, as reported by Mozilla.
  • Image properties can no longer be used to execute scripts, as reported by Max Leonov.
  • Fixed an issue where the representation of DOM attribute values could allow cross site scripting, as reported by Arnaud.lb.
CVE-2008-1080 CVE-2008-1081 http://www.opera.com/docs/changelogs/freebsd/926/ http://www.opera.com/support/search/view/877/ http://www.opera.com/support/search/view/879/ http://www.opera.com/support/search/view/880/ 2008-02-20 2008-02-22 2010-05-12
mozilla -- multiple vulnerabilities firefox 2.0.0.12,1 linux-firefox linux-firefox-devel 2.0.0.12 seamonkey linux-seamonkey 1.1.8 flock linux-flock 1.0.9 linux-seamonkey-devel 0

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • Web forgery overwrite with div overlay
  • URL token stealing via stylesheet redirect
  • Mishandling of locally-saved plain text files
  • File action dialog tampering
  • Possible information disclosure in BMP decoder
  • Web browsing history and forward navigation stealing
  • Directory traversal via chrome: URI
  • Stored password corruption
  • Privilege escalation, XSS, Remote Code Execution
  • Multiple file input focus stealing vulnerabilities
  • Crashes with evidence of memory corruption (rv:1.8.1.12)
CVE-2008-0412 CVE-2008-0413 CVE-2008-0414 CVE-2008-0415 CVE-2008-0417 CVE-2008-0418 CVE-2008-0419 CVE-2008-0420 CVE-2008-0591 CVE-2008-0592 CVE-2008-0593 CVE-2008-0594 http://www.mozilla.org/projects/security/known-vulnerabilities.html http://www.mozilla.org/security/announce/2008/mfsa2008-01.html http://www.mozilla.org/security/announce/2008/mfsa2008-02.html http://www.mozilla.org/security/announce/2008/mfsa2008-03.html http://www.mozilla.org/security/announce/2008/mfsa2008-04.html http://www.mozilla.org/security/announce/2008/mfsa2008-05.html http://www.mozilla.org/security/announce/2008/mfsa2008-06.html http://www.mozilla.org/security/announce/2008/mfsa2008-07.html http://www.mozilla.org/security/announce/2008/mfsa2008-08.html http://www.mozilla.org/security/announce/2008/mfsa2008-09.html http://www.mozilla.org/security/announce/2008/mfsa2008-10.html http://www.mozilla.org/security/announce/2008/mfsa2008-11.html 2008-02-07 2008-02-22 2009-12-12
openldap -- modrdn Denial of Service vulnerability openldap-server 2.3.41 2.4.02.4.8

Secunia Advisory reports:

A vulnerability has been reported in OpenLDAP, which can be exploited by malicious users to cause a DoS (Denial of Service).

27778 CVE-2008-0658 2008-02-13 2008-02-22
clamav -- ClamAV libclamav PE File Integer Overflow Vulnerability clamav 0.920.92.1

iDefense Security Advisory 02.12.08:

Remote exploitation of an integer overflow vulnerability in Clam AntiVirus' ClamAV, as included in various vendors' operating system distributions, allows attackers to execute arbitrary code with the privileges of the affected process.

The vulnerability exists within the code responsible for parsing and scanning PE files. While iterating through all sections contained in the PE file, several attacker controlled values are extracted from the file. On each iteration, arithmetic operations are performed without taking into consideration 32-bit integer wrap.

Since insufficient integer overflow checks are present, an attacker can cause a heap overflow by causing a specially crafted Petite packed PE binary to be scanned. This results in an exploitable memory corruption condition.

Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the process using libclamav. In the case of the clamd program, this will result in code execution with the privileges of the clamav user. Unsuccessful exploitation results in the clamd process crashing.

Workaround

Disabling the scanning of PE files will prevent exploitation.

If using clamscan, this can be done by running clamscan with the '--no-pe' option.

If using clamdscan, set the 'ScanPE' option in the clamd.conf file to 'no'.

CVE-2008-0318 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=658 http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog 2008-01-07 2008-02-15
cacti -- Multiple security vulnerabilities have been discovered cacti 0.8.7b

The cacti development team reports:

Multiple security vulnerabilities have been discovered in Cacti's web interface:

  • XSS vulnerabilities
  • Path disclosure vulnerabilities
  • SQL injection vulnerabilities
  • HTTP response splitting vulnerabilities
http://forums.cacti.net/about25749.html 2008-02-12 2008-02-12
ikiwiki -- javascript insertion via uris ikiwiki 2.32.3

The ikiwiki development team reports:

The htmlscrubber did not block javascript in uris. This was fixed by adding a whitelist of valid uri types, which does not include javascript. Some urls specifyable by the meta plugin could also theoretically have been used to inject javascript; this was also blocked.

CVE-2008-0808 http://ikiwiki.info/security/#index30h2 2008-02-10 2008-02-11 2010-05-12
zenphoto -- XSS vulnerability zenphoto 1.1.4

zenphoto project reports:

A new zenphoto version is now available. This release contains security fixes for HTML, XSS, and SQL injection vulnerabilities.

CVE-2007-6666 http://www.securityfocus.com/bid/27084 http://secunia.com/advisories/28281 2008-01-03 2008-02-09
jetty -- multiple vulnerability jetty 6.1.7

Greg Wilkins reports:

jetty allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' characters in the URI.

27117 CVE-2007-6672 http://jira.codehaus.org/browse/JETTY-386#action_117699 2007-12-22 2008-02-04
libxine -- buffer overflow vulnerability libxine 1.1.10

xine project reports:

A new xine-lib version is now available. This release contains a security fix (remotely-expoitable buffer overflow, CVE-2006-1664). (This is not the first time that that bug has been fixed...) It also fixes a few more recent bugs, such as the audio output problems in 1.1.9.

CVE-2006-1664 http://secunia.com/advisories/19853/ 2008-01-23 2008-01-29
xorg -- multiple vulnerabilities xorg-server 1.4_4,1 libXfont 1.3.1_2,1

Matthieu Herrb of X.Org reports:

Several vulnerabilities have been identified in server code of the X window system caused by lack of proper input validation on user controlled data in various parts of the software, causing various kinds of overflows.

Exploiting these overflows will crash the X server or, under certain circumstances allow the execution of arbitray machine code.

When the X server is running with root privileges (which is the case for the Xorg server and for most kdrive based servers), these vulnerabilities can thus also be used to raise privileges.

All these vulnerabilities, to be exploited succesfully, require either an already established connection to a running X server (and normally running X servers are only accepting authenticated connections), or a shell access with a valid user on the machine where the vulnerable server is installed.

CVE-2007-5760 CVE-2007-5958 CVE-2007-6427 CVE-2007-6428 CVE-2007-6429 CVE-2008-0006 http://lists.freedesktop.org/archives/xorg/2008-January/031918.html http://lists.freedesktop.org/archives/xorg/2008-January/032099.html http://secunia.com/advisories/28532/ 2008-01-18 2008-01-23
xfce -- multiple vulnerabilities xfce4-panel libxfce4gui 4.4.2

Gentoo reports:

A remote attacker could entice a user to install a specially crafted "rc" file to execute arbitrary code via long strings in the "Name" and "Comment" fields or via unspecified vectors involving the second vulnerability.

CVE-2007-6531 CVE-2007-6532 http://www.xfce.org/documentation/changelogs/4.4.2 http://www.gentoo.org/security/en/glsa/glsa-200801-06.xml 2008-01-09 2008-01-22 2008-02-13
claws-mail -- insecure temporary file creation claws-mail 3.1.0

Nico Golde reports:

A local attacker could exploit this vulnerability to conduct symlink attacks to overwrite files with the privileges of the user running Claws Mail.

26676 CVE-2007-6208 http://www.gentoo.org/security/en/glsa/glsa-200801-03.xml http://security.gentoo.org/glsa/glsa-200801-03.xml http://secunia.com/advisories/27897 2007-12-03 2008-01-22 2008-02-12
IRC Services-- Denial of Service Vulnerability ircservices 5.0.63

Secunia reports:

A vulnerability has been reported in IRC Services, which can be exploited by malicious people to cause a Denial of Service. The vulnerability is caused due to the improper handling of overly long passwords within the "default_encrypt()" function in encrypt.c and can be exploited to crash an affected server.

CVE-2007-6122 http://secunia.com/advisories/27761 http://ircservices.za.net/Changes.txt 2007-11-21 2008-01-19
libxine -- buffer overflow vulnerability libxine 1.1.9.1

xine project reports:

A new xine-lib version is now available. This release contains a security fix (remotely-expoitable buffer overflow, CVE-2008-0225). It also contains a read-past-end fix for an internal library function which is only used if the OS does not supply it and a rendering fix for Darwin/PPC.

CVE-2008-0225 http://aluigi.altervista.org/adv/xinermffhof-adv.txt http://secunia.com/advisories/28384 2008-01-08 2008-01-19
geeklog xss vulnerability geeklog 1.4.1

Geeklog reports:

MustLive pointed out a possible XSS in the form to email an article to a friend that we're fixing with this release.

Please note that this problem only exists in Geeklog 1.4.0 - neither Geeklog 1.4.1 nor any older versions (1.3.x series) have that problem.

CVE-2006-3756 http://www.geeklog.net/article.php/geeklog-1.4.0sr6 2008-01-08 2008-01-15
drupal -- cross site request forgery drupal5 5.6 drupal4 4.7.11

The Drupal Project reports:

The aggregator module fetches items from RSS feeds and makes them available on the site. The module provides an option to remove items from a particular feed. This has been implemented as a simple GET request and is therefore vulnerable to cross site request forgeries. For example: Should a privileged user view a page containing an <img> tag with a specially constructed src pointing to a remove items URL, the items would be removed.

CVE-2008-0272 http://drupal.org/node/208562 http://secunia.com/advisories/28422/ 2008-01-10 2008-01-11 2010-05-12
drupal -- cross site scripting (utf8) drupal5 5.6 drupal4 4.7.11

The Drupal Project reports:

When outputting plaintext Drupal strips potentially dangerous HTML tags and attributes from HTML, and escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.

Certain byte sequences that are invalid in the UTF8 specification are not handled properly by Internet Explorer 6 and may lead it to see a multibyte start character where none is present. Internet Explorer 6 then consumes a number of subsequent UTF-8 characters. This may lead to unsafe attributes that were outside a tag for the filter to appear inside a tag for Internet Explorer 6. This behaviour can then be used to insert and execute javascript in the context of the website.

CVE-2008-0273 http://drupal.org/node/208564 http://secunia.com/advisories/28422/ 2008-01-10 2008-01-11 2010-05-12
drupal -- cross site scripting (register_globals) drupal5 5.6 drupal4 4.7.11

The Drupal Project reports:

When theme .tpl.php files are accessible via the web and the PHP setting register_globals is set to enabled, anonymous users are able to execute cross site scripting attacks via specially crafted links.

Drupal's .htaccess attempts to set register_globals to disabled and also prevents access to .tpl.php files. Only when both these measures are not effective and your PHP interpreter is configured with register_globals set to enabled, will this issue affect you.

CVE-2008-0274 http://drupal.org/node/208565 http://secunia.com/advisories/28422/ 2008-01-10 2008-01-11 2010-05-12
maradns -- CNAME record resource rotation denial of service maradns 1.2.12.08

Secunia reports:

A vulnerability has been reported in MaraDNS, which can be exploited by malicious people to cause a Denial of Service.

The vulnerability is caused due to an error within the handling of certain DNS packets. This can be exploited to cause a resource rotation by sending specially crafted DNS packets, which cause an authoritative CNAME record to not resolve, resulting in a Denial of Sevices.

CVE-2008-0061 http://maradns.blogspot.com/2007/08/maradns-update-all-versions.html http://secunia.com/advisories/28329 2008-01-04 2008-01-10
linux-realplayer -- multiple vulnerabilities linux-realplayer 10.0.510.0.9.809.20070726

Secunia reports:

Multiple vulnerabilities have been reported in RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious people to compromise a user's system.

An input validation error when processing .RA/.RAM files can be exploited to cause a heap corruption via a specially crafted .RA/.RAM file with an overly large size field in the header.

An error in the processing of .PLS files can be exploited to cause a memory corruption and execute arbitrary code via a specially crafted .PLS file.

An input validation error when parsing .SWF files can be exploited to cause a buffer overflow via a specially crafted .SWF file with malformed record headers.

A boundary error when processing rm files can be exploited to cause a buffer overflow.

CVE-2007-5081 CVE-2007-3410 CVE-2007-2263 CVE-2007-2264 http://secunia.com/advisories/27361 http://service.real.com/realplayer/security/10252007_player/en/ http://www.zerodayinitiative.com/advisories/ZDI-07-063.html http://www.zerodayinitiative.com/advisories/ZDI-07-062.html http://www.zerodayinitiative.com/advisories/ZDI-07-061.html http://secunia.com/advisories/25819/ 759385 2007-10-25 2008-01-04
linux-flashplugin -- multiple vulnerabilities linux-flashplugin 9.09.0r115 7.07.0r73

Adobe Security bulletin:

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities. Users are recommended to update to the most current version of Flash Player available for their platform.

CVE-2007-6242 CVE-2007-4768 CVE-2007-5275 CVE-2007-6243 CVE-2007-6244 CVE-2007-6245 CVE-2007-4324 CVE-2007-6246 CVE-2007-5476 http://www.adobe.com/support/security/bulletins/apsb07-20.html http://secunia.com/advisories/28161/ 2007-12-18 2008-01-03
dovecot -- Specific LDAP + auth cache configuration may mix up user logins dovecot 1.0.10

Dovecot reports:

If two users with the same password and same pass_filter variables log in within auth_cache_ttl seconds (1h by default), the second user may get logged in with the first user's cached pass_attrs. For example if pass_attrs contained the user's home/mail directory, this would mean that the second user will be accessing the first user's mails.

http://www.dovecot.org/list/dovecot-news/2007-December/000057.html 2007-12-21 2007-12-29
gallery2 -- multiple vulnerabilities gallery2 2.2.4

The Gallery team reports:

Gallery 2.2.4 addresses the following security vulnerabilities:

  • Publish XP module - Fixed unauthorized album creation and file uploads.
  • URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink protection.
  • Core / add-item modules - Fixed Cross Site Scripting (XSS) vulnerabilities through malicious file names.
  • Installation (Gallery application) - Update web-accessibility protection of the storage folder for Apache 2.2.
  • Core (Gallery application) / MIME module - Fixed vulnerability in checks for disallowed file extensions in file uploads.
  • Gallery Remote module - Added missing permissions checks for some GR commands.
  • WebDAV module - Fixed Cross Site Scripting (XSS) vulnerability through HTTP PROPPATCH.
  • WebDAV module - Fixed information (item data) disclosure in a WebDAV view.
  • Comment module - Fixed information (item data) disclosure in comment views.
  • Core module (Gallery application) - Improved resilience against item information disclosure attacks.
  • Slideshow module - Fixed information (item data) disclosure in the slideshow.
  • Print modules - Fixed information (item data) disclosure in several print modules.
  • Core / print modules - Fixed arbitrary URL redirection (phishing attacks) in the core module and several print modules.
  • WebCam module - Fixed proxied request weakness.
CVE-2007-6685 CVE-2007-6686 CVE-2007-6687 CVE-2007-6689 CVE-2007-6690 CVE-2007-6692 http://gallery.menalto.com/gallery_2.2.4_released 2007-12-24 2007-12-25 2010-05-12
e2fsprogs -- heap buffer overflow e2fsprogs 1.40.3

Theodore Y. Ts'o reports:

Fix a potential security vulnerability where an untrusted filesystem can be corrupted in such a way that a program using libext2fs will allocate a buffer which is far too small. This can lead to either a crash or potentially a heap-based buffer overflow crash. No known exploits exist, but main concern is where an untrusted user who possesses privileged access in a guest Xen environment could corrupt a filesystem which is then accessed by thus allowing the untrusted user to gain privileged access in the host OS. Thanks to the McAfee AVERT Research group for reporting this issue.

26772 CVE-2007-5497 http://secunia.com/advisories/27889/ http://sourceforge.net/project/shownotes.php?group_id=2406&release_id=560230 2007-12-07 2007-12-20
wireshark -- multiple vulnerabilities wireshark wireshark-lite ethereal ethereal-lite tethereal tethereal-lite 0.8.160.99.7

The Wireshark team reports of multiple vulnerabilities:

  • Wireshark could crash when reading an MP3 file.
  • Beyond Security discovered that Wireshark could loop excessively while reading a malformed DNP packet.
  • Stefan Esser discovered a buffer overflow in the SSL dissector.
  • The ANSI MAP dissector could be susceptible to a buffer overflow on some platforms.
  • The Firebird/Interbase dissector could go into an infinite loop or crash.
  • The NCP dissector could cause a crash.
  • The HTTP dissector could crash on some systems while decoding chunked messages.
  • The MEGACO dissector could enter a large loop and consume system resources.
  • The DCP ETSI dissector could enter a large loop and consume system resources.
  • Fabiodds discovered a buffer overflow in the iSeries (OS/400) Communication trace file parser.
  • The PPP dissector could overflow a buffer.
  • The Bluetooth SDP dissector could go into an infinite loop.
  • A malformed RPC Portmap packet could cause a crash.
  • The IPv6 dissector could loop excessively.
  • The USB dissector could loop excessively or crash.
  • The SMB dissector could crash.
  • The RPL dissector could go into an infinite loop.
  • The WiMAX dissector could crash due to unaligned access on some platforms.
  • The CIP dissector could attempt to allocate a huge amount of memory and crash.

Impact

It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

CVE-2007-6112 CVE-2007-6113 CVE-2007-6114 CVE-2007-6115 CVE-2007-6117 CVE-2007-6118 CVE-2007-6120 CVE-2007-6121 CVE-2007-6438 CVE-2007-6439 CVE-2007-6441 CVE-2007-6450 CVE-2007-6451 http://www.wireshark.org/security/wnpa-sec-2007-03.html 2007-12-19 2007-12-19 2007-12-22
opera -- multiple vulnerabilities opera opera-devel linux-opera 9.25

Opera Software ASA reports about multiple security fixes:

  • Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by David Bloom. Details will be disclosed at a later date.
  • Fixed an issue with TLS certificates that could be used to execute arbitrary code, as reported by Alexander Klink (Cynops GmbH). Details will be disclosed at a later date.
  • Rich text editing can no longer be used to allow cross domain scripting, as reported by David Bloom. See our advisory.
  • Prevented bitmaps from revealing random data from memory, as reported by Gynvael Coldwind. Details will be disclosed at a later date.
CVE-2007-6520 CVE-2007-6521 CVE-2007-6522 CVE-2007-6524 http://www.opera.com/docs/changelogs/freebsd/925/ http://www.opera.com/support/search/view/875/ 2007-12-19 2007-12-19 2007-12-29
peercast -- buffer overflow vulnerability peercast 0.1218

Luigi Auriemma reports that peercast is vulnerable to a buffer overflow which could lead to a DoS or potentially remote code execution:

The handshakeHTTP function which handles all the requests received by the other clients is vulnerable to a heap overflow which allows an attacker to fill the loginPassword and loginMount buffers located in the Servent class with how much data he wants.

CVE-2007-6454 http://aluigi.altervista.org/adv/peercasthof-adv.txt http://secunia.com/advisories/28120/ 2007-12-17 2007-12-19 2010-05-12
ganglia-webfrontend -- XSS vulnerabilities ganglia-webfrontend 3.0.6

The Ganglia project reports:

The Ganglia development team is pleased to release Ganglia 3.0.6 (Foss) which is available[...]. This release includes a security fix for web frontend cross-scripting vulnerability.

http://sourceforge.net/mailarchive/message.php?msg_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com http://sourceforge.net/mailarchive/forum.php?thread_name=d4c731da0712101044l7245cba9l34974008879f47a3%40mail.gmail.com&forum_name=ganglia-developers 2007-12-10 2007-12-17 2007-12-18
qemu -- Translation Block Local Denial of Service Vulnerability qemu qemu-devel 0.9.0_4 0.9.0s.20070101*0.9.0s.20070802_1

SecurityFocus reports:

QEMU is prone to a local denial-of-service vulnerability because it fails to perform adequate boundary checks when handling user-supplied input.

Attackers can exploit this issue to cause denial-of-service conditions. Given the nature of the issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

26666 CVE-2007-6227 http://www.securityfocus.com/archive/1/484429 2007-11-30 2007-12-12 2007-12-14
drupal -- SQL injection vulnerability drupal5 5.4 drupal4 4.7.9

The Drupal Project reports:

The function taxonomy_select_nodes() directly injects variables into SQL queries instead of using placeholders. While taxonomy module itself validates the input passed to taxonomy_select_nodes(), this is a weakness in Drupal core. Several contributed modules, such as taxonomy_menu, ajaxLoader, and ubrowser, directly pass user input to taxonomy_select_nodes(), enabling SQL injection attacks by anonymous users.

CVE-2007-6299 http://drupal.org/node/198162 http://secunia.com/advisories/27932/ 2007-12-05 2007-12-12
samba -- buffer overflow vulnerability samba samba3 ja-samba 3.0.28 *,13.0.28,1

Secuna Research reports:

Secunia Research has discovered a vulnerability in Samba, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the "send_mailslot()" function. This can be exploited to cause a stack-based buffer overflow with zero bytes via a specially crafted "SAMLOGON" domain logon packet containing a username string placed at an odd offset followed by an overly long GETDC string. Successful exploitation allows execution of arbitrary code, but requires that the "domain logons" option is enabled.

CVE-2007-6015 http://secunia.com/advisories/27760/ 2007-12-10 2007-12-12 2008-09-26
smbftpd -- format string vulnerability smbftpd 0.96

Secunia reports:

Format string vulnerability in the SMBDirList function in dirlist.c in SmbFTPD 0.96 allows remote attackers to execute arbitrary code via format string specifiers in a directory name.

CVE-2007-5184 http://secunia.com/advisories/27014/ http://sourceforge.net/project/shownotes.php?release_id=543077 2007-10-01 2007-12-12
jetty -- multiple vulnerabilities jetty 6.1.6

Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.

CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

237888 212984 438616 CVE-2007-5613 CVE-2007-5614 CVE-2007-5615 http://svn.codehaus.org/jetty/jetty/trunk/VERSION.txt 2007-12-05 2007-12-10
liveMedia -- DoS vulnerability liveMedia 2007.11.18,1

The live555 development team reports:

Fixed a bounds-checking error in "parseRTSPRequestString()" caused by an int vs. unsigned problem.

The function which handles the incoming queries from the clients is affected by a vulnerability which allows an attacker to crash the server remotely using the smallest RTSP query possible to use.

CVE-2007-6036 http://aluigi.altervista.org/adv/live555x-adv.txt http://www.live555.com/liveMedia/public/changelog.txt 2007-11-20 2007-12-08 2007-12-09
GNU finger vulnerability gnu-finger 1.37_1

GNU security announcement:

GNU Finger unfortunately has not been updated in many years, and has known security vulnerabilities. Please do not use it in production environments.

CVE-1999-1165 http://www.gnu.org/software/finger/ 1999-07-21 2007-12-05
Squid -- Denial of Service Vulnerability squid 2.02.6.16_1 3.*3.0.r1.20071001_1

Squid secuirty advisory reports:

Due to incorrect bounds checking Squid is vulnerable to a denial of service check during some cache update reply processing.

This problem allows any client trusted to use the service to perform a denial of service attack on the Squid service.

26687 CVE-2007-6239 2007-11-28 2007-12-04 2007-12-07
rubygem-rails -- session-fixation vulnerability rubygem-rails 1.2.6

Rails core team reports:

The rails core team has released ruby on rails 1.2.6 to address a bug in the fix for session fixation attacks (CVE-2007-5380). The CVE Identifier for this new issue is CVE-2007-6077.

CVE-2007-6077 2007-11-24 2007-11-27
rubygem-rails -- JSON XSS vulnerability rubygem-rails 1.2.5 rubygem-activesupport 1.4.4

Rails core team reports:

All users of Rails 1.2.4 or earlier are advised to upgrade to 1.2.5, though it isn't strictly necessary if you aren't working with JSON. For more information the JSON vulnerability, see CVE-2007-3227.

CVE-2007-3227 2007-10-12 2007-11-28 2007-12-01
ikiwiki -- improper symlink verification vulnerability ikiwiki 2.14

The ikiwiki development team reports:

Ikiwiki did not check if path to the srcdir to contained a symlink. If an attacker had commit access to the directories in the path, they could change it to a symlink, causing ikiwiki to read and publish files that were not intended to be published. (But not write to them due to other checks.)

http://ikiwiki.info/security/#index29h2 2007-11-26 2007-11-27
firefox -- multiple remote unspecified memory corruption vulnerabilities firefox 2.0.0.10,1 linux-firefox 2.0.0.10 seamonkey linux-seamonkey 1.1.7 flock linux-flock 1.0.2 linux-firefox-devel 3.0.a2007.12.12 linux-seamonkey-devel 2.0.a2007.12.12

Mozilla Foundation reports:

The Firefox 2.0.0.10 update contains fixes for three bugs that improve the stability of the product. These crashes showed some evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

26593 CVE-2007-5959 2007-11-26 2007-11-27 2007-12-14
phpmyadmin -- Cross Site Scripting phpmyadmin 2.11.2.2

phpMyAdmin security announcement:

The login page auth_type cookie was vulnerable to XSS via the convcharset parameter. An attacker could use this to execute malicious code on the visitors computer

CVE-2007-6100 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8 http://www.nth-dimension.org.uk/downloads.php?id=38 2007-11-20 2007-11-21 2010-05-12
samba -- multiple vulnerabilities samba samba3 ja-samba 3.0.26a *,13.0.26a_2,1

The Samba Team reports:

Secunia Research reported a vulnerability that allows for the execution of arbitrary code in nmbd. This defect may only be exploited when the "wins support" parameter has been enabled in smb.conf.

Samba developers have discovered what is believed to be a non-exploitable buffer over in nmbd during the processing of GETDC logon server requests. This code is only used when the Samba server is configured as a Primary or Backup Domain Controller.

26454 CVE-2007-4572 CVE-2007-5398 http://secunia.com/advisories/27450/ http://us1.samba.org/samba/security/CVE-2007-4572.html http://us1.samba.org/samba/security/CVE-2007-5398.html 2007-11-15 2007-11-21 2008-09-26
php -- multiple security vulnerabilities php5 5.2.5

PHP project reports:

Security Enhancements and Fixes in PHP 5.2.5:

  • Fixed dl() to only accept filenames. Reported by Laurent Gaffie.
  • Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887). Reported by Laurent Gaffie.
  • Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences. Reported by Rasmus Lerdorf
  • Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
  • Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications. Reported by SecurityReason.
  • Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
  • Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
26403 CVE-2007-4887 2007-11-08 2007-11-16
mt-daapd -- denial of service vulnerability mt-daapd 0.2.4.1

US-CERT reports:

webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a stats method action to /xml-rpc with (1) an empty Authorization header line, which triggers a crash in the ws_decodepassword function; or (2) a header line without a ':' character, which triggers a crash in the ws_getheaders function.

CVE-2007-5824 2007-11-05 2007-11-12
net-snmp -- denial of service via GETBULK request net-snmp 5.3.1_7

CVE reports:

The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via a GETBULK request with a large max-repeaters value.

CVE-2007-5846 2007-11-06 2007-11-13 2007-11-14
flac -- media file processing integer overflow vulnerabilities flac 1.1.2_2

iDefense Laps reports:

Remote exploitation of multiple integer overflow vulnerabilities in libFLAC, as included with various vendor's software distributions, allows attackers to execute arbitrary code in the context of the currently logged in user.

These vulnerabilities specifically exist in the handling of malformed FLAC media files. In each case, an integer overflow can occur while calculating the amount of memory to allocate. As such, insufficient memory is allocated for the data that is subsequently read in from the file, and a heap based buffer overflow occurs.

CVE-2007-4619 http://secunia.com/advisories/27210/ http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=608 2007-10-11 2007-11-13
xpdf -- multiple remote Stream.CC vulnerabilities cups-base 1.3.3_2 gpdf 0 kdegraphics 3.5.8_1 koffice 1.6.3_3,2 poppler 0.6 xpdf 3.02_5

Secunia Research reports:

Secunia Research has discovered some vulnerabilities in Xpdf, which can be exploited by malicious people to compromise a user's system.

  • An array indexing error within the "DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc can be exploited to corrupt memory via a specially crafted PDF file.
  • An integer overflow error within the "DCTStream::reset()" method in xpdf/Stream.cc can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file.
  • A boundary error within the "CCITTFaxStream::lookChar()" method in xpdf/Stream.cc can be exploited to cause a heap-based buffer overflow by tricking a user into opening a PDF file containing a specially crafted "CCITTFaxDecode" filter.

Successful exploitation may allow execution of arbitrary code.

26367 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 2007-11-07 2007-11-12 2007-11-14
plone -- unsafe data interpreted as pickles plone 2.52.5.5 3.03.0.3

Plone projectreports:

This hotfix corrects a vulnerability in the statusmessages and linkintegrity modules, where unsafe network data was interpreted as python pickles. This allows an attacker to run arbitrary python code within the Zope/Plone process.

26354 CVE-2007-5741 2007-11-06 2007-11-12
phpmyadmin -- cross-site scripting vulnerability phpMyAdmin 2.11.2.1

The DigiTrust Group reports:

When creating a new database, a malicious user can use a client-side Web proxy to place malicious code in the db parameter of the POST request. Since db_create.php does not properly sanitize user-supplied input, an administrator could face a persistent XSS attack when the database names are displayed.

CVE-2007-5976 CVE-2007-5977 http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7 2007-11-11 2007-11-11 2010-05-12
gallery2 -- multiple vulnerabilities gallery2 2.2.3

Gallery project reports:

Gallery 2.2.3 addresses the following security vulnerabilities:

  • Unauthorized renaming of items possible with WebDAV (reported by Merrick Manalastas)
  • Unauthorized modification and retrieval of item properties possible with WebDAV
  • Unauthorized locking and replacing of items possible with WebDAV
  • Unauthorized editing of data file possible via linked items with Reupload and WebDAV (reported by Nicklous Roberts)
CVE-2007-4650 25580 2007-08-29 2007-11-09
tikiwiki -- multiple vulnerabilities tikiwik 1.9.8.2

Secunia reports:

Some vulnerabilities have been reported in TikiWiki, which can be exploited by malicious people to conduct cross-site scripting and script insertion attacks and disclose potentially sensitive information.

Input passed to the username parameter in tiki-remind_password.php (when remind is set to send me my password) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code (for example with meta refreshes to a javascript: URL) in a user's browser session in context of an affected site.

Input passed to the local_php and error_handler parameters in tiki-index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

Input passed to the imp_language parameter in tiki-imexport_languages.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

Certain img src elements are not properly santised before being used. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed.

CVE-2007-4554 CVE-2007-5683 CVE-2007-5684 http://secunia.com/advisories/26618/ http://tikiwiki.cvs.sourceforge.net/tikiwiki/tiki/changelog.txt?view=markup&pathrev=REL-1-9-8-2 2007-08-27 2007-11-09 2008-10-03
cups -- off-by-one buffer overflow cups-base 1.3.3_1

Secunia reports:

Secunia Research has discovered a vulnerability in CUPS, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the "ippReadIO()" function in cups/ipp.c when processing IPP (Internet Printing Protocol) tags. This can be exploited to overwrite one byte on the stack with a zero by sending an IPP request containing specially crafted "textWithLanguage" or "nameWithLanguage" tags.

Successful exploitation allows execution of arbitrary code.

CVE-2007-4351 http://secunia.com/secunia_research/2007-76/ 2007-11-06 2007-11-09 2007-11-12
perl -- regular expressions unicode data buffer overflow perl perl-threaded 5.8.*5.8.8_1

Red Hat reports:

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl.

CVE-2007-5116 http://secunia.com/advisories/27546/ 2007-11-05 2007-11-06 2007-11-07
pcre -- arbitrary code execution pcre pcre-utf8 7.3

Debian project reports:

Tavis Ormandy of the Google Security Team has discovered several security issues in PCRE, the Perl-Compatible Regular Expression library, which potentially allow attackers to execute arbitrary code by compiling specially crafted regular expressions.

CVE-2007-1659 CVE-2007-1660 CVE-2007-1661 CVE-2007-1662 CVE-2007-4766 CVE-2007-4767 CVE-2007-4768 http://www.pcre.org/changelog.txt 2007-11-05 2007-11-06
perdition -- str_vwrite format string vulnerability perdition 1.17.1

SEC-Consult reports:

Perdition IMAP is affected by a format string bug in one of its IMAP output-string formatting functions. The bug allows the execution of arbitrary code on the affected server. A successful exploit does not require prior authentication.

26270 CVE-2007-5740 http://www.sec-consult.com/300.html http://secunia.com/advisories/27458 2007-10-31 2007-11-05
gftp -- multiple vulnerabilities gftp 2.0.18_6

Gentoo reports:

Kalle Olavi Niemitalo discovered two boundary errors in fsplib code included in gFTP when processing overly long directory or file names.

A remote attacker could trigger these vulnerabilities by enticing a user to download a file with a specially crafted directory or file name, possibly resulting in the execution of arbitrary code or a Denial of Service.

CVE-2007-3961 CVE-2007-3962 http://www.gentoo.org/security/en/glsa/glsa-200711-01.xml 2007-11-01 2007-11-05 2007-11-11
dircproxy -- remote denial of service dircproxy 1.0.5_1 dircproxy-devel 1.2.0.b2_1

Securiweb reports:

dircproxy allows remote attackers to cause a denial of service (segmentation fault) via an ACTION command without a parameter, which triggers a NULL pointer dereference, as demonstrated using a blank /me message from irssi.

CVE-2007-5226 http://dircproxy.securiweb.net/ticket/89 https://bugzilla.redhat.com/show_bug.cgi?id=319301 2006-09-06 2007-11-04 2008-01-31
wordpress -- cross-site scripting wordpress de-wordpress 2.3.1 zh-wordpress 0

A Secunia Advisory report:

Input passed to the "posts_columns" parameter in wp-admin/edit-post-rows.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2007-5710 http://secunia.com/advisories/27407 http://wordpress.org/development/2007/10/wordpress-231/ 2007-10-29 2007-11-01
openldap -- multiple remote denial of service vulnerabilities openldap-server 2.3.39 2.4.02.4.6

BugTraq reports:

OpenLDAP is prone to multiple remote denial-of-service vulnerabilities because of an incorrect NULL-termination issue and a double-free issue.

26245 CVE-2007-5707 CVE-2007-5708 2007-10-29 2007-10-30 2007-10-31
py-django -- denial of service vulnerability py23-django py24-django py25-django 0.96.1 py23-django-devel py24-django-devel py25-django-devel 20071026

Django project reports:

A per-process cache used by Django's internationalization ("i18n") system to store the results of translation lookups for particular values of the HTTP Accept-Language header used the full value of that header as a key. An attacker could take advantage of this by sending repeated requests with extremely large strings in the Accept-Language header, potentially causing a denial of service by filling available memory.

Due to limitations imposed by Web server software on the size of HTTP header fields, combined with reasonable limits on the number of requests which may be handled by a single server process over its lifetime, this vulnerability may be difficult to exploit. Additionally, it is only present when the "USE_I18N" setting in Django is "True" and the i18n middleware component is enabled*. Nonetheless, all users of affected versions of Django are encouraged to update.

http://www.djangoproject.com/weblog/2007/oct/26/security-fix/ 2007-10-26 2007-10-27
opera -- multiple vulnerabilities opera opera-devel linux-opera 9.24

An advisory from Opera reports:

If a user has configured Opera to use an external newsgroup client or e-mail application, specially crafted Web pages can cause Opera to run that application incorrectly. In some cases this can lead to execution of arbitrary code.

When accesing frames from different Web sites, specially crafted scripts can bypass the same-origin policy, and overwrite functions from those frames. If scripts on the page then run those functions, this can cause the script of the attacker's choice to run in the context of the target Web site.

CVE-2007-5540 CVE-2007-5541 http://www.opera.com/support/search/view/866/ http://www.opera.com/support/search/view/867/ http://secunia.com/advisories/27277/ 2007-10-17 2007-10-25
drupal --- multiple vulnerabilities drupal4 4.7.8 drupal5 5.3

The Drupal Project reports:

In some circumstances Drupal allows user-supplied data to become part of response headers. As this user-supplied data is not always properly escaped, this can be exploited by malicious users to execute HTTP response splitting attacks which may lead to a variety of issues, among them cache poisoning, cross-user defacement and injection of arbitrary code.

The Drupal installer allows any visitor to provide credentials for a database when the site's own database is not reachable. This allows attackers to run arbitrary code on the site's server. An immediate workaround is the removal of the file install.php in the Drupal root directory.

The allowed extension list of the core Upload module contains the extension HTML by default. Such files can be used to execute arbitrary script code in the context of the affected site when a user views the file. Revoking upload permissions or removing the .html extension from the allowed extension list will stop uploads of malicious files. but will do nothing to protect your site againstfiles that are already present. Carefully inspect the file system path for any HTML files. We recommend you remove any HTML file you did not update yourself. You should look for , CSS includes, Javascript includes, and onerror="" attributes if you need to review files individually.

The Drupal Forms API protects against cross site request forgeries (CSRF), where a malicous site can cause a user to unintentionally submit a form to a site where he is authenticated. The user deletion form does not follow the standard Forms API submission model and is therefore not protected against this type of attack. A CSRF attack may result in the deletion of users.

The publication status of comments is not passed during the hook_comments API operation, causing various modules that rely on the publication status (such as Organic groups, or Subscriptions) to mail out unpublished comments.

CVE-2007-5597 CVE-2007-5596 CVE-2007-5595 CVE-2007-5594 CVE-2007-5593 http://drupal.org/node/184315 http://drupal.org/node/184316 http://drupal.org/node/184348 http://drupal.org/node/184354 http://drupal.org/node/184320 http://secunia.com/advisories/27292 http://secunia.com/advisories/27292 http://secunia.com/advisories/27292 http://secunia.com/advisories/27290 http://secunia.com/advisories/27290 2007-10-17 2007-10-24
ldapscripts -- Command Line User Credentials Disclosure ldapscripts 1.7.1

Ganael Laplanche reports:

Up to now, each ldap* command was called with the -w parameter, which allows to specify the bind password on the command line. Unfortunately, this could make the password appear to anybody performing a `ps` during the call. This is now avoided by using the -y parameter and a password file.

http://sourceforge.net/project/shownotes.php?group_id=156483&release_id=546600 http://secunia.com/advisories/27111 CVE-2007-5373 2007-10-09 2007-10-23
firefox -- OnUnload Javascript browser entrapment vulnerability firefox 2.0.0.8,1 linux-firefox 2.0.0.8 seamonkey linux-seamonkey 1.1.5

RedHat reports:

Several flaws were found in the way in which Firefox displayed malformed web content. A web page containing specially-crafted content could potentially trick a user into surrendering sensitive information. (CVE-2007-1095, CVE-2007-3844, CVE-2007-3511, CVE-2007-5334)

CVE-2007-1095 2007-10-19 2007-10-22 2007-10-23
phpmyadmin -- cross-site scripting vulnerability phpMyAdmin 2.11.1.2

The DigiTrust Group discovered serious XSS vulnerability in the phpMyAdmin server_status.php script. According to their report

vulnerability can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2007-5589 http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6 2007-10-17 2007-10-17 2010-05-12
phpmyadmin -- cross-site scripting vulnerability phpMyAdmin 2.11.1.1

SecurityFocus reports:

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

CVE-2007-5386 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5 http://www.digitrustgroup.com/advisories/TDG-advisory071009a http://secunia.com/advisories/27173 26020 2007-10-12 2007-10-16 2007-10-20
nagios-plugins -- Long Location Header Buffer Overflow Vulnerability nagios-plugins 1.4.10,1

A Secunia Advisory reports:

The vulnerability is caused due to a boundary error within the redir() function in check_http.c when processing HTTP Location: header information. This can be exploited to cause a buffer overflow by returning an overly long string in the "Location:" header to a vulnerable system.

http://sourceforge.net/forum/forum.php?forum_id=740172 http://secunia.com/advisories/27124/ CVE-2007-5198 2007-09-28 2007-10-11
png -- multiple vulnerabilities png 1.2.22

A Secunia Advisory reports:

Some vulnerabilities have been reported in libpng, which can be exploited by malicious people to cause a DoS (Denial of Service).

Certain errors within libpng, including a logical NOT instead of a bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency extension, and an incorrect use of sizeof() may be exploited to crash an application using the library.

Various out-of-bounds read errors exist within the functions png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(), png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by exploited to crash an application using the library.

The vulnerability is caused due to an off-by-one error within the ICC profile chunk handling, which potentially can be exploited to crash an application using the library.

http://secunia.com/advisories/27093/ http://secunia.com/advisories/27130/ CVE-2007-5267 CVE-2007-5266 CVE-2007-5268 CVE-2007-5269 2007-10-08 2007-10-11
ImageMagick -- multiple vulnerabilities ImageMagick ImageMagick-nox11 6.3.5.9

Multiple vulnerabilities have been discovered in ImageMagick.

ImageMagick before 6.3.5-9 allows context-dependent attackers to cause a denial of service via a crafted image file that triggers (1) an infinite loop in the ReadDCMImage function, related to ReadBlobByte function calls; or (2) an infinite loop in the ReadXCFImage function, related to ReadBlobMSBLong function calls.

Multiple integer overflows in ImageMagick before 6.3.5-9 allow context-dependent attackers to execute arbitrary code via a crafted (1) .dcm, (2) .dib, (3) .xbm, (4) .xcf, or (5) .xwd image file, which triggers a heap-based buffer overflow.

Off-by-one error in the ReadBlobString function in blob.c in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted image file, which triggers the writing of a '\0' character to an out-of-bounds address.

Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.

CVE-2007-4985 CVE-2007-4986 CVE-2007-4987 CVE-2007-4988 http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html 2007-09-19 2007-10-10
jdk/jre -- Applet Caching May Allow Network Access Restrictions to be Circumvented jdk 1.3.01.6.0.3p3 1.5.0,11.5.0.13p7,1 linux-blackdown-jdk 1.3.0 linux-sun-jdk 1.3.01.3.1.20 1.4.01.4.2.16 1.5.0.b1 1.5.0.b1,1 1.5.0,21.5.0.13,2 1.6.01.6.0.03

SUN reports:

A vulnerability in the Java Runtime Environment (JRE) with applet caching may allow an untrusted applet that is downloaded from a malicious website to make network connections to network services on machines other than the one that the applet was downloaded from. This may allow network resources (such as web pages) and vulnerabilities (that exist on these network services) which are not otherwise normally accessible to be accessed or exploited.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1 CVE-2007-5232 2007-10-03 2007-10-08 2007-11-16
xfs -- multiple vulnerabilities xfs 1.0.5,1

Matthieu Herrb reports:

Problem Description:

Several vulnerabilities have been identified in xfs, the X font server. The QueryXBitmaps and QueryXExtents protocol requests suffer from lack of validation of their 'length' parameters.

Impact:

On most modern systems, the font server is accessible only for local clients and runs with reduced privileges, but on some systems it may still be accessible from remote clients and possibly running with root privileges, creating an opportunity for remote privilege escalation.

CVE-2007-4568 http://lists.freedesktop.org/archives/xorg/2007-October/028899.html 2007-10-02 2007-10-08
tcl/tk -- buffer overflow in ReadImage function tk tk-threads 8.2.*8.2.3_11 8.3.*8.3.5_10 8.4.*,28.4.16,2

A Buffer overflow in the ReadImage function in generic/tkImgGIF.c in Tcl/Tk, allows remote attackers to execute arbitrary code via multi-frame interlaced GIF files in which later frames are smaller than the first.

http://secunia.com/advisories/26942 http://sourceforge.net/project/shownotes.php?release_id=541207 CVE-2007-5137 2007-09-27 2007-10-05 2011-09-04
firebird -- multiple remote buffer overflow vulnerabilities firebird-server 1.*1.5.5 2.0.*2.0.3

RISE Security reports:

There exists multiple vulnerabilities within functions of Firebird Relational Database, which when properly exploited can lead to remote compromise of the vulnerable system.

25925 2007-10-03 2007-10-04
id3lib -- insecure temporary file creation id3lib 3.8.3_4

Debian Bug report log reports:

When tagging file $foo, a temporary copy of the file is created, and for some reason, libid3 doesn't use mkstemp but just creates $foo.XXXXXX literally, without any checking.

This would silently truncate and overwrite an existing $foo.XXXXXX.

25372 CVE-2007-4460 2007-08-20 2007-10-01 2007-10-01
mediawiki -- cross site scripting vulnerability mediawiki 1.10.01.10.2 1.9.01.9.4 1.8.01.8.5

The MediaWiki development team reports:

A possible HTML/XSS injection vector in the API pretty-printing mode has been found and fixed.

The vulnerability may be worked around in an unfixed version by simply disabling the API interface if it is not in use, by adding this to LocalSettings.php:

$wgEnableAPI = false;

(This is the default setting in 1.8.x.)

CVE-2007-4828 http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html 2007-09-10 2007-09-21 2007-10-10
wordpress -- remote sql injection vulnerability wordpress 2.2.3,1 de-wordpress zh-wordpress 2.2.3 wordpress-mu 1.2.4,2

Alexander Concha reports:

While testing WordPress, it has been discovered a SQL Injection vulnerability that allows an attacker to retrieve remotely any user credentials from a vulnerable site, this bug is caused because of early database escaping and the lack of validation in query string like parameters.

CVE-2007-4894 http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html 2007-09-10 2007-09-21
samba -- nss_info plugin privilege escalation vulnerability samba 3.0.26a *,13.0.26a,1

The Samba development team reports:

The idmap_ad.so library provides an nss_info extension to Winbind for retrieving a user's home directory path, login shell and primary group id from an Active Directory domain controller. This functionality is enabled by defining the "winbind nss info" smb.conf option to either "sfu" or "rfc2307".

Both the Windows "Identity Management for Unix" and "Services for Unix" MMC plug-ins allow a user to be assigned a primary group for Unix clients that differs from the user's Windows primary group. When the rfc2307 or sfu nss_info plugin has been enabled, in the absence of either the RFC2307 or SFU primary group attribute, Winbind will assign a primary group ID of 0 to the domain user queried using the getpwnam() C library call.

CVE-2007-4138 http://www.samba.org/samba/security/CVE-2007-4138.html 2007-09-11 2007-09-21 2008-09-26
bugzilla -- multiple vulnerabilities bugzilla ja-bugzilla 2.20.*2.22.3 3.*3.0.1

A Bugzilla Security Advisory reports:

This advisory covers three security issues that have recently been fixed in the Bugzilla code:

  • A possible cross-site scripting (XSS) vulnerability when filing bugs using the guided form.
  • When using email_in.pl, insufficiently escaped data may be passed to sendmail.
  • Users using the WebService interface may access Bugzilla's time-tracking fields even if they normally cannot see them.

We strongly advise that 2.20.x and 2.22.x users should upgrade to 2.20.5 and 2.22.3 respectively. 3.0 users, and users of 2.18.x or below, should upgrade to 3.0.1.

25425 CVE-2007-4538 CVE-2007-4539 CVE-2007-4543 http://www.bugzilla.org/security/2.20.4/ 2007-08-23 2007-09-21
clamav -- multiple remote Denial of Service vulnerabilities clamav 0.91.2

BugTraq reports:

ClamAV is prone to multiple denial-of-service vulnerabilities.

A successful attack may allow an attacker to crash the application and deny service to users.

25398 CVE-2007-4510 2007-08-21 2007-09-21
coppermine -- multiple vulnerabilities coppermine 1.4.13

The coppermine development team reports two vulnerabilities with the coppermine application. These vulnerabilities are caused by improper checking of the log variable in "viewlog.php" and improper checking of the referer variable in "mode.php". This could allow local file inclusion, potentially disclosing valuable information and could lead to an attacker conducting a cross site scripting attack against the targeted site.

CVE-2007-4976 CVE-2007-4977 http://coppermine-gallery.net/forum/index.php?topic=46847.0 2007-09-14 2007-09-20 2010-05-12
openoffice -- arbitrary command execution vulnerability openoffice 0

iDefense reports:

Remote exploitation of multiple integer overflow vulnerabilities within OpenOffice, as included in various vendors' operating system distributions, allows attackers to execute arbitrary code.

These vulnerabilities exist within the TIFF parsing code of the OpenOffice suite. When parsing the TIFF directory entries for certain tags, the parser uses untrusted values from the file to calculate the amount of memory to allocate. By providing specially crafted values, an integer overflow occurs in this calculation. This results in the allocation of a buffer of insufficient size, which in turn leads to a heap overflow.

CVE-2007-2834 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=593 2007-09-19 2007-09-20
bugzilla -- "createmailregexp" security bypass vulnerability bugzilla 3.*3.0.2

The Bugzilla development team reports:

Bugzilla::WebService::User::offer_account_by_email does not check the "createemailregexp" parameter, and thus allows users to create accounts who would normally be denied account creation. The "emailregexp" parameter is still checked. If you do not have the SOAP::Lite Perl module installed on your Bugzilla system, your system is not vulnerable (because the Bugzilla WebService will not be enabled).

CVE-2007-5038 http://www.bugzilla.org/security/3.0.1/ 2007-09-18 2007-09-20 2010-05-12
konquerer -- address bar spoofing kdebase 3.5.7_3 kdelibs 3.5.7_2

The KDE development team reports:

The Konqueror address bar is vulnerable to spoofing attacks that are based on embedding white spaces in the url. In addition the address bar could be tricked to show an URL which it is intending to visit for a short amount of time instead of the current URL.

CVE-2007-3820 CVE-2007-4224 CVE-2007-4225 http://www.kde.org/info/security/advisory-20070914-1.txt 2007-09-14 2007-09-19
kdm -- passwordless login vulnerability kdebase3 3.5.7_3

The KDE development team reports:

KDM can be tricked into performing a password-less login even for accounts with a password set under certain circumstances, namely autologin to be configured and "shutdown with password" enabled.

CVE-2007-4569 http://www.kde.org/info/security/advisory-20070919-1.txt 2007-09-19 2007-09-19
flyspray -- authentication bypass flyspray 0.9.9.2

The Flyspray Project reports:

Flyspray authentication system can be bypassed by sending a carefully crafted post request.

To be vulnerable, PHP configuration directive output_buffering has to be disabled or set to a low value.

CVE-2007-1788 http://www.flyspray.org/fsa:1 2007-03-13 2007-09-19
mozilla -- code execution via Quicktime media-link files firefox 2.0.0.7,1 linux-firefox 2.0.0.7 seamonkey linux-seamonkey 1.1.5 linux-firefox-devel 3.0.a2007.12.12 linux-seamonkey-devel 2.0.a2007.12.12 firefox-ja linux-mozilla-devel linux-mozilla mozilla 0

The Mozilla Foundation reports a vulnerability within the mozilla browser. This vulnerability also affects various other browsers like firefox and seamonkey. The vulnerability is caused by QuickTime Media-Link files that contain a qtnext attribute. This could allow an attacker to start the browser with arbitrary command-line options. This could allow the attacker to install malware, steal local data and possibly execute and/or do other arbitrary things within the users context.

CVE-2006-4965 http://www.mozilla.org/security/announce/2007/mfsa2007-28.html 2007-09-18 2007-09-19 2007-12-14
php -- multiple vulnerabilities php5 5.2.4 php4 4.4.8

The PHP development team reports:

Security Enhancements and Fixes in PHP 5.2.4:

  • Fixed a floating point exception inside wordwrap() (Reported by Mattias Bengtsson)
  • Fixed several integer overflows inside the GD extension (Reported by Mattias Bengtsson)
  • Fixed size calculation in chunk_split() (Reported by Gerhard Wagner)
  • Fixed integer overflow in str[c]spn(). (Reported by Mattias Bengtsson)
  • Fixed money_format() not to accept multiple %i or %n tokens. (Reported by Stanislav Malyshev)
  • Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Reported by Stefan Esser)
  • Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Reported by Mattias Bengtsson)
  • Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Reported by Maksymilian Arciemowicz)
  • Fixed a possible invalid read in glob() win32 implementation (CVE-2007-3806) (Reported by shinnai)
  • Fixed a possible buffer overflow in php_openssl_make_REQ (Reported by zatanzlatan at hotbrev dot com)
  • Fixed an open_basedir bypass inside glob() function (Reported by dr at peytz dot dk)
  • Fixed a possible open_basedir bypass inside session extension when the session file is a symlink (Reported by c dot i dot morris at durham dot ac dot uk)
  • Improved fix for MOPB-03-2007.
  • Corrected fix for CVE-2007-2872.
CVE-2007-2872 CVE-2007-3378 CVE-2007-3806 CVE-2007-3996 CVE-2007-3997 CVE-2007-3998 CVE-2007-4652 CVE-2007-4657 CVE-2007-4658 CVE-2007-4659 CVE-2007-4660 CVE-2007-4661 CVE-2007-4662 CVE-2007-4663 CVE-2007-4670 http://www.php.net/releases/4_4_8.php http://www.php.net/releases/5_2_4.php http://secunia.com/advisories/26642 2007-08-30 2007-09-11 2008-01-14
apache -- multiple vulnerabilities apache 2.2.02.2.6 2.0.02.0.61

Apache HTTP server project reports:

The following potential security flaws are addressed:

  • CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers.
  • CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value.
  • CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group.
  • CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset "detection". Reported by Stefan Esser.
  • CVE-2006-1862: mod_mem_cache: Copy headers into longer lived storage; header names and values could previously point to cleaned up storage.
CVE-2007-3847 CVE-2007-1863 CVE-2006-5752 CVE-2007-3304 2007-09-07 2007-09-11
lighttpd -- FastCGI header overrun in mod_fastcgi lighttpd 1.4.18

lighttpd maintainer reports:

Lighttpd is prone to a header overflow when using the mod_fastcgi extension, this can lead to arbitrary code execution in the fastcgi application. For a detailed description of the bug see the external reference.

This bug was found by Mattias Bengtsson and Philip Olausson

http://www.lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt http://secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability/ CVE-2007-4727 2007-09-09 2007-09-10
rkhunter -- insecure temporary file creation rkhunter 1.2.5

Gentoo reports:

Sune Kloppenborg Jeppesen and Tavis Ormandy of the Gentoo Linux Security Team have reported that the check_update.sh script and the main rkhunter script insecurely creates several temporary files with predictable filenames.

A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When rkhunter or the check_update.sh script runs, this would result in the file being overwritten with the rights of the user running the utility, which could be the root user.

13399 CVE-2005-1270 http://www.gentoo.org/security/en/glsa/glsa-200504-25.xml 2005-04-26 2007-09-05
lsh -- multiple vulnerabilities lsh 2.0.1

Secunia reports:

A vulnerability has been reported in LSH, which potentially can be exploited by malicious people to cause a DoS (Denial of Service).

CVE-2003-0826 CVE-2005-0814 http://secunia.com/advisories/14609 2005-03-17 2007-09-05 2008-01-07
fetchmail -- denial of service on reject of local warning message fetchmail 4.6.86.3.8_4

Matthias Andree reports:

fetchmail will generate warning messages in certain circumstances (for instance, when leaving oversized messages on the server or login to the upstream fails) and send them to the local postmaster or the user running it.

If this warning message is then refused by the SMTP listener that fetchmail is forwarding the message to, fetchmail crashes and does not collect further messages until it is restarted.

CVE-2007-4565 http://www.fetchmail.info/fetchmail-SA-2007-02.txt 2007-07-29 2007-09-02
gtar -- Directory traversal vulnerability gtar 1.18_1

Red Hat reports:

A path traversal flaw was discovered in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar had write access.

Red Hat credits Dmitry V. Levin for reporting the issue.

25417 CVE-2007-4131 http://rhn.redhat.com/errata/RHSA-2007-0860.html https://bugzilla.redhat.com/show_bug.cgi?id=251921 2007-08-23 2007-09-01
claws-mail -- POP3 Format String Vulnerability claws-mail sylpheed-claws 2.10.0_3 sylpheed2 2.4.4_1

A Secunia Advisory reports:

A format string error in the "inc_put_error()" function in src/inc.c when displaying a POP3 server's error response can be exploited via specially crafted POP3 server replies containing format specifiers.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into connecting to a malicious POP3 server.

CVE-2007-2958 http://secunia.com/advisories/26550/ http://secunia.com/secunia_research/2007-70/advisory/ 2007-08-24 2007-08-27 2010-05-12
rsync -- off by one stack overflow rsync 2.6.9_1

BugTraq reports:

The rsync utility is prone to an off-by-one buffer-overflow vulnerability. This issue is due to a failure of the application to properly bounds-check user-supplied input.

Successfully exploiting this issue may allow arbitrary code-execution in the context of the affected utility.

25336 CVE-2007-4091 2007-08-15 2007-08-21 2007-08-23
opera -- Vulnerability in javascript handling opera opera-devel linux-opera 9.23.20070809

An advisory from Opera reports:

A specially crafted JavaScript can make Opera execute arbitrary code.

http://www.opera.com/support/search/view/865/ 2007-08-03 2007-08-15 2007-08-25
fsplib -- multiple vulnerabilities fsplib 0.9

A Secunia Advisory reports:

fsplib can be exploited to compromise an application using the library.

A boundary error exists in the processing of file names in fsp_readdir_native, which can be exploited to cause a stack-based buffer overflow if the defined MAXNAMLEN is bigger than 256.

A boundary error exists in the processing of directory entries in fsp_readdir, which can be exploited to cause a stack-based buffer overflow on systems with an insufficient size allocated for the d_name field of directory entries.

CVE-2007-3961 CVE-2007-3962 http://secunia.com/advisories/26184/ 2007-07-24 2007-08-02
joomla -- multiple vulnerabilities joomla 1.0.13

A Secunia Advisory reports:

joomla can be exploited to conduct session fixation attacks, cross-site scripting attacks or HTTP response splitting attacks.

Certain unspecified input passed in com_search, com_content and mod_login is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Input passed to the url parameter is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTTP headers, which will be included in a response sent to the user, allowing for execution of arbitrary HTML and script code in a user's browser session in context of an affected site.

An error exists in the handling of sessions and can be exploited to hijack another user's session by tricking the user into logging in after following a specially crafted link.

CVE-2007-4188 CVE-2007-4189 CVE-2007-4190 CVE-2007-5577 http://www.joomla.org/content/view/3677/1/ http://secunia.com/advisories/26239/ 2007-07-30 2007-08-02 2010-05-12
FreeBSD -- Buffer overflow in tcpdump(1) tcpdump 3.9.6 FreeBSD 6.26.2_7 6.16.1_19 5.55.5_15

Problem Description:

An un-checked return value in the BGP dissector code can result in an integer overflow. This value is used in subsequent buffer management operations, resulting in a stack based buffer overflow under certain circumstances.

Impact:

By crafting malicious BGP packets, an attacker could exploit this vulnerability to execute code or crash the tcpdump process on the target system. This code would be executed in the context of the user running tcpdump(1). It should be noted that tcpdump(1) requires privileges in order to open live network interfaces.

Workaround:

No workaround is available.

CVE-2007-3798 SA-07:06.tcpdump 2007-08-01 2007-08-02
FreeBSD -- Predictable query ids in named(8) named 9.49.4.1.1 9.39.3.4.1 FreeBSD 6.26.2_7 6.16.1_19 5.55.5_15

Problem Description:

When named(8) is operating as a recursive DNS server or sending NOTIFY requests to slave DNS servers, named(8) uses a predictable query id.

Impact:

An attacker who can see the query id for some request(s) sent by named(8) is likely to be able to perform DNS cache poisoning by predicting the query id for other request(s).

Workaround:

No workaround is available.

CVE-2007-2926 SA-07:07.bind 2007-07-24 2007-08-02
xpdf -- stack based buffer overflow xpdf 3.02_2 kdegraphics 3.5.7_1 cups-base 1.2.11_3 gpdf 0 pdftohtml 0.39_3 poppler 0.5.9_4

The KDE Team reports:

kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains a vulnerability that can cause a stack based buffer overflow via a PDF file that exploits an integer overflow in StreamPredictor::StreamPredictor(). Remotely supplied pdf files can be used to disrupt the kpdf viewer on the client machine and possibly execute arbitrary code.

25124 CVE-2007-3387 http://www.kde.org/info/security/advisory-20070730-1.txt 2007-07-30 2007-07-31 2009-04-29
mutt -- buffer overflow vulnerability mutt mutt-lite ja-mutt zh-mutt 1.4.2.3

Securityfocus reports:

Mutt is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before using it in a memory copy operation. An attacker can exploit this issue to execute arbitrary code with the with the privileges of the victim. Failed exploit attempts will result in a denial of service.

24192 CVE-2007-2683 http://www.redhat.com/support/errata/RHSA-2007-0386.html 2007-05-28 2007-07-29
p5-Net-DNS -- multiple Vulnerabilities p5-Net-DNS 0.60

A Secunia Advisory reports:

An error exists in the handling of DNS queries where IDs are incremented with a fixed value and are additionally used for child processes in a forking server. This can be exploited to poison the DNS cache of an application using the module if a valid ID is guessed.

An error in the PP implementation within the "dn_expand()" function can be exploited to cause a stack overflow due to an endless loop via a specially crafted DNS packet.

CVE-2007-3377 CVE-2007-3409 http://secunia.com/advisories/25829/ 2007-06-27 2007-07-28
phpsysinfo -- url Cross-Site Scripting phpSysInfo 2.5.3_1

Doz reports:

A Input passed in the URL to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

http://secunia.com/advisories/26248/ 2007-07-27 2007-07-28 2007-08-01
drupal -- Cross site request forgeries drupal5 5.2

The Drupal Project reports:

Several parts in Drupal core are not protected against cross site request forgeries due to inproper use of the Forms API, or by taking action solely on GET requests. Malicious users are able to delete comments and content revisions and disable menu items by enticing a privileged users to visit certain URLs while the victim is logged-in to the targeted site.

http://drupal.org/node/162360 http://secunia.com/advisories/26224/ 2007-07-26 2007-07-28
drupal -- Multiple cross-site scripting vulnerabilities drupal4 4.7.7 drupal5 5.2

The Drupal Project reports:

Some server variables are not escaped consistently. When a malicious user is able to entice a victim to visit a specially crafted link or webpage, arbitrary HTML and script code can be injected and executed in the context of the victim's session on the targeted website.

Custom content type names are not escaped consistently. A malicious user with the 'administer content types' permission would be able to inject and execute arbitrary HTML and script code on the website. Revoking the 'administer content types' permission provides an immediate workaround.

http://drupal.org/node/162361 http://secunia.com/advisories/26224/ 2007-07-26 2007-07-28
vim -- Command Format String Vulnerability vim vim-lite vim-ruby vim6 vim6-ruby 7.1.39

A Secunia Advisory reports:

A format string error in the "helptags_one()" function in src/ex_cmds.c when running the "helptags" command can be exploited to execute arbitrary code via specially crafted help files.

CVE-2007-2953 http://secunia.com/advisories/25941/ 2007-07-27 2007-07-27
libvorbis -- Multiple memory corruption flaws libvorbis 1.2.0,3

isecpartners reports:

libvorbis contains several vulnerabilities allowing heap overwrite, read violations and a function pointer overwrite. These bugs cause a at least a denial of service, and potentially code execution.

http://www.isecpartners.com/advisories/2007-003-libvorbis.txt CVE-2007-3106 2007-06-05 2007-07-26
tomcat -- XSS vulnerability in sample applications apache-tomcat 6.0.06.0.11 tomcat 5.0.05.5.24 jakarta-tomcat 5.0.05.5.24

The Apache Project reports:

The JSP and Servlet included in the sample application within the Tomcat documentation webapp did not escape user provided data before including it in the output. This enabled a XSS attack. These pages have been simplified not to use any user provided data in the output.

CVE-2007-1355 24058 2007-05-19 2007-07-24
tomcat -- multiple vulnerabilities apache-tomcat 4.1.04.1.36 6.0.06.0.11 tomcat 5.0.05.5.23 jakarta-tomcat 4.0.04.1.0 5.0.05.5.23

Apache Project reports:

The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.36 stable. This build contains numerous library updates, A small number of bug fixes and two important security fixes.

CVE-2005-2090 CVE-2007-0450 CVE-2007-1358 2007-04-27 2007-07-24
dokuwiki -- XSS vulnerability in spellchecker backend dokuwiki 20070626_1 dokuwiki-devel 20070524_1

DokuWiki reports:

The spellchecker tests the UTF-8 capabilities of the used browser by sending an UTF-8 string to the backend, which will send it back unfiltered. By comparing string length the spellchecker can work around broken implementations. An attacker could construct a form to let users send JavaScript to the spellchecker backend, resulting in malicious JavaScript being executed in their browser.

Affected are all versions up to and including 2007-06-26 even when the spell checker is disabled.

http://xforce.iss.net/xforce/xfdb/35501 CVE-2007-3930 2007-06-26 2007-07-24
lighttpd -- multiple vulnerabilities lighttpd 1.4.15_1

Secunia Advisory reports:

Some vulnerabilities have been reported in lighttpd, which can be exploited by malicious people to bypass certain security restrictions or cause a DoS (Denial of Service).

CVE-2007-3947 CVE-2007-3948 CVE-2007-3949 CVE-2007-3950 http://trac.lighttpd.net/trac/ticket/1216 http://trac.lighttpd.net/trac/ticket/1232 http://trac.lighttpd.net/trac/ticket/1230 http://trac.lighttpd.net/trac/ticket/1263 2007-07-20 2007-07-21 2010-05-12
opera -- multiple vulnerabilities opera opera-devel linux-opera 9.22

Opera Software ASA reports of multiple security fixes in Opera, including an arbitrary code execute vulnerability:

Opera for Linux, FreeBSD, and Solaris has a flaw in the createPattern function that leaves old data that was in the memory before Opera allocated it in the new pattern. The pattern can be read and analyzed by JavaScript, so an attacker can get random samples of the user's memory, which may contain data.

Removing a specially crafted torrent from the download manager can crash Opera. The crash is caused by an erroneous memory access.

An attacker needs to entice the user to accept the malicious BitTorrent download, and later remove it from Opera's download manager. To inject code, additional means will have to be employed.

Users clicking a BitTorrent link and rejecting the download are not affected.

data: URLs embed data inside them, instead of linking to an external resource. Opera can mistakenly display the end of a data URL instead of the beginning. This allows an attacker to spoof the URL of a trusted site.

Opera's HTTP authentication dialog is displayed when the user enters a Web page that requires a login name and a password. To inform the user which server it was that asked for login credentials, the dialog displays the server name.

The user has to see the entire server name. A truncated name can be misleading. Opera's authentication dialog cuts off the long server names at the right hand side, adding an ellipsis (...) to indicate that it has been cut off.

The dialog has a predictable size, allowing an attacker to create a server name which will look almost like a trusted site, because the real domain name has been cut off. The three dots at the end will not be obvious to all users.

This flaw can be exploited by phishers who can set up custom sub-domains, for example by hosting their own public DNS.

CVE-2007-3929 CVE-2007-4944 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=564 http://www.opera.com/support/search/view/861/ http://www.opera.com/support/search/view/862/ http://www.opera.com/support/search/view/863/ http://www.opera.com/support/search/view/864/ http://www.opera.com/docs/changelogs/freebsd/922/ 2007-07-19 2007-07-19 2010-05-12
mozilla -- multiple vulnerabilities firefox 2.0.0.5,1 3.*,13.0.a2_3,1 linux-firefox linux-thunderbird mozilla-thunderbird thunderbird 2.0.0.5 seamonkey linux-seamonkey 1.1.3 linux-firefox-devel 3.0.a2007.12.12 linux-seamonkey-devel 2.0.a2007.12.12 firefox-ja linux-mozilla-devel linux-mozilla mozilla 0

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2007-25 XPCNativeWrapper pollution
  • MFSA 2007-24 Unauthorized access to wyciwyg:// documents
  • MFSA 2007-21 Privilege escalation using an event handler attached to an element not in the document
  • MFSA 2007-20 Frame spoofing while window is loading
  • MFSA 2007-19 XSS using addEventListener and setTimeout
  • MFSA 2007-18 Crashes with evidence of memory corruption
CVE-2007-3089 CVE-2007-3734 CVE-2007-3735 CVE-2007-3737 CVE-2007-3738 http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.5 http://www.mozilla.org/security/announce/2007/mfsa2007-18.html http://www.mozilla.org/security/announce/2007/mfsa2007-19.html http://www.mozilla.org/security/announce/2007/mfsa2007-20.html http://www.mozilla.org/security/announce/2007/mfsa2007-21.html http://www.mozilla.org/security/announce/2007/mfsa2007-24.html http://www.mozilla.org/security/announce/2007/mfsa2007-25.html TA07-199A 2007-07-17 2007-07-19 2008-06-21
linux-flashplugin -- critical vulnerabilities linux-flashplugin 9.09.0r45 8.08.0r34 7.0r69

Adobe reports:

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities.

CVE-2007-2022 CVE-2007-3456 CVE-2007-3457 2007-07-10 2007-07-18
wireshark -- Multiple problems wireshark wireshark-lite ethereal ethereal-lite tethereal tethereal-lite 0.8.200.99.6

wireshark Team reports:

It may be possible to make Wireshark or Ethereal crash or use up available memory by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

CVE-2007-3389 CVE-2007-3390 CVE-2007-3391 CVE-2007-3392 CVE-2007-3393 http://secunia.com/advisories/25833/ http://www.wireshark.org/security/wnpa-sec-2007-02.html 2007-06-29 2007-07-06 2010-05-12
typespeed -- arbitrary code execution typespeed 0.4.1

Debian reports:

Ulf Härnhammar from the Debian Security Audit Project discovered a problem in typespeed, a touch-typist trainer disguised as game. This could lead to a local attacker executing arbitrary code.

CVE-2005-0105 http://www.debian.org/security/2005/dsa-684 2005-02-16 2007-07-03 2007-07-09
vlc -- format string vulnerability and integer overflow vlc 0.8.6c

isecpartners reports:

VLC is vulnerable to a format string attack in the parsing of Vorbis comments in Ogg Vorbis and Ogg Theora files, CDDA data or SAP/SDP service discovery messages. Additionally, there are two errors in the handling of wav files, one a denial of service due to an uninitialized variable, and one integer overflow in sampling frequency calculations.

CVE-2007-3316 CVE-2007-3468 CVE-2007-3467 http://www.isecpartners.com/advisories/2007-001-vlc.txt 2007-06-05 2007-06-18 2010-05-12
flac123 -- stack overflow in comment parsing flac123 0.0.10

isecpartners reports:

flac123, also known as flac-tools, is vulnerable to a buffer overflow in vorbis comment parsing. This allows for the execution of arbitrary code.

CVE-2007-3507 http://sourceforge.net/forum/forum.php?forum_id=710314 http://www.isecpartners.com/advisories/2007-002-flactools.txt 2007-06-05 2007-06-28 2007-08-10
gd -- multiple vulnerabilities gd 2.0.35,1

gd had been reported vulnerable to several vulnerabilities:

  • CVE-2007-3472: Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers has unspecified attack vectors and impact.
  • CVE-2007-3473: The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.
  • CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
  • CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map.
  • CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
  • CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.
  • CVE-2007-3478: Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
CVE-2007-3472 CVE-2007-3473 CVE-2007-3474 CVE-2007-3475 CVE-2007-3476 CVE-2007-3477 CVE-2007-3478 http://www.libgd.org/ReleaseNote020035 http://www.frsirt.com/english/advisories/2007/2336 http://bugs.libgd.org/?do=details&task_id=89 http://bugs.libgd.org/?do=details&task_id=94 http://bugs.libgd.org/?do=details&task_id=70 http://bugs.libgd.org/?do=details&task_id=87 http://bugs.libgd.org/?do=details&task_id=92 http://bugs.libgd.org/?do=details&task_id=74 http://bugs.libgd.org/?do=details&task_id=48 http://bugs.php.net/bug.php?id=40578 2007-06-21 2007-06-29
evolution-data-server -- remote execution of arbitrary code vulnerability evolution-data-server 1.10.2_1 1.11.*1.11.4

Debian project reports:

It was discovered that the IMAP code in the Evolution Data Server performs insufficient sanitising of a value later used an array index, which can lead to the execution of arbitrary code.

CVE-2007-3257 http://secunia.com/advisories/25766/ http://bugzilla.gnome.org/show_bug.cgi?id=447414 2007-06-23 2007-06-25 2007-06-28
xpcd -- buffer overflow xpcd 0

Debian Project reports:

Erik Sjolund discovered a buffer overflow in pcdsvgaview, an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses svgalib to display graphics on the Linux console for which root permissions are required. A malicious user could overflow a fixed-size buffer and may cause the program to execute arbitrary code with elevated privileges.

12523 CVE-2005-0074 http://www.debian.org/security/2005/dsa-676 2005-02-11 2007-06-21
clamav -- multiple vulnerabilities clamav 0.90.3

Clamav had been found vulnerable to multiple vulnerabilities:

  • Improper checking for the end of an buffer causing an unspecified attack vector.
  • Insecure temporary file handling, which could be exploited to read sensitive information.
  • A flaw in the parser engine which could allow a remote attacker to bypass the scanning of RAR files.
  • A flaw in libclamav/unrar.c which could cause a remote Denial of Service (DoS) by sending a specially crafted RAR file with a modified vm_codesize.
  • A flaw in the OLE2 parser which could cause a remote Denial of Service (DoS).
CVE-2007-2650 CVE-2007-3023 CVE-2007-3024 CVE-2007-3122 CVE-2007-3123 http://news.gmane.org/gmane.comp.security.virus.clamav.devel/cutoff=2853 2007-04-18 2007-06-19
p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability p5-Mail-SpamAssassin 3.2.1

SpamAssassin website reports:

A local user symlink-attack DoS vulnerability in SpamAssassin has been found, affecting versions 3.1.x, 3.2.0, and SVN trunk.

http://spamassassin.apache.org/advisories/cve-2007-2873.txt CVE-2007-2873 2007-06-11 2007-06-18
cups -- Incomplete SSL Negotiation Denial of Service cups-base 1.2.11

Secunia reports:

CUPS is not using multiple workers to handle connections. This can be exploited to stop CUPS from accepting new connections by starting but never completing an SSL negotiation.

http://secunia.com/advisories/24517/ http://security.gentoo.org/glsa/glsa-200703-28.xml CVE-2007-0720 2007-05-05 2007-06-12
c-ares -- DNS Cache Poisoning Vulnerability c-ares 1.4.0

Secunia reports:

The vulnerability is caused due to predictable DNS "Transaction ID" field in DNS queries and can be exploited to poison the DNS cache of an application using the library if a valid ID is guessed.

CVE-2007-3152 CVE-2007-3153 http://secunia.com/advisories/25579/ http://cool.haxx.se/cvs.cgi/curl/ares/CHANGES?rev=HEAD&content-type=text/vnd.viewcvs-markup 2007-06-08 2007-06-09 2010-05-12
wordpress -- XMLRPC SQL Injection wordpress de-wordpress zh-wordpress 2.2.1

Secunia reports:

Slappter has discovered a vulnerability in WordPress, which can be exploited by malicious users to conduct SQL injection attacks.

Input passed to the "wp.suggestCategories" method in xmlrpc.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation allows e.g. retrieving usernames and password hashes, but requires valid user credentials and knowledge of the database table prefix.

24344 http://secunia.com/advisories/25552/ 2007-06-06 2007-06-09 2007-06-24
wordpress -- unmoderated comments disclosure wordpress de-wordpress zh-wordpress 2.2.2

Blogsecurity reports:

An attacker can read comments on posts that have not been moderated. This can be a real security risk if blog admins are using unmoderated comments (comments that have not been made public) to hide sensitive notes regarding posts, future work, passwords etc. So please be careful if you are one of these blog admins.

http://blogsecurity.net/news/news-310507/ 2007-06-01 2007-06-09 2007-08-16
webmin -- cross site scripting vulnerability webmin 1.350

Secunia reports:

Input passed to unspecified parameters in pam_login.cgi is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

24381 CVE-2007-3156 http://secunia.com/advisories/25580/ http://www.webmin.com/changes-1.350.html 2007-06-01 2007-06-09 2010-05-12
mplayer -- cddb stack overflow mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.10_10

Mplayer Team reports:

A stack overflow was found in the code used to handle cddb queries. When copying the album title and category, no checking was performed on the size of the strings before storing them in a fixed-size array. A malicious entry in the database could trigger a stack overflow in the program, leading to arbitrary code execution with the uid of the user running MPlayer.

24302 CVE-2007-2948 2007-06-06 2007-06-07
mod_jk -- information disclosure mod_jk 1.2.23,1 mod_jk-ap2 1.2.23

Kazu Nambo reports:

URL decoding the the Apache webserver prior to decoding in the Tomcat server could pypass access control rules and give access to pages on a different AJP by sending a crafted URL.

CVE-2007-1860 http://secunia.com/advisories/25383/ http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1 http://tomcat.apache.org/security-jk.html 2007-05-18 2007-06-05 2007-10-31
typo3 -- email header injection typo3 3.04.0.5 4.14.1.1

Olivier Dobberkau, Andreas Otto, and Thorsten Kahler report:

An unspecified error in the internal form engine can be used for sending arbitrary mail headers, using it for purposes which it is not meant for, e.g. sending spam messages.

CVE-2007-1081 http://secunia.com/advisories/24207/ http://typo3.org/teams/security/security-bulletins/typo3-20070221-1/ 2007-02-21 2007-06-04
phppgadmin -- cross site scripting vulnerability phppgadmin 4.1.1

SecurityFocus reports about phppgadmin:

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

24115 CVE-2007-5728 http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/063617.html http://secunia.com/advisories/25446/ 2007-05-27 2007-06-04 2010-05-12
findutils -- GNU locate heap buffer overrun findutils 4.2.31

James Youngman reports:

When GNU locate reads filenames from an old-format locate database, they are read into a fixed-length buffer allocated on the heap. Filenames longer than the 1026-byte buffer can cause a buffer overrun. The overrunning data can be chosen by any person able to control the names of filenames created on the local system. This will normally include all local users, but in many cases also remote users (for example in the case of FTP servers allowing uploads).

CVE-2007-2452 http://lists.gnu.org/archive/html/bug-findutils/2007-06/msg00000.html 2007-05-30 2007-06-01
FreeType 2 -- Heap overflow vulnerability freetype2 2.2.1_2

Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.

CVE-2007-2754 http://lists.gnu.org/archive/html/freetype-devel/2007-04/msg00041.html http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2754 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240200 ports/112769 2007-04-27 2007-05-24
FreeBSD -- heap overflow in file(1) file 4.21 FreeBSD 6.26.2_5 6.16.1_17 5.55.5_13

Problem Description:

When writing data into a buffer in the file_printf function, the length of the unused portion of the buffer is not correctly tracked, resulting in a buffer overflow when processing certain files.

Impact:

An attacker who can cause file(1) to be run on a maliciously constructed input can cause file(1) to crash. It may be possible for such an attacker to execute arbitrary code with the privileges of the user running file(1).

The above also applies to any other applications using the libmagic(3) library.

Workaround:

No workaround is available, but systems where file(1) and other libmagic(3)-using applications are never run on untrusted input are not vulnerable.

CVE-2007-1536 SA-07:04.file 2007-05-23 2007-05-23 2007-08-02
squirrelmail -- Cross site scripting in HTML filter squirrelmail 1.4.01.4.9a

The SquirrelMail developers report:

Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

CVE-2007-1262 http://www.squirrelmail.org/security/issue/2007-05-09 2007-05-09 2007-05-21
png -- DoS crash vulnerability png 1.2.17

A Libpng Security Advisory reports:

A grayscale PNG image with a malformed (bad CRC) tRNS chunk will crash some libpng applications.

This vulnerability could be used to crash a browser when a user tries to view such a malformed PNG file. It is not known whether the vulnerability could be exploited otherwise.

CVE-2007-2445 684664 http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt 2007-05-15 2007-05-16
samba -- multiple vulnerabilities samba ja-samba 3.*3.0.25 3.*,13.0.25,1

The Samba Team reports:

A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root.

When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server.

Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data.

Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.

This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the "username map script" smb.conf option (which is not enabled by default).

After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the "username map script" vulnerability, the remote file and printer management scripts require an authenticated user session.

CVE-2007-2444 CVE-2007-2446 CVE-2007-2447 http://de5.samba.org/samba/security/CVE-2007-2444.html http://de5.samba.org/samba/security/CVE-2007-2446.html http://de5.samba.org/samba/security/CVE-2007-2447.html 2007-05-14 2007-05-16 2008-09-26
php -- multiple vulnerabilities php5-imap php5-odbc php5-session php5-shmop php5-sqlite php5-wddx php5 5.2.2 php4-odbc php4-session php4-shmop php4-wddx php4 4.4.7 mod_php4-twig mod_php4 mod_php5 mod_php php4-cgi php4-cli php4-dtc php4-horde php4-nms php5-cgi php5-cli php5-dtc php5-horde php5-nms 44.4.7 55.2.2

The PHP development team reports:

Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:

  • Fixed CVE-2007-1001, GD wbmp used with invalid image size
  • Fixed asciiz byte truncation inside mail()
  • Fixed a bug in mb_parse_str() that can be used to activate register_globals
  • Fixed unallocated memory access/double free in in array_user_key_compare()
  • Fixed a double free inside session_regenerate_id()
  • Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers.
  • Limit nesting level of input variables with max_input_nesting_level as fix for.
  • Fixed CRLF injection inside ftp_putcmd().
  • Fixed a possible super-global overwrite inside import_request_variables().
  • Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library.

Security Enhancements and Fixes in PHP 5.2.2 only:

  • Fixed a header injection via Subject and To parameters to the mail() function
  • Fixed wrong length calculation in unserialize S type.
  • Fixed substr_compare and substr_count information leak.
  • Fixed a remotely trigger-able buffer overflow inside make_http_soap_request().
  • Fixed a buffer overflow inside user_filter_factory_create().

Security Enhancements and Fixes in PHP 4.4.7 only:

  • XSS in phpinfo()
CVE-2007-1001 http://www.php.net/releases/4_4_7.php http://www.php.net/releases/5_2_2.php 2007-05-03 2007-05-07 2014-04-01
qemu -- several vulnerabilities qemu qemu-devel 0.9.0_1 0.9.0s.20070101*0.9.0s.20070405_3

The Debian Security Team reports:

Several vulnerabilities have been discovered in the QEMU processor emulator, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-1320
Tavis Ormandy discovered that a memory management routine of the Cirrus video driver performs insufficient bounds checking, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1321
Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1322
Tavis Ormandy discovered that the "icebp" instruction can be abused to terminate the emulation, resulting in denial of service.

CVE-2007-1323
Tavis Ormandy discovered that the NE2000 network driver and the socket code perform insufficient input validation, which might allow the execution of arbitrary code through a heap overflow.

CVE-2007-1366
Tavis Ormandy discovered that the "aam" instruction can be abused to crash qemu through a division by zero, resulting in denial of service.

CVE-2007-1320 CVE-2007-1321 CVE-2007-1322 CVE-2007-1323 CVE-2007-1366 http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00040.html 2007-05-01 2007-05-01 2007-05-02
p5-Imager -- possibly exploitable buffer overflow p5-Imager 0.57

Imager 0.56 and all earlier versions with BMP support have a security issue when reading compressed 8-bit per pixel BMP files where either a compressed run of data or a literal run of data overflows the scan-line.

Such an overflow causes a buffer overflow in a malloc() allocated memory buffer, possibly corrupting the memory arena headers.

The effect depends on your system memory allocator, with glibc this typically results in an abort, but with other memory allocators it may be possible to cause local code execution.

CVE-2007-1942 CVE-2007-1943 CVE-2007-1946 CVE-2007-1948 https://rt.cpan.org/Public/Bug/Display.html?id=26811 http://ifsec.blogspot.com/2007/04/several-windows-image-viewers.html 2007-04-04 2007-04-30 2010-05-12
FreeBSD -- IPv6 Routing Header 0 is dangerous FreeBSD 6.26.2_4 6.16.1_16 5.55.5_12

Problem Description

There is no mechanism for preventing IPv6 routing headers from being used to route packets over the same link(s) many times.

Impact

An attacker can "amplify" a denial of service attack against a link between two vulnerable hosts; that is, by sending a small volume of traffic the attacker can consume a much larger amount of bandwidth between the two vulnerable hosts.

An attacker can use vulnerable hosts to "concentrate" a denial of service attack against a victim host or network; that is, a set of packets sent over a period of 30 seconds or more could be constructed such that they all arrive at the victim within a period of 1 second or less over a period of 30 seconds or more could be constructed such that they all arrive at the victim within a period of 1 second or less.

Other attacks may also be possible.

Workaround

No workaround is available.

CVE-2007-2242 SA-07:03.ipv6 2007-04-26 2007-04-28
mod_perl -- remote DoS in PATH_INFO parsing mod_perl 1.30 mod_perl2 2.0.3_2,3

Mandriva reports:

PerlRun.pm in Apache mod_perl 1.29 and earlier, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

CVE-2007-1349 http://www.mandriva.com/security/advisories?name=MDKSA-2007:083 http://secunia.com/advisories/24839 2007-03-29 2007-04-24 2007-06-27
claws-mail -- APOP vulnerability claws-mail 2.9.0

CVE reports:

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.

CVE-2007-1558 http://www.claws-mail.org/news.php 2007-04-02 2007-04-19
lighttpd -- DOS when access files with mtime 0 lighttpd 1.4.15

Lighttpd SA:

Lighttpd caches the rendered string for mtime. The cache key has as a default value 0. At that point the pointer to the string are still NULL. If a file with an mtime of 0 is requested it tries to access the pointer and crashes.

The bug requires that a malicious user can either upload files or manipulate the mtime of the files.

The bug was reported by cubiq and fixed by Marcus Rueckert.

CVE-2007-1870 http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_02.txt 2007-01-14 2007-04-14
lighttpd -- Remote DOS in CRLF parsing lighttpd 1.4.111.4.13_2

Lighttpd SA:

If the connection aborts during parsing "\r\n\r\n" the server might get into a infinite loop and use 100% of the CPU time. lighttpd still responses to other requests. This can be repeated until either the server limit for concurrent connections or file descriptors is reached.

The bug was reported and fixed by Robert Jakabosky.

CVE-2007-1869 http://www.lighttpd.net/assets/2007/4/13/lighttpd_sa2007_01.txt 2006-12-15 2007-04-14
freeradius -- EAP-TTLS Tunnel Memory Leak Remote DOS Vulnerability freeradius freeradius-mysql 1.1.5

The freeradius development team reports:

A malicous 802.1x supplicant could send malformed Diameter format attributes inside of an EAP-TTLS tunnel. The server would reject the authentication request, but would leak one VALUE_PAIR data structure, of approximately 300 bytes. If an attacker performed the attack many times (e.g. thousands or more over a period of minutes to hours), the server could leak megabytes of memory, potentially leading to an "out of memory" condition, and early process exit.

23466 CVE-2005-1455 CVE-2005-1454 CVE-2007-2028 CVE-2005-4745 http://www.freeradius.org/security.html 2007-04-10 2007-04-13 2010-05-12
fetchmail -- insecure APOP authentication fetchmail 6.3.8

Matthias Andree reports:

The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called "APOP" which no longer should be considered secure.

Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accepted random garbage as a POP3 server's APOP challenge. This made it easier than necessary for man-in-the-middle attackers to retrieve by several probing and guessing the first three characters of the APOP secret, bringing brute forcing the remaining characters well within reach.

CVE-2007-1558 http://www.fetchmail.info/fetchmail-SA-2007-01.txt 2007-04-06 2007-04-09
mcweject -- exploitable buffer overflow mcweject 0.9

CVE reports:

Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD, and possibly other versions, allows local users to execute arbitrary code via a long command line argument, possibly involving the device name.

CVE-2007-1719 ports/111365 http://www.milw0rm.com/exploits/3578 2007-03-27 2007-04-08
WebCalendar -- "noSet" variable overwrite vulnerability WebCalendar 1.0.5

Secunia reports:

A vulnerability has been discovered in WebCalendar, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to unspecified parameters is not properly verified before being used with the "noSet" parameter set. This can be exploited to overwrite certain variables, and allows e.g. the inclusion of arbitrary PHP files from internal or external resources.

CVE-2007-1343 22834 http://sourceforge.net/project/shownotes.php?release_id=491130 http://xforce.iss.net/xforce/xfdb/32832 2007-03-04 2007-04-08
zope -- cross-site scripting vulnerability zope 2.7.9_2 2.8.02.8.8 2.9.02.9.6 2.10.02.10.2 plone 2.5.3

The Zope Team reports:

A vulnerability has been discovered in Zope, where by certain types of misuse of HTTP GET, an attacker could gain elevated privileges. All Zope versions up to and including 2.10.2 are affected.

23084 CVE-2007-0240 ports/111119 http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view http://plone.org/products/plone/releases/2.5.3 2007-01-16 2007-04-05 2009-03-22
Squid -- TRACE method handling denial of service squid 2.6.*2.6.12

Squid advisory 2007:1 notes:

Due to an internal error Squid-2.6 is vulnerable to a denial of service attack when processing the TRACE request method.

Workarounds:

To work around the problem deny access to using the TRACE method by inserting the following two lines before your first http_access rule.

acl TRACE method TRACE

http_access deny TRACE

CVE-2007-1560 http://www.squid-cache.org/Advisories/SQUID-2007_1.txt 2007-03-20 2007-03-21 2010-05-12
sql-ledger -- security bypass vulnerability sql-ledger 2.6.26

Chris Travers reports:

George Theall of Tenable Security notified the LedgerSMB core team today of an authentication bypass vulnerability allowing full access to the administrator interface of LedgerSMB 1.1 and SQL-Ledger 2.x. The problem is caused by the password checking routine failing to enforce a password check under certain circumstances. The user can then create accounts or effect denial of service attacks.

This is not related to any previous CVE.

We have coordinated with the SQL-Ledger vendor and today both of us released security patches correcting the problem. SQL-Ledger users who can upgrade to 2.6.26 should do so, and LedgerSMB 1.1 or 1.0 users should upgrade to 1.1.9. Users who cannot upgrade should configure their web servers to use http authentication for the admin.pl script in the main root directory.

ports/110350 http://www.securityfocus.com/archive/1/462375 2007-03-09 2007-03-16
samba -- potential Denial of Service bug in smbd samba ja-samba 3.0.6,13.0.24,1

The Samba Team reports:

Internally Samba's file server daemon, smbd, implements support for deferred file open calls in an attempt to serve client requests that would otherwise fail due to a share mode violation. When renaming a file under certain circumstances it is possible that the request is never removed from the deferred open queue. smbd will then become stuck is a loop trying to service the open request.

This bug may allow an authenticated user to exhaust resources such as memory and CPU on the server by opening multiple CIFS sessions, each of which will normally spawn a new smbd process, and sending each connection into an infinite loop.

CVE-2007-0452 http://www.samba.org/samba/security/CVE-2007-0452.html 2007-02-05 2007-03-16
samba -- format string bug in afsacl.so VFS plugin samba ja-samba 3.0.6,13.0.24,1

The Samba Team reports:

NOTE: This security advisory only impacts Samba servers that share AFS file systems to CIFS clients and which have been explicitly instructed in smb.conf to load the afsacl.so VFS module.

The source defect results in the name of a file stored on disk being used as the format string in a call to snprintf(). This bug becomes exploitable only when a user is able to write to a share which utilizes Samba's afsacl.so library for setting Windows NT access control lists on files residing on an AFS file system.

CVE-2007-0454 http://www.samba.org/samba/security/CVE-2007-0454.html 2007-02-05 2007-03-16
ktorrent -- multiple vulnerabilities ktorrent 2.1.2 ktorrent-devel 20070311

Two problems have been found in KTorrent:

  • KTorrent does not properly sanitize file names to filter out ".." components, so it's possible for an attacker to create a malicious torrent in order to overwrite arbitrary files within the filesystem.
  • Messages with invalid chunk indexes aren't rejected.
CVE-2007-1384 CVE-2007-1385 http://ktorrent.org/forum/viewtopic.php?t=1401 2007-03-09 2007-03-11 2007-03-14
mplayer -- DMO File Parsing Buffer Overflow Vulnerability mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.10_5

"Moritz Jodeit reports:

There's an exploitable buffer overflow in the current version of MPlayer (v1.0rc1) which can be exploited with a maliciously crafted video file. It is hidden in the DMO_VideoDecoder() function of `loader/dmo/DMO_VideoDecoder.c' file.

22771 CVE-2007-1246 2007-02-11 2007-03-09
trac -- cross site scripting vulnerability trac 0.10.3 ja-trac 0.10.3_1

Secunia reports:

The vulnerability is caused due to an error within the "download wiki page as text" function, which can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation may require that the victim uses IE.

http://secunia.com/advisories/24470 http://trac.edgewall.org/wiki/ChangeLog#a0.10.3.1 2007-03-09 2007-03-09
mod_jk -- long URL stack overflow vulnerability mod_jk-ap2 mod_jk 1.2.191.2.21

TippingPoint and The Zero Day Initiative reports:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Tomcat JK Web Server Connector. Authentication is not required to exploit this vulnerability.

The specific flaw exists in the URI handler for the mod_jk.so library, map_uri_to_worker(), defined in native/common/jk_uri_worker_map.c. When parsing a long URL request, the URI worker map routine performs an unsafe memory copy. This results in a stack overflow condition which can be leveraged to execute arbitrary code.

CVE-2007-0774 http://tomcat.apache.org/security-jk.html http://www.zerodayinitiative.com/advisories/ZDI-07-008.html 2007-03-02 2007-03-05 2007-03-06
bind -- Multiple Denial of Service vulnerabilities named 9.3.4 FreeBSD 6.26.2_1 6.16.1_13 5.55.5_11

Problem Description:

A type * (ANY) query response containing multiple RRsets can trigger an assertion failure.

Certain recursive queries can cause the nameserver to crash by using memory which has already been freed.

Impact:

A remote attacker sending a type * (ANY) query to an authoritative DNS server for a DNSSEC signed zone can cause the named(8) daemon to exit, resulting in a Denial of Service.

A remote attacker sending recursive queries can cause the nameserver to crash, resulting in a Denial of Service.

Workaround:

There is no workaround available, but systems which are not authoritative servers for DNSSEC signed zones are not affected by the first issue; and systems which do not permit untrusted users to perform recursive DNS resolution are not affected by the second issue. Note that the default configuration for named(8) in FreeBSD allows local access only (which on many systems is equivalent to refusing access to untrusted users).

CVE-2007-0493 CVE-2007-0494 SA-07:02.bind 2007-02-09 2007-02-27
FreeBSD -- Jail rc.d script privilege escalation FreeBSD 6.16.1_12 6.06.0_17 5.55.5_15

Problem Description:

In multiple situations the host's jail rc.d(8) script does not check if a path inside the jail file system structure is a symbolic link before using the path. In particular this is the case when writing the output from the jail start-up to /var/log/console.log and when mounting and unmounting file systems inside the jail directory structure.

Impact:

Due to the lack of handling of potential symbolic links the host's jail rc.d(8) script is vulnerable to "symlink attacks". By replacing /var/log/console.log inside the jail with a symbolic link it is possible for the superuser (root) inside the jail to overwrite files on the host system outside the jail with arbitrary content. This in turn can be used to execute arbitrary commands with non-jailed superuser privileges.

Similarly, by changing directory mount points inside the jail file system structure into symbolic links, it may be possible for a jailed attacker to mount file systems which were meant to be mounted inside the jail at arbitrary points in the host file system structure, or to unmount arbitrary file systems on the host system.

NOTE WELL: The above vulnerabilities occur only when a jail is being started or stopped using the host's jail rc.d(8) script; once started (and until stopped), running jails cannot exploit this.

Workaround:

If the sysctl(8) variable security.jail.chflags_allowed is set to 0 (the default), setting the "sunlnk" system flag on /var, /var/log, /var/log/console.log, and all file system mount points and their parent directories inside the jail(s) will ensure that the console log file and mount points are not replaced by symbolic links. If this is done while jails are running, the administrator must check that an attacker has not replaced any directories with symlinks after setting the "sunlnk" flag.

CVE-2007-0166 SA-07:01.jail 2007-01-11 2007-02-27 2007-08-02
gtar -- name mangling symlink vulnerability FreeBSD 5.55.5_9 4.114.11_26

Problem Description:

Symlinks created using the "GNUTYPE_NAMES" tar extension can be absolute due to lack of proper sanity checks.

Impact:

If an attacker can get a user to extract a specially crafted tar archive the attacker can overwrite arbitrary files with the permissions of the user running gtar. If file system permissions allow it, this may allow the attacker to overwrite important system file (if gtar is being run as root), or important user configuration files such as .tcshrc or .bashrc, which would allow the attacker to run arbitrary commands.

Workaround:

Use "bsdtar", which is the default tar implementation in FreeBSD 5.3 and higher. For FreeBSD 4.x, bsdtar is available in the FreeBSD Ports Collection as ports/archivers/libarchive.

CVE-2006-6097 SA-06:26.gtar 2006-12-06 2007-02-27
FreeBSD -- Kernel memory disclosure in firewire(4) FreeBSD 6.16.1_11 6.06.2_16 5.55.5_9 4.114.11_26

Problem Description:

In the FW_GCROM ioctl, a signed integer comparison is used instead of an unsigned integer comparison when computing the length of a buffer to be copied from the kernel into the calling application.

Impact:

A user in the "operator" group can read the contents of kernel memory. Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way; for example, a terminal buffer might include a user-entered password.

Workaround:

No workaround is available, but systems without IEEE 1394 ("FireWire") interfaces are not vulnerable. (Note that systems with IEEE 1394 interfaces are affected regardless of whether any devices are attached.)

Note also that FreeBSD does not have any non-root users in the "operator" group by default; systems on which no users have been added to this group are therefore also not vulnerable.

CVE-2006-6013 SA-06:25.kmem 2006-12-06 2007-02-27
libarchive -- Infinite loop in corrupt archives handling in libarchive libarchive 1.3.1

Problem Description:

If the end of an archive is reached while attempting to "skip" past a region of an archive, libarchive will enter an infinite loop wherein it repeatedly attempts (and fails) to read further data.

Impact:

An attacker able to cause a system to extract (via "tar -x" or another application which uses libarchive) or list the contents (via "tar -t" or another libarchive-using application) of an archive provided by the attacker can cause libarchive to enter an infinite loop and use all available CPU time.

Workaround:

No workaround is available.

CVE-2006-5680 SA-06:24.libarchive 2006-11-08 2007-02-26
OpenSSL -- Multiple problems in crypto(3) openssl 0.9.7l_0 0.9.80.9.8d_0 FreeBSD 6.16.1_9 6.06.0_14 5.55.5_7 5.45.4_21 5.35.3_36 4.114.11_24

Problem Description:

Several problems have been found in OpenSSL:

  • During the parsing of certain invalid ASN1 structures an error condition is mishandled, possibly resulting in an infinite loop.
  • A buffer overflow exists in the SSL_get_shared_ciphers function.
  • A NULL pointer may be dereferenced in the SSL version 2 client code.

In addition, many applications using OpenSSL do not perform any validation of the lengths of public keys being used.

Impact:

Servers which parse ASN1 data from untrusted sources may be vulnerable to a denial of service attack.

An attacker accessing a server which uses SSL version 2 may be able to execute arbitrary code with the privileges of that server.

A malicious SSL server can cause clients connecting using SSL version 2 to crash.

Applications which perform public key operations using untrusted keys may be vulnerable to a denial of service attack.

Workaround:

No workaround is available, but not all of the vulnerabilities mentioned affect all applications.

CVE-2006-2937 CVE-2006-2938 CVE-2006-2940 CVE-2006-3738 CVE-2006-4343 SA-06:23.openssl 2006-09-28 2007-02-26
mozilla -- multiple vulnerabilities firefox 1.5.0.10,1 2.*,12.0.0.2,1 linux-firefox 1.5.0.10 lightning 0.3.1 seamonkey linux-seamonkey 1.0.8 1.11.1.1 thunderbird linux-thunderbird mozilla-thunderbird 1.5.0.10 linux-firefox-devel 3.0.a2007.04.18 linux-seamonkey-devel 1.5.a2007.04.18 firefox-ja linux-mozilla-devel linux-mozilla mozilla 0

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2007-08 onUnload + document.write() memory corruption
  • MFSA 2007-07 Embedded nulls in location.hostname confuse same-domain checks
  • MFSA 2007-06 Mozilla Network Security Services (NSS) SSLv2 buffer overflow
  • MFSA 2007-05 XSS and local file access by opening blocked popups
  • MFSA 2007-04 Spoofing using custom cursor and CSS3 hotspot
  • MFSA 2007-03 Information disclosure through cache collisions
  • MFSA 2007-02 Improvements to help protect against Cross-Site Scripting attacks
  • MFSA 2007-01 Crashes with evidence of memory corruption (rv:1.8.0.10/1.8.1.2)
CVE-2006-6077 CVE-2007-0008 CVE-2007-0009 CVE-2007-0775 CVE-2007-0776 CVE-2007-0777 CVE-2007-0778 CVE-2007-0779 CVE-2007-0780 CVE-2007-0800 CVE-2007-0981 CVE-2007-0995 CVE-2007-1092 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=482 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=483 http://www.mozilla.org/security/announce/2007/mfsa2007-01.html http://www.mozilla.org/security/announce/2007/mfsa2007-02.html http://www.mozilla.org/security/announce/2007/mfsa2007-03.html http://www.mozilla.org/security/announce/2007/mfsa2007-04.html http://www.mozilla.org/security/announce/2007/mfsa2007-05.html http://www.mozilla.org/security/announce/2007/mfsa2007-06.html http://www.mozilla.org/security/announce/2007/mfsa2007-07.html http://www.mozilla.org/security/announce/2007/mfsa2007-08.html 2007-02-23 2007-02-24 2007-04-19
snort -- DCE/RPC preprocessor vulnerability snort 2.6.12.6.1.3

A IBM Internet Security Systems Protection Advisory reports:

Snort is vulnerable to a stack-based buffer overflow as a result of DCE/RPC reassembly. This vulnerability is in a dynamic-preprocessor enabled in the default configuration, and the configuration for this preprocessor allows for auto-recognition of SMB traffic to perform reassembly on. No checks are performed to see if the traffic is part of a valid TCP session, and multiple Write AndX requests can be chained in the same TCP segment. As a result, an attacker can exploit this overflow with a single TCP PDU sent across a network monitored by Snort or Sourcefire.

Snort users who cannot upgrade immediately are advised to disable the DCE/RPC preprocessor by removing the DCE/RPC preprocessor directives from snort.conf and restarting Snort. However, be advised that disabling the DCE/RPC preprocessor reduces detection capabilities for attacks in DCE/RPC traffic. After upgrading, customers should re-enable the DCE/RPC preprocessor.

196240 CVE-2006-5276 http://xforce.iss.net/xforce/xfdb/31275 http://www.snort.org/docs/advisory-2007-02-19.html 2007-02-19 2007-02-21
rar -- password prompt buffer overflow vulnerability rar 3.70.b1,1 unrar zh-unrar 3.70.b1,4

iDefense reports:

Remote exploitation of a stack based buffer overflow vulnerability in RARLabs Unrar may allow an attacker to execute arbitrary code with the privileges of the user opening the archive.

Unrar is prone to a stack based buffer overflow when processing specially crafted password protected archives.

If users are using the vulnerable command line based unrar, they still need to interact with the program in order to trigger the vulnerability. They must respond to the prompt asking for the password, after which the vulnerability will be triggered. They do not need to enter a correct password, but they must at least push the enter key.

22447 CVE-2007-0855 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=472 http://www.rarsoft.com/rarnew.htm 2007-02-07 2007-02-17
php -- multiple vulnerabilities php5-imap php5-odbc php5-session php5-shmop php5-sqlite php5-wddx php5 5.2.1_2 php4-odbc php4-session php4-shmop php4-wddx php4 4.4.5 mod_php4-twig mod_php4 mod_php5 mod_php php4-cgi php4-cli php4-dtc php4-horde php4-nms php5-cgi php5-cli php5-dtc php5-horde php5-nms 44.4.5 55.2.1_2

Multiple vulnerabilities have been found in PHP, including: buffer overflows, stack overflows, format string, and information disclosure vulnerabilities.

The session extension contained safe_mode and open_basedir bypasses, but the FreeBSD Security Officer does not consider these real security vulnerabilities, since safe_mode and open_basedir are insecure by design and should not be relied upon.

CVE-2007-0905 CVE-2007-0906 CVE-2007-0907 CVE-2007-0908 CVE-2007-0909 CVE-2007-0910 CVE-2007-0988 http://secunia.com/advisories/24089/ http://www.php.net/releases/4_4_5.php http://www.php.net/releases/5_2_1.php 2007-02-09 2007-02-17 2013-04-01
joomla -- multiple remote vulnerabilities joomla 1.0.12

Secunia reports:

Some vulnerabilities have been reported in Joomla!, where some have unknown impacts and one can be exploited by malicious people to conduct cross-site scripting attacks.

  1. Input passed to an unspecified parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
  2. The vulnerabilities are caused due to unspecified errors in Joomla!. The vendor describes them as "several low level security issues". No further information is currently available.
21810 CVE-2006-6832 CVE-2006-6833 CVE-2006-6834 http://secunia.com/advisories/23563/ 2006-12-29 2007-01-17
sircd -- remote reverse DNS buffer overflow sircd 0.4.0

Secunia reports:

A vulnerability in sircd can be exploited by a malicious person to compromise a vulnerable system. The vulnerability is caused by a boundary error in the code handling reverse DNS lookups, when a user connects to the service. If the FQDN (Fully Qualified Domain Name) returned is excessively long, the allocated buffer is overflowed making it possible to execute arbitrary code on the system with the privileges of the sircd daemon.

6924 http://secunia.com/advisories/8153 2003-02-24 2007-01-15
sircd -- remote operator privilege escalation vulnerability sircd 0

Secunia reports:

A vulnerability has been reported in sircd, which can be exploited by malicious users to gain operator privileges. The problem is that any user reportedly can set their usermode to operator. The vulnerability has been reported in versions 0.5.2 and 0.5.3. Other versions may also be affected.

9097 http://secunia.com/advisories/10274/ 2003-11-20 2007-01-15
cacti -- Multiple vulnerabilities cacti 0.8.6i.4

Secunia reports:

rgod has discovered four vulnerabilities in Cacti, which can be exploited by malicious people to bypass certain security restrictions, manipulate data and compromise vulnerable systems.

http://secunia.com/advisories/23528/ http://forums.cacti.net/about18846-0-asc-0.html 2006-12-28 2007-01-12
mplayer -- buffer overflow in the code for RealMedia RTSP streams. mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.10_1

A potential buffer overflow was found in the code used to handle RealMedia RTSP streams. When checking for matching asm rules, the code stores the results in a fixed-size array, but no boundary checks are performed. This may lead to a buffer overflow if the user is tricked into connecting to a malicious server. Since the attacker can not write arbitrary data into the buffer, creating an exploit is very hard; but a DoS attack is easily made. A fix for this problem was committed to SVN on Sun Dec 31 13:27:53 2006 UTC as r21799. The fix involves three files: stream/realrtsp/asmrp.c, stream/realrtsp/asmrp.h and stream/realrtsp/real.c.

ports/107217 CVE-2006-6172 http://www.mplayerhq.hu/design7/news.html 2006-12-31 2007-01-08
fetchmail -- crashes when refusing a message bound for an MDA fetchmail 6.3.56.3.6

Matthias Andree reports:

When delivering messages to a message delivery agent by means of the "mda" option, fetchmail can crash (by passing a NULL pointer to ferror() and fflush()) when refusing a message. SMTP and LMTP delivery modes aren't affected.

CVE-2006-5974 http://www.fetchmail.info/fetchmail-SA-2006-03.txt 2007-01-04 2007-01-06
fetchmail -- TLS enforcement problem/MITM attack/password exposure fetchmail 6.3.6

Matthias Andree reports:

Fetchmail has had several longstanding password disclosure vulnerabilities.

  • sslcertck/sslfingerprint options should have implied "sslproto tls1" in order to enforce TLS negotiation, but did not.
  • Even with "sslproto tls1" in the config, fetches would go ahead in plain text if STLS/STARTTLS wasn't available (not advertised, or advertised but rejected).
  • POP3 fetches could completely ignore all TLS options whether available or not because it didn't reliably issue CAPA before checking for STLS support - but CAPA is a requisite for STLS. Whether or not CAPAbilities were probed, depended on the "auth" option. (Fetchmail only tried CAPA if the auth option was not set at all, was set to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)
  • POP3 could fall back to using plain text passwords, even if strong authentication had been configured.
  • POP2 would not complain if strong authentication or TLS had been requested.
CVE-2006-5867 http://www.fetchmail.info/fetchmail-SA-2006-02.txt 2007-01-04 2007-01-06
opera -- multiple vulnerabilities opera opera-devel linux-opera 9.10

iDefense reports:

The vulnerability specifically exists due to Opera improperly processing a JPEG DHT marker. The DHT marker is used to define a Huffman Table which is used for decoding the image data. An invalid number of index bytes in the DHT marker will trigger a heap overflow with partially user controlled data.

Exploitation of this vulnerability would allow an attacker to execute arbitrary code on the affected host. The attacker would first need to construct a website containing the malicious image and trick the vulnerable user into visiting the site. This would trigger the vulnerability and allow the code to execute with the privileges of the local user.

A flaw exists within Opera's Javascript SVG implementation. When processing a createSVGTransformFromMatrix request Opera does not properly validate the type of object passed to the function. Passing an incorrect object to this function can result in it using a pointer that is user controlled when it attempts to make the virtual function call.

Exploitation of this vulnerability would allow an attacker to execute arbitrary code on the affected host. The attacker would first need to construct a website containing the malicious JavaScript and trick the vulnerable user into visiting the site. This would trigger the vulnerability and allow the code to execute with the privileges of the local user.

CVE-2007-0126 CVE-2007-0127 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=458 http://www.opera.com/support/search/supsearch.dml?index=851 http://www.opera.com/support/search/supsearch.dml?index=852 2007-01-05 2007-01-05 2010-05-12
drupal -- multiple vulnerabilities drupal 4.74.7.5 4.6.11

The Drupal security team reports:

A few arguments passed via URLs are not properly sanitized before display. When an attacker is able to entice an administrator to follow a specially crafted link, arbitrary HTML and script code can be injected and executed in the victim's session. Such an attack may lead to administrator access if certain conditions are met.

The way page caching was implemented allows a denial of service attack. An attacker has to have the ability to post content on the site. He or she would then be able to poison the page cache, so that it returns cached 404 page not found errors for existing pages.

If the page cache is not enabled, your site is not vulnerable. The vulnerability only affects sites running on top of MySQL.

CVE-2007-0136 http://drupal.org/files/sa-2007-001/advisory.txt http://drupal.org/files/sa-2007-002/advisory.txt 2007-01-05 2007-01-05 2010-05-12
w3m -- format string vulnerability w3m w3m-img w3m-m17n w3m-m17n-img ja-w3m ja-w3m-img 0.5.1_6

An anonymous person reports:

w3m-0.5.1 crashes when using the -dump or -backend options to open a HTTPS URL with a SSL certificate where the CN contains "%n%n%n%n%n%n".

21735 CVE-2006-6772 http://sourceforge.net/tracker/index.php?func=detail&aid=1612792&group_id=39518&atid=425439 http://secunia.com/advisories/23492/ 2006-12-10 2007-01-03
plone -- user can masquerade as a group plone 2.52.5.1_1

Plone.org reports:

PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a potential vulnerability that allows a user to masquerade as a group. Please update your sites.

21460 CVE-2006-4249 http://plone.org/products/plone-hotfix/releases/20061031 2006-11-02 2006-12-27
proftpd -- remote code execution vulnerabilities proftpd proftpd-mysql 1.3.0_5

The proftpd development team reports that several remote buffer overflows had been found in the proftpd server.

CVE-2006-5815 CVE-2006-6170 2006-11-10 2006-12-21
gzip -- multiple vulnerabilities FreeBSD 6.16.1_7 6.06.0_12 5.55.5_5 5.45.4_19 5.35.3_34 4.11_22 gzip 1.3.12

Problem Description

Multiple programming errors have been found in gzip which can be triggered when gzip is decompressing files. These errors include insufficient bounds checks in buffer use, a NULL pointer dereference, and a potential infinite loop.

Impact

The insufficient bounds checks in buffer use can cause gzip to crash, and may permit the execution of arbitrary code. The NULL pointer deference can cause gzip to crash. The infinite loop can cause a Denial-of-Service situation where gzip uses all available CPU time.

Workaround

No workaround is available.

CVE-2006-4334 CVE-2006-4335 CVE-2006-4336 CVE-2006-4337 CVE-2006-4338 SA-06:21.gzip 2006-09-19 2006-12-19 2007-06-05
bind9 -- Denial of Service in named(8) FreeBSD 6.16.1_6 6.06.0_11 5.55.5_4 5.45.4_18 5.05.3_33 bind9 9.09.3.2.1

Problem Description

For a recursive DNS server, a remote attacker sending enough recursive queries for the replies to arrive after all the interested clients have left the recursion queue will trigger an INSIST failure in the named(8) daemon. Also for a recursive DNS server, an assertion failure can occur when processing a query whose reply will contain more than one SIG(covered) RRset.

For an authoritative DNS server serving a RFC 2535 DNSSEC zone which is queried for the SIG records where there are multiple SIG(covered) RRsets (e.g. a zone apex), named(8) will trigger an assertion failure when it tries to construct the response.

Impact

An attacker who can perform recursive lookups on a DNS server and is able to send a sufficiently large number of recursive queries, or is able to get the DNS server to return more than one SIG(covered) RRsets can stop the functionality of the DNS service.

An attacker querying an authoritative DNS server serving a RFC 2535 DNSSEC zone may be able to crash the DNS server.

Workaround

A possible workaround is to only allow trusted clients to perform recursive queries.

CVE-2006-4095 CVE-2006-4096 SA-06:20.bind 2006-09-06 2006-12-19
openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3) FreeBSD 6.16.1_6 6.06.0_11 5.55.5_4 5.45.4_18 5.35.3_33 4.11_21 openssl 0.9.80.9.8c_9 0.9.7k_0

Problem Description

When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any bytes which follow the cryptographic hash being signed. In a valid signature there will be no such bytes.

Impact

OpenSSL will incorrectly report some invalid signatures as valid. When an RSA public exponent of 3 is used, or more generally when a small public exponent is used with a relatively large modulus (e.g., a public exponent of 17 with a 4096-bit modulus), an attacker can construct a signature which OpenSSL will accept as a valid PKCS#1 v1.5 signature.

Workaround

No workaround is available.

CVE-2006-4339 SA-06:19.openssl 2006-09-06 2006-12-19
sql-ledger -- multiple vulnerabilities sql-ledger 2.6.22

The Debian security Team reports:

Several remote vulnerabilities have been discovered in SQL Ledger, a web based double-entry accounting program, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems:

Chris Travers discovered that the session management can be tricked into hijacking existing sessions.

Chris Travers discovered that directory traversal vulnerabilities can be exploited to execute arbitrary Perl code.

It was discovered that missing input sanitising allows execution of arbitrary Perl code.

CVE-2006-4244 CVE-2006-4731 CVE-2006-5872 http://www.us.debian.org/security/2006/dsa-1239 2006-12-17 2006-12-18
dbus -- match_rule_equal() Weakness dbus 1.0.2

Secunia reports:

D-Bus have a weakness, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

An error within the "match_rule_equal()" function can be exploited to disable the ability of other processes to receive messages by removing their matches from D-Bus.

CVE-2006-6107 http://www.freedesktop.org/wiki/Software/dbus https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218055 http://secunia.com/advisories/23373/ 2006-12-12 2006-12-14
evince -- Buffer Overflow Vulnerability evince 0.6.1_1

Secunia reports:

A vulnerability has been discovered in Evince, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error within the "get_next_text()" function in ps/ps.c. This can be exploited to cause a buffer overflow by e.g. tricking a user into opening a specially crafted PostScript file.

CVE-2006-5864 http://secunia.com/advisories/23111/ 2006-11-27 2006-12-14
tdiary -- injection vulnerability ja-tdiary tdiary 2.0.3 ja-tdiary-devel tdiary-devel 2.12.1.4_2

An undisclosed eRuby injection vulnerability had been discovered in tDiary.

http://sourceforge.net/forum/forum.php?forum_id=642685 2006-12-10 2006-12-13 2007-03-16
wv -- Multiple Integer Overflow Vulnerabilities wv 1.2.3

Secunia reports:

Some vulnerabilities have been reported in wvWare, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

The vulnerabilities are caused due to integer overflows within the "wvGetLFO_records()" and "wvGetLFO_PLF()" functions. These can be exploited to cause heap-based buffer overflows by e.g. tricking a user to open a specially crafted Microsoft Word document with an application using the library.

CVE-2006-4513 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=433 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=434 http://secunia.com/advisories/22595/ 2006-10-26 2006-12-13
wv2 -- Integer Overflow Vulnerability wv2 0.2.3

Secunia reports:

A vulnerability has been reported in wvWare wv2 Library, which potentially can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to an integer overflow error in "word_helper.h" when handling a Word document. This can be exploited to cause a buffer overflow and may allow arbitrary code execution via a specially crafted Word document.

CVE-2006-2197 http://secunia.com/advisories/20665/ 2006-06-12 2006-12-13
tnftpd -- Remote root Exploit tnftpd 20040810

The tnftpd port suffer from a remote stack overrun, which can lead to a root compromise.

CVE-2006-6652 http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051009.html 2006-12-1 2006-12-11 2010-05-12
clamav -- Multipart Nestings Denial of Service clamav 0.88.7 clamav-devel 20061029

Secunia reports:

Clam AntiVirus have a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a stack overflow when scanning messages with deeply nested multipart content. This can be exploited to crash the service by sending specially crafted emails to a vulnerable system.

CVE-2006-6481 http://secunia.com/advisories/23347/ http://www.quantenblog.net/security/virus-scanner-bypass 2006-12-06 2006-12-12 2013-06-19
libxine -- multiple buffer overflow vulnerabilities libxine 1.1.3

The libxine development team reports that several vulnerabilities had been found in the libxine library. The first vulnerability is caused by improper checking of the src/input/libreal/real.c "real_parse_sdp()" function. A remote attacker could exploit this by tricking an user to connect to a preparated server potentially causing a buffer overflow. Another buffer overflow had been found in the libmms library, potentially allowing a remote attacker to cause a denial of service vulnerability, and possible remote code execution through the following functions: send_command, string_utf16, get_data and get_media_packets. Other functions might be affected as well.

18608 21435 CVE-2006-2200 CVE-2006-6172 http://sourceforge.net/project/shownotes.php?release_id=468432 2006-05-04 2006-12-07 2006-12-09
gnupg -- remotely controllable function pointer gnupg 1.4.6

Werner Koch reports:

GnuPG uses data structures called filters to process OpenPGP messages. These filters are used in a similar way as a pipelines in the shell. For communication between these filters context structures are used. These are usually allocated on the stack and passed to the filter functions. At most places the OpenPGP data stream fed into these filters is closed before the context structure gets deallocated. While decrypting encrypted packets, this may not happen in all cases and the filter may use a void contest structure filled with garbage. An attacker may control this garbage. The filter context includes another context used by the low-level decryption to access the decryption algorithm. This is done using a function pointer. By carefully crafting an OpenPGP message, an attacker may control this function pointer and call an arbitrary function of the process. Obviously an exploit needs to prepared for a specific version, compiler, libc, etc to be successful - but it is definitely doable.

Fixing this is obvious: We need to allocate the context on the heap and use a reference count to keep it valid as long as either the controlling code or the filter code needs it.

We have checked all other usages of such a stack based filter contexts but fortunately found no other vulnerable places. This allows to release a relatively small patch. However, for reasons of code cleanness and easier audits we will soon start to change all these stack based filter contexts to heap based ones.

CVE-2006-6235 http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html http://secunia.com/advisories/23245/ 2006-12-04 2006-12-07 2006-12-15
ruby -- cgi.rb library Denial of Service ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.5_5,1 ruby_static 1.8.*,1

The official ruby site reports:

Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

A specific HTTP request for any web application using cgi.rb causes CPU consumption on the machine on which the web application is running. Many such requests result in a denial of service.

CVE-2006-6303 http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/ 2006-12-04 2006-12-04 2010-05-12
libmusicbrainz -- multiple buffer overflow vulnerabilities libmusicbrainz 2.1.3

SecurityFocus reports about libmusicbrainz:

The libmusicbrainz library is prone to multiple buffer-overflow vulnerabilities because the application fails to check the size of the data before copying it into a finite-sized internal memory buffer.

An attacker can exploit these issues to execute arbitrary code within the context of the application or to cause a denial-of-service condition.

19508 CVE-2006-4197 http://www.securityfocus.com/bid/21185/discuss 2006-08-17 2006-12-02
tdiary -- cross site scripting vulnerability ja-tdiary tdiary 2.0.2 ja-tdiary-devel tdiary-devel 2.12.1.4_1

tDiary was vulnerable to an unspecified Cross-Site Scripting vulnerability

CVE-2006-6174 http://sourceforge.net/forum/forum.php?forum_id=638868 2006-11-26 2006-12-02 2010-05-12
ImageMagick -- SGI Image File heap overflow vulnerability ImageMagick ImageMagick-nox11 6.0.06.2.9

SecurityFocus reports about ImageMagick:

ImageMagick is prone to a remote heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of applications that use the ImageMagick library.

21185 CVE-2006-5868 http://www.securityfocus.com/bid/21185/discuss 2006-11-14 2006-12-02
gtar -- GNUTYPE_NAMES directory traversal vulnerability gtar 1.16_2

Teemu Salmela reports:

There is a tar record type, called GNUTYPE_NAMES (an obsolete GNU extension), that allows the creation of symbolic links pointing to arbitrary locations in the filesystem, which makes it possible to create/overwrite arbitrary files.

21235 CVE-2006-6097 http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html 2006-11-21 2006-11-30
kronolith -- arbitrary local file inclusion vulnerability kronolith 2.1.4

iDefense Labs reports:

Remote exploitation of a design error in Horde's Kronolith could allow an authenticated web mail user to execute arbitrary PHP code under the security context of the running web server.

The vulnerability specifically exists due to a design error in the way it includes certain files. Specifically, the 'lib/FBView.php' file contains a function 'Kronolith_FreeBusy_View::factory' which will include local files that are supplied via the 'view' HTTP GET request parameter.

http://lists.horde.org/archives/announce/2006/000307.html 2006-11-29 2006-11-30
gnupg -- buffer overflow gnupg 1.4.5_1

Werner Koch reports:

When running GnuPG interactively, special crafted messages may be used to crash gpg or gpg2. Running gpg in batch mode, as done by all software using gpg as a backend (e.g. mailers), is not affected by this bug.

Exploiting this overflow seems to be possible.

gpg-agent, gpgsm, gpgv or other tools from the GnuPG suite are not affected.

http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html 2006-11-27 2006-11-27
proftpd -- Remote Code Execution Vulnerability proftpd proftpd-mysql 1.3.0_2

FrSIRT reports:

A vulnerability has been identified in ProFTPD, which could be exploited by attackers to cause a denial of service or execute arbitrary commands. This flaw is due to a buffer overflow error in the "main.c" file where the "cmd_buf_size" size of the buffer used to handle FTP commands sent by clients is not properly set to the size configured via the "CommandBufferSize" directive, which could be exploited by attackers to compromise a vulnerable server via a specially crafted FTP command.

http://www.frsirt.com/english/advisories/2006/4451 2006-11-10 2006-11-14 2006-11-15
unzoo -- Directory Traversal Vulnerability unzoo 4.4_1

Secunia reports:

Doubles has discovered a vulnerability in Unzoo, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error when unpacking archives. This can be exploited via a directory traversal attack to overwrite files outside the directory, where the files are extracted to, if a user is tricked into extracting a malicious archive using Unzoo.

11417 http://secunia.com/advisories/12857/ http://securitytracker.com/alerts/2004/Oct/1011673.html 2004-10-18 2006-11-14 2006-12-15
bugzilla -- multiple vulnerabilities bugzilla ja-bugzilla 2.*2.22.1

A Bugzilla Security Advisory reports:

  • Sometimes the information put into the <h1> and <h2> tags in Bugzilla was not properly escaped, leading to a possible XSS vulnerability.
  • Bugzilla administrators were allowed to put raw, unfiltered HTML into many fields in Bugzilla, leading to a possible XSS vulnerability. Now, the HTML allowed in those fields is limited.
  • attachment.cgi could leak the names of private attachments
  • The "deadline" field was visible in the XML format of a bug, even to users who were not a member of the "timetrackinggroup."
  • A malicious user could pass a URL to an admin, and make the admin delete or change something that he had not intended to delete or change.
  • It is possible to inject arbitrary HTML into the showdependencygraph.cgi page, allowing for a cross-site scripting attack.
CVE-2006-5453 CVE-2006-5454 CVE-2006-5455 http://www.bugzilla.org/security/2.18.5/ 2006-10-15 2006-11-11
Imlib2 -- multiple image file processing vulnerabilities imlib2 20060926_1,1

Secunia reports:

Some vulnerabilities have been reported in imlib2, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.

The vulnerabilities are caused due to unspecified errors within the processing of JPG, ARGB, PNG, LBM, PNM, TIFF, and TGA images. This may be exploited to execute arbitrary code by e.g. tricking a user into opening a specially crafted image file with an application using imlib2.

20903 CVE-2006-4806 CVE-2006-4807 CVE-2006-4808 CVE-2006-4809 2006-11-03 2006-11-08
ruby -- cgi.rb library Denial of Service ruby ruby+pthreads ruby+pthreads+oniguruma ruby+oniguruma 1.8.*,11.8.5_4,1 ruby_static 1.8.*,1

Official ruby site reports:

A vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS). The problem is triggered by sending the library an HTTP request that uses multipart MIME encoding and as an invalid boundary specifier that begins with "-" instead of "--". Once triggered it will exhaust all available memory resources effectively creating a DoS condition.

20777 CVE-2006-5467 http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html 2006-10-25 2006-11-04 2006-12-15
screen -- combined UTF-8 characters vulnerability screen 4.0.3

A vulnerability in the handling of combined UTF-8 characters in screen may allow an user-assisted attacker to crash screen or potentially allow code execution as the user running screen. To exploit this issue the user running scren must in some way interact with the attacker.

20727 CVE-2006-4573 http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212056 2006-10-23 2006-10-29
mysql -- database suid privilege escalation mysql-server 5.15.1.12 5.05.0.25

Dmitri Lenev reports a privilege escalation in MySQL. MySQL evaluates arguments of suid routines in the security context of the routine's definer instead of the routine's caller, which allows remote and local authenticated users to gain privileges through a routine that has been made available using GRANT EXECUTE.

CVE-2006-4227 http://bugs.mysql.com/bug.php?id=18630 2006-03-29 2006-10-29 2006-10-30
mysql -- database "case-sensitive" privilege escalation mysql-server 5.15.1.12 5.05.0.25 4.1.21

Michal Prokopiuk reports a privilege escalation in MySQL. The vulnerability causes MySQL, when run on case-sensitive filesystems, to allow remote and local authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.

19559 CVE-2006-4226 http://bugs.mysql.com/bug.php?id=17647 2006-08-09 2006-10-29
Serendipity -- XSS Vulnerabilities serendipity 1.0.1

The Serendipity Team reports:

Serendipity failed to correctly sanitize user input on the media manager administration page. The content of GET variables were written into JavaScript strings. By using standard string evasion techniques it was possible to execute arbitrary JavaScript.

Additionally Serendipity dynamically created a HTML form on the media manager administration page that contained all variables found in the URL as hidden fields. While the variable values were correctly escaped it was possible to break out by specifying strange variable names.

http://www.hardened-php.net/advisory_112006.136.htmlSerendipity http://secunia.com/advisories/22501/ 2006-10-19 2006-10-21
kdelibs -- integer overflow in khtml kdelibs kdelibs-nocups 3.5.4_4 qt qt-copy 3.3.6_3

Red Hat reports:

An integer overflow flaw was found in the way Qt handled pixmap images. The KDE khtml library uses Qt in such a way that untrusted parameters could be passed to Qt, triggering the overflow. An attacker could for example create a malicious web page that when viewed by a victim in the Konqueror browser would cause Konqueror to crash or possibly execute arbitrary code with the privileges of the victim.

CVE-2006-4811 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=210742 http://rhn.redhat.com/errata/RHSA-2006-0720.html 2006-10-14 2006-10-22
opera -- URL parsing heap overflow vulnerability opera opera-devel linux-opera 9.*9.02

iDefense Labs reports:

Remote exploitation of a heap overflow vulnerability within version 9 of Opera Software's Opera Web browser could allow an attacker to execute arbitrary code on the affected host.

A flaw exists within Opera when parsing a tag that contains a URL. A heap buffer with a constant size of 256 bytes is allocated to store the URL, and the tag's URL is copied into this buffer without sufficient bounds checking of its length.

CVE-2006-4819 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=424 http://secunia.com/advisories/22218/ http://www.opera.com/support/search/supsearch.dml?index=848 2006-10-17 2006-10-20
asterisk -- remote heap overwrite vulnerability asterisk asterisk-bristuff 1.2.13

Adam Boileau of Security-Assessment.com reports:

The Asterisk Skinny channel driver for Cisco SCCP phones (chan_skinny.so) incorrectly validates a length value in the packet header. An integer wrap-around leads to heap overwrite, and arbitrary remote code execution as root.

http://www.security-assessment.com/files/advisories/Asterisk_remote_heap_overflow.pdf http://marc.theaimsgroup.com/?l=bugtraq&m=116121567530170 2006-10-17 2006-10-20
plone -- unprotected MembershipTool methods plone 2.1.2

The Plone Team reports:

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the:

  • changeMemberPortrait
  • deletePersonalPortrait
  • testCurrentPassword

methods, which allows remote attackers to modify portraits.

CVE-2006-1711 http://plone.org/products/plone/releases/2.1.4 https://svn.plone.org/svn/plone/PloneHotfix20060410/trunk/README.txt 2006-10-19 2006-10-19 2006-10-20
drupal -- HTML attribute injection drupal 4.6.10

The Drupal Team reports:

A malicious user may entice users to visit a specially crafted URL that may result in the redirection of Drupal form submission to a third-party site. A user visiting the user registration page via such a url, for example, will submit all data, such as his/her e-mail address, but also possible private profile data, to a third-party site.

http://drupal.org/files/sa-2006-026/advisory.txt http://drupal.org/drupal-4.7.4 2006-10-18 2006-10-18
drupal -- cross site request forgeries drupal 4.6.10

The Drupal Team reports:

Visiting a specially crafted page, anywhere on the web, may allow that page to post forms to a Drupal site in the context of the visitor's session. To illustrate; suppose one has an active user 1 session, the most powerful administrator account for a site, to a Drupal site while visiting a website created by an attacker. This website will now be able to submit any form to the Drupal site with the privileges of user 1, either by enticing the user to submit a form or by automated means.

An attacker can exploit this vulnerability by changing passwords, posting PHP code or creating new users, for example. The attack is only limited by the privileges of the session it executes in.

http://drupal.org/files/sa-2006-025/advisory.txt http://drupal.org/drupal-4.7.4 2006-10-18 2006-10-18
drupal -- multiple XSS vulnerabilities drupal 4.6.10

The Drupal Team reports:

A bug in input validation and lack of output validation allows HTML and script insertion on several pages.

Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This vulnerability exists on systems that do not use PHP's mb_string extension (to check if mb_string is being used, navigate to admin/settings and look under "String handling"). Disabling the aggregator module provides an immediate workaround.

The aggregator module, profile module, and forum module do not properly escape output of certain fields.

Note: XSS attacks may lead to administrator access if certain conditions are met.

http://drupal.org/files/sa-2006-024/advisory.txt http://drupal.org/drupal-4.7.4 2006-10-18 2006-10-18
ingo -- local arbitrary shell command execution ingo 1.1.2

The Horde team reports a vulnerability within Ingo, the filter management suite. The vulnerability is caused due to inadequete escaping, possibly allowing a local user to execute arbitrary shell commands via procmail.

CVE-2006-5449 http://bugs.horde.org/ticket/?id=4513 http://cvs.horde.org/diff.php/ingo/docs/CHANGES?r1=1.55.2.49&r2=1.55.2.59&ty=h http://lists.horde.org/archives/announce/2006/000296.html 2006-10-18 2006-10-18 2010-05-12
nvidia-driver -- arbitrary root code execution vulnerability nvidia-driver 1.0.87621.0.8776

Rapid7 reports:

The NVIDIA Binary Graphics Driver for Linux is vulnerable to a buffer overflow that allows an attacker to run arbitrary code as root. This bug can be exploited both locally or remotely (via a remote X client or an X client which visits a malicious web page). A working proof-of-concept root exploit is included with this advisory.

The NVIDIA drivers for Solaris and FreeBSD are also likely to be vulnerable.

Disabling Render acceleration in the "nvidia" driver, via the "RenderAccel" X configuration option, can be used as a workaround for this issue.

147252 CVE-2006-5379 http://nvidia.custhelp.com/cgi-bin/nvidia.cfg/php/enduser/std_adp.php?p_faqid=1971 http://secunia.com/advisories/22419/ http://www.rapid7.com/advisories/R7-0025.jsp 2006-10-16 2006-10-16 2006-10-21
clamav -- CHM unpacker and PE rebuilding vulnerabilities clamav 0.88.5 clamav-devel 20060922

Secunia reports:

Two vulnerabilities have been reported in Clam AntiVirus, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) An unspecified error in the CHM unpacker in chmunpack.c can be exploited to cause a DoS.

2) An unspecified error in rebuildpe.c when rebuilding PE files after unpacking can be exploited to cause a heap-based buffer overflow.

http://secunia.com/advisories/22370/ http://lurker.clamav.net/message/20061016.015114.dc6a8930.en.html http://sourceforge.net/project/shownotes.php?release_id=455799 2006-10-15 2006-10-16
tkdiff -- temporary file symlink privilege escalation tkdiff 4.1.1

Javier Fernández-Sanguino Peña reports a vulnerability in tkdiff which allows local users to gain priveleges of the user running tkdiff due to insecure temporary file creation.

http://www.debian.org/security/2005/dsa-927 CVE-2005-3343 16064 http://secunia.com/advisories/18083 2005-12-20 2006-10-15
vtiger -- multiple remote file inclusion vulnerabilities vtiger 5.0

Dedi Dwianto a.k.a the_day reports:

Input passed to the "$calpath" parameter in update.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources.

CVE-2006-5289 20435 http://marc.theaimsgroup.com/?l=bugtraq&m=116049557032343 http://advisories.echo.or.id/adv/adv54-theday-2006.txt 2006-10-09 2006-10-15
google-earth -- heap overflow in the KML engine google-earth 4.0.2414

JAAScois reports:

While processing KML/KMZ data Google Earth fails to verify its size prior to copying it into a fixed-sized buffer. This can be exploited as a buffer-overflow vulnerability to cause the application to crash and/or to execute arbitrary code.

20464 http://www.jaascois.com/exploits/18602024/ 2006-10-10 2006-10-14 2007-04-13
torrentflux -- User-Agent XSS Vulnerability torrentflux 0

Steven Roddis reports that User-Agent string is not properly escaped when handled by torrentflux. This allows for arbitrary code insertion.

20371 CVE-2006-5227 http://www.stevenroddis.com.au/2006/10/06/torrentflux-user-agent-xss-vulnerability/ http://secunia.com/advisories/22293/ 2006-09-30 2006-10-07 2006-10-15
python -- buffer overrun in repr() for unicode strings python+ipv6 0 python 2.4.3_1 2.5.*2.5.c2

Benjamin C. Wiley Sittler reports:

I discovered a [buffer overrun in repr() for unicode strings]. This causes an unpatched non-debug wide (UTF-32/UCS-4) build of python to abort.

Ubuntu security team reports:

If an application uses repr() on arbitrary untrusted data, this [bug] could be exploited to execute arbitrary code with the privileges of the python application.

CVE-2006-4980 https://launchpad.net/distros/ubuntu/+source/python2.4/+bug/56633 http://www.ubuntu.com/usn/usn-359-1 http://secunia.com/advisories/22276/ 2006-08-15 2006-10-07 2006-10-08
php -- _ecalloc Integer Overflow Vulnerability php5 5.1.6_1 php5-cli php5-cgi php5-dtc php5-horde php5-nms mod_php5 55.1.6_1

Stefan Esser reports:

The PHP 5 branch of the PHP source code lacks the protection against possible integer overflows inside ecalloc() that is present in the PHP 4 branch and also for several years part of our Hardening-Patch and our new Suhosin-Patch.

It was discovered that such an integer overflow can be triggered when user input is passed to the unserialize() function. Earlier vulnerabilities in PHP's unserialize() that were also discovered by one of our audits in December 2004 are unrelated to the newly discovered flaw, but they have shown, that the unserialize() function is exposed to user-input in many popular PHP applications. Examples for applications that use the content of COOKIE variables with unserialize() are phpBB and Serendipity.

The successful exploitation of this integer overflow will result in arbitrary code execution.

CVE-2006-4812 http://www.hardened-php.net/advisory_092006.133.html http://secunia.com/advisories/22280/ 2006-09-30 2006-10-06 2013-04-01
mambo -- multiple SQL injection vulnerabilities mambo 4.6.5

James Bercegay reports:

Mambo is vulnerable to an Authentication Bypass issue that is due to an SQL Injection in the login function. The SQL Injection is possible because the $passwd variable is only sanitized when it is not passed as an argument to the function.

Omid reports:

There are several sql injections in Mambo 4.6 RC2 & Joomla 1.0.10 (and maybe other versions):

  • When a user edits a content, the "id" parameter is not checked properly in /components/com_content/content.php, which can cause 2 sql injections.
  • The "limit" parameter in the administration section is not checked. This affects many pages of administration section
  • In the administration section, while editing/creating a user, the "gid" parameter is not checked properly.
19719 19734 http://www.gulftech.org/?node=research&article_id=00116-10042006 http://seclists.org/bugtraq/2006/Aug/0491.html http://www.frsirt.com/english/advisories/2006/3918 http://mamboxchange.com/forum/forum.php?forum_id=7704 http://secunia.com/advisories/21644/ http://secunia.com/advisories/22221/ 2006-08-26 2006-10-05 2011-06-27
tin -- buffer overflow vulnerabilities tin zh-tin 1.8.2

Urs Janssen and Aleksey Salow report possible buffer overflows in tin versions 1.8.0 and 1.8.1.

OpenPKG project elaborates there is an allocation off-by-one bug in version 1.8.0 which can lead to a buffer overflow.

ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.005-tin.html 2006-02-15 2006-10-05
openldap -- slapd acl selfwrite Security Issue openldap-server openldap-sasl-server 2.3.25

Howard Chu reports:

An ACL of the form 'access to dn.subtree="ou=groups, dc=example,dc=com" attr=member by * selfwrite' is intended to only allow users to add/delete their own DN to the target attribute. Currently it allows any DNs to be modified.

19832 CVE-2006-4600 http://www.openldap.org/its/index.cgi/Software%20Bugs?id=4587 http://www.openldap.org/lists/openldap-announce/200608/msg00000.html http://secunia.com/advisories/21721 http://securitytracker.com/alerts/2006/Sep/1016783.html 2006-06-14 2006-10-05
mono -- "System.CodeDom.Compiler" Insecure Temporary Creation mono 1.1.13.8.1

Sebastian Krahmer reports:

Sebastian Krahmer of the SuSE security team discovered that the System.CodeDom.Compiler classes used temporary files in an insecure way. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Under some circumstances, a local attacker could also exploit this to inject arbitrary code into running Mono processes.

CVE-2006-5072 http://www.ubuntu.com/usn/usn-357-1 http://secunia.com/advisories/22237/ 2006-10-04 2006-10-05
php -- open_basedir Race Condition Vulnerability php4 php5 4.4.4_1 55.1.6_2 php-suhosin 0.9.6 php4-cli php5-cli php4-cgi php5-cgi php4-dtc php5-dtc php4-horde php5-horde php4-nms php5-nms mod_php4 mod_php5 44.4.4_1 55.1.6_2

Stefan Esser reports:

PHP's open_basedir feature is meant to disallow scripts to access files outside a set of configured base directories. The checks for this are placed within PHP functions dealing with files before the actual open call is performed.

Obviously there is a little span of time between the check and the actual open call. During this time span the checked path could have been altered and point to a file that is forbidden to be accessed due to open_basedir restrictions.

Because the open_basedir restrictions often not call PHP functions but 3rd party library functions to actually open the file it is impossible to close this time span in a general way. It would only be possible to close it when PHP handles the actual opening on it's own.

While it seems hard to change the path during this little time span it is very simple with the use of the symlink() function combined with a little trick. PHP's symlink() function ensures that source and target of the symlink operation are allowed by open_basedir restrictions (and safe_mode). However it is possible to point a symlink to any file by the use of mkdir(), unlink() and at least two symlinks.

20326 CVE-2006-5178 http://www.hardened-php.net/advisory_082006.132.html http://secunia.com/advisories/22235/ 2006-10-02 2006-10-05 2013-04-01
phpbb -- NULL byte injection vulnerability phpbb zh-phpbb-tw 2.0.22

Secunia reports:

ShAnKaR has discovered a vulnerability in phpBB, which can be exploited by malicious users to compromise a vulnerable system.

Input passed to the "avatar_path" parameter in admin/admin_board.php is not properly sanitised before being used as a configuration variable to store avatar images. This can be exploited to upload and execute arbitrary PHP code by changing "avatar_path" to a file with a trailing NULL byte.

Successful exploitation requires privileges to the administration section.

20347 CVE-2006-4758 http://secunia.com/advisories/22188/ http://xforce.iss.net/xforce/xfdb/28884 http://www.security.nnov.ru/Odocument221.html 2006-09-12 2006-10-04 2006-12-24
postnuke -- admin section SQL injection postnuke 0.763

ISS X-Force reports:

PostNuke is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the admin section using the hits parameter, which could allow the attacker to view, add, modify or delete information in the back-end database.

20317 CVE-2006-5121 http://xforce.iss.net/xforce/xfdb/29271 http://www.securityfocus.com/archive/1/archive/1/447361/100/0/threaded http://secunia.com/advisories/22197/ 2006-09-29 2006-10-03 2007-11-17
freetype -- LWFN Files Buffer Overflow Vulnerability freetype2 2.1.10_5

SecurityTracker reports:

A vulnerability was reported in FreeType. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted font file that, when loaded by the target user's system, will trigger an integer underflow or integer overflow and crash the application or execute arbitrary code on the target system.

Chris Evans reported these vulnerabilities.

Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.

18034 CVE-2006-0747 CVE-2006-1861 CVE-2006-3467 http://securitytracker.com/alerts/2006/Jul/1016522.html 2006-07-10 2006-10-02
cscope -- Buffer Overflow Vulnerabilities cscope 15.6

Secunia reports:

Will Drewry has reported some vulnerabilities in Cscope, which potentially can be exploited by malicious people to compromise a vulnerable system.

Various boundary errors within the parsing of file lists or the expansion of environment variables can be exploited to cause stack-based buffer overflows when parsing specially crafted "cscope.lists" files or directories.

A boundary error within the parsing of command line arguments can be exploited to cause a stack-based buffer overflow when supplying an overly long "reffile" argument.

Successful exploitation may allow execution of arbitrary code.

19686 19687 CVE-2006-4262 http://secunia.com/advisories/21601 http://sourceforge.net/mailarchive/forum.php?thread_id=30266760&forum_id=33500 http://sourceforge.net/mailarchive/forum.php?thread_id=30266761&forum_id=33500 2006-08-20 2006-10-02 2006-10-11
gnutls -- RSA Signature Forgery Vulnerability gnutls gnutls-devel 1.4.4

Secunia reports:

A vulnerability has been reported in GnuTLS, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in the verification of certain signatures. If a RSA key with exponent 3 is used, it may be possible to forge PKCS #1 v1.5 signatures signed with that key.

20027 CVE-2006-4790 http://secunia.com/advisories/21937 http://lists.gnupg.org/pipermail/gnutls-dev/2006-September/001205.html 2006-09-08 2006-10-02
MT -- Search Unspecified XSS MT 3.33.33

Secunia reports:

Arai has reported a vulnerability in Movable Type and Movable Type Enterprise, which can be exploited by malicious people to conduct cross-site scripting attacks.

Some unspecified input passed via the search functionality isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

20228 CVE-2006-5080 http://secunia.com/advisories/22109 http://www.sixapart.com/movabletype/news/2006/09/mt_333-mte_103_updates.html 2006-09-26 2006-10-02 2006-10-15
phpmyadmin -- XSRF vulnerabilities phpMyAdmin 2.9.0.1

phpMyAdmin team reports:

We received a security advisory from Stefan Esser (sesser@hardened-php.net) and we wish to thank him for his work.

It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

CVE-2006-5116 CVE-2006-5117 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5 http://secunia.com/advisories/22126/ 20253 2006-09-28 2006-10-02 2006-10-03
openssh -- multiple vulnerabilities FreeBSD 6.16.1_10 6.06.0_15 5.55.5_8 5.45.4_22 5.05.3_37 4.11_25 openssh 4.4,1 openssh-portable 4.4.p1,1

Problem Description

The CRC compensation attack detector in the sshd(8) daemon, upon receipt of duplicate blocks, uses CPU time cubic in the number of duplicate blocks received. [CVE-2006-4924]

A race condition exists in a signal handler used by the sshd(8) daemon to handle the LoginGraceTime option, which can potentially cause some cleanup routines to be executed multiple times. [CVE-2006-5051]

Impact

An attacker sending specially crafted packets to sshd(8) can cause a Denial of Service by using 100% of CPU time until a connection timeout occurs. Since this attack can be performed over multiple connections simultaneously, it is possible to cause up to MaxStartups (10 by default) sshd processes to use all the CPU time they can obtain. [CVE-2006-4924]

The OpenSSH project believe that the race condition can lead to a Denial of Service or potentially remote code execution, but the FreeBSD Security Team has been unable to verify the exact impact. [CVE-2006-5051]

Workaround

The attack against the CRC compensation attack detector can be avoided by disabling SSH Protocol version 1 support in sshd_config(5).

There is no workaround for the second issue.

20216 CVE-2006-4924 CVE-2006-5051 SA-06:22.openssh http://www.openssh.com/txt/release-4.4 2006-09-25 2006-09-30
dokuwiki -- multiple vulnerabilities dokuwiki 20060309c dokuwiki-devel 20060909

Secunia reports:

rgod has discovered a vulnerability in DokuWiki, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "TARGET_FN" parameter in bin/dwpage.php is not properly sanitised before being used to copy files. This can be exploited via directory traversal attacks in combination with DokuWiki's file upload feature to execute arbitrary PHP code.

CVE Mitre reports:

Direct static code injection vulnerability in doku.php in DokuWiki before 2006-03-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php.

Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors.

DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to "debug".

19911 CVE-2006-4674 CVE-2006-4675 CVE-2006-4679 http://secunia.com/advisories/21819/ http://bugs.splitbrain.org/index.php?do=details&id=906 2006-09-08 2006-09-30 2006-10-02
dokuwiki -- multiple vulnerabilities dokuwiki 20060309_5 dokuwiki-devel 20060609_2

Secunia reports:

Some vulnerabilities have been reported in DokuWiki, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

Input passed to the "w" and "h" parameters in lib/exec/fetch.php is not properly sanitised before being passed as resize parameters to the "convert" application. This can be exploited to cause a DoS due to excessive CPU and memory consumption by passing very large numbers, or to inject arbitrary shell commands by passing specially crafted strings to the "w" and "h" parameter.

Successful exploitation requires that the "$conf[imconvert]" option is set.

CVE-2006-5098 CVE-2006-5099 http://secunia.com/advisories/22192/ http://secunia.com/advisories/22199/ http://bugs.splitbrain.org/?do=details&id=924 http://bugs.splitbrain.org/?do=details&id=926 2006-09-26 2006-09-30 2006-10-02
tikiwiki -- multiple vulnerabilities tikiwiki 1.9.5

Secunia reports:

Thomas Pollet has discovered a vulnerability in TikiWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "highlight" parameter in tiki-searchindex.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

rgod has discovered a vulnerability in TikiWiki, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to the "jhot.php" script not correctly verifying uploaded files. This can e.g. be exploited to execute arbitrary PHP code by uploading a malicious PHP script to the "img/wiki" directory.

19654 19819 CVE-2006-4299 CVE-2006-4602 http://secunia.com/advisories/21536/ http://secunia.com/advisories/21733/ 2006-08-21 2006-09-30
punbb -- NULL byte injection vulnerability punbb 1.2.13

CVE Mitre reports:

PunBB 1.2.12 does not properly handle an avatar directory pathname ending in %00, which allows remote authenticated administrative users to upload arbitrary files and execute code, as demonstrated by a query to admin_options.php with an avatars_dir parameter ending in %00. NOTE: this issue was originally disputed by the vendor, but the dispute was withdrawn on 20060926.

CVE-2006-4759 http://forums.punbb.org/viewtopic.php?id=13255 2006-09-13 2006-09-30
freeciv -- Denial of Service Vulnerabilities freeciv freeciv-gtk freeciv-gtk2 freeciv-nox11 2.0.8_2

Secunia reports:

Luigi Auriemma has reported a vulnerability in Freeciv, which can be exploited by malicious people to cause a DoS (Denial of Service).

An error in the "generic_handle_player_attribute_chunk()" function in common/packets.c can be exploited to crash the service via a specially crafted PACKET_PLAYER_ATTRIBUTE_CHUNK packet sent to the server.

An error in the "handle_unit_orders()" function in server/unithand.c can be exploited to crash the service via a specially crafted packet.

CVE-2006-3913 19117 http://secunia.com/advisories/21171/ http://aluigi.altervista.org/adv/freecivx-adv.txt 2006-07-23 2006-09-26
freeciv -- Packet Parsing Denial of Service Vulnerability freeciv freeciv-gtk freeciv-gtk2 freeciv-nox11 2.0.8

Secunia reports:

Luigi Auriemma has reported a vulnerability in Freeciv, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the handling of the packet length in "common/packets.c". This can be exploited to crash the Freeciv server via a specially- crafted packet with the size set to "0xffff".

CVE-2006-0047 16975 http://secunia.com/advisories/19120/ http://aluigi.altervista.org/adv/freecivdos-adv.txt 2006-03-06 2006-09-26
plans -- multiple vulnerabilities plans 6.7.2

Secunia reports:

A vulnerability has been reported in Plans, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "evt_id" parameter in "plans.cgi" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that SQL database support has been enabled in "plans_config.pl" (the default setting is flat files).

Some vulnerabilities have been reported in Plans, which can be exploited by malicious people to conduct cross-site scripting attacks or gain knowledge of sensitive information.

Input passed to various unspecified parameters is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

An unspecified error can be exploited to gain knowledge of the MySQL password.

14069 http://secunia.com/advisories/15167/ http://secunia.com/advisories/15854/ http://planscalendar.com/forum/viewtopic.php?t=660 2005-04-28 2006-09-26 2006-10-15
eyeOS -- multiple XSS security bugs eyeOS 0.9.1

eyeOS team reports:

[EyeOS 0.9.1] release fixes two XSS security bugs, so we recommend all users to upgrade to this new version in order to have the best security. These two bugs were discovered by Jose Carlos Norte, who is a new eyeOS developer.

20213 CVE-2006-5071 http://eyeos.blogspot.com/2006/09/eyeos-091-released.html 2006-09-25 2006-09-25 2006-10-15
zope -- restructuredText "csv_table" Information Disclosure zope 2.7.02.7.9_1 2.8.02.8.8_1

Secunia reports:

A vulnerability has been reported in Zope, which can be exploited by malicious people to disclose potentially sensitive information.

The vulnerability is caused due to an error in the use of the docutils module to parse and render "restructured" text. This can be exploited to disclose certain information via the "csv_table" reStructuredText directive.

20022 CVE-2006-4684 http://secunia.com/advisories/21947/ http://www.zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt 2006-08-21 2006-09-22 2006-12-27
libmms -- stack-based buffer overflow libmms 0.3 libxine 1.1.1

Mitre CVE reports:

Stack-based buffer overflow in libmms, as used by (a) MiMMS 0.0.9 and (b) xine-lib 1.1.0 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via the (1) send_command, (2) string_utf16, (3) get_data, and (4) get_media_packet functions, and possibly other functions.

CVE-2006-2200 18608 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=374577 2006-05-04 2006-09-22
opera -- RSA Signature Forgery opera opera-devel linux-opera 9.02

Opera reports:

A specially crafted digital certificate can bypass Opera's certificate signature verification. Forged certificates can contain any false information the forger chooses, and Opera will still present it as valid. Opera will not present any warning dialogs in this case, and the security status will be the highest possible (3). This defeats the protection against "man in the middle", the attacks that SSL was designed to prevent.

There is a flaw in OpenSSL's RSA signature verification that affects digital certificates using 3 as the public exponent. Some of the certificate issuers that are on Opera's list of trusted signers have root certificates with 3 as the public exponent. The forged certificate can appear to be signed by one of these.

CVE-2006-4339 http://secunia.com/advisories/21982/ http://secunia.com/advisories/21709/ http://www.cdc.informatik.tu-darmstadt.de/securebrowser/ http://www.openssl.org/news/secadv_20060905.txt http://www.mozilla.org/security/announce/2006/mfsa2006-60.html 2006-09-18 2006-09-22
mozilla -- multiple vulnerabilities firefox 1.5.0.7,1 2.*,12.0_1,1 linux-firefox 1.5.0.7 seamonkey linux-seamonkey 1.0.5 thunderbird linux-thunderbird mozilla-thunderbird 1.5.0.7 linux-firefox-devel 3.0.a2006.09.21 linux-seamonkey-devel 1.5.a2006.09.21 linux-mozilla-devel linux-mozilla mozilla 0

The Mozilla Foundation reports of multiple security issues in Firefox, Seamonkey, and Thunderbird. Several of these issues can probably be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2006-64 Crashes with evidence of memory corruption (rv:1.8.0.7)
  • MFSA 2006-63 JavaScript execution in mail via XBL
  • MFSA 2006-62 Popup-blocker cross-site scripting (XSS)
  • MFSA 2006-61 Frame spoofing using document.open()
  • MFSA 2006-60 RSA Signature Forgery
  • MFSA 2006-59 Concurrency-related vulnerability
  • MFSA 2006-58 Auto-Update compromise through DNS and SSL spoofing
  • MFSA 2006-57 JavaScript Regular Expression Heap Corruption
20042 CVE-2006-4253 CVE-2006-4340 CVE-2006-4565 CVE-2006-4566 CVE-2006-4567 CVE-2006-4568 CVE-2006-4569 CVE-2006-4570 CVE-2006-4571 http://www.mozilla.org/security/announce/2006/mfsa2006-57.html http://www.mozilla.org/security/announce/2006/mfsa2006-58.html http://www.mozilla.org/security/announce/2006/mfsa2006-59.html http://www.mozilla.org/security/announce/2006/mfsa2006-60.html http://www.mozilla.org/security/announce/2006/mfsa2006-61.html http://www.mozilla.org/security/announce/2006/mfsa2006-62.html http://www.mozilla.org/security/announce/2006/mfsa2006-63.html http://www.mozilla.org/security/announce/2006/mfsa2006-64.html 2006-09-14 2006-09-15 2006-11-02
win32-codecs -- multiple vulnerabilities win32-codecs 3.1.0.p8_1,1

The Apple Security Team reports that there are multiple vulnerabilities within QuickTime (one of the plugins for win32-codecs). A remote attacker capable of creating a malicious SGI image, FlashPix, FLC movie, or a QuickTime movie can possibly lead to execution of arbitrary code or cause a Denial of Service (application crash).

Users who have QuickTime (/win32-codecs) as a browser plugin may be vulnerable to remote code execution by visiting a website containing a malicious SGI image, FlashPix, FLC movie or a QuickTime movie.

20138 CVE-2006-4381 CVE-2006-4382 CVE-2006-4384 CVE-2006-4385 CVE-2006-4386 CVE-2006-4388 CVE-2006-4389 http://docs.info.apple.com/article.html?artnum=304357 2006-09-08 2006-09-14 2006-10-17
php -- multiple vulnerabilities php4 php5 4.4.4 55.1.5 php4-cli php5-cli php4-cgi php5-cgi php4-dtc php5-dtc php4-horde php5-horde php4-nms php5-nms mod_php4 mod_php5 4.4.4 55.1.5

The PHP development team reports:

  • Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions.
  • Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems.
  • Fixed possible open_basedir/safe_mode bypass in cURL extension and with realpath cache.
  • Fixed overflow in GD extension on invalid GIF images.
  • Fixed a buffer overflow inside sscanf() function.
  • Fixed an out of bounds read inside stripos() function.
  • Fixed memory_limit restriction on 64 bit system.
CVE-2006-4481 CVE-2006-4482 CVE-2006-4483 CVE-2006-4484 CVE-2006-4485 CVE-2006-4486 http://www.php.net/release_4_4_4.php http://www.php.net/release_5_1_5.php 2006-08-18 2006-09-13 2014-03-28
drupal-pubcookie -- authentication may be bypassed drupal-pubcookie 4.6.0_20060210

The Drupal Project reports:

It is possible for a malicious user to spoof a user's identity by bypassing the login redirection mechanism in the pubcookie module. The malicious user may gain the privileges of the user they are spoofing, including the administrative user.

CVE-2006-4717 http://drupal.org/node/83064 2006-09-08 2006-09-13 2010-05-12
linux-flashplugin7 -- arbitrary code execution vulnerabilities linux-flashplugin 7.0r68

Adobe reports:

Multiple input validation errors have been identified in Flash Player 8.0.24.0 and earlier versions that could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the user?s web browser, email client, or other applications that include or reference the Flash Player. (CVE-2006-3311, CVE-2006-3587, CVE-2006-3588)

These updates include changes to prevent circumvention of the "allowScriptAccess" option. (CVE-2006-4640)

CVE-2006-3311 CVE-2006-3587 CVE-2006-3588 CVE-2006-4640 http://www.adobe.com/support/security/bulletins/apsb06-11.html 2006-09-12 2006-09-12
mailman -- Multiple Vulnerabilities mailman ja-mailman mailman-with-htdig 2.1.9.r1

Secunia reports:

Mailman can be exploited by malicious people to conduct cross-site scripting and phishing attacks, and cause a DoS (Denial of Service).

1) An error in the logging functionality can be exploited to inject a spoofed log message into the error log via a specially crafted URL.

Successful exploitation may trick an administrator into visiting a malicious web site.

2) An error in the processing of malformed headers which does not follow the RFC 2231 standard can be exploited to cause a DoS (Denial of Service).

3) Some unspecified input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

19831 CVE-2006-2191 CVE-2006-2941 CVE-2006-3636 CVE-2006-4624 http://secunia.com/advisories/21732/ http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295 2006-06-09 2006-09-04 2006-10-04
hlstats -- multiple cross site scripting vulnerabilities hlstats 1.35

Kefka reports multiple cross site scripting vulnerabilities within hlstats. The vulnerabilities are caused due to improper checking of variables, allowing an attacker to perform cross site scripting.

19745 CVE-2006-4454 CVE-2006-6780 CVE-2006-6781 CVE-2007-2812 2006-08-29 2006-09-02 2011-09-03
gtetrinet -- remote code execution gtetrinet 0.7.10

The Debian Security Team reports:

Michael Gehring discovered several potential out-of-bounds index accesses in gtetrinet, a multiplayer Tetris-like game, which may allow a remote server to execute arbitrary code

19766 CVE-2006-3125 http://www.debian.org/security/2006/dsa-1163 2006-08-30 2006-09-02 2006-10-01
joomla -- multiple vulnerabilities joomla 1.0.11

The Joomla development team reports multiple vulnerabilities within the joomla application. Joomla is vulnerable to the following vulnerabilities:

  • Improper validation of the mosMail function
  • Improper validation of the JosIsValidEmail function.
  • Remote code execution in PEAR.php
  • Zend Hash del key or index vulnerability
http://www.joomla.org/content/view/1841/78/ 2006-08-28 2006-08-30 2010-05-12
sppp -- buffer overflow vulnerability FreeBSD 4.11_20 5.35.3_32 5.45.4_17 5.55.5_3 6.06.0_10 6.16.1_4

Problem Description

While processing Link Control Protocol (LCP) configuration options received from the remote host, sppp(4) fails to correctly validate option lengths. This may result in data being read or written beyond the allocated kernel memory buffer.

Impact

An attacker able to send LCP packets, including the remote end of a sppp(4) connection, can cause the FreeBSD kernel to panic. Such an attacker may also be able to obtain sensitive information or gain elevated privileges.

Workaround

No workaround is available, but systems which do not use sppp(4) are not vulnerable.

CVE-2006-4304 SA-06:18.ppp 2006-08-23 2006-08-23 2006-08-30
horde -- Phishing and Cross-Site Scripting Vulnerabilities horde 3.1.2 imp 4.1.2

Secunia reports:

Some vulnerabilities have been reported in Horde, which can be exploited by malicious people to conduct phishing and cross-site scripting attacks.

  1. Input passed to the "url" parameter in index.php isn't properly verified before it is being used to include an arbitrary web site in a frameset. This can e.g. be exploited to trick a user into believing certain malicious content is served from a trusted web site.
  2. Some unspecified input passed in index.php isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
19557 19544 http://secunia.com/advisories/21500/ http://lists.horde.org/archives/announce/2006/000292.html 2006-08-17 2006-08-17
globus -- Multiple tmpfile races globus 4.0.2_20060706

The Globus Alliance reports:

The proxy generation tool (grid-proxy-init) creates the file, secures the file to provide access only to owner and writes proxy to the file. A race condition exists between the opening of the proxy credentials file, and making sure it is safe file to write to. The checks to ensure this file is accessible only to the owner take place using the filename after the file is opened for writing, but before any data is written.

Various components of the toolkit use files in shared directories to store information, some being sensitive information. For example, the tool to create proxy certificates, stores the generated proxy certificate by default in /tmp. Specific vulnerabilities in handling such files were reported in myproxy-admin-adduser, grid-ca-sign and grid-security-config.

CVE-2006-4232 CVE-2006-4233 http://www.globus.org/mail_archive/security-announce/2006/08/msg00000.html http://www.globus.org/mail_archive/security-announce/2006/08/msg00001.html 2006-08-08 2006-08-15 2010-05-12
x11vnc -- authentication bypass vulnerability x11vnc 0.8.2

Ludwig Nussel reports that x11vnc is vulnerable to an authentication bypass vulnerability. The vulnerability is caused by an error in auth.c. This could allow a remote attacker to gain unauthorized and unauthenticated access to the system.

18977 CVE-2006-2450 http://bugs.debian.org/376824 2006-08-08 2006-08-13
alsaplayer -- multiple vulnerabilities alsaplayer 0

Luigi Auriemma reports three vulnerabilities within alsaplayer:

  • The function which handles the HTTP connections is vulnerable to a buffer-overflow that happens when it uses sscanf for copying the URL in the Location's field received from the server into the redirect buffer of only 1024 bytes declared in http_open.
  • A buffer-overflow exists in the functions which add items to the playlist when the GTK interface is used (so the other interfaces are not affected by this problem): new_list_item and CbUpdated in interface/gtk/PlaylistWindow.cpp.
  • AlsaPlayer automatically queries the CDDB server specified in its configuration (by default freedb.freedb.org) when the user choices the CDDA function for playing audio CDs. The function which queries the server uses a buffer of 20 bytes and one of 9 for storing the category and ID strings received from the server while the buffer which contains this server's response is 32768 bytes long. Naturally for exploiting this bug the attacker must have control of the freedb server specified in the AlsaPlayer's configuration.

These vulnerabilities could allow a remote attacker to execute arbitrary code, possibly gaining access to the system.

CVE-2006-4089 19450 http://aluigi.altervista.org/adv/alsapbof-adv.txt 2006-08-09 2006-08-13 2010-05-12
postgresql -- encoding based SQL injection postgresql postgresql-server ja-postgresql 7.37.3.15 7.47.4.13 8.0.08.0.8 8.1.08.1.4

The PostgreSQL development team reports:

An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible injection of hostile SQL commands into the database. The attacks covered here work in any multibyte encoding.

The widely-used practice of escaping ASCII single quote "'" by turning it into "\'" is unsafe when operating in multibyte encodings that allow 0x5c (ASCII code for backslash) as the trailing byte of a multibyte character; this includes at least SJIS, BIG5, GBK, GB18030, and UHC. An application that uses this conversion while embedding untrusted strings in SQL commands is vulnerable to SQL-injection attacks if it communicates with the server in one of these encodings. While the standard client libraries used with PostgreSQL have escaped "'" in the safe, SQL-standard way of "''" for some time, the older practice remains common.

18092 CVE-2006-2313 CVE-2006-2314 http://www.postgresql.org/docs/techdocs.50 2006-05-11 2006-08-13
postgresql -- multiple vulnerabilities postgresql postgresql-server ja-postgresql 7.27.2.7 7.37.3.9 7.47.4.7 8.0.08.0.1

Multiple vulnerabilities had been reported in various versions of PostgreSQL:

  • The EXECUTE restrictions can be bypassed by using the AGGREGATE function, which is missing a permissions check.
  • A buffer overflow exists in gram.y which could allow an attacker to execute arbitrary code by sending a large number of arguments to a refcursor function, found in gram.y
  • The intagg contributed module allows an attacker to crash the server (Denial of Service) by constructing a malicious crafted array.
CVE-2005-0244 CVE-2005-0245 CVE-2005-0246 http://secunia.com/advisories/12948 2005-02-01 2006-08-13
mysql -- format string vulnerability mysql-server 5.15.1.6 5.05.0.19 4.14.1.18

Jean-David Maillefer reports a Denial of Service vulnerability within MySQL. The vulnerability is caused by improper checking of the data_format routine, which cause the MySQL server to crash. The crash is triggered by the following code:
"SELECT date_format('%d%s', 1);

19032 CVE-2006-3469 http://bugs.mysql.com/bug.php?id=20729 2006-06-27 2006-08-13
squirrelmail -- random variable overwrite vulnerability ja-squirrelmail 1.4.01.4.8,2 squirrelmail 1.4.01.4.8

The SquirrelMail developers report:

A logged in user could overwrite random variables in compose.php, which might make it possible to read/write other users' preferences or attachments.

CVE-2006-4019 http://www.squirrelmail.org/security/issue/2006-08-11 2006-08-11 2006-08-12
rubygem-rails -- evaluation of ruby code rubygem-rails 1.1.01.1.3 1.1.41.1.6

The Ruby on Rails blog reports:

With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3), you can trigger the evaluation of Ruby code through the URL because of a bug in the routing code of Rails. This means that you can essentially take down a Rails process by starting something like /script/profiler, as the code will run for a long time and that process will be hung while it happens. Other URLs can even cause data loss.

http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure 2006-08-09 2006-08-10
clamav -- heap overflow vulnerability clamav 0.88.10.88.4 clamav-devel 20060808

Clamav team reports:

A heap overflow vulnerability was discovered in libclamav which could cause a denial of service or allow the execution of arbitrary code.

The problem is specifically located in the PE file rebuild function used by the UPX unpacker.

Relevant code from libclamav/upx.c:

memcpy(dst, newbuf, foffset); *dsize = foffset; free(newbuf); cli_dbgmsg("UPX: PE structure rebuilt from compressed file\n"); return 1;

Due to improper validation it is possible to overflow the above memcpy() beyond the allocated memory block.

CVE-2006-4018 http://www.clamav.net/security/0.88.4.html 2006-08-07 2006-08-08
drupal -- XSS vulnerability drupal 4.6.9

The Drupal project reports:

A malicious user can execute a cross site scripting attack by enticing someone to visit a Drupal site via a specially crafted link.

http://drupal.org/files/sa-2006-011/advisory.txt 2006-08-02 2006-08-02 2006-08-08
gnupg -- 2 more possible memory allocation attacks gnupg 1.4.5

Author reports:

Fixed 2 more possible memory allocation attacks. They are similar to the problem we fixed with 1.4.4. This bug can easily be exploted for a DoS; remote code execution is not entirely impossible.

http://lists.gnupg.org/pipermail/gnupg-announce/2006q3/000229.html 2006-08-01 2006-08-02
ruby -- multiple vulnerabilities ruby ruby_static 1.6.*1.8.* 1.8.*1.8.4_9,1

Secunia reports:

Two vulnerabilities have been reported in Ruby, which can be exploited by malicious people to bypass certain security restrictions.

  1. An error in the handling of the "alias" functionality can be exploited to bypass the safe level protection and replace methods called in the trusted level.
  2. An error caused due to directory operations not being properly checked can be exploited to bypass the safe level protection and close untainted directory streams.
18944 CVE-2006-3694 http://secunia.com/advisories/21009/ http://jvn.jp/jp/JVN%2383768862/index.html http://jvn.jp/jp/JVN%2313947696/index.html 2006-07-12 2006-07-29 2006-07-30
apache -- mod_rewrite buffer overflow vulnerability apache 1.3.281.3.36_1 2.0.462.0.58_2 2.2.02.2.2_1 apache+mod_perl 1.3.281.3.36_1 apache+ipv6 1.3.281.3.37 apache_fp 0 ru-apache 1.3.281.3.37+30.23 ru-apache+mod_ssl 1.3.281.3.34.1.57_2 apache+ssl 1.3.281.3.34.1.57_2 apache+mod_ssl apache+mod_ssl+ipv6 apache+mod_ssl+mod_accel apache+mod_ssl+mod_accel+ipv6 apache+mod_ssl+mod_accel+mod_deflate apache+mod_ssl+mod_accel+mod_deflate+ipv6 apache+mod_ssl+mod_deflate apache+mod_ssl+mod_deflate+ipv6 apache+mod_ssl+mod_snmp apache+mod_ssl+mod_snmp+mod_accel apache+mod_ssl+mod_snmp+mod_accel+ipv6 apache+mod_ssl+mod_snmp+mod_deflate apache+mod_ssl+mod_snmp+mod_deflate+ipv6 apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 1.3.281.3.36+2.8.27_1

The Apache Software Foundation and The Apache HTTP Server Project reports:

An off-by-one flaw exists in the Rewrite module, mod_rewrite, as shipped with Apache 1.3 since 1.3.28, 2.0 since 2.0.46, and 2.2 since 2.2.0.

Depending on the manner in which Apache HTTP Server was compiled, this software defect may result in a vulnerability which, in combination with certain types of Rewrite rules in the web server configuration files, could be triggered remotely. For vulnerable builds, the nature of the vulnerability can be denial of service (crashing of web server processes) or potentially allow arbitrary code execution. This issue has been rated as having important security impact by the Apache HTTP Server Security Team.

This flaw does not affect a default installation of Apache HTTP Server. Users who do not use, or have not enabled, the Rewrite module mod_rewrite are not affected by this issue. This issue only affects installations using a Rewrite rule with the following characteristics:

  • The RewriteRule allows the attacker to control the initial part of the rewritten URL (for example if the substitution URL starts with $1)
  • The RewriteRule flags do NOT include any of the following flags: Forbidden (F), Gone (G), or NoEscape (NE).

Please note that ability to exploit this issue is dependent on the stack layout for a particular compiled version of mod_rewrite. If the compiler used to compile Apache HTTP Server has added padding to the stack immediately after the buffer being overwritten, it will not be possible to exploit this issue, and Apache HTTP Server will continue operating normally.

The Apache HTTP Server project thanks Mark Dowd of McAfee Avert Labs for the responsible reporting of this vulnerability.

395412 CVE-2006-3747 http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=115409818602955 2006-07-27 2006-07-28 2006-11-01
mozilla -- multiple vulnerabilities firefox 1.5.0.5,1 2.*,12.0_1,1 linux-firefox 1.5.0.5 linux-firefox-devel 3.0.a2006.07.26 seamonkey linux-seamonkey 1.0.3 thunderbird linux-thunderbird mozilla-thunderbird 1.5.0.5 mozilla linux-mozilla linux-mozilla-devel 0

A Mozilla Foundation Security Advisory reports of multiple issues. Several of which can be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2006-56 chrome: scheme loading remote content
  • MFSA 2006-55 Crashes with evidence of memory corruption (rv:1.8.0.5)
  • MFSA 2006-54 XSS with XPCNativeWrapper(window).Function(...)
  • MFSA 2006-53 UniversalBrowserRead privilege escalation
  • MFSA 2006-52 PAC privilege escalation using Function.prototype.call
  • MFSA 2006-51 Privilege escalation using named-functions and redefined "new Object()"
  • MFSA 2006-50 JavaScript engine vulnerabilities
  • MFSA 2006-49 Heap buffer overwrite on malformed VCard
  • MFSA 2006-48 JavaScript new Function race condition
  • MFSA 2006-47 Native DOM methods can be hijacked across domains
  • MFSA 2006-46 Memory corruption with simultaneous events
  • MFSA 2006-45 Javascript navigator Object Vulnerability
  • MFSA 2006-44 Code execution through deleted frame reference
CVE-2006-3113 CVE-2006-3677 CVE-2006-3801 CVE-2006-3802 CVE-2006-3803 CVE-2006-3804 CVE-2006-3805 CVE-2006-3806 CVE-2006-3807 CVE-2006-3808 CVE-2006-3809 CVE-2006-3810 CVE-2006-3811 CVE-2006-3812 http://www.mozilla.org/projects/security/known-vulnerabilities.html#seamonkey1.0.3 http://www.mozilla.org/security/announce/2006/mfsa2006-44.html http://www.mozilla.org/security/announce/2006/mfsa2006-45.html http://www.mozilla.org/security/announce/2006/mfsa2006-46.html http://www.mozilla.org/security/announce/2006/mfsa2006-47.html http://www.mozilla.org/security/announce/2006/mfsa2006-48.html http://www.mozilla.org/security/announce/2006/mfsa2006-49.html http://www.mozilla.org/security/announce/2006/mfsa2006-50.html http://www.mozilla.org/security/announce/2006/mfsa2006-51.html http://www.mozilla.org/security/announce/2006/mfsa2006-52.html http://www.mozilla.org/security/announce/2006/mfsa2006-53.html http://www.mozilla.org/security/announce/2006/mfsa2006-54.html http://www.mozilla.org/security/announce/2006/mfsa2006-55.html http://www.mozilla.org/security/announce/2006/mfsa2006-56.html 2006-07-25 2006-07-27 2006-11-02
zope -- information disclosure vulnerability zope 2.7.02.7.9 2.8.02.8.7 2.9.02.9.3

Zope team reports:

Unspecified vulnerability in (Zope2) allows local users to obtain sensitive information via unknown attack vectors related to the docutils module and "restructured text".

CVE-2006-3458 http://www.zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-2006-07-05/view 2006-07-05 2006-07-14
drupal -- multiple vulnerabilities drupal 4.6.8

The Drupal team reports:

Vulnerability: XSS Vulnerability in taxonomy module

It is possible for a malicious user to insert and execute XSS into terms, due to lack of validation on output of the page title. The fix wraps the display of terms in check_plain().

CVE-2006-2833 http://drupal.org/node/66767 2006-05-18 2006-07-13 2006-07-14
shoutcast -- cross-site scripting, information exposure shoutcast linux-shoutcast 1.9.7

Goober's advisory reports reports that shoutcast is vulnerable to an arbitrary file reading vulnerability:

Impact of the vulnerability depends on the way the product was installed. In general, the vulnerability allows the attacker to read any file which can be read by the Shoutcast server process.

CVE-2006-3007 http://secunia.com/advisories/20524/ http://people.ksp.sk/~goober/advisory/001-shoutcast.html 2006-06-09 2006-07-11
samba -- memory exhaustion DoS in smbd samba ja-samba 3.0.1,13.0.23,1

The Samba Team reports:

The smbd daemon maintains internal data structures used track active connections to file and printer shares. In certain circumstances an attacker may be able to continually increase the memory usage of an smbd process by issuing a large number of share connection requests. This defect affects all Samba configurations.

CVE-2006-3403 http://www.samba.org/samba/security/CAN-2006-3403.html 2006-07-10 2006-07-10
twiki -- multiple file extensions file upload vulnerability twiki 4.0.4,1

A TWiki Security Alert reports:

The TWiki upload filter already prevents executable scripts such as .php, .php1, .phps, .pl from potentially getting executed by appending a .txt suffix to the uploaded filename. However, PHP and some other types allows additional file suffixes, such as .php.en, .php.1, and .php.2. TWiki does not check for these suffixes, e.g. it is possible to upload php scripts with such suffixes without the .txt filename padding.

This issue can also be worked around with a restrictive web server configuration. See the TWiki Security Alert for more information about how to do this.

18854 CVE-2006-3336 http://secunia.com/advisories/20992/ http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads 2006-07-05 2006-07-10
trac -- reStructuredText breach of privacy and denial of service vulnerability trac ja-trac 0.9.6

The Trac 0.9.6 Release Notes reports:

Fixed reStructuredText breach of privacy and denial of service vulnerability found by Felix Wiemann.

The discovered vulnerability requires docutils to be installed and enabled. Systems that do not have docutils installed or enabled are not vulnerable. As of this version version 0.3.9 or greater of docutils is required for using reStructuredText markup in Trac.

CVE-2005-3980 CVE-2005-4305 CVE-2005-4065 http://projects.edgewall.com/trac/wiki/ChangeLog http://lists.edgewall.com/archive/trac-announce/2006-July/000013.html 2006-07-06 2006-07-07 2010-05-12
horde -- various problems in dereferrer horde horde-php5 3.1.2

Horde 3.1.2 release announcement:

Security Fixes:

  • Closed XSS problems in dereferrer (IE only), help viewer and problem reporting screen.
  • Removed unused image proxy code from dereferrer.
CVE-2006-3548 http://lists.horde.org/archives/announce/2006/000288.html 2006-06-28 2006-07-05 2010-05-12
mambo -- SQL injection vulnerabilities mambo 4.5.4

The Team Mambo reports that two SQL injection vulnerabilities have been found in Mambo. The vulnerabilities exists due to missing sanitation of the title and catid parameters in the weblinks.php page and can lead to execution of arbitrary SQL code.

16775 CVE-2006-0871 CVE-2006-1794 CVE-2006-3262 CVE-2006-3263 http://marc.theaimsgroup.com/?l=bugtraq&m=115056811230529 http://secunia.com/advisories/18935/ http://secunia.com/advisories/20745/ http://www.mamboserver.com/?option=com_content&task=view&id=207 http://www.gulftech.org/?node=research&article_id=00104-02242006 2006-06-19 2006-07-05 2006-10-05
phpmyadmin -- cross site scripting vulnerability phpMyAdmin 2.8.2

phpmyadmin Site reports:

It was possible to craft a request that contains XSS by attacking the "table" parameter.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4 http://securitynews.ir/advisories/phpmyadmin281.txt 2006-06-30 2006-07-03 2007-10-16
webmin, usermin -- arbitrary file disclosure vulnerability webmin 1.290 usermin 1.220

The webmin development team reports:

An attacker without a login to Webmin can read the contents of any file on the server using a specially crafted URL. All users should upgrade to version 1.290 as soon as possible, or setup IP access control in Webmin.

18744 http://www.webmin.com/security.html 2006-06-30 2006-07-02
mutt -- Remote Buffer Overflow Vulnerability mutt mutt-lite 1.4.2.1_2 mutt-devel mutt-devel-lite 1.5.11_2 ja-mutt 1.4.2.1.j1 zh-mutt-devel 1.5.11_20040617 ja-mutt-devel 1.5.6.j1_2 mutt-ng 20060501

SecurityFocus reports:

Mutt is prone to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely crash the application, denying further service to legitimate users.

18642 http://dev.mutt.org/cgi-bin/gitweb.cgi?p=mutt/.git;a=commit;h=dc0272b749f0e2b102973b7ac43dbd3908507540 2006-06-26 2006-06-30
Joomla -- multiple vulnerabilities joomla 1.0.10

Joomla Site reports:

  • Secured "Remember Me" functionality against SQL injection attacks
  • Secured "Related Items" module against SQL injection attacks
  • Secured "Weblinks" submission against SQL injection attacks
  • Secured SEF from XSS vulnerability
  • Hardened frontend submission forms against spoofing
  • Secured mosmsg from misuse
  • Hardened mosgetparam by setting variable type to integer if default value is detected as numeric
  • Secured com_messages from XSS vulnerability
  • Secured getUserStateFromRequest() from XSS vulnerability
http://secunia.com/advisories/20746/ http://www.joomla.org/content/view/1510/74/ 2006-06-26 2006-06-30
hashcash -- heap overflow vulnerability hashcash 1.22

Andreas Seltenreich reports that hashcash is prone to a heap overflow vulnerability. This vulnerability is caused by improper checking of memory allocations within the "array_push()" function. An attacker could trigger this vulnerability by passing a lot of "-r" or "-j" flags from the command line, this only applies when the application is configured to allow command line options, or by passing a lot of resource names when the application was started with the "-m" flag set. This could lead to a Denial or Service or could allow remote access to the targeted system.

http://secunia.com/advisories/20800/ http://www.hashcash.org/source/CHANGELOG 2006-06-27 2006-06-27
gnupg -- user id integer overflow vulnerability gnupg 1.4.4

If GnuPG processes a userid with a very long packet length, GnuPG can crash due to insufficient bounds check. This can result in a denial-of-service condition or potentially execution of arbitrary code with the privileges of the user running GnuPG.

18554 CVE-2006-3082 http://marc.theaimsgroup.com/?l=gnupg-users&m=115124706210430 http://marc.theaimsgroup.com/?l=full-disclosure&m=114907659313360 http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157 2006-05-31 2006-06-25
horde -- multiple parameter cross site scripting vulnerabilities horde horde-php5 3.1.1

FrSIRT advisory ADV-2006-2356 reports:

Multiple vulnerabilities have been identified in Horde Application Framework, which may be exploited by attackers to execute arbitrary scripting code. These flaws are due to input validation errors in the "test.php" and "templates/problem/problem.inc" scripts that do not validate the "url", "name", "email", "subject" and "message" parameters, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.

CVE-2006-2195 http://www.frsirt.com/english/advisories/2006/2356 http://cvs.horde.org/diff.php?f=horde%2Ftest.php&r1=1.145&r2=1.146 http://cvs.horde.org/diff.php?f=horde%2Ftemplates%2Fproblem%2Fproblem.inc&r1=2.25&r2=2.26 2006-06-10 2006-06-17
WebCalendar -- information disclosure vulnerability WebCalendar 1.0.4

Secunia reports:

socsam has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to bypass certain security restrictions and disclose sensitive information.

Input passed to the "includedir" parameter isn't properly verified, before it is used in an "fopen()" call. This can be exploited to load an arbitrary setting file from an external web site.

This can further be exploited to disclose the content of arbitrary files by defining the "user_inc" variable in a malicious setting file.

Successful exploitation requires that "register_globals" is enabled.

18175 CVE-2006-2762 http://www.securityfocus.com/archive/1/435379 http://www.securityfocus.com/archive/1/436263 2006-05-30 2006-06-16 2006-06-17
sendmail -- Incorrect multipart message handling FreeBSD 4.114.11_19 5.35.3_31 5.45.4_16 5.55.5_2 6.06.0_9 6.16.1_2

Problem Description

A suitably malformed multipart MIME message can cause sendmail to exceed predefined limits on its stack usage.

Impact

An attacker able to send mail to, or via, a server can cause queued messages on the system to not be delivered, by causing the sendmail process which handles queued messages to crash. Note that this will not stop new messages from entering the queue (either from local processes, or incoming via SMTP).

Workaround

No workaround is available, but systems which do not receive email from untrusted sources are not vulnerable.

CVE-2006-1173 SA-06:17.sendmail 2006-06-14 2006-06-14
dokuwiki -- multiple vulnerabilities dokuwiki 20060309_2

Multiple vulnerabilities have been reported within dokuwiki. dokuwiki is proven vulnerable to:

  • arbitrary PHP code insertion via spellcheck module,
  • XSS attack via "Update your account profile,"
  • bypassing of ACL controls when enabled.
http://bugs.splitbrain.org/index.php?do=details&id=820 http://bugs.splitbrain.org/index.php?do=details&id=823 http://bugs.splitbrain.org/index.php?do=details&id=825 2006-05-31 2006-06-11 2006-06-12
libxine -- buffer overflow vulnerability libxine 1.1.1_6

A Secunia Advisory reports:

Federico L. Bossi Bonin has discovered a weakness in xine-lib, which can be exploited by malicious people to crash certain applications on a user's system.

The weakness is cause due to a heap corruption within the "xineplug_inp_http.so" plugin when handling an overly large reply from the HTTP server. This can be exploited to crash an application that uses the plugin (e.g. gxine).

http://secunia.com/advisories/20369 CVE-2006-2802 18187 2006-05-31 2006-06-11
smbfs -- chroot escape FreeBSD 4.104.10_24 4.114.11_18 5.35.3_30 5.45.4_15 5.55.5_1 6.06.0_8 6.16.1_1

Problem Description

smbfs does not properly sanitize paths containing a backslash character; in particular the directory name '..\' is interpreted as the parent directory by the SMB/CIFS server, but smbfs handles it in the same manner as any other directory.

Impact

When inside a chroot environment which resides on a smbfs mounted file-system it is possible for an attacker to escape out of this chroot to any other directory on the smbfs mounted file-system.

Workaround

Mount the smbfs file-systems which need to be used with chroot on top, in a way so the chroot directory is exactly on the mount point and not a sub directory

CVE-2006-2654 SA-06:16.smbfs 2006-05-31 2006-06-09
ypserv -- Inoperative access controls in ypserv FreeBSD 5.35.3_30 5.45.4_15 5.55.5_1 6.06.0_8 6.16.1_1

Problem Description

There are two documented methods of restricting access to NIS maps through ypserv(8): through the use of the /var/yp/securenets file, and through the /etc/hosts.allow file. While both mechanisms are implemented in the server, a change in the build process caused the "securenets" access restrictions to be inadvertantly disabled.

Impact

ypserv(8) will not load or process any of the networks or hosts specified in the /var/yp/securenets file, rendering those access controls ineffective.

Workaround

One possible workaround is to use /etc/hosts.allow for access control, as shown by examples in that file.

Another workaround is to use a firewall (e.g., ipfw(4), ipf(4), or pf(4)) to limit access to RPC functions from untrusted systems or networks, but due to the complexities of RPC, it might be difficult to create a set of firewall rules which accomplish this without blocking all access to the machine in question.

CVE-2006-2655 SA-06:15.ypserv 2006-05-31 2006-06-09
freeradius -- multiple vulnerabilities freeradius 1.0.01.0.4

The freeradious development team reports:

Multiple issues exist with version 1.0.4, and all prior versions of the server. Externally exploitable vulnerabilities exist only for sites that use the rlm_sqlcounter module. Those sites may be vulnerable to SQL injection attacks, similar to the issues noted below. All sites that have not deployed the rlm_sqlcounter module are not vulnerable to external exploits.

The issues are:
SQL Injection attack in the rlm_sqlcounter module.
Buffer overflow in the rlm_sqlcounter module, that may cause a server crash.
Buffer overflow while expanding %t, that may cause a server crash.

17171 CVE-2005-4744 2005-09-09 2006-06-08
freeradius -- authentication bypass vulnerability freeradius 1.0.01.1.0

The freeradius development team reports:

A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 (where the module first appeared) to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing

17293 CVE-2006-1354 2006-06-03 2006-06-08
squirrelmail -- plugin.php local file inclusion vulnerability squirrelmail 1.4.6_1

The SquirrelMail Project Team reports:

A security issue has been uncovered in functions/plugin.php that could allow a remote user to access local files on the server without requiring login. This issue manifests itself if register_globals is enabled, and magic_quotes_gpc is disabled.

http://www.squirrelmail.org/security/issue/2006-06-01 http://secunia.com/advisories/20406/ 2006-06-01 2006-06-05 2006-06-06
dokuwiki -- spellchecker remote PHP code execution dokuwiki 20060309_1

Stefan Esser reports:

During the evaluation of DokuWiki for a german/korean wiki of mine a flaw in DokuWiki's spellchecker was discovered, that allows injecting arbitrary PHP commands, by requesting a spellcheck on PHP commands in 'complex curly syntax'.

Because the spellchecker is written as part of the AJAX functionality of DokuWiki, it can be directly called by any website visitor, without the need for a wiki account.

http://www.hardened-php.net/advisory_042006.119.html http://bugs.splitbrain.org/index.php?do=details&id=823 http://secunia.com/advisories/20429/ 2006-06-05 2006-06-05
drupal -- multiple vulnerabilities drupal 4.6.7

The Drupal team reports:

Vulnerability: SQL injection

A security vulnerability in the database layer allowed certain queries to be submitted to the database without going through Drupal's query sanitizer.

Vulnerability: Execution of arbitrary files

Certain -- alas, typical -- configurations of Apache allows execution of carefully named arbitrary scripts in the files directory. Drupal now will attempt to automatically create a .htaccess file in your "files" directory to protect you.

CVE-2006-2742 CVE-2006-2743 http://drupal.org/node/65357 http://drupal.org/node/65409 2006-05-18 2006-06-05
MySQL -- SQL-injection security vulnerability mysql-server 5.15.1.9 5.05.0.22 4.14.1.20

MySQL reports:

An SQL-injection security hole has been found in multibyte encoding processing. An SQL-injection security hole can include a situation whereby when inserting user supplied data into a database, the user might inject his own SQL statements that the server will execute. With regards to this vulnerability discovered, when character set unaware escaping is used (e.g., addslashes() in PHP), it is possible to bypass it in some multibyte character sets (e.g., SJIS, BIG5 and GBK). As a result, a function like addslashes() is not able to prevent SQL injection attacks. It is impossible to fix this on the server side. The best solution is for applications to use character set aware escaping offered in a function like mysql_real_escape().

Workarounds:

One can use NO_BACKSLASH_ESCAPES mode as a workaround for a bug in mysql_real_escape_string(), if you cannot upgrade your server for some reason. It will enable SQL standard compatibility mode, where backslash is not considered a special character.

http://lists.mysql.com/announce/364 http://lists.mysql.com/announce/365 2006-05-31 2006-06-01
MySQL -- Information Disclosure and Buffer Overflow Vulnerabilities mysql-server 4.04.0.27 4.14.1.19 5.15.1.9

Secunia reports:

MySQL have some vulnerabilities, which can be exploited by malicious users to disclose potentially sensitive information and compromise a vulnerable system.

1) An error within the code that generates an error response to an invalid COM_TABLE_DUMP packet can be exploited by an authenticated client to disclosure certain memory content of the server process.

2) A boundary error within the handling of specially crafted invalid COM_TABLE_DUMP packets can be exploited by an authenticated client to cause a buffer overflow and allows arbitrary code execution.

3) An error within the handling of malformed login packets can be exploited to disclosure certain memory content of the server process in the error messages.

CVE-2006-1516 CVE-2006-1517 CVE-2006-1518 602457 http://www.wisec.it/vulns.php?page=7 http://www.wisec.it/vulns.php?page=8 http://dev.mysql.com/doc/refman/4.1/en/news-4-0-27.html http://dev.mysql.com/doc/refman/4.1/en/news-4-1-19.html http://dev.mysql.com/doc/refman/5.1/en/news-5-1-10.html http://secunia.com/advisories/19929/ http://www.vuxml.org/freebsd/a8d8713e-dc83-11da-a22b-000c6ec775d9.html 2006-05-02 2006-06-01
frontpage -- cross site scripting vulnerability frontpage mod_frontpage13 mod_frontpage20 mod_frontpage21 mod_frontpage22 5.0.2.4803

Esteban Martinez Fayo reports:

The FrontPage Server Extensions 2002 (included in Windows Sever 2003 IIS 6.0 and available as a separate download for Windows 2000 and XP) has a web page /_vti_bin/_vti_adm/fpadmdll.dll that is used for administrative purposes. This web page is vulnerable to cross site scripting attacks allowing an attacker to run client-side script on behalf of an FPSE user. If the victim is an administrator, the attacker could take complete control of a Front Page Server Extensions 2002 server.

To exploit the vulnerability an attacker can send a specially crafted e-mail message to a FPSE user and then persuade the user to click a link in the e-mail message.

In addition, this vulnerability can be exploited if an attacker hosts a malicious website and persuade the user to visit it.

CVE-2006-0015 http://marc.theaimsgroup.com/?l=bugtraq&m=114487846329000 http://www.microsoft.com/technet/security/bulletin/MS06-017.mspx http://www.rtr.com/fpsupport/fpse_release_may_2_2006.htm 2006-04-12 2006-05-23
cscope -- buffer overflow vulnerabilities cscope 15.5_2

Jason Duell reports:

Cscope contains an alarming number of buffer overflow vulnerabilities. By a rough count, there are at least 48 places where we blindly sprintf() a file name into a fixed-length buffer of size PATHLEN without checking to see if the file's name is <= PATHLEN. We do similar things with environment variable values.

CVE-2004-2541 http://sourceforge.net/tracker/index.php?func=detail&aid=1064875&group_id=4664&atid=104664 http://secunia.com/advisories/13237 2004-11-11 2006-05-23
coppermine -- Multiple File Extensions Vulnerability coppermine 1.4.6

Secunia reports:

Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of file uploads where a filename has multiple file extensions. This can be exploited to upload malicious script files inside the web root (e.g. a PHP script).

Successful exploitation may allow execution of script code depending on the HTTP server configuration (it requires e.g. an Apache server with the "mod_mime" module installed).

http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266 http://secunia.com/advisories/20211/ 2006-05-22 2006-05-22
coppermine -- "file" Local File Inclusion Vulnerability coppermine 1.4.5

Secunia reports:

Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "file" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Example: http://[host]/index.php?file=.//././/././/././/./[file]%00

Successful exploitation requires that "magic_quotes_gpc" is disabled.

CVE-2006-1909 http://coppermine-gallery.net/forum/index.php?topic=30655.0 http://myimei.com/security/2006-04-14/copperminephotogallery144-plugininclusionsystemindexphp-remotefileinclusion-attack.html http://secunia.com/advisories/19665/ 2006-04-19 2006-05-22
coppermine -- File Inclusion Vulnerabilities coppermine 1.4.4

Secunia reports:

Coppermine Photo Gallery have a vulnerability, which can be exploited by malicious people and by malicious users to compromise a vulnerable system.

1) Input passed to the "lang" parameter in include/init.inc.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources. The vulnerability can be further exploited by users who are allowed to upload image files to execute arbitrary PHP code.

2) Input passed to the "f" parameter in docs/showdoc.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources on the Windows platform, and remote files from Windows shared folders.

CVE-2006-0872 CVE-2006-0873 http://retrogod.altervista.org/cpg_143_adv.html http://secunia.com/advisories/18941/ 2006-02-20 2006-05-22
phpmyadmin -- XSRF vulnerabilities phpMyAdmin 2.8.1

phpMyAdmin security team reports:

It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

Such issue is quite common in many PHP applications and users should take care what links they follow. We consider these vulnerabilities to be quite dangerous.

CVE-2006-1804 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-3 http://secunia.com/advisories/19659 2006-05-20 2006-05-21
vnc -- authentication bypass vulnerability vnc 4.1.1

RealVNC is susceptible to an authentication-bypass vulnerability. A malicious VNC client can cause a VNC server to allow it to connect without any authentication regardless of the authentication settings configured in the server. Exploiting this issue allows attackers to gain unauthenticated, remote access to the VNC servers.

17978 http://www.securityfocus.com/archive/1/433994/30/0/threaded 2006-05-15 2006-05-18
phpldapadmin -- Cross-Site Scripting and Script Insertion vulnerabilities phpldapadmin098 0.9.8.3

Secunia reports:

phpLDAPadmin have some vulnerabilities, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks.

1) Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed to the "Container DN", "Machine Name", and "UID Number" parameters in "template_engine.php" isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed.

CVE-2006-2016 http://pridels.blogspot.com/2006/04/phpldapadmin-multiple-vuln.html http://www.frsirt.com/english/advisories/2006/1450 http://secunia.com/advisories/19747/ 2006-04-21 2006-05-14
fswiki -- XSS vulnerability fswiki 3.5.11

JVN reports:

FreeStyleWiki has XSS vulnerability.

http://jvn.jp/jp/JVN%2335274905/ 2006-04-18 2006-05-06
mysql50-server -- COM_TABLE_DUMP arbitrary code execution mysql-server 5.05.0.21

Stefano Di Paola reports:

An authenticated user could remotely execute arbitrary commands by taking advantage of a stack overflow.

To take advantage of these flaws an attacker should have direct access to MySQL server communication layer (port 3306 or unix socket). But if used in conjuction with some web application flaws (i.e. php code injection) an attacker could use socket programming (i.e. php sockets) to gain access to that layer.

CVE-2006-1518 http://www.wisec.it/vulns.php?page=8 http://marc.theaimsgroup.com/?l=bugtraq&m=114659633220473 http://dev.mysql.com/doc/refman/5.0/en/news-5-0-21.html 2006-05-02 2006-05-06
awstats -- arbitrary command execution vulnerability awstats 6.5_2,1

OS Reviews reports:

If the update of the stats via web front-end is allowed, a remote attacker can execute arbitrary code on the server using a specially crafted request involving the migrate parameter. Input starting with a pipe character ("|") leads to an insecure call to Perl's open function and the rest of the input being executed in a shell. The code is run in the context of the process running the AWStats CGI.

Arbitrary code can be executed by uploading a specially crafted configuration file if an attacker can put a file on the server with chosen file name and content (e.g. by using an FTP account on a shared hosting server). In this configuration file, the LogFile directive can be used to execute shell code following a pipe character. As above, an open call on unsanitized input is the source of this vulnerability.

http://awstats.sourceforge.net/awstats_security_news.php http://secunia.com/advisories/19969/ http://www.osreviews.net/reviews/comm/awstats 2006-05-03 2006-05-05 2006-11-15
phpwebftp -- "language" Local File Inclusion phpwebftp 3.3

Secunia reports:

phpWebFTP have a vulnerability, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "language" parameter in index.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

CVE-2006-1812 CVE-2006-1813 https://sourceforge.net/forum/forum.php?forum_id=566199 http://secunia.com/advisories/19706/ 2006-04-18 2006-05-03
firefox -- denial of service vulnerability firefox 1.5.*,11.5.0.3,1 linux-firefox 1.5.0.3

A Mozilla Foundation Security Advisory reports for deleted object reference when designMode="on"

Martijn Wargers and Nick Mott each described crashes that were discovered to ultimately stem from the same root cause: attempting to use a deleted controller context when designMode was turned on. This generally results in crashing the browser, but in theory references to deleted objects can be abused to run malicious code.

"splices" reported the same crash at the fan site MozillaZine and on Bugtraq, incorrectly describing it as a buffer overflow.

CVE-2006-1993 http://www.mozilla.org/security/announce/2006/mfsa2006-30.html 2006-05-02 2006-05-03 2006-05-05
trac -- Wiki Macro Script Insertion Vulnerability trac ja-trac 0.9.5

Secunia reports:

A vulnerability has been reported, which can be exploited by malicious people to conduct script insertion attacks.

Input passed using the wiki macro isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed.

http://projects.edgewall.com/trac/wiki/ChangeLog http://jvn.jp/jp/JVN%2384091359/index.html http://secunia.com/advisories/19870/ 2006-04-28 2006-05-02
clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability clamav 0.800.88.2 clamav-devel 2004082620060502

Secunia reports:

A vulnerability has been reported in ClamAV, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the HTTP client in the Freshclam command line utility. This can be exploited to cause a stack-based buffer overflow when the HTTP headers received from a web server exceeds 8KB.

Successful exploitation requires that Freshclam is used to download virus signature updates from a malicious mirror web server e.g. via DNS poisoning.

CVE-2006-1989 http://www.clamav.net/security/0.88.2.html http://secunia.com/advisories/19880/ 2006-05-01 2006-05-03
jabberd -- SASL Negotiation Denial of Service Vulnerability jabberd 2.0.11

Secunia reports:

A vulnerability has been reported in jabberd, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the handling of SASL negotiation. This can be exploited to cause a crash by sending a "response" stanza before an "auth" stanza.

CVE-2006-1329 http://article.gmane.org/gmane.network.jabber.admin/27372 http://jabberstudio.org/projects/jabberd2/releases/view.php?id=826 http://secunia.com/advisories/19281/ 2006-03-20 2006-05-01
cacti -- ADOdb "server.php" Insecure Test Script Security Issue cacti 0.8.6h

Secunia reports:

Cacti have a security issue, which can be exploited by malicious people to execute arbitrary SQL code and potentially compromise a vulnerable system.

The problem is caused due to the presence of the insecure "server.php" test script.

http://secunia.com/advisories/18276/ http://secunia.com/advisories/17418/ 2006-01-09 2006-04-27
amaya -- Attribute Value Buffer Overflow Vulnerabilities amaya 9.5

Secunia reports:

Amaya have two vulnerabilities, which can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the parsing of various attribute values. This can be exploited to cause stack-based buffer overflows when a user opens a specially crafted HTML document containing certain tags with overly long attribute values.

Successful exploitation allows execution of arbitrary code.

CVE-2006-1900 http://morph3us.org/advisories/20060412-amaya-94.txt http://morph3us.org/advisories/20060412-amaya-94-2.txt http://secunia.com/advisories/19670/ 2006-04-14 2006-04-27
lifetype -- ADOdb "server.php" Insecure Test Script Security Issue lifetype 1.0.3

Secunia reports:

A security issue has been discovered in LifeType, which can be exploited by malicious people to execute arbitrary SQL code and potentially compromise a vulnerable system.

The problem is caused due to the presence of the insecure "server.php" test script.

CVE-2006-0146 http://secunia.com/advisories/19699/ http://secunia.com/advisories/17418/ 2006-04-19 2006-04-27
ethereal -- Multiple Protocol Dissector Vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.50.99.0

Secunia reports:

Multiple vulnerabilities have been reported in Ethereal, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

The vulnerabilities are caused due to various types of errors including boundary errors, an off-by-one error, an infinite loop error, and several unspecified errors in a multitude of protocol dissectors.

Successful exploitation causes Ethereal to stop responding, consume a large amount of system resources, crash, or execute arbitrary code.

CVE-2006-1932 CVE-2006-1933 CVE-2006-1934 CVE-2006-1935 CVE-2006-1936 CVE-2006-1937 CVE-2006-1938 CVE-2006-1939 CVE-2006-1940 http://www.ethereal.com/appnotes/enpa-sa-00023.html http://secunia.com/advisories/19769/ 2006-04-25 2006-04-27
asterisk -- denial of service vulnerability, local system access asterisk 1.2.7

Emmanouel Kellenis reports a denial of service vulnerability within asterisk. The vulnerability is caused by a buffer overflow in "format_jpeg.c". A large JPEG image could trigger this bug, potentially allowing a local attacker to execute arbitrary code.

17561 CVE-2006-1827 http://www.cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory 2006-04-07 2006-04-25
zgv, xzgv -- heap overflow vulnerability zgv 5.9_1 xzgv 0.9

Gentoo reports:

Andrea Barisani of Gentoo Linux discovered xzgv and zgv allocate insufficient memory when rendering images with more than 3 output components, such as images using the YCCK or CMYK colour space. When xzgv or zgv attempt to render the image, data from the image overruns a heap allocated buffer.

An attacker may be able to construct a malicious image that executes arbitrary code with the permissions of the xzgv or zgv user when attempting to render the image.

17409 CVE-2006-1060 http://www.gentoo.org/security/en/glsa/glsa-200604-10.xml 2006-04-21 2006-04-23 2010-03-22
crossfire-server -- denial of service and remote code execution vulnerability crossfire-server 1.9.0

FRSIRT reports:

A vulnerability has been identified in CrossFire, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service. This flaw is due to a buffer overflow error in the "oldsocketmode" module that fails to properly handle overly large requests, which could be exploited by a malicious client to crash or compromise a vulnerable system.

16883 CVE-2006-1010 http://www.frsirt.com/english/advisories/2006/0760 2006-02-28 2006-04-23
p5-DBI -- insecure temporary file creation vulnerability p5-DBI-137 0 p5-DBI 1.37_1 1.381.48

Javier Fernández-Sanguino Peña reports:

The DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.

12360 CAN-2005-0077 http://www.debian.org/security/2005/dsa-658 2005-01-25 2006-04-23 2006-05-11
wordpress -- full path disclosure wordpress 1.5.2

Dedi Dwianto reports:

A remote user can access the file directly to cause the system to display an error message that indicates the installation path. The resulting error message will disclose potentially sensitive installation path information to the remote attacker.

CVE-2005-4463 http://echo.or.id/adv/adv24-theday-2005.txt 2005-12-20 2006-04-23
xine -- multiple remote string vulnerabilities xine 0.99.4_4

c0ntexb reports:

There are 2 format string bugs in the latest version of Xine that could be exploited by a malicious person to execute code on the system of a remote user running the media player against a malicious playlist file. By passing a format specifier in the path of a file that is embedded in a remote playlist, it is possible to trigger this bug.

17579 CVE-2006-1905 http://www.open-security.org/advisories/16 2006-04-18 2006-04-23
cyrus-sasl -- DIGEST-MD5 Pre-Authentication Denial of Service cyrus-sasl 2.*2.1.21

Unspecified vulnerability in the CMU Cyrus Simple Authentication and Security Layer (SASL) library, has unknown impact and remote unauthenticated attack vectors, related to DIGEST-MD5 negotiation.

CVE-2006-1721 2006-04-11 2006-04-22
FreeBSD -- FPU information disclosure FreeBSD 6.06.0_7 5.45.4_14 5.35.3_29 55.3 4.114.11_17 4.104.10_23 4.10

Problem Description

On "7th generation" and "8th generation" processors manufactured by AMD, including the AMD Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, and Sempron, the fxsave and fxrstor instructions do not save and restore the FOP, FIP, and FDP registers unless the exception summary bit (ES) in the x87 status word is set to 1, indicating that an unmasked x87 exception has occurred.

This behaviour is consistent with documentation provided by AMD, but is different from processors from other vendors, which save and restore the FOP, FIP, and FDP registers regardless of the value of the ES bit. As a result of this discrepancy remaining unnoticed until now, the FreeBSD kernel does not restore the contents of the FOP, FIP, and FDP registers between context switches.

Impact

On affected processors, a local attacker can monitor the execution path of a process which uses floating-point operations. This may allow an attacker to steal cryptographic keys or other sensitive information.

Workaround

No workaround is available, but systems which do not use AMD Athlon, Duron, Athlon MP, Athlon XP, Athlon64, Athlon64 FX, Opteron, Turion, or Sempron processors are not vulnerable.

CVE-2006-1056 SA-06:14.fpu 2006-04-19 2006-04-19 2006-06-09
plone -- "member_id" Parameter Portrait Manipulation Vulnerability plone 2.1.2_1

Secunia reports:

The vulnerability is caused due to missing security declarations in "changeMemberPortrait" and "deletePersonalPortrait". This can be exploited to manipulate or delete another user's portrait via the "member_id" parameter.

CVE-2006-1711 http://dev.plone.org/plone/ticket/5432 http://www.debian.org/security/2006/dsa-1032 http://secunia.com/advisories/19633/ 2006-04-13 2006-04-18
mozilla -- multiple vulnerabilities firefox 1.0.8,1 1.5.*,11.5.0.2,1 linux-firefox 1.5.0.2 mozilla 1.7.13,2 1.8.*,2 linux-mozilla 1.7.13 linux-mozilla-devel 0 seamonkey linux-seamonkey 1.0.1 thunderbird mozilla-thunderbird 1.5.0.2

A Mozilla Foundation Security Advisory reports of multiple issues. Several of which can be used to run arbitrary code with the privilege of the user running the program.

  • MFSA 2006-29 Spoofing with translucent windows
  • MFSA 2006-28 Security check of js_ValueToFunctionObject() can be circumvented
  • MFSA 2006-26 Mail Multiple Information Disclosure
  • MFSA 2006-25 Privilege escalation through Print Preview
  • MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest
  • MFSA 2006-23 File stealing by changing input type
  • MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability
  • MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)
  • MFSA 2006-19 Cross-site scripting using .valueOf.call()
  • MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability
  • MFSA 2006-17 cross-site scripting through window.controllers
  • MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()
  • MFSA 2006-15 Privilege escalation using a JavaScript function's cloned parent
  • MFSA 2006-14 Privilege escalation via XBL.method.eval
  • MFSA 2006-13 Downloading executables with "Save Image As..."
  • MFSA 2006-12 Secure-site spoof (requires security warning dialog)
  • MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)
  • MFSA 2006-10 JavaScript garbage-collection hazard audit
  • MFSA 2006-09 Cross-site JavaScript injection using event handlers
179014 252324 329500 350262 488774 736934 813230 842094 932734 935556 968814 CVE-2006-0749 CVE-2006-1045 CVE-2006-1529 CVE-2006-1530 CVE-2006-1531 CVE-2006-1723 CVE-2006-1724 CVE-2006-1725 CVE-2006-1726 CVE-2006-1727 CVE-2006-1728 CVE-2006-1729 CVE-2006-1730 CVE-2006-1731 CVE-2006-1732 CVE-2006-1733 CVE-2006-1734 CVE-2006-1735 CVE-2006-1736 CVE-2006-1737 CVE-2006-1738 CVE-2006-1739 CVE-2006-1740 CVE-2006-1741 CVE-2006-1742 CVE-2006-1790 http://www.mozilla.org/security/announce/2006/mfsa2006-09.html http://www.mozilla.org/security/announce/2006/mfsa2006-10.html http://www.mozilla.org/security/announce/2006/mfsa2006-11.html http://www.mozilla.org/security/announce/2006/mfsa2006-12.html http://www.mozilla.org/security/announce/2006/mfsa2006-13.html http://www.mozilla.org/security/announce/2006/mfsa2006-14.html http://www.mozilla.org/security/announce/2006/mfsa2006-15.html http://www.mozilla.org/security/announce/2006/mfsa2006-16.html http://www.mozilla.org/security/announce/2006/mfsa2006-17.html http://www.mozilla.org/security/announce/2006/mfsa2006-18.html http://www.mozilla.org/security/announce/2006/mfsa2006-19.html http://www.mozilla.org/security/announce/2006/mfsa2006-20.html http://www.mozilla.org/security/announce/2006/mfsa2006-22.html http://www.mozilla.org/security/announce/2006/mfsa2006-23.html http://www.mozilla.org/security/announce/2006/mfsa2006-25.html http://www.mozilla.org/security/announce/2006/mfsa2006-26.html http://www.mozilla.org/security/announce/2006/mfsa2006-28.html http://www.mozilla.org/security/announce/2006/mfsa2006-29.html http://www.zerodayinitiative.com/advisories/ZDI-06-010.html TA06-107A 2006-04-13 2006-04-16 2006-04-27
mailman -- Private Archive Script Cross-Site Scripting mailman ja-mailman mailman-with-htdig 2.1.8

Secunia reports:

A vulnerability has been reported in Mailman, which can be exploited by malicious people to conduct cross-site scripting attacks.

Unspecified input passed to the private archive script is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

CVE-2006-1712 http://mail.python.org/pipermail/mailman-announce/2006-April/000084.html http://secunia.com/advisories/19558/ 2006-04-07 2006-04-16
f2c -- insecure temporary files f2c 20060506

Javier Fernández-Sanguino Peña reports two temporary file vulnerability within f2c. The vulnerabilities are caused due to weak temporary file handling. An attacker could create an symbolic link, causing a local user running f2c to overwrite the symlinked file. This could give the attacker elevated privileges.

1280 CAN-2005-0017 2005-01-27 2006-04-10 2006-08-15
mplayer -- Multiple integer overflows mplayer mplayer-esound mplayer-gtk mplayer-gtk2 mplayer-gtk-esound mplayer-gtk2-esound 0.99.7_12

Secunia reports:

The vulnerabilities are caused due to integer overflow errors in "libmpdemux/asfheader.c" within the handling of an ASF file, and in "libmpdemux/aviheader.c" when parsing the "indx" chunk in an AVI file. This can be exploited to cause heap-based buffer overflows via a malicious ASF file, or via a AVI file with specially-crafted "wLongsPerEntry" and "nEntriesInUse" values in the "indx" chunk.

CVE-2006-1502 http://www.xfocus.org/advisories/200603/11.html http://secunia.com/advisories/19418/ 2006-03-29 2006-04-07
kaffeine -- buffer overflow vulnerability kaffeine 0.4.20.8.0

The KDE team reports:

Kaffeine can produce a buffer overflow in http_peek() while creating HTTP request headers for fetching remote playlists, which under certain circumstances could be used to crash the application and/or execute arbitrary code.

17372 CVE-2006-0051 http://www.kde.org/info/security/advisory-20060404-1.txt 2006-04-04 2006-04-07
thunderbird -- javascript execution thunderbird mozilla-thunderbird 1.0.7

Renaud Lifchitz reports a vulnerability within thunderbird. The vulnerability is caused by improper checking of javascript scripts. This could lead to javascript code execution which can lead to information disclosure or a denial of service (application crash). This vulnerability is present even if javascript had been disabled in the preferences.

16770 CAN-2006-0884 2006-02-22 2006-04-07
phpmyadmin -- XSS vulnerabilities phpMyAdmin 2.8.0.3

phpMyAdmin security announcement:

It was possible to conduct an XSS attack with a direct call to some scripts under the themes directory.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1 http://secunia.com/advisories/19556/ 2006-04-06 2006-04-06 2006-04-07
phpmyadmin -- 'set_theme' Cross-Site Scripting phpMyAdmin 2.8.0.2

Secunia reports:

A vulnerability has been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "set_theme" parameter isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2006-1258 http://secunia.com/advisories/19277 2006-03-17 2006-04-06
clamav -- Multiple Vulnerabilities clamav 0.88.1 clamav-devel 20051104_1

Secunia reports:

Some vulnerabilities have been reported in ClamAV, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

An unspecified integer overflow error exists in the PE header parser in "libclamav/pe.c". Successful exploitation requires that the ArchiveMaxFileSize option is disabled.

Some format string errors in the logging handling in "shared/output.c" may be exploited to execute arbitrary code.

An out-of-bounds memory access error in the "cli_bitset_test()" function in "ibclamav/others.c" may be exploited to cause a crash.

CVE-2006-1614 CVE-2006-1615 CVE-2006-1630 http://secunia.com/advisories/19534/ http://www.us.debian.org/security/2006/dsa-1024 2006-04-06 2006-04-06
mediawiki -- hardcoded placeholder string security bypass vulnerability mediawiki 1.5.4

The mediawiki development team reports a vulnerability within the mediawiki application. The vulnerability is caused by improper checking of inline style attributes. This could result in the execution of arbitrary javascript code in Microsoft Internet Explorer. It appears that other browsers are not affected by this vulnerability.

16032 CAN-2005-4501 http://sourceforge.net/project/shownotes.php?release_id=379951 2005-12-22 2006-04-05
netpbm -- buffer overflow in pnmtopng netpbm 10.26

Ubuntu reports:

A buffer overflow was found in the "pnmtopng" conversion program. By tricking an user (or automated system) to process a specially crafted PNM image with pnmtopng, this could be exploited to execute arbitrary code with the privileges of the user running pnmtopng.

15128 CAN-2005-2978 http://www.ubuntulinux.org/support/documentation/usn/usn-210-1 2005-10-18 2006-04-05
zoo -- stack based buffer overflow zoo 2.10.1_2

Jean-Sébastien Guay-Leroux report a vulnerability within the zoo archiver. The vulnerability which is present in the fullpath() function (from the misc.c file) is caused by improper checking of user supplied data. The data returned to the buffer can be up to 512 bytes, while the buffer is created to hold 256 bytes. This could result in a buffer overflow which could allow remote code execution.

16790 CVE-2006-0855 http://www.guay-leroux.com/projects/zoo-advisory.txt 2006-02-22 2006-04-05 2006-04-06
mediawiki -- cross site scripting vulnerability mediawiki 1.41.4.14 1.51.5.7

The mediawiki development team reports that there is an site scripting vulnerability within mediawiki. The vulnerability is caused by improper checking of encoded links which could allow the injection of html in the output generated by mediawiki. This could lead to cross site scripting attacks against mediawiki installations.

17269 CVE-2006-1498 http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-March/000040.html 2006-03-27 2006-04-05
dia -- XFig Import Plugin Buffer Overflow dia dia-gnome 0.86_10.94_6,1

Secunia reports:

Some vulnerabilities have been reported in Dia, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the XFig import plugin. This can be exploited to cause buffer overflows and may allow arbitrary code execution when a specially-crafted FIG file is imported.

CVE-2006-1550 http://secunia.com/advisories/19469/ http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html 2006-03-31 2006-04-05
openvpn -- LD_PRELOAD code execution on client through malicious or compromised server openvpn 2.02.0.6

Hendrik Weimer reports:

OpenVPN clients are a bit too generous when accepting configuration options from a server. It is possible to transmit environment variables to client-side shell scripts. There are some filters in place to prevent obvious nonsense, however they don't catch the good old LD_PRELOAD trick. All we need is to put a file onto the client under a known location (e.g. by returning a specially crafted document upon web access) and we have a remote root exploit. But since the attack may only come from authenticated servers, this threat is greatly reduced.

CVE-2006-1629 http://www.osreviews.net/reviews/security/openvpn-print http://openvpn.net/changelog.html http://sourceforge.net/mailarchive/message.php?msg_id=15298074 2006-04-03 2006-04-05 2006-04-06
samba -- Exposure of machine account credentials in winbind log files samba 3.0.21a,13.0.22,1 ja-samba 3.0.21a,13.0.22,1

Samba Security Advisory:

The machine trust account password is the secret shared between a domain controller and a specific member server. Access to the member server machine credentials allows an attacker to impersonate the server in the domain and gain access to additional information regarding domain users and groups.

The winbindd daemon writes the clear text of server's machine credentials to its log file at level 5. The winbindd log files are world readable by default and often log files are requested on open mailing lists as tools used to debug server misconfigurations.

This affects servers configured to use domain or ads security and possibly Samba domain controllers as well (if configured to use winbindd).

CVE-2006-1059 http://us1.samba.org/samba/security/CAN-2006-1059.html http://secunia.com/advisories/19455/ 2006-03-30 2006-04-05
mod_pubcookie -- cross site scripting vulnerability mod_pubcookie 3.3.0

Nathan Dors of the Pubcookie Project reports:

Non-persistent XSS vulnerabilities were found in the Pubcookie Apache module (mod_pubcookie) and ISAPI filter. These components mishandle untrusted data when printing responses to the browser. This makes them vulnerable to carefully crafted requests containing script or HTML. If an attacker can lure an unsuspecting user to visit carefully staged content, the attacker can use it to redirect the user to a vulnerable Pubcookie application server and attempt to exploit the XSS vulnerabilities.

These vulnerabilities are classified as *high* due to the nature and purpose of Pubcookie application servers for user authentication and Web Single Sign-on (SSO). An attacker who injects malicious script through the vulnerabilities might steal private Pubcookie data including a user's authentication assertion ("granting") cookies and application session cookies.

314540 2006-03-06 2006-04-05
pubcookie-login-server -- cross site scripting vulnerability pubcookie-login-server 3.3.0

Nathan Dors of the Pubcookie Project reports:

Multiple non-persistent XSS vulnerabilities were found in the Pubcookie login server's compiled binary "index.cgi" CGI program. The CGI program mishandles untrusted data when printing responses to the browser. This makes the program vulnerable to carefully crafted requests containing script or HTML. If an attacker can lure an unsuspecting user to visit carefully staged content, the attacker can use it to redirect the user to his or her local Pubcookie login page and attempt to exploit the XSS vulnerabilities.

These vulnerabilities are classified as *critical* due to the nature and purpose of the Pubcookie login server for user authentication and Web Single Sign-on (SSO). Specific threats include:

  • An attacker who injects malicious script through the vulnerabilities might steal senstive user data including a user's authentication credentials (usernames and passwords);
  • An attacker who injects malicious script through the vulnerabilities might steal private Pubcookie data including a user's authentication assertion ("granting") cookies and SSO ("login") session cookies;
  • An attacker who injects HTML tags through the vulnerabilities might deface a site's Pubcookie login page for a single visit by a single user (i.e. a non-persistent defacement).

At the heart of these threats lies a violation of the user's trust in the Pubcookie login server.

337585 2006-03-06 2006-04-05
freeradius -- EAP-MSCHAPv2 Authentication Bypass freeradius 1.0.01.1.1

Freeradius Security Contact reports:

Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing.

CVE-2006-1354 http://www.freeradius.org/security.html#1.1.0 http://secunia.com/advisories/19300/ 2006-03-21 2006-03-29
horde -- remote code execution vulnerability in the help viewer horde horde-php5 3.1.1

Horde 3.1.1 release announcement:

Major changes compared to Horde 3.1 are:

  • Fix for remote code execution vulnerability in the help viewer, discovered by Jan Schneider from the Horde team.
17292 CVE-2006-1491 http://lists.horde.org/archives/announce/2006/000271.html 2006-03-28 2006-03-28 2006-03-30
linux-realplayer -- buffer overrun linux-realplayer 10.0.110.0.7.785.20060201

Secunia Advisories Reports:

A boundary error when processing SWF files can be exploited to cause a buffer overflow. This may allow execution of arbitrary code on the user's system.

CVE-2006-0323 http://service.real.com/realplayer/security/03162006_player/en/ http://secunia.com/advisories/19358/ 2006-03-23 2006-03-27
linux-realplayer -- heap overflow linux-realplayer 10.0.110.0.6

iDefense Reports:

Remote exploitation of a heap-based buffer overflow in RealNetwork Inc's RealPlayer could allow the execution of arbitrary code in the context of the currently logged in user.

In order to exploit this vulnerability, an attacker would need to entice a user to follow a link to a malicious server. Once the user visits a website under the control of an attacker, it is possible in a default install of RealPlayer to force a web-browser to use RealPlayer to connect to an arbitrary server, even when it is not the default application for handling those types, by the use of embedded object tags in a webpage. This may allow automated exploitation when the page is viewed.

CVE-2005-2922 http://service.real.com/realplayer/security/03162006_player/en/ http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404 http://secunia.com/advisories/19358/ 2006-03-23 2006-03-27
sendmail -- race condition vulnerability sendmail 8.138.13.6 FreeBSD 6.06.0_6 5.45.4_13 5.35.3_28 4.114.11_16 4.104.10_22

Problem Description

A race condition has been reported to exist in the handling by sendmail of asynchronous signals.

Impact

A remote attacker may be able to execute arbitrary code with the privileges of the user running sendmail, typically root.

Workaround

There is no known workaround other than disabling sendmail.

CVE-2006-0058 SA-06:13.sendmail 2006-03-22 2006-03-24 2006-06-09
OPIE -- arbitrary password change FreeBSD 6.06.0_6 5.45.4_13 5.35.3_28 4.114.11_16 4.104.10_22

Problem Description

The opiepasswd(1) program uses getlogin(2) to identify the user calling opiepasswd(1). In some circumstances getlogin(2) will return "root" even when running as an unprivileged user. This causes opiepasswd(1) to allow an unpriviled user to configure OPIE authentication for the root user.

Impact

In certain cases an attacker able to run commands as a non privileged users which have not explicitly logged in, for example CGI scripts run by a web server, is able to configure OPIE access for the root user. If the attacker is able to authenticate as root using OPIE authentication, for example if "PermitRootLogin" is set to "yes" in sshd_config or the attacker has access to a local user in the "wheel" group, the attacker can gain root privileges.

Workaround

Disable OPIE authentication in PAM:

# sed -i "" -e /opie/s/^/#/ /etc/pam.d/*

or

Remove the setuid bit from opiepasswd:

# chflags noschg /usr/bin/opiepasswd
# chmod 555 /usr/bin/opiepasswd
# chflags schg /usr/bin/opiepasswd
CVE-2006-1283 SA-06:12.opie 2006-03-22 2006-03-24 2006-06-09
ipsec -- reply attack vulnerability FreeBSD 6.06.0_6 5.45.4_13 5.35.3_28 4.114.11_16 4.104.10_22

Problem Description

IPsec provides an anti-replay service which when enabled prevents an attacker from successfully executing a replay attack. This is done through the verification of sequence numbers. A programming error in the fast_ipsec(4) implementation results in the sequence number associated with a Security Association not being updated, allowing packets to unconditionally pass sequence number verification checks.

Impact

An attacker able to intercept IPSec packets can replay them. If higher level protocols which do not provide any protection against packet replays (e.g., UDP) are used, this may have a variety of effects.

Workaround

No workaround is available.

CVE-2006-0905 SA-06:11.ipsec 2006-03-22 2006-03-24 2006-06-09
xorg-server -- privilege escalation xorg-server 6.9.0

Daniel Stone of X.Org reports:

During the analysis of results from the Coverity code review of X.Org, we discovered a flaw in the server that allows local users to execute arbitrary code with root privileges, or cause a denial of service by overwriting files on the system, again with root privileges.

CVE-2006-0745 https://bugs.freedesktop.org/show_bug.cgi?id=6213 2006-03-20 2006-03-21
heimdal -- Multiple vulnerabilities heimdal 0.6.6

A Project heimdal Security Advisory reports:

The telnet client program in Heimdal has buffer overflows in the functions slc_add_reply() and env_opt_add(), which may lead to remote code execution.

The telnetd server program in Heimdal has buffer overflows in the function getterminaltype, which may lead to remote code execution.

The rshd server in Heimdal has a privilege escalation bug when storing forwarded credentials. The code allowes a user to overwrite a file with its credential cache, and get ownership of the file.

CVE-2005-0469 CVE-2005-2040 CVE-2006-0582 CVE-2006-0677 http://www.pdc.kth.se/heimdal/advisory/2005-04-20 http://www.pdc.kth.se/heimdal/advisory/2005-06-20 http://www.pdc.kth.se/heimdal/advisory/2006-02-06 2006-02-06 2006-03-20
curl -- TFTP packet buffer overflow vulnerability curl linux-curl 7.14.17.15.3

A Project cURL Security Advisory reports:

libcurl uses the given file part of a TFTP URL in a manner that allows a malicious user to overflow a heap-based memory buffer due to the lack of boundary check.

This overflow happens if you pass in a URL with a TFTP protocol prefix ("tftp://"), using a valid host and a path part that is longer than 512 bytes.

The affected flaw can be triggered by a redirect, if curl/libcurl is told to follow redirects and an HTTP server points the client to a tftp URL with the characteristics described above.

CVE-2006-1061 http://curl.haxx.se/docs/adv_20060320.html 2006-03-20 2006-03-20 2006-10-05
drupal -- multiple vulnerabilities drupal 3.6.6

Drupal reports:

Mail header injection vulnerability.

Linefeeds and carriage returns were not being stripped from email headers, raising the possibility of bogus headers being inserted into outgoing email.

This could lead to Drupal sites being used to send unwanted email.

Session fixation vulnerability.

If someone creates a clever enough URL and convinces you to click on it, and you later log in but you do not log off then the attacker may be able to impersonate you.

XSS vulnerabilities.

Some user input sanity checking was missing. This could lead to possible cross-site scripting (XSS) attacks.

XSS can lead to user tracking and theft of accounts and services.

Security bypass in menu.module.

If you use menu.module to create a menu item, the page you point to will be accessible to all, even if it is an admin page.

http://drupal.org/node/53806 http://drupal.org/node/53805 http://drupal.org/node/53803 http://drupal.org/node/53796 2006-03-13 2006-03-17
horde -- "url" disclosure of sensitive information vulnerability horde horde-php5 3.1

Secunia advisory SA19246:

Paul Craig has discovered a vulnerability in Horde, which can be exploited by malicious people to disclose sensitive information. Input passed to the "url" parameter in "services/go.php" isn't properly verified, before it is used in a "readfile()" call. This can be exploited to disclose the content of arbitrary files via e.g. the "php://" protocol wrapper.

The vulnerability has been confirmed in version 3.0.9 and has also been reported in prior versions.

Provided and/or discovered by: Paul Craig, Security-Assessment.com.

http://secunia.com/advisories/19246/ 2006-03-15 2006-03-15
linux-flashplugin -- arbitrary code execution vulnerability linux-flashplugin 7.0r63

Adobe reports:

Critical vulnerabilities have been identified in Flash Player that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these vulnerabilities.

Flash Player 8 update (8.0.24.0), and Flash Player 7 update (7.0.63.0) address security vulnerabilities in previous versions of Flash Player, which could lead to the potential execution of arbitrary code. These vulnerabilities could be accessed through content delivered from a remote location via the users web browser, email client, or other applications that include or reference the Flash Player.

CVE-2006-0024 http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html 2006-03-14 2006-03-15
nfs -- remote denial of service FreeBSD 6.06.0_5 5.45.4_12 5.35.3_27 4.114.11_15 4.104.10_21

Problem description:

A part of the NFS server code charged with handling incoming RPC messages via TCP had an error which, when the server received a message with a zero-length payload, would cause a NULL pointer dereference which results in a kernel panic. The kernel will only process the RPC messages if a userland nfsd daemon is running.

Impact:

The NULL pointer deference allows a remote attacker capable of sending RPC messages to an affected FreeBSD system to crash the FreeBSD system.

Workaround:

  1. Disable the NFS server: set the nfs_server_enable variable to "NO" in /etc/rc.conf, and reboot.

    Alternatively, if there are no active NFS clients (as listed by the showmount(8) utility), simply killing the mountd and nfsd processes should suffice.

  2. Add firewall rules to block RPC traffic to the NFS server from untrusted hosts.

CVE-2006-0900 SA-06:10.nfs 2006-03-01 2006-03-12 2006-06-09
openssh -- remote denial of service FreeBSD 5.45.4_12 5.35.3_27

Problem description:

Because OpenSSH and OpenPAM have conflicting designs (one is event- driven while the other is callback-driven), it is necessary for OpenSSH to fork a child process to handle calls to the PAM framework. However, if the unprivileged child terminates while PAM authentication is under way, the parent process incorrectly believes that the PAM child also terminated. The parent process then terminates, and the PAM child is left behind.

Due to the way OpenSSH performs internal accounting, these orphaned PAM children are counted as pending connections by the master OpenSSH server process. Once a certain number of orphans has accumulated, the master decides that it is overloaded and stops accepting client connections.

Impact:

By repeatedly connecting to a vulnerable server, waiting for a password prompt, and closing the connection, an attacker can cause OpenSSH to stop accepting client connections until the system restarts or an administrator manually kills the orphaned PAM processes.

Workaround:

The following command will show a list of orphaned PAM processes:

# pgrep -lf 'sshd.*\[pam\]'

The following command will kill orphaned PAM processes:

# pkill -f 'sshd.*\[pam\]'

To prevent OpenSSH from leaving orphaned PAM processes behind, perform one of the following:

  1. Disable PAM authentication in OpenSSH. Users will still be able to log in using their Unix password, OPIE or SSH keys.

    To do this, execute the following commands as root:

    # echo 'UsePAM no' >>/etc/ssh/sshd_config
    # echo 'PasswordAuthentication yes' >>/etc/ssh/sshd_config
    # /etc/rc.d/sshd restart
  2. If disabling PAM is not an option - if, for instance, you use RADIUS authentication, or store user passwords in an SQL database - you may instead disable privilege separation. However, this may leave OpenSSH vulnerable to hitherto unknown bugs, and should be considered a last resort.

    To do this, execute the following commands as root:

    # echo 'UsePrivilegeSeparation no' >>/etc/ssh/sshd_config
    # /etc/rc.d/sshd restart
CVE-2006-0883 SA-06:09.openssh 2006-03-01 2006-03-12 2006-06-09
GnuPG does not detect injection of unsigned data gnupg 1.4.2.2

Werner Koch reports:

In the aftermath of the false positive signature verfication bug (announced 2006-02-15) more thorough testing of the fix has been done and another vulnerability has been detected. This new problem affects the use of *gpg* for verification of signatures which are _not_ detached signatures. The problem also affects verification of signatures embedded in encrypted messages; i.e. standard use of gpg for mails.

CVE-2006-0049 http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html 2006-03-09 2006-03-10 2006-03-11
mplayer -- heap overflow in the ASF demuxer mplayer mplayer-gtk mplayer-esound mplayer-gtk-esound 0.99.7_11

The Mplayer team reports:

A potential buffer overflow was found in the ASF demuxer. Arbitrary remote code execution is possible (under the user ID running the player) when streaming an ASF file from a malicious server or local code execution (under the user ID running the player) if a malicious ASF file is played locally.

CVE-2006-0579 http://www.mplayerhq.hu/design7/news.html#vuln13 http://secunia.com/advisories/18718 http://bugs.gentoo.org/show_bug.cgi?id=122029 2006-02-15 2006-03-09
SSH.COM SFTP server -- format string vulnerability ssh2 ssh2-nox11 3.2.9.1_5

SSH Communications Security Corp reports a format string vulnerability in their SFTP server. This vulnerability could cause a user with SCP/SFTP access only to get permission to execute also other commands. It could also allow user A to create a special file that when accessed by user B allows user A to execute commands as user B.

CVE-2006-0705 16640 http://www.ssh.com/company/newsroom/article/715/ http://www.frsirt.com/english/advisories/2006/0554 http://securitytracker.com/id?1015619 http://secunia.com/advisories/18828 http://xforce.iss.net/xforce/xfdb/24651 2006-02-13 2006-03-04 2006-03-06
gtar -- invalid headers buffer overflow gtar 1.15.1_2

GNU tar is vulnerable to a buffer overflow, caused by improper bounds checking of the PAX extended headers. By tricking an user into processing a specially crafted tar archive, this could be exploited to execute arbitrary code with the privileges of the user.

16764 CVE-2006-0300 2006-02-22 2006-03-03
bugzilla -- multiple vulnerabilities bugzilla ja-bugzilla 2.17.12.20.1

Some vulnerabilities have been reported in Bugzilla, which can be exploited by malicious users to conduct SQL injection attacks, and by malicious people to disclose sensitive information and conduct script insertion attacks.

CVE-2006-2420 CVE-2006-0916 CVE-2006-0915 CVE-2006-0914 CVE-2006-0913 http://www.bugzilla.org/security/2.18.4/ 2006-02-20 2006-02-27 2006-11-11
squirrelmail -- multiple vulnerabilities squirrelmail 1.4.6

Multiple vulnerabilities has been discovered since 1.4.5, including IMAP injection as well as some XSS issues.

CVE-2006-0377 CVE-2006-0195 CVE-2006-0188 2006-02-23 2006-02-24
gedit -- format string vulnerability gedit 2.10.3

Yan Feng reports a format string vulnerability in gedit. This vulnerability could cause a denial of service with a binary file that contains format string characters within the filename. It had been reported that web browsers and email clients can be configured to provide a filename as an argument to gedit.:

CAN-2005-1686 :http://marc.theaimsgroup.com/?l=bugtraq&m=111661117701398 2005-05-20 2006-02-20
WebCalendar -- unauthorized access vulnerability WebCalendar 1.0.0

SecurityFocus reports that WebCalendar is affected by an unauthorized access vulnerability. The vulnerability is caused by improper checking of the authentication mechanism before access is being permitted to the "assistant_edit.php" file.

14072 CAN-2005-2320 2005-06-27 2006-02-20
abiword, koffice -- stack based buffer overflow vulnerabilities koffice 1.2.01.4.1_1,1 abiword 2.2.11

Chris Evans reports that AbiWord is vulnerable to multiple stack-based buffer overflow vulnerabilities. This is caused by improper checking of the user-supplied data before it is being copied to an too small buffer. The vulnerability is triggered when someone is importing RTF files.

15096 CAN-2005-2972 http://scary.beasts.org/security/CESA-2005-006.txt http://www.abisource.com/changelogs/2.2.11.phtml http://www.kde.org/info/security/advisory-20051011-1.txt 2005-10-14 2006-02-20 2006-02-20
postgresql81-server -- SET ROLE privilege escalation postgresql-server 8.1.08.1.3

The PostgreSQL team reports:

Due to inadequate validity checking, a user could exploit the special case that SET ROLE normally uses to restore the previous role setting after an error. This allowed ordinary users to acquire superuser status, for example.

CVE-2006-0553 http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3 2006-02-14 2006-02-18 2006-08-13
gnupg -- false positive signature verification gnupg 1.4.2.1

Werner Koch reports:

The Gentoo project identified a security related bug in GnuPG. When using any current version of GnuPG for unattended signature verification (e.g. by scripts and mail programs), false positive signature verification of detached signatures may occur.

This problem affects the tool *gpgv*, as well as using "gpg --verify" to imitate gpgv, if only the exit code of the process is used to decide whether a detached signature is valid. This is a plausible mode of operation for gpgv.

If, as suggested, the --status-fd generated output is used to decide whether a signature is valid, no problem exists. In particular applications making use of the GPGME library[2] are not affected.

CVE-2006-0455 http://marc.theaimsgroup.com/?l=gnupg-devel&m=113999098729114 2006-02-15 2006-02-17
rssh -- privilege escalation vulnerability rssh 2.3.0

Pizzashack reports:

Max Vozeler has reported a problem whereby rssh can allow users who have shell access to systems where rssh is installed (and rssh_chroot_helper is installed SUID) to gain root access to the system, due to the ability to chroot to arbitrary locations. There are a lot of potentially mitigating factors, but to be safe you should upgrade immediately.

16050 CVE-2005-3345 http://www.pizzashack.org/rssh/security.shtml 2005-12-18 2006-02-16
tor -- malicious tor server can locate a hidden service tor 0.1.0.12

Roger Dingledine reports:

If you offer a Tor hidden service, an adversary who can run a fast Tor server and who knows some basic statistics can find the location of your hidden service in a matter of minutes to hours.

CVE-2006-0414 http://archives.seul.org/or/announce/Jan-2006/msg00001.html 2006-01-12 2006-02-16
sudo -- arbitrary command execution sudo 1.6.8.10

Tavis Ormandy reports:

The bash shell uses the value of the PS4 environment variable (after expansion) as a prefix for commands run in execution trace mode. Execution trace mode (xtrace) is normally set via bash's -x command line option or interactively by running "set -o xtrace". However, it may also be enabled by placing the string "xtrace" in the SHELLOPTS environment variable before bash is started.

A malicious user with sudo access to a shell script that uses bash can use this feature to run arbitrary commands for each line of the script.

15191 CVE-2005-2959 http://www.courtesan.com/sudo/alerts/bash_env.html 2005-10-25 2006-02-16
libtomcrypt -- weak signature scheme with ECC keys libtomcrypt 1.02

The Secure Science Corporation reports that libtomcrypt is vulnerable to a weak signature scheme. This allows an attacker to create a valid random signature and use that to sign arbitrary messages without requiring the private key.

http://marc.theaimsgroup.com/?l=bugtraq&m=111540819703204 2005-05-01 2006-02-16
mantis -- "view_filters_page.php" cross site scripting vulnerability mantis 1.0.0a4

r0t reports:

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to "target_field" parameter in "view_filters_page.php" is not properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

CAN-2005-4238 http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html 2005-12-13 2006-02-16
phpbb -- multiple vulnerabilities phpbb zh-phpbb-tw 2.0.18

Multiple vulnerabilities have been reported within phpbb. phpbb is proven vulnerable to:

  • script insertion,
  • bypassing of protetion mechanisms,
  • multiple cross site scripting vulnerabilities,
  • SQL injection,
  • arbitrary code execution
15170 15243 CVE-2005-3310 CVE-2005-3415 CVE-2005-3416 CVE-2005-3417 CVE-2005-3418 CVE-2005-3419 CVE-2005-3420 CVE-2005-3536 CVE-2005-3537 http://marc.theaimsgroup.com/?l=bugtraq&m=113017003617987 http://www.hardened-php.net/advisory_172005.75.html 2005-10-24 2006-02-16
postgresql -- character conversion and tsearch2 vulnerabilities postgresql 7.2.07.2.8 7.3.07.3.10 7.4.07.4.8 8.0.08.0.3

The postgresql development team reports:

The more severe of the two errors is that the functions that support client-to-server character set conversion can be called from SQL commands by unprivileged users, but these functions are not designed to be safe against malicious choices of argument values. This problem exists in PostgreSQL 7.3.* through 8.0.*. The recommended fix is to disable public EXECUTE access for these functions. This does not affect normal usage of the functions for character set conversion, but it will prevent misuse.

The other error is that the contrib/tsearch2 module misdeclares several functions as returning type "internal" when they do not have any "internal" argument. This breaks the type safety of "internal" by allowing users to construct SQL commands that invoke other functions accepting "internal" arguments. The consequences of this have not been investigated in detail, but it is certainly at least possible to crash the backend.

CAN-2005-1409 CAN-2005-1410 http://www.postgresql.org/about/news.315 2005-05-02 2006-02-16
heartbeat -- insecure temporary file creation vulnerability heartbeat 1.2.4

Eric Romang reports a temporary file creation vulnerability within heartbeat. The vulnerability is caused by hardcoded temporary file usage. This can cause an attacker to create an arbitrary symlink causing the application to overwrite the symlinked file with the permissions of the user executing the application.

CAN-2005-2231 http://www.zataz.net/adviso/heartbeat-06272005.txt 2005-07-12 2006-02-16 2006-04-16
kpdf -- heap based buffer overflow kdegraphics 3.5.1_1

The KDE team reports:

kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains a heap based buffer overflow in the splash rasterizer engine that can crash kpdf or even execute arbitrary code.

CVE-2006-0301 http://www.kde.org/info/security/advisory-20060202-1.txt 2006-02-02 2006-02-15
perl, webmin, usermin -- perl format string integer wrap vulnerability perl 5.6.05.6.2 5.8.05.8.7_1 webmin 1.250 usermin 1.180

The Perl Development page reports:

Dyad Security recently released a security advisory explaining how in certain cases, a carefully crafted format string passed to sprintf can cause a buffer overflow. This buffer overflow can then be used by an attacker to execute code on the machine. This was discovered in the context of a design problem with the Webmin administration package that allowed a malicious user to pass unchecked data into sprintf.

15629 CVE-2005-3912 CVE-2005-3962 http://dev.perl.org/perl5/news/2005/perl_patches_fix_sprintf_buffer.html http://www.dyadsecurity.com/perl-0002.html http://www.dyadsecurity.com/webmin-0001.html http://www.webmin.com/security.html 2005-09-23 2006-02-15
phpicalendar -- cross site scripting vulnerability phpicalendar 2.1

Francesco Ongaro reports that phpicalendar is vulnerable for a cross site scripting attack. The vulnerability is caused by improper validation of the index.php file allowing attackers to include an arbitrary file with the .php extension

15193 CVE-2005-3366 http://www.ush.it/2005/10/25/php-icalendar-css/ 2005-10-25 2006-02-15
phpicalendar -- file disclosure vulnerability phpicalendar 2.21

The phpicalendar team reports that there is an unspecified vulnerability within phpicalendar. This seems to be a file disclosure vulnerability caused by improper checking of the template parsing function. This would allow an attacker to disclose any file readable by the user under which the webserver runs.

http://phpicalendar.net/forums/viewtopic.php?t=396 2006-02-08 2006-02-15
FreeBSD -- Infinite loop in SACK handling FreeBSD 5.45.4_11 5.35.3_26

Problem description:

When insufficient memory is available to handle an incoming selective acknowledgement, the TCP/IP stack may enter an infinite loop.

Impact:

By opening a TCP connection and sending a carefully crafted series of packets, an attacker may be able to cause a denial of service.

Workaround:

On FreeBSD 5.4, the net.inet.tcp.sack.enable sysctl can be used to disable the use of SACK:

# sysctl net.inet.tcp.sack.enable=0

No workaround is available for FreeBSD 5.3.

CVE-2006-0433 SA-06:08.sack 2006-02-01 2006-02-14 2006-06-09
pf -- IP fragment handling panic FreeBSD 6.06.0_4 5.45.4_10 5.35.3_25

Problem description:

A logic bug in pf's IP fragment cache may result in a packet fragment being inserted twice, violating a kernel invariant.

Impact:

By sending carefully crafted sequence of IP packet fragments, a remote attacker can cause a system running pf with a ruleset containing a 'scrub fragment crop' or 'scrub fragment drop-ovl' rule to crash.

Workaround:

Do not use 'scrub fragment crop' or 'scrub fragment drop-ovl' rules on systems running pf. In most cases, such rules can be replaced by 'scrub fragment reassemble' rules; see the pf.conf(5) manual page for more details.

Systems which do not use pf, or use pf but do not use the aforementioned rules, are not affected by this issue.

CVE-2006-0381 SA-06:07.pf 2006-01-25 2006-02-14 2006-06-09
FreeBSD -- Local kernel memory disclosure FreeBSD 6.06.0_4

Problem description:

A buffer allocated from the kernel stack may not be completely initialized before being copied to userland. [CVE-2006-0379]

A logic error in computing a buffer length may allow too much data to be copied into userland. [CVE-2006-0380]

Impact:

Portions of kernel memory may be disclosed to local users. Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password.

Workaround:

No workaround is available.

CVE-2006-0379 CVE-2006-0380 SA-06:06.kmem 2006-01-25 2006-02-14 2006-06-09
IEEE 802.11 -- buffer overflow FreeBSD 6.06.0_3

Problem description:

An integer overflow in the handling of corrupt IEEE 802.11 beacon or probe response frames when scanning for existing wireless networks can result in the frame overflowing a buffer.

Impact:

An attacker able broadcast a carefully crafted beacon or probe response frame may be able to execute arbitrary code within the context of the FreeBSD kernel on any system scanning for wireless networks.

Workaround:

No workaround is available, but systems without IEEE 802.11 hardware or drivers loaded are not vulnerable.

CVE-2006-0226 SA-06:05.80211 2006-01-18 2006-02-14 2006-06-09
ipfw -- IP fragment denial of service FreeBSD 6.06.0_2

Problem description:

The firewall maintains a pointer to layer 4 header information in the event that it needs to send a TCP reset or ICMP error message to discard packets. Due to incorrect handling of IP fragments, this pointer fails to get initialized.

Impact:

An attacker can cause the firewall to crash by sending ICMP IP fragments to or through firewalls which match any reset, reject or unreach actions.

Workaround:

Change any reset, reject or unreach actions to deny. It should be noted that this will result in packets being silently discarded.

CVE-2006-0054 SA-06:04.ipfw 2006-01-11 2006-02-14 2006-06-09
kpopup -- local root exploit and local denial of service kpopup 0.9.10.9.5

Mitre CVE reports:

Format string vulnerability in main.cpp in kpopup 0.9.1-0.9.5pre2 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via format string specifiers in command line arguments.

misc.cpp in KPopup 0.9.1 trusts the PATH variable when executing killall, which allows local users to elevate their privileges by modifying the PATH variable to reference a malicious killall program.

SecurityFocus credits "b0f" b0fnet@yahoo.com

CVE-2003-1170 8918 CVE-2003-1167 8915 http://www.securityfocus.com/archive/1/342736 http://www.henschelsoft.de/kpopup_en.html 2003-10-28 2006-02-07
cpio -- multiple vulnerabilities FreeBSD 6.06.0_2 5.45.4_9 5.35.3_24 4.114.11_14 4.104.10_20

Problem description:

A number of issues has been discovered in cpio:

When creating a new file, cpio closes the file before setting its permissions. (CVE-2005-1111)

When extracting files cpio does not properly sanitize file names to filter out ".." components, even if the --no-absolute-filenames option is used. (CVE-2005-1229)

When adding large files (larger than 4 GB) to a cpio archive on 64-bit platforms an internal buffer might overflow. (CVE-2005-4268)

Impact

The first problem can allow a local attacker to change the permissions of files owned by the user executing cpio providing that they have write access to the directory in which the file is being extracted. (CVE-2005-1111)

The lack of proper file name sanitation can allow an attacker to overwrite arbitrary local files when extracting files from a cpio archive. (CVE-2005-1229)

The buffer-overflow on 64-bit platforms could lead cpio to a Denial-of-Service situation (crash) or possibly execute arbitrary code with the permissions of the user running cpio. (CVE-2005-4268)

Workaround

Use a different utility to create and extract cpio archives, for example pax(1) or (on FreeBSD 5.3 or later) tar(1). If this is not possible, do not extract untrusted archives and when running on 64-bit platforms do not add untrusted files to cpio archives.

CVE-2005-1111 CVE-2005-1229 CVE-2005-4268 SA-06:03.cpio 2006-01-11 2006-01-27
ee -- temporary file privilege escalation FreeBSD 6.06.0_2 5.45.4_9 5.35.3_24 4.114.11_14 4.104.10_20

Problem description

The ispell_op function used by ee(1) while executing spell check operations employs an insecure method of temporary file generation. This method produces predictable file names based on the process ID and fails to confirm which path will be over written with the user.
It should be noted that ispell does not have to be installed in order for this to be exploited. The option simply needs to be selected.

Impact

These predictable temporary file names are problematic because they allow an attacker to take advantage of a race condition in order to execute a symlink attack, which could allow them to overwrite files on the system in the context of the user running the ee(1) editor.

Workaround

Instead of invoking ispell through ee(1), invoke it directly.

16207 CVE-2006-0055 SA-06:02.ee 2006-01-11 2006-01-27
texindex -- temporary file privilege escalation FreeBSD 6.06.0_2 5.45.4_9 5.35.3_24 4.114.11_14 4.104.10_20

Problem description

The "sort_offline" function used by texindex(1) employs the "maketempname" function, which produces predictable file names and fails to validate that the paths do not exist.

Impact

These predictable temporary file names are problematic because they allow an attacker to take advantage of a race condition in order to execute a symlink attack, which could enable them to overwrite files on the system in the context of the user running the texindex(1) utility.

Workaround

No workaround is available, but the problematic code is only executed if the input file being processed is 500kB or more in length; as a result, users working with documents of less than several hundred pages are very unlikely to be affected.

14854 CAN-2005-3011 SA-06:01.texindex 2006-01-11 2006-01-27
cvsbug -- race condition FreeBSD 5.45.4_7 5.35.3_22 4.114.11_12 4.104.10_18 cvs+ipv6 1.11.17_1

Problem description

A temporary file is created, used, deleted, and then re-created with the same name. This creates a window during which an attacker could replace the file with a link to another file. While cvsbug(1) is based on the send-pr(1) utility, this problem does not exist in the version of send-pr(1) distributed with FreeBSD.
In FreeBSD 4.10 and 5.3, some additional problems exist concerning temporary file usage in both cvsbug(1) and send-pr(1).

Impact

A local attacker could cause data to be written to any file to which the user running cvsbug(1) (or send-pr(1) in FreeBSD 4.10 and 5.3) has write access. This may cause damage in itself (e.g., by destroying important system files or documents) or may be used to obtain elevated privileges.

Workaround

Do not use the cvsbug(1) utility on any system with untrusted users.
Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3 system with untrusted users.

CAN-2005-2693 SA-05:20.cvsbug 2005-09-07 2006-01-27 2006-11-08
sge -- local root exploit in bundled rsh executable sge sgeee 5.3.6.20040330_1 6.*6.0.7.1

Sun Microsystems reports:

The SGE 6.0u7_1 release fixes a security bug which can allow malicious users to gain root access.

http://gridengine.sunsource.net/project/gridengine/news/SGE60u7_1-announce.html 2005-12-23 2006-01-23
fetchmail -- crash when bouncing a message fetchmail 6.3.06.3.2

Matthias Andree reports:

Fetchmail contains a bug that causes itself to crash when bouncing a message to the originator or to the local postmaster. The crash happens after the bounce message has been sent, when fetchmail tries to free the dynamic array of failed addresses, and calls the free() function with an invalid pointer.

CVE-2006-0321 http://www.fetchmail.info/fetchmail-SA-2006-01.txt http://bugs.debian.org/348747 2006-01-22 2006-01-23
clamav -- possible heap overflow in the UPX code clamav 0.88 clamav-devel 20060110

The Zero Day Initiative reports:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable Clam AntiVirus installations. Authentication is not required to exploit this vulnerability.

This specific flaw exists within libclamav/upx.c during the unpacking of executable files compressed with UPX. Due to an invalid size calculation during a data copy from the user-controlled file to heap allocated memory, an exploitable memory corruption condition is created.

16191 CVE-2006-0162 http://lurker.clamav.net/message/20060109.213247.a16ae8db.en.html http://www.zerodayinitiative.com/advisories/ZDI-06-001.html http://secunia.com/advisories/18379/ 2006-01-09 2006-01-10 2006-01-15
milter-bogom -- headerless message crash milter-bogom 1.8.2

Juan J. Marítnez reports:

The milter crashes while processing a headerless message

Impact: bogom crashes and sendmail moves it to error state

http://www.usebox.net/jjm/bogom/errata/bogom-errata-2006-1.txt http://alf.dyndns.ws/pipermail/milter/2006-January/000076.html 2006-01-05 2006-01-09
bogofilter -- heap corruption through excessively long words bogofilter 0.96.20.96.3

Matthias Andree reports:

Bogofilter's/bogolexer's input handling in version 0.96.2 was not keeping track of its output buffers properly and could overrun a heap buffer if the input contained words whose length exceeded 16,384 bytes, the size of flex's input buffer. A "word" here refers to a contiguous run of input octets that was not '_' and did not match at least one of ispunct(), iscntrl() or isspace().

CVE-2005-4592 http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-02 2005-10-23 2006-01-07
bogofilter -- heap corruption through malformed input bogofilter 0.93.50.96.3

Matthias Andree reports:

When using Unicode databases (default in more recent bogofilter installations), upon encountering invalid input sequences, bogofilter or bogolexer could overrun a malloc()'d buffer, corrupting the heap, while converting character sets. Bogofilter would usually be processing untrusted data received from the network at that time.

This problem was aggravated by an unrelated bug that made bogofilter process binary attachments as though they were text, and attempt charset conversion on them. Given the MIME default character set, US-ASCII, all input octets in the range 0x80...0xff were considered invalid input sequences and could trigger the heap corruption.

CVE-2005-4591 http://bogofilter.sourceforge.net/security/bogofilter-SA-2005-01 2005-10-22 2006-01-07
rxvt-unicode -- restore permissions on tty devices rxvt-unicode 6.3

A rxvt-unicode changelog reports:

SECURITY FIX: on systems using openpty, permissions were not correctly updated on the tty device and were left as world-readable and world-writable (likely in original rxvt, too), and were not restored properly. Affected are only systems where non-unix ptys were used (such as most BSDs). Found, patched and debugged by Ryan Beasley.

http://dist.schmorp.de/rxvt-unicode/Changes 2005-12-31 2006-01-04
apache -- mod_imap cross-site scripting flaw apache 1.31.3.34_3 2.0.352.0.55_2 2.12.1.9_3 2.22.2.0_3 apache+mod_perl 1.3.34_1 apache_fp 0 apache+ipv6 1.3.37 ru-apache 1.3.34+30.22_1 ru-apache+mod_ssl 1.3.34+30.22+2.8.25_1 apache+ssl 1.3.01.3.33.1.55_2 apache+mod_ssl apache+mod_ssl+ipv6 apache+mod_ssl+mod_accel apache+mod_ssl+mod_accel+ipv6 apache+mod_ssl+mod_accel+mod_deflate apache+mod_ssl+mod_accel+mod_deflate+ipv6 apache+mod_ssl+mod_deflate apache+mod_ssl+mod_deflate+ipv6 apache+mod_ssl+mod_snmp apache+mod_ssl+mod_snmp+mod_accel apache+mod_ssl+mod_snmp+mod_accel+ipv6 apache+mod_ssl+mod_snmp+mod_deflate apache+mod_ssl+mod_snmp+mod_deflate+ipv6 apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 1.3.34+2.8.25_1

The Apache HTTP Server Project reports:

A flaw in mod_imap when using the Referer directive with image maps. In certain site configurations a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers.

CVE-2005-3352 15834 http://www.apacheweek.com/features/security-13 http://www.apacheweek.com/features/security-20 2005-11-01 2006-01-01 2009-01-23
nbd-server -- buffer overflow vulnerability nbd-server 2.8.2_1

Kurt Fitzner reports a buffer overflow vulnerability within nbd. This could potentially allow the execution of arbitrary code on the nbd server.

CVE-2005-3534 http://www.debian.org/security/2005/dsa-924 2005-12-21 2005-12-22 2005-12-25
scponly -- local privilege escalation exploits scponly 4.2

Max Vozeler reports:

If ALL the following conditions are true, administrators using scponly-4.1 or older may be at risk of a local privilege escalation exploit:

  • the chrooted setuid scponlyc binary is installed
  • regular non-scponly users have interactive shell access to the box
  • a user executable dynamically linked setuid binary (such as ping) exists on the same file system mount as the user's home directory
  • the operating system supports an LD_PRELOAD style mechanism to overload dynamic library loading

Pekka Pessi also reports:

If ANY the following conditions are true, administrators using scponly-4.1 or older may be at risk of a local privilege escalation exploit:

  • scp compatibility is enabled
  • rsync compatibility is enabled
https://lists.ccs.neu.edu/pipermail/scponly/2005-December/001027.html http://sublimation.org/scponly/#relnotes 2005-12-21 2005-12-22
fetchmail -- null pointer dereference in multidrop mode with headerless email fetchmail 6.3.1

The fetchmail team reports:

Fetchmail contains a bug that causes an application crash when fetchmail is configured for multidrop mode and the upstream mail server sends a message without headers. As fetchmail does not record this message as "previously fetched", it will crash with the same message if it is re-executed, so it cannot make progress. A malicious or broken-into upstream server could thus cause a denial of service in fetchmail clients.

CVE-2005-4348 http://www.fetchmail.info/fetchmail-SA-2005-03.txt http://article.gmane.org/gmane.mail.fetchmail.user/7573 http://bugs.debian.org/343836 2005-12-19 2005-12-19
mantis -- "t_core_path" file inclusion vulnerability mantis 1.0.0rc3

Secunia Research reports:

Input passed to the "t_core_path" parameter in "bug_sponsorship_list_view_inc.php" isn't properly verified, before it used to include files. This can be exploited to include arbitrary files from external and local resources.

CVE-2005-3335 http://secunia.com/secunia_research/2005-46/advisory/ 2005-10-26 2005-12-14
mantis -- "view_filters_page.php" cross-site scripting vulnerability mantis 1.0.0rc4

r0t reports:

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because input passed to "target_field" parameter in "view_filters_page.php" isn't properly sanitised before being returned to the user. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

15842 http://pridels.blogspot.com/2005/12/mantis-bugtracking-system-xss-vuln.html 2005-12-13 2005-12-14
mnemo -- Cross site scripting vulnerabilities in several of the notepad name and note data fields mnemo 2.0.3

Announce of Mnemo H3 (2.0.3) (final):

This [2.0.3] is a security release that fixes cross site scripting vulnerabilities in several of the notepad name and note data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Mnemo 2.0.2 upgrade to 2.0.3 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433279228172&w=2 2005-12-11 2005-12-11
nag -- Cross site scripting vulnerabilities in several of the tasklist name and task data fields nag 2.0.4

Announce of Nag H3 (2.0.4) (final):

This [2.0.4] is a security release that fixes cross site scripting vulnerabilities in several of the tasklist name and task data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Nag 2.0.3 upgrade to 2.0.4 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433205826731&w=2 2005-12-11 2005-12-11
turba -- Cross site scripting vulnerabilities in several of the address book name and contact data fields turba 2.0.5

Announce of Turba H3 (2.0.5) (final):

This [2.0.5] is a security release that fixes cross site scripting vulnerabilities in several of the address book name and contact data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Turba 2.0.4 upgrade to 2.0.5 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433120829232&w=2 2005-12-11 2005-12-11
kronolith -- Cross site scripting vulnerabilities in several of the calendar name and event data fields kronolith 2.0.6

Announce of Kronolith H3 (2.0.6) (final):

This [2.0.6] is a security release that fixes cross site scripting vulnerabilities in several of the calendar name and event data fields. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Kronolith 2.0.5 upgrade to 2.0.6 as soon as possible.

http://marc.theaimsgroup.com/?l=kronolith&m=113433029822279&w=2 2005-12-11 2005-12-11
horde -- Cross site scripting vulnerabilities in several of Horde's templates horde horde-php5 3.0.8

Announce of Horde H3 3.0.8 (final):

This [3.0.8] is a security release that fixes cross site scripting vulnerabilities in several of Horde's templates. None of the vulnerabilities can be exploited by unauthenticated users; however, we strongly recommend that all users of Horde 3.0.7 upgrade to 3.0.8 as soon as possible.

http://marc.theaimsgroup.com/?l=horde-announce&m=113433346726097&w=2 2005-12-11 2005-12-11
curl -- URL buffer overflow vulnerability curl 7.11.27.15.1

A Project cURL Security Advisory reports:

libcurl's URL parser function can overflow a malloced buffer in two ways, if given a too long URL.

1 - pass in a URL with no protocol (like "http://") prefix, using no slash and the string is 256 bytes or longer. This leads to a single zero byte overflow of the malloced buffer.

2 - pass in a URL with only a question mark as separator (no slash) between the host and the query part of the URL. This leads to a single zero byte overflow of the malloced buffer.

Both overflows can be made with the same input string, leading to two single zero byte overwrites.

The affected flaw cannot be triggered by a redirect, but the long URL must be passed in "directly" to libcurl. It makes this a "local" problem. Of course, lots of programs may still pass in user-provided URLs to libcurl without doing much syntax checking of their own, allowing a user to exploit this vulnerability.

15756 CVE-2005-4077 http://curl.haxx.se/docs/adv_20051207.html http://www.hardened-php.net/advisory_242005.109.html http://secunia.com/advisories/17907/ 2005-12-07 2005-12-09 2006-01-01
phpmyadmin -- register_globals emulation "import_blacklist" manipulation phpMyAdmin 2.7.0.1

Secunia reports:

Stefan Esser has reported a vulnerability in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks, disclose sensitive information, and compromise a vulnerable system.

The vulnerability is caused due to an error in the register_globals emulation layer in "grab_globals.php" where the "import_blacklist" variable is not properly protected from being overwritten. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site, and include arbitrary files from external and local resources.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9 http://www.hardened-php.net/advisory_252005.110.html http://secunia.com/advisories/17925/ 2005-12-07 2005-12-07
phpmyadmin -- XSS vulnerabilities phpMyAdmin 2.7.0

A phpMyAdmin security advisory reports:

It was possible to conduct an XSS attack via the HTTP_HOST variable; also, some scripts in the libraries directory that handle header generation were vulnerable to XSS.

CVE-2005-3665 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8 http://secunia.com/advisories/17895/ 2005-12-05 2005-12-07
ffmpeg -- libavcodec buffer overflow vulnerability ffmpeg 0.4.9.p1_4 ffmpeg-devel 0.4.9.c.2005120600

Secunia reports:

Simon Kilvington has reported a vulnerability in FFmpeg libavcodec, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system.

The vulnerability is caused due to a boundary error in the "avcodec_default_get_buffer()" function of "utils.c" in libavcodec. This can be exploited to cause a heap-based buffer overflow when a specially-crafted 1x1 ".png" file containing a palette is read.

http://article.gmane.org/gmane.comp.video.ffmpeg.devel/26558 http://secunia.com/advisories/17892/ 2005-11-30 2005-12-07
trac -- search module SQL injection vulnerability trac 0.9.2

Secunia reports:

A vulnerability has been reported in Trac, which can be exploited by malicious people to conduct SQL injection attacks.

Some unspecified input passed in the search module isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

http://projects.edgewall.com/trac/wiki/ChangeLog#a0.9.2 http://secunia.com/advisories/17894/ 2005-12-05 2005-12-07
drupal -- multiple vulnerabilities drupal 4.6.4

Secunia reports:

Some vulnerabilities have been reported in Drupal, which can be exploited by malicious people to bypass certain security restrictions, and conduct script insertion and HTTP response splitting attacks.

1) An input validation error in the filtering of HTML code can be exploited to inject arbitrary JavaScript code in submitted content, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed. Successful exploitation requires that the user has access to the full HTML input format. Ref: sa-2005-007

2) An input validation error in the attachment handling can be exploited to upload a malicious image with embedded HTML and script content, which will be executed in a user's browser session in context of an affected site when viewed directly with the Microsoft Internet Explorer browser. This can also be exploited to inject arbitrary HTTP headers, which will be included in the response sent to the user. Ref: sa-2005-008

3) The problem is that it is possible to bypass the "access user profile" permission. However, this cannot be exploited to modify data. Successful exploitation requires that the server runs PHP 5. Ref: sa-2005-009

http://drupal.org/files/sa-2005-007/advisory.txt http://drupal.org/files/sa-2005-008/advisory.txt http://drupal.org/files/sa-2005-009/advisory.txt http://secunia.com/advisories/17824/ 2005-12-01 2005-12-01
opera -- multiple vulnerabilities linux-opera opera-devel opera 8.51

Opera reports:

It is possible to make a form input that looks like an image link. If the form input has a "title" attribute, the status bar will show the "title". A "title" which looks like a URL can mislead the user, since the title can say http://nice.familiar.com/, while the form action can be something else.

Opera's tooltip says "Title:" before the title text, making a spoof URL less convincing. A user who has enabled the status bar and disabled tooltips can be affected by this. Neither of these settings are Opera's defaults.

This exploit is mostly of interest to users who disable JavaScript. If JavaScript is enabled, any link target or form action can be overridden by the script. The tooltip and the statusbar can only be trusted to show the true location if JavaScript is disabled.

Java code using LiveConnect methods to remove a property of a JavaScript object may in some cases use null pointers that can make Opera crash. This crash is not exploitable and such code is rare on the web.

CVE-2005-3699 http://secunia.com/advisories/17571/ http://www.opera.com/support/search/supsearch.dml?index=817 http://www.opera.com/support/search/supsearch.dml?index=819 2005-11-16 2005-11-30
opera -- command line URL shell command injection linux-opera opera-devel opera 8.51

An Opera Advisory reports:

Opera for UNIX uses a wrapper shell script to start up Opera. This shell script reads the input arguments, like the file names or URLs that Opera is to open. It also performs some environment checks, for example whether Java is available and if so, where it is located.

This wrapper script can also run commands embedded in the URL, so that a specially crafted URL can make arbitrary commands run on the recipient's machine. Users who have other programs set up to use Opera to open Web links are vulnerable to this flaw. For these users, clicking a Web link in for example OpenOffice.org or Evolution can run a command that was put into the link.

15521 CVE-2005-3750 http://secunia.com/secunia_research/2005-57/advisory/ http://www.opera.com/support/search/supsearch.dml?index=818 2005-11-17 2005-11-30
mambo -- "register_globals" emulation layer overwrite vulnerability mambo 4.5.3

A Secunia Advisory reports:

peter MC tachatte has discovered a vulnerability in Mambo, which can be exploited by malicious people to manipulate certain information and compromise a vulnerable system.

The vulnerability is caused due to an error in the "register_globals" emulation layer in "globals.php" where certain arrays used by the system can be overwritten. This can be exploited to include arbitrary files from external and local resources via the "mosConfig_absolute_path" parameter.

Successful exploitation requires that "register_globals" is disabled.

http://www.mamboserver.com/index.php?option=com_content&task=view&id=172&Itemid=1 http://secunia.com/advisories/17622/ 2005-11-17 2005-11-30
ghostscript -- insecure temporary file creation vulnerability ghostscript-gnu ghostscript-gnu-nox11 7.07_14 ghostscript-afpl ghostscript-afpl-nox11 8.53_1

Ghostscript is affected by an insecure temporary file creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the existence of a file before writing to it.

An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly this issue is unlikely to facilitate privilege escalation.

11285 CVE-2004-0967 2004-10-19 2005-11-27
horde -- Cross site scripting vulnerabilities in MIME viewers horde horde-php5 3.0.7

Announce of Horde 3.0.7 (final):

This [3.0.7] is a security release that fixes cross site scripting vulnerabilities in two of Horde's MIME viewers. These holes could for example be exploited by an attacker sending specially crafted emails to Horde's webmail client IMP. The attack could be used to steal users' identity information, taking over users' sessions, or changing users' settings.

As a hotfix the css and tgz MIME drivers can be disabled by removing their entries from the $mime_drivers_map['horde']['registered'] list in horde/config/mime_drivers.php.

15535 CVE-2005-3759 http://lists.horde.org/archives/announce/2005/000232.html 2005-11-22 2005-11-22 2005-11-26
phpmyadmin -- HTTP Response Splitting vulnerability phpMyAdmin 2.6.4.4

A phpMyAdmin security advisory reports:

Some scripts in phpMyAdmin are vulnerable to an HTTP Response Splitting attack.

Severity:

We consider these vulnerabilities to be serious. However, they can only be triggered on systems running with register_globals = on.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6 http://secunia.com/advisories/17578/ http://www.fitsec.com/advisories/FS-05-02.txt 2005-11-15 2005-11-16
phpSysInfo -- "register_globals" emulation layer overwrite vulnerability phpSysInfo 2.5.1

A Secunia Advisory reports:

Christopher Kunz has reported a vulnerability in phpSysInfo, which can be exploited by malicious people to manipulate certain information.

The vulnerability is caused due to an error in the "register_globals" emulation layer where certain arrays used by the system can be overwritten. This can be exploited to execute arbitrary HTML and script code in a user's browser session and include arbitrary files from local resources.

http://www.hardened-php.net/advisory_222005.81.html http://secunia.com/advisories/17441/ 2005-11-10 2005-11-13 2005-12-25
Macromedia flash player -- swf file handling arbitrary code linux-flashplugin6 6.0r79_3 linux-flashplugin7 7.0r61

A Secunia Advisory reports:

A vulnerability has been reported in Macromedia Flash Player, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to missing validation of the frame type identifier that is read from a SWF file. This value is used as an index in Flash.ocx to reference an array of function pointers. This can be exploited via a specially crafted SWF file to cause the index to reference memory that is under the attacker's control, which causes Flash Player to use attacker supplied values as function pointers.

Successful exploitation allows execution of arbitrary code.

http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html http://secunia.com/advisories/17430/ http://www.eeye.com/html/research/advisories/AD20051104.html 2005-06-27 2005-11-13
flyspray -- cross-site scripting vulnerabilities flyspray 0.9.8

A Secunia Advisory reports:

Lostmon has reported some vulnerabilities in Flyspray, which can be exploited by malicious people to conduct cross-site scripting attacks.

Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

15209 http://secunia.com/advisories/17316/ http://lostmon.blogspot.com/2005/10/flyspray-bug-killer-multiple-variable.html 2005-10-26 2005-11-10 2005-11-29
p5-Mail-SpamAssassin -- long message header denial of service p5-Mail-SpamAssassin 3.1.0

A Secunia Advisory reports:

A vulnerability has been reported in SpamAssassin, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to the use of an inefficient regular expression in "/SpamAssassin/Message.pm" to parse email headers. This can cause perl to crash when it runs out of stack space and can be exploited via a malicious email that contains a large number of recipients.

http://secunia.com/advisories/17386/ http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570 2005-11-10 2005-11-10
qpopper -- multiple privilege escalation vulnerabilities qpopper 4.04.0.5

Jens Steube reports that qpopper is vulnerable to a privilege escalation vulnerability. qpopper does not properly drop root privileges so that user supplied configuration and trace files can be processed with root privileges. This could allow a local attacker to create or modify arbitrary files.

qpopper is also affected by improper umask settings which could allow users to create group or world-writeable files, possibly allowing an attacker to overwrite arbitrary files.

CVE-2005-1151 CVE-2005-1152 http://secunia.com/advisories/15475/ 2005-05-26 2005-11-07 2005-11-26
pear-PEAR -- PEAR installer arbitrary code execution vulnerability pear-PEAR 1.4.3

Gregory Beaver reports:

A standard feature of the PEAR installer implemented in all versions of PEAR can lead to the execution of arbitrary PHP code upon running the "pear" command or loading the Web/Gtk frontend.

To be vulnerable, a user must explicitly install a publicly released malicious package using the PEAR installer, or explicitly install a package that depends on a malicious package.

http://pear.php.net/advisory-20051104.txt 2005-11-01 2005-11-04
openvpn -- potential denial-of-service on servers in TCP mode openvpn 2.02.0.4

James Yonan reports:

If the TCP server accept() call returns an error status, the resulting exception handler may attempt to indirect through a NULL pointer, causing a segfault. Affects all OpenVPN 2.0 versions.

CVE-2005-3409 http://openvpn.net/changelog.html 2005-11-01 2005-11-01 2005-11-04
openvpn -- arbitrary code execution on client through malicious or compromised server openvpn 2.02.0.4

James Yonan reports:

A format string vulnerability in the foreign_option function in options.c could potentially allow a malicious or compromised server to execute arbitrary code on the client. Only non-Windows clients are affected. The vulnerability only exists if (a) the client's TLS negotiation with the server succeeds, (b) the server is malicious or has been compromised such that it is configured to push a maliciously crafted options string to the client, and (c) the client indicates its willingness to accept pushed options from the server by having "pull" or "client" in its configuration file (Credit: Vade79).

CVE-2005-3393 http://www.securityfocus.com/archive/1/415293/30/0/threaded http://openvpn.net/changelog.html 2005-10-31 2005-11-01 2005-11-04
PHP -- multiple vulnerabilities mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.4.1 mod_php mod_php4 44.4.1,1

A Secunia Advisory reports:

Some vulnerabilities have been reported in PHP, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, and potentially compromise a vulnerable system.

http://secunia.com/advisories/17371/ 2005-10-31 2005-11-01
skype -- multiple buffer overflow vulnerabilities skype 1.2.0.18

A Secunia Advisory reports:

Some vulnerabilities have been reported in Skype, which can be exploited by malicious people to cause a DoS or to compromise a user's system.

CVE-2005-3265 CVE-2005-3267 930345 668193 http://secunia.com/advisories/17305/ http://skype.com/security/skype-sb-2005-02.html http://skype.com/security/skype-sb-2005-03.html 2005-10-25 2005-11-01 2005-11-02
squid -- FTP server response handling denial of service squid 2.5.11_3

A Secunia Advisory reports:

M.A.Young has reported a vulnerability in Squid, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in handling certain FTP server responses. This can be exploited to crash Squid by visiting a malicious FTP server via the proxy.

CVE-2005-3258 http://secunia.com/advisories/17271/ 2005-10-19 2005-11-01
base -- PHP SQL injection vulnerability base 1.2.1

A Secunia Advisory reports:

Remco Verhoef has discovered a vulnerability in Basic Analysis and Security Engine (BASE), which can be exploited by malicious users to conduct SQL injection attacks.

15199 http://secunia.com/advisories/17314/ 2005-10-25 2005-10-31
fetchmail -- fetchmailconf local password exposure fetchmail 6.2.5.2_1

The fetchmail team reports:

The fetchmailconf program before and excluding version 1.49 opened the run control file, wrote the configuration to it, and only then changed the mode to 0600 (rw-------). Writing the file, which usually contains passwords, before making it unreadable to other users, can expose sensitive password information.

CVE-2005-3088 http://www.fetchmail.info/fetchmail-SA-2005-02.txt 2005-10-21 2005-10-30
lynx -- remote buffer overflow lynx ja-lynx 2.8.5_1 2.8.6*2.8.6d14 lynx-ssl 2.8.5_1

Ulf Härnhammar reports:

When Lynx connects to an NNTP server to fetch information about the available articles in a newsgroup, it will call a function called HTrjis() with the information from certain article headers. The function adds missing ESC characters to certain data, to support Asian character sets. However, it does not check if it writes outside of the char array buf, and that causes a remote stack-based buffer overflow.

CVE-2005-3120 http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html 2005-10-17 2005-10-30 2006-10-05
ruby -- vulnerability in the safe level settings ruby ruby_static 1.6.*1.6.8.2004.07.28_2 1.8.*1.8.2_5

Ruby home page reports:

The Object Oriented Scripting Language Ruby supports safely executing an untrusted code with two mechanisms: safe level and taint flag on objects.

A vulnerability has been found that allows bypassing these mechanisms.

By using the vulnerability, arbitrary code can be executed beyond the restrictions specified in each safe level. Therefore, Ruby has to be updated on all systems that use safe level to execute untrusted code.

CVE-2005-2337 http://www.ruby-lang.org/en/20051003.html 2005-10-02 2005-10-27
xloadimage -- buffer overflows in NIFF image title handling xloadimage 4.1.15 xli 1.17.0_4

Ariel Berkman reports:

Unlike most of the supported image formats in xloadimage, the NIFF image format can store a title name of arbitrary length as part of the image file.

When xloadimage is processing a loaded image, it is creating a new Image object and then writing the processed image to it. At that point, it will also copy the title from the old image to the newly created image.

The 'zoom', 'reduce', and 'rotate' functions are using a fixed length buffer to construct the new title name when an image processing is done. Since the title name in a NIFF format is of varying length, and there are insufficient buffer size validations, the buffer can be overflowed.

15051 CVE-2005-3178 http://marc.theaimsgroup.com/?l=bugtraq&m=112862493918840&w=2 2005-10-05 2005-10-20 2005-10-23
snort -- Back Orifice preprocessor buffer overflow vulnerability snort 2.4.02.4.3

Jennifer Steffens reports:

The Back Orifice preprocessor contains a stack-based buffer overflow. This vulnerability could be leveraged by an attacker to execute code remotely on a Snort sensor where the Back Orifice preprocessor is enabled. However, there are a number of factors that make remote code execution difficult to achieve across different builds of Snort on different platforms, even on the same platform with different compiler versions, and it is more likely that an attacker could use the vulnerability as a denial of service attack.

The Back Orifice preprocessor can be disabled by commenting out the line "preprocessor bo" in snort.conf. This can be done in any text editor using the following procedure:

  1. Locate the line "preprocessor bo"
  2. Comment out this line by preceding it with a hash (#). The new line will look like "#preprocessor bo"
  3. Save the file
  4. Restart snort
175500 http://www.snort.org/pub-bin/snortnews.cgi#99 http://xforce.iss.net/xforce/alerts/id/207 2005-10-18 2005-10-18
WebCalendar -- remote file inclusion vulnerability WebCalendar 1.0.1

WebCalendar is proven vulnerable to a remote file inclusion vulnerability. The send_reminders.php does not properly verify the "includedir" parameter, giving remote attackers the possibility to include local and remote files. These files can be used by the attacker to gain access to the system.

14651 CVE-2005-2717 http://sourceforge.net/forum/forum.php?thread_id=1342085&forum_id=11587 2005-08-26 2005-10-15 2005-11-08
gallery2 -- file disclosure vulnerability gallery2 2.0.1

Michael Dipper wrote:

A vulnerability has been discovered in gallery, which allows remote users unauthorized access to files on the webserver.

A remote user accessing gallery over the web may use specially crafted HTTP parameters to access arbitrary files located on the webserver. All files readable by the webserver process are subject to disclosure. The vulnerability is *not* restricted to the webserver's document root but extends to the whole server file space.

The vulnerability may be used by any anonymous user, there is no login to the application required.

15108 CVE-2005-3251 http://dipper.info/security/20051012/ 2005-10-12 2005-10-15 2005-11-08
openssl -- potential SSL 2.0 rollback openssl openssl-overwrite-base 0.9.7g 0.9.80.9.8_1 0.9.*_200503250.9.*_20051011 openssl-beta openssl-beta-overwrite-base 0.9.8_1 0.9.*_200503250.9.*_20051011 compat5x-alpha compat5x-amd64 compat5x-i386 compat5x-sparc64 5.4.0.8 FreeBSD 4.10_19 4.114.11_13 5.35.3_23 5.45.4_8

Vulnerability:

Such applications are affected if they use the option SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of SSL_OP_ALL, which is intended to work around various bugs in third-party software that might prevent interoperability. The SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in the SSL 2.0 server supposed to prevent active protocol-version rollback attacks. With this verification step disabled, an attacker acting as a "man in the middle" can force a client and a server to negotiate the SSL 2.0 protocol even if these parties both support SSL 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe cryptographic weaknesses and is supported as a fallback only.

Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor SSL_OP_ALL are not affected. Also, applications that disable use of SSL 2.0 are not affected.

SA-05:21.openssl CVE-2005-2969 http://www.openssl.org/news/secadv_20051011.txt 2005-10-11 2005-10-12 2005-10-25
phpmyadmin -- local file inclusion vulnerability phpMyAdmin 2.6.4.r12.6.4.1

A phpMyAdmin security announcement reports:

In libraries/grab_globals.lib.php, the $__redirect parameter was not correctly validated, opening the door to a local file inclusion attack.

We consider this vulnerability to be serious.

15053 http://marc.theaimsgroup.com/?l=bugtraq&m=112907764728209 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4 2005-10-11 2005-10-11 2005-10-13
zope -- expose RestructuredText functionality to untrusted users zope 2.6.02.7.8 2.8.02.8.1_2

A Zope Hotfix Alert reports:

This hotfix resolves a security issue with docutils.

Affected are possibly all Zope instances that expose RestructuredText functionalies to untrusted users through the web.

CVE-2005-3323 15082 http://www.zope.org/Products/Zope/Hotfix_2005-10-09/security_alert 2005-10-09 2005-10-11 2005-11-28
libxine -- format string vulnerability libxine 1.1.0_1

Gentoo Linux Security Advisory reports:

Ulf Harnhammar discovered a format string bug in the routines handling CDDB server response contents.

An attacker could submit malicious information about an audio CD to a public CDDB server (or impersonate a public CDDB server). When the victim plays this CD on a multimedia frontend relying on xine-lib, it could end up executing arbitrary code.

CVE-2005-2967 http://www.gentoo.org/security/en/glsa/glsa-200510-08.xml http://xinehq.de/index.php/security/XSA-2005-1 2005-10-08 2005-10-09
imap-uw -- mailbox name handling remote buffer vulnerability imap-uw 2004g

FrSIRT reports:

A vulnerability has been identified in UW-IMAP, which could be exploited by remote attackers to execute arbitrary commands. This flaw is due to a stack overflow error in the "mail_valid_net_parse_work()" [src/c-client/mail.c] function that does not properly handle specially crafted mailbox names containing a quote (") character, which could be exploited by authenticated remote attackers to execute arbitrary commands with the privileges of the IMAP server.

CVE-2005-2933 http://www.frsirt.com/english/advisories/2005/1953 http://www.idefense.com/application/poi/display?id=313&type=vulnerabilities http://www.washington.edu/imap/documentation/RELNOTES.html 2005-10-05 2005-10-05
weex -- remote format string vulnerability weex 2.6.1.5_1

Emanuel Haupt reports:

Someone who controls an FTP server that weex will log in to can set up malicious data in the account that weex will use, and that will cause a format string bug that will allow remote code execution. It will only happen when weex is first run or when its cache files are rebuilt with the -r option, though. The vulnerability was found by Ulf Harnhammar.

ports/86833 2005-10-02 2005-10-02
picasm -- buffer overflow vulnerability picasm 1.12c

Shaun Colley reports:

When generating error and warning messages, picasm copies strings into fixed length buffers without bounds checking.

If an attacker could trick a user into assembling a source file with a malformed 'error' directive, arbitrary code could be executed with the privileges of the user. This could result in full system compromise.

13698 CVE-2005-1679 http://marc.theaimsgroup.com/?l=bugtraq&m=111661253517089 2005-05-20 2005-10-02
uim -- privilege escalation vulnerability ja-uim 0.4.9.1

The uim developers reports:

Masanari Yamamoto discovered that incorrect use of environment variables in uim. This bug causes privilege escalation if setuid/setgid applications was linked to libuim.

This bug appears in 'immodule for Qt' enabled Qt. (Normal Qt is also safe.) In some distribution, mlterm is also an setuid/setgid application.

http://lists.freedesktop.org/archives/uim/2005-September/001346.html 2005-09-28 2005-10-01
cfengine -- arbitrary file overwriting vulnerability cfengine 2.1.6_1 cfengine2 0

A Debian Security Advisory reports:

Javier Fernández-Sanguino Peña discovered several insecure temporary file uses in cfengine, a tool for configuring and maintaining networked machines, that can be exploited by a symlink attack to overwrite arbitrary files owned by the user executing cfengine, which is probably root.

CVE-2005-2960 14994 http://www.debian.org/security/2005/dsa-835 http://www.debian.org/security/2005/dsa-836 2005-10-01 2005-10-01 2005-10-07
clamav -- arbitrary code execution and DoS vulnerabilities clamav 0.87 clamav-devel 20050917

Gentoo Linux Security Advisory reports:

Clam AntiVirus is vulnerable to a buffer overflow in "libclamav/upx.c" when processing malformed UPX-packed executables. It can also be sent into an infinite loop in "libclamav/fsg.c" when processing specially-crafted FSG-packed executables.

By sending a specially-crafted file an attacker could execute arbitrary code with the permissions of the user running Clam AntiVirus, or cause a Denial of Service.

363713 CVE-2005-2919 CVE-2005-2920 http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml 2005-09-16 2005-09-24 2005-10-22
firefox & mozilla -- multiple vulnerabilities firefox 1.0.7,1 linux-firefox 1.0.7 mozilla 1.7.12,2 1.8.*,2 linux-mozilla 1.7.12 linux-mozilla-devel 0 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports of multiple issues:

Heap overrun in XBM image processing

jackerror reports that an improperly terminated XBM image ending with space characters instead of the expected end tag can lead to a heap buffer overrun. This appears to be exploitable to install or run malicious code on the user's machine.

Thunderbird does not support the XBM format and is not affected by this flaw.

Crash on "zero-width non-joiner" sequence

Mats Palmgren discovered that a reported crash on Unicode sequences with "zero-width non-joiner" characters was due to stack corruption that may be exploitable.

XMLHttpRequest header spoofing

It was possible to add illegal and malformed headers to an XMLHttpRequest. This could have been used to exploit server or proxy flaws from the user's machine, or to fool a server or proxy into thinking a single request was a stream of separate requests. The severity of this vulnerability depends on the value of servers which might be vulnerable to HTTP request smuggling and similar attacks, or which share an IP address (virtual hosting) with the attacker's page.

For users connecting to the web through a proxy this flaw could be used to bypass the same-origin restriction on XMLHttpRequests by fooling the proxy into handling a single request as multiple pipe-lined requests directed at arbitrary hosts. This could be used, for example, to read files on intranet servers behind a firewall.

Object spoofing using XBL <implements>

moz_bug_r_a4 demonstrated a DOM object spoofing bug similar to MFSA 2005-55 using an XBL control that <implements> an internal interface. The severity depends on the version of Firefox: investigation so far indicates Firefox 1.0.x releases don't expose any vulnerable functionality to interfaces spoofed in this way, but that early Deer Park Alpha 1 versions did.

XBL was changed to no longer allow unprivileged controls from web content to implement XPCOM interfaces.

JavaScript integer overflow

Georgi Guninski reported an integer overflow in the JavaScript engine. We presume this could be exploited to run arbitrary code under favorable conditions.

Privilege escalation using about: scheme

heatsync and shutdown report two different ways to bypass the restriction on loading high privileged "chrome" pages from an unprivileged "about:" page. By itself this is harmless--once the "about" page's privilege is raised the original page no longer has access--but should this be combined with a same-origin violation this could lead to arbitrary code execution.

Chrome window spoofing

moz_bug_r_a4 demonstrates a way to get a blank "chrome" canvas by opening a window from a reference to a closed window. The resulting window is not privileged, but the normal browser UI is missing and can be used to construct a spoof page without any of the safety features of the browser chrome designed to alert users to phishing sites, such as the address bar and the status bar.

CVE-2005-2701 CVE-2005-2702 CVE-2005-2703 CVE-2005-2704 CVE-2005-2705 CVE-2005-2706 CVE-2005-2707 http://www.mozilla.org/security/announce/mfsa2005-58.html 2005-09-22 2005-09-23 2005-10-26
firefox & mozilla -- command line URL shell command injection firefox 1.0.7,1 linux-firefox 1.0.7 mozilla 1.7.12,2 1.8.*,2 linux-mozilla 1.7.12 linux-mozilla-devel 0 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Secunia Advisory reports:

Peter Zelezny has discovered a vulnerability in Firefox, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the shell script used to launch Firefox parsing shell commands that are enclosed within backticks in the URL provided via the command line. This can e.g. be exploited to execute arbitrary shell commands by tricking a user into following a malicious link in an external application which uses Firefox as the default browser.

CVE-2005-2968 https://bugzilla.mozilla.org/show_bug.cgi?id=307185 http://secunia.com/advisories/16869/ http://www.mozilla.org/security/announce/mfsa2005-59.html 2005-09-06 2005-09-22 2005-10-26
apache -- Certificate Revocation List (CRL) off-by-one vulnerability apache 2.*2.0.54_1

Marc Stern reports an off-by-one vulnerability in within mod_ssl. The vulnerability lies in mod_ssl's Certificate Revocation List (CRL). If Apache is configured to use a CRL this could allow an attacker to crash a child process causing a Denial of Service.

14366 CVE-2005-1268 2005-07-12 2005-09-17
squirrelmail -- _$POST variable handling allows for various attacks squirrelmail ja-squirrelmail 1.4.01.4.5

A Squirrelmail Advisory reports:

An extract($_POST) was done in options_identities.php which allowed for an attacker to set random variables in that file. This could lead to the reading (and possible writing) of other people's preferences, cross site scripting or writing files in webserver-writable locations.

14254 CVE-2005-2095 http://www.squirrelmail.org/security/issue/2005-07-13 2005-07-13 2005-09-17 2005-09-19
X11 server -- pixmap allocation vulnerability XFree86-Server 4.5.0_2 xorg-server 6.8.2_5 6.8.996.8.99.12_1

Allocating large pixmaps by a client can trigger an integer overflow in the X server, potentially leading to execution of arbitrary code with elevated (root) privileges.

14807 102441 CVE-2005-2495 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166856 https://bugs.freedesktop.org/show_bug.cgi?id=594 2005-09-12 2005-09-15
unzip -- permission race vulnerability unzip zh-unzip ko-unzip 5.52_2

Imran Ghory reports a vulnerability within unzip. The vulnerability is caused by a race condition between extracting an archive and changing the permissions of the extracted files. This would give an attacker enough time to remove a file and hardlink it to another file owned by the user running unzip. When unzip changes the permissions of the file it could give the attacker access to files that normally would not have been accessible for others.

14450 CVE-2005-2475 http://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117 2005-08-02 2005-09-13
firefox & mozilla -- buffer overflow vulnerability firefox 1.0.6_5,1 linux-firefox 1.0.7 mozilla 1.7.11_1,2 1.8.*,21.8.b1_5,2 linux-mozilla 1.7.12 linux-mozilla-devel 0 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

Tom Ferris reports:

A buffer overflow vulnerability exists within Firefox version 1.0.6 and all other prior versions which allows for an attacker to remotely execute arbitrary code on an affected host.

The problem seems to be when a hostname which has all dashes causes the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true, but is sets encHost to an empty string. Meaning, Firefox appends 0 to approxLen and then appends the long string of dashes to the buffer instead.

Note: It is possible to disable IDN support as a workaround to protect against this buffer overflow. How to do this is described on the What Firefox and Mozilla users should know about the IDN buffer overflow security issue web page.

14784 573857 CVE-2005-2871 http://marc.theaimsgroup.com/?l=full-disclosure&m=112624614008387 http://www.mozilla.org/security/idn.html https://bugzilla.mozilla.org/show_bug.cgi?id=307259 http://www.mozilla.org/security/announce/mfsa2005-57.html 2005-09-08 2005-09-10 2005-10-26
htdig -- cross site scripting vulnerability htdig 3.2.0.b6_1

Michael Krax reports a vulnerability within htdig. The vulnerability lies within an unsanitized config parameter, allowing a malicious attacker to execute arbitrary scripting code on the target's browser. This might allow the attacker to obtain the user's cookies which are associated with the site, including cookies used for authentication.

12442 CVE-2005-0085 http://www.securitytracker.com/alerts/2005/Feb/1013078.html 2005-02-03 2005-09-04 2005-09-13
squid -- Denial Of Service Vulnerability in sslConnectTimeout squid 2.5.10_5

The squid patches page notes:

After certain slightly odd requests Squid crashes with a segmentation fault in sslConnectTimeout.

14731 CVE-2005-2796 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-sslConnectTimeout http://www.squid-cache.org/bugs/show_bug.cgi?id=1355 http://secunia.com/advisories/16674/ 2005-07-21 2005-09-04 2005-10-02
squid -- Possible Denial Of Service Vulnerability in store.c squid 2.5.10_5

The squid patches page notes:

Squid crashes with the above assertion failure [assertion failed: store.c:523: "e->store_status == STORE_PENDING"] in certain conditions involving aborted requests.

14761 CVE-2005-2794 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-STORE_PENDING http://www.squid-cache.org/bugs/show_bug.cgi?id=1368 http://secunia.com/advisories/16708/ 2005-08-02 2005-09-04 2005-10-02
bind9 -- denial of service bind9 9.3.0 FreeBSD 5.35.3_16

Problem description

A DNSSEC-related validator function in BIND 9.3.0 contains an inappropriate internal consistency test. When this test is triggered, named(8) will exit.

Impact

On systems with DNSSEC enabled, a remote attacker may be able to inject a specially crafted packet that will cause the internal consistency test to trigger, and named(8) to terminate. As a result, the name server will no longer be available to service requests.

Workaround

DNSSEC is not enabled by default, and the "dnssec-enable" directive is not normally present. If DNSSEC has been enabled, disable it by changing the "dnssec-enable" directive to "dnssec-enable no;" in the named.conf(5) configuration file.

938617 CVE-2005-0034 http://www.uniras.gov.uk/niscc/docs/al-20050125-00060.html?lang=en http://www.isc.org/sw/bind/bind9.3.php#security 2005-01-25 2005-09-03
bind -- buffer overrun vulnerability bind84 8.4.48.4.6

An ISC advisory reports a buffer overrun vulnerability within bind. The vulnerability could result in a Denial of Service. A workaround is available by disabling recursion and glue fetching.

327633 CVE-2005-0033 http://www.uniras.gov.uk/niscc/docs/al-20050125-00059.html?lang=en http://www.isc.org/sw/bind/bind-security.php 2005-01-25 2005-09-03 2005-09-21
urban -- stack overflow vulnerabilities urban 1.5.3_2

Several filename-related stack overflow bugs allow a local attacker to elevate its privileges to the games group, since urban is installed setgid games.

Issue discovered and fixed by <shaun@rsc.cx>.

CVE-2005-2864 http://marc.theaimsgroup.com/?l=bugtraq&m=112604855119036 2005-09-02 2005-09-02 2005-09-22
fswiki -- command injection vulnerability fswiki 3.5.9

There is a command injection vulnerability in admin page of fswiki.

http://jvn.jp/jp/JVN%2342435855/index.html 2005-08-29 2005-08-29
evolution -- remote format string vulnerabilities evolution 1.52.2.3_1

A SITIC Vulnerability Advisory reports:

Evolution suffers from several format string bugs when handling data from remote sources. These bugs lead to crashes or the execution of arbitrary assembly language code.

  1. The first format string bug occurs when viewing the full vCard data attached to an e-mail message.
  2. The second format string bug occurs when displaying contact data from remote LDAP servers.
  3. The third format string bug occurs when displaying task list data from remote servers.
  4. The fourth, and least serious, format string bug occurs when the user goes to the Calendars tab to save task list data that is vulnerable to problem 3 above. Other calendar entries that do not come from task lists are also affected.
14532 CVE-2005-2549 CVE-2005-2550 http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html 2005-08-10 2005-08-27 2006-03-24
pam_ldap -- authentication bypass vulnerability pam_ldap 1.8.0

Luke Howard reports:

If a pam_ldap client authenticates against an LDAP server that returns a passwordPolicyResponse control, but omits the optional "error" field of the PasswordPolicyResponseValue, then the LDAP authentication result will be ignored and the authentication step will always succeed.

CVE-2005-2641 778916 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166163 2005-08-22 2005-08-27
pcre -- regular expression buffer overflow pcre pcre-utf8 6.2

The pcre library is vulnerable to a buffer overflow vulnerability due to insufficient validation of quantifier values. This could lead execution of arbitrary code with the permissions of the program using pcre by way of a specially crated regular expression.

14620 CVE-2005-2491 http://www.pcre.org/changelog.txt 2005-08-01 2005-08-26
elm -- remote buffer overflow in Expires header elm 2.5.8

Ulf Harnhammar has discovered a remotely exploitable buffer overflow in Elm e-mail client when parsing the Expires header of an e-mail message:

The attacker only needs to send the victim an e-mail message. When the victim with that message in his or her inbox starts Elm or simply views the inbox in an already started copy of Elm, the buffer overflow will happen immediately. The overflow is stack-based, and it gives full control over EIP, EBP and EBX. It is caused by a bad sscanf(3) call, using a format string containing "%s" to copy from a long char array to a shorter array.

http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html 2005-08-20 2005-08-23
openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server openvpn 2.0.1

James Yonan reports:

If two or more client machines try to connect to the server at the same time via TCP, using the same client certificate, and when --duplicate-cn is not enabled on the server, a race condition can crash the server with "Assertion failed at mtcp.c:411"

CVE-2005-2534 http://openvpn.net/changelog.html 2005-08-03 2005-08-19
openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory openvpn 2.0.1

James Yonan reports:

A malicious [authenticated] client in "dev tap" ethernet bridging mode could theoretically flood the server with packets appearing to come from hundreds of thousands of different MAC addresses, causing the OpenVPN process to deplete system virtual memory as it expands its internal routing table.

CVE-2005-2533 http://openvpn.net/changelog.html 2005-07-27 2005-08-19
openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients openvpn 2.0.1

James Yonan reports:

If the client sends a packet which fails to decrypt on the server, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client.

CVE-2005-2532 http://openvpn.net/changelog.html 2005-07-27 2005-08-19
openvpn -- denial of service: client certificate validation can disconnect unrelated clients openvpn 2.0.1

James Yonan reports:

DoS attack against server when run with "verb 0" and without "tls-auth". If a client connection to the server fails certificate verification, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client.

CVE-2005-2531 http://openvpn.net/changelog.html 2005-08-03 2005-08-19
tor -- diffie-hellman handshake flaw tor 0.1.0.14

A tor advisory reports

Tor clients can completely loose anonymity, confidentiality, and data integrity if the first Tor server in their path is malicious. Specifically, if the Tor client chooses a malicious Tor server for her first hop in the circuit, that server can learn all the keys she negotiates for the rest of the circuit (or just spoof the whole circuit), and then read and/or modify all her traffic over that circuit.

CVE-2005-2643 http://archives.seul.org/or/announce/Aug-2005/msg00002.html 2005-08-11 2005-08-17 2005-09-21
acroread -- plug-in buffer overflow vulnerability acroread 7.0.1 5.*,17.0.1,1 acroread4 acroread5 0 acroread7 7.0.1

A Adobe Security Advisory reports:

The identified vulnerability is a buffer overflow within a core application plug-in, which is part of Adobe Acrobat and Adobe Reader. If a malicious file were opened it could trigger a buffer overflow as the file is being loaded into Adobe Acrobat and Adobe Reader. A buffer overflow can cause the application to crash and increase the risk of malicious code execution.

CVE-2005-2470 http://www.adobe.com/support/techdocs/321644.html 2005-08-16 2005-08-16
pear-XML_RPC -- remote PHP code injection vulnerability pear-XML_RPC 1.4.0 phpmyfaq 1.4.11 drupal 4.6.3 eGroupWare 1.0.0.009 phpAdsNew 2.0.5 phpgroupware 0.9.16.007 b2evolution 0.9.0.12_2

A Hardened-PHP Project Security Advisory reports:

When the library parses XMLRPC requests/responses, it constructs a string of PHP code, that is later evaluated. This means any failure to properly handle the construction of this string can result in arbitrary execution of PHP code.

This new injection vulnerability is cause by not properly handling the situation, when certain XML tags are nested in the parsed document, that were never meant to be nested at all. This can be easily exploited in a way, that user-input is placed outside of string delimiters within the evaluation string, which obviously results in arbitrary code execution.

Note that several applications contains an embedded version on XML_RPC, therefor making them the vulnerable to the same code injection vulnerability.

CVE-2005-2498 http://b2evolution.net/news/2005/08/31/fix_for_xml_rpc_vulnerability_again_1 http://downloads.phpgroupware.org/changelog http://drupal.org/files/sa-2005-004/advisory.txt http://phpadsnew.com/two/nucleus/index.php?itemid=45 http://sourceforge.net/project/shownotes.php?release_id=349626 http://www.hardened-php.net/advisory_142005.66.html http://www.hardened-php.net/advisory_152005.67.html http://www.phpmyfaq.de/advisory_2005-08-15.php 2005-08-15 2005-08-15 2005-09-04
awstats -- arbitrary code execution vulnerability awstats 6.4_1

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation vulnerability in AWStats allows remote attackers to execute arbitrary commands.

The problem specifically exists because of insufficient input filtering before passing user-supplied data to an eval() function. As part of the statistics reporting function, AWStats displays information about the most common referrer values that caused users to visit the website. The referrer data is used without proper sanitation in an eval() statement, resulting in the execution of arbitrary perl code.

Successful exploitation results in the execution of arbitrary commands with permissions of the web service. Exploitation will not occur until the stats page has been regenerated with the tainted referrer values from the http access log. Note that AWStats is only vulnerable in situations where at least one URLPlugin is enabled.

CVE-2005-1527 http://marc.theaimsgroup.com/?l=full-disclosure&m=112377934108902 http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities 2005-08-09 2005-08-14 2005-08-23
libgadu -- multiple vulnerabilities gaim ja-gaim ko-gaim ru-gaim 1.4.0_1 kdenetwork 3.2.23.4.2 pl-ekg 1.6r3,1 centericq 4.21.0_1

Wojtek Kaniewski reports:

Multiple vulnerabilities have been found in libgadu, a library for handling Gadu-Gadu instant messaging protocol. It is a part of ekg, a Gadu-Gadu client, but is widely used in other clients. Also some of the user contributed scripts were found to behave in an insecure manner.

  • integer overflow in libgadu (CVE-2005-1852) that could be triggered by an incomming message and lead to application crash and/or remote code execution
  • insecure file creation (CVE-2005-1850) and shell command injection (CVE-2005-1851) in other user contributed scripts (discovered by Marcin Owsiany and Wojtek Kaniewski)
  • several signedness errors in libgadu that could be triggered by an incomming network data or an application passing invalid user input to the library
  • memory alignment errors in libgadu that could be triggered by an incomming message and lead to bus errors on architectures like SPARC
  • endianness errors in libgadu that could cause invalid behaviour of applications on big-endian architectures
14345 CVE-2005-1850 CVE-2005-1851 CVE-2005-1852 CVE-2005-2369 CVE-2005-2370 CVE-2005-2448 http://marc.theaimsgroup.com/?l=bugtraq&m=112198499417250 http://gaim.sourceforge.net/security/?id=20 http://www.kde.org/info/security/advisory-20050721-1.txt 2005-07-21 2005-08-12 2005-10-23
gaim -- AIM/ICQ non-UTF-8 filename crash gaim ja-gaim ko-gaim ru-gaim 1.4.0_1

The GAIM team reports:

A remote user could cause Gaim to crash on some systems by sending the Gaim user a file whose filename contains certain invalid characters. It is unknown what combination of systems are affected, but it is suspected that Windows users and systems with older versions of GTK+ are especially susceptible.

CVE-2005-2102 http://gaim.sourceforge.net/security/?id=21 2005-08-09 2005-08-12
gaim -- AIM/ICQ away message buffer overflow gaim ja-gaim ko-gaim ru-gaim 1.4.0_1

The GAIM team reports:

A remote AIM or ICQ user can cause a buffer overflow in Gaim by setting an away message containing many AIM substitution strings (such as %t or %n).

CVE-2005-2103 http://gaim.sourceforge.net/security/?id=22 2005-08-09 2005-08-12
xpdf -- disk fill DoS vulnerability xpdf 3.00_7 kdegraphics 3.4.2 gpdf 2.10.0_2 cups-base 1.1.23.0_5

xpdf is vulnerable to a denial of service vulnerability which can cause xpdf to create an infinitely large file, thereby filling up the /tmp partition, when opening a specially crafted PDF file.

Note that several applications contains an embedded version of xpdf, therefor making them the vulnerable to the same DoS. In CUPS this vulnerability would cause the pdftops filter to crash.

14529 CVE-2005-2097 http://rhn.redhat.com/errata/RHSA-2005-670.html http://www.kde.org/info/security/advisory-20050809-1.txt 2005-08-09 2005-08-12 2005-09-07
gforge -- XSS and email flood vulnerabilities gforge 0

Jose Antonio Coret reports that GForge contains multiple Cross Site Scripting vulnerabilities and an e-mail flood vulnerability:

The login form is also vulnerable to XSS (Cross Site Scripting) attacks. This may be used to launch phising attacks by sending HTML e-mails (i.e.: saying that you need to upgrade to the latest GForge version due to a security problem) and putting in the e-mail an HTML link that points to an specially crafted url that inserts an html form in the GForge login page and when the user press the login button, he/she send the credentials to the attackers website.

The 'forgot your password?' feature allows a remote user to load a certain URL to cause the service to send a validation e-mail to the specified user's e-mail address. There is no limit to the number of messages sent over a period of time, so a remote user can flood the target user's secondary e-mail address. E-Mail Flood, E-Mail bomber.

14405 CVE-2005-2430 CVE-2005-2431 http://marc.theaimsgroup.com/?l=bugtraq&m=112259845904350 2005-07-27 2005-08-09
postnuke -- multiple vulnerabilities postnuke 0.760

Postnuke Security Announcementss reports of the following vulnerabilities:

  • missing input validation within /modules/Messages/readpmsg.php
  • possible path disclosure within /user.php
  • possible path disclosure within /modules/News/article.php
  • possible remote code injection within /includes/pnMod.php
  • possible cross-site-scripting in /index.php
  • remote code injection via xml rpc library
CVE-2005-1621 CVE-2005-1695 CVE-2005-1696 CVE-2005-1698 CVE-2005-1777 CVE-2005-1778 CVE-2005-1921 http://marc.theaimsgroup.com/?l=bugtraq&m=111721364707520 http://secunia.com/advisories/15450/ http://news.postnuke.com/Article2691.html http://news.postnuke.com/Article2699.html 2005-05-27 2005-08-08
mambo -- multiple vulnerabilities mambo 4.5.2.3

A Secunia Advisory reports:

Some vulnerabilities have been reported in Mambo, where some have unknown impacts and others can be exploited by malicious people to conduct spoofing and SQL injection attacks.

  1. Input passed to the "user_rating" parameter when voting isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
  2. Some unspecified vulnerabilities in the "mosDBTable" class and the "DOMIT" library have an unknown impact.
  3. An unspecified error in the "administrator/index3.php" script can be exploited to spoof session IDs.
13966 CVE-2005-2002 http://secunia.com/advisories/15710/ 2005-06-15 2005-08-05
ipsec -- Incorrect key usage in AES-XCBC-MAC FreeBSD 5.45.4_6 5.*5.3_20

Problem description

A programming error in the implementation of the AES-XCBC-MAC algorithm for authentication resulted in a constant key being used instead of the key specified by the system administrator.

Impact

If the AES-XCBC-MAC algorithm is used for authentication in the absence of any encryption, then an attacker may be able to forge packets which appear to originate from a different system and thereby succeed in establishing an IPsec session. If access to sensitive information or systems is controlled based on the identity of the source system, this may result in information disclosure or privilege escalation.

CVE-2005-2359 SA-05:19.ipsec 2005-07-27 2005-08-05
zlib -- buffer overflow vulnerability linux_base-suse 9.3_1 FreeBSD 5.45.4_6 5.35.3_20

Problem description

A fixed-size buffer is used in the decompression of data streams. Due to erronous analysis performed when zlib was written, this buffer, which was belived to be sufficiently large to handle any possible input stream, is in fact too small.

Impact

A carefully constructed compressed data stream can result in zlib overwriting some data structures. This may cause applications to halt, resulting in a denial of service; or it may result in an attacker gaining elevated privileges.

CVE-2005-1849 SA-05:18.zlib 2005-07-27 2005-08-05 2005-09-24
devfs -- ruleset bypass FreeBSD 5.45.4_5 5.*5.3_19

Problem description

Due to insufficient parameter checking of the node type during device creation, any user can expose hidden device nodes on devfs mounted file systems within their jail. Device nodes will be created in the jail with their normal default access permissions.

Impact

Jailed processes can get access to restricted resources on the host system. For jailed processes running with superuser privileges this implies access to all devices on the system. This level of access can lead to information leakage and privilege escalation.

CVE-2005-2218 SA-05:17.devfs 2005-07-20 2005-08-05
proftpd -- format string vulnerabilities proftpd proftpd-mysql 1.3.0.rc2

The ProFTPD release notes states:

sean <infamous42md at hotpop.com> found two format string vulnerabilities, one in mod_sql's SQLShowInfo directive, and one involving the 'ftpshut' utility. Both can be considered low risk, as they require active involvement on the part of the site administrator in order to be exploited.

These vulnerabilities could potentially lead to information disclosure, a denial-of-server situation, or execution of arbitrary code with the permissions of the user running ProFTPD.

CVE-2005-2390 http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2 2005-07-26 2005-08-03
nbsmtp -- format string vulnerability nbsmtp 0.99_1

When nbsmtp is executed in debug mode, server messages will be printed to stdout and logged via syslog. Syslog is used insecurely and user-supplied format characters are directly fed to the syslog function, which results in a format string vulnerability.

Under some circumstances, an SMTP server may be able to abuse this vulnerability in order to alter the nbsmtp process and execute malicious code.

http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt 2005-07-25 2005-08-01
sylpheed -- MIME-encoded file name buffer overflow vulnerability sylpheed sylpheed-gtk2 sylpheed-claws 1.0.4

Sylpheed is vulnerable to a buffer overflow when displaying emails with attachments that have MIME-encoded file names. This could be used by a remote attacker to crash sylpheed potentially allowing execution of arbitrary code with the permissions of the user running sylpheed.

12934 CVE-2005-0926 http://sylpheed.good-day.net/changelog.html.en 2005-03-29 2005-07-31
phpmyadmin -- cross site scripting vulnerability phpmyadmin phpMyAdmin 2.6.2.r1

A phpMyAdmin security announcement reports:

The convcharset parameter was not correctly validated, opening the door to a XSS attack.

12982 CVE-2005-0992 http://marc.theaimsgroup.com/?l=bugtraq&m=111264361622660 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3 2005-04-03 2005-07-31
gnupg -- OpenPGP symmetric encryption vulnerability gnupg 1.4.1 p5-Crypt-OpenPGP 1.03 pgp 3.0

Serge Mister and Robert Zuccherato reports that the OpenPGP protocol is vulnerable to a cryptographic attack when using symmetric encryption in an automated way.

David Shaw reports about the impact:

This attack, while very significant from a cryptographic point of view, is not generally effective in the real world. To be specific, unless you have your OpenPGP program set up as part of an automated system to accept encrypted messages, decrypt them, and then provide a response to the submitter, then this does not affect you at all.

Note that the fix in GnuPG does note completely eliminate the potential problem:

These patches disable a portion of the OpenPGP protocol that the attack is exploiting. This change should not be user visible. With the patch in place, this attack will not work using a public-key encrypted message. It will still work using a passphrase-encrypted message.

303094 CVE-2005-0366 http://eprint.iacr.org/2005/033 http://lists.gnupg.org/pipermail/gnupg-announce/2005q1/000191.html http://www.pgp.com/newsroom/ctocorner/openpgp.html 2005-02-08 2005-07-31 2007-04-23
vim -- vulnerabilities in modeline handling: glob, expand vim vim-lite vim+ruby 6.36.3.82

Georgi Guninski discovered a way to construct Vim modelines that execute arbitrary shell commands. The vulnerability can be exploited by including shell commands in modelines that call the glob() or expand() functions. An attacker could trick an user to read or edit a trojaned file with modelines enabled, after which the attacker is able to execute arbitrary commands with the privileges of the user.

Note: It is generally recommended that VIM users use set nomodeline in ~/.vimrc to avoid the possibility of trojaned text files.

14374 CVE-2005-2368 http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html 2005-07-25 2005-07-31
tiff -- buffer overflow vulnerability tiff 3.7.3 linux-tiff 3.6.1_3 pdflib pdflib-perl 6.0.1_2 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

A Gentoo Linux Security Advisory reports:

Tavis Ormandy of the Gentoo Linux Security Audit Team discovered a stack based buffer overflow in the libTIFF library when reading a TIFF image with a malformed BitsPerSample tag.

Successful exploitation would require the victim to open a specially crafted TIFF image, resulting in the execution of arbitrary code.

CVE-2005-1544 http://bugzilla.remotesensing.org/show_bug.cgi?id=843 http://www.gentoo.org/security/en/glsa/glsa-200505-07.xml http://www.remotesensing.org/libtiff/v3.7.3.html 2005-05-10 2005-07-30 2006-06-08
opera -- image dragging vulnerability linux-opera opera-devel opera 8.02

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to conduct cross-site scripting attacks and retrieve a user's files.

The vulnerability is caused due to Opera allowing a user to drag e.g. an image, which is actually a "javascript:" URI, resulting in cross-site scripting if dropped over another site. This may also be used to populate a file upload form, resulting in uploading of arbitrary files to a malicious web site.

Successful exploitation requires that the user is tricked into dragging and dropping e.g. an image or a link.

http://secunia.com/advisories/15756/ http://www.opera.com/freebsd/changelogs/802/ 2005-07-28 2005-07-30 2006-06-08
opera -- download dialog spoofing vulnerability linux-opera opera-devel opera 8.02

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to trick users into executing malicious files.

The vulnerability is caused due to an error in the handling of extended ASCII codes in the download dialog. This can be exploited to spoof the file extension in the file download dialog via a specially crafted "Content-Disposition" HTTP header.

Successful exploitation may result in users being tricked into executing a malicious file via the download dialog, but requires that the "Arial Unicode MS" font (ARIALUNI.TTF) has been installed on the system.

http://secunia.com/advisories/15870/ http://www.opera.com/freebsd/changelogs/802/ 2005-07-28 2005-07-30
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.50.10.12

An Ethreal Security Advisories reports:

Our testing program has turned up several more security issues:

  • The LDAP dissector could free static memory and crash.
  • The AgentX dissector could crash.
  • The 802.3 dissector could go into an infinite loop.
  • The PER dissector could abort.
  • The DHCP dissector could go into an infinite loop.
  • The BER dissector could abort or loop infinitely.
  • The MEGACO dissector could go into an infinite loop.
  • The GIOP dissector could dereference a null pointer.
  • The SMB dissector was susceptible to a buffer overflow.
  • The WBXML could dereference a null pointer.
  • The H1 dissector could go into an infinite loop.
  • The DOCSIS dissector could cause a crash.
  • The SMPP dissector could go into an infinite loop.
  • SCTP graphs could crash.
  • The HTTP dissector could crash.
  • The SMB dissector could go into a large loop.
  • The DCERPC dissector could crash.
  • Several dissectors could crash while reassembling packets.

Steve Grubb at Red Hat found the following issues:

  • The CAMEL dissector could dereference a null pointer.
  • The DHCP dissector could crash.
  • The CAMEL dissector could crash.
  • The PER dissector could crash.
  • The RADIUS dissector could crash.
  • The Telnet dissector could crash.
  • The IS-IS LSP dissector could crash.
  • The NCP dissector could crash.

iDEFENSE found the following issues:

  • Several dissectors were susceptible to a format string overflow.

Impact:

It may be possible to make Ethereal crash, use up available memory, or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

http://www.ethereal.com/appnotes/enpa-sa-00020.html 2005-07-26 2005-07-30
apache -- http request smuggling apache 1.3.33_2 2.*2.0.54_1 2.1.02.1.6_1 apache+ssl 1.3.33.1.55_1 apache+mod_perl 1.3.33_3 apache+mod_ssl apache+mod_ssl+ipv6 apache+mod_ssl+mod_accel apache+mod_ssl+mod_accel+ipv6 apache+mod_ssl+mod_accel+mod_deflate apache+mod_ssl+mod_accel+mod_deflate+ipv6 apache+mod_ssl+mod_deflate apache+mod_ssl+mod_deflate+ipv6 apache+mod_ssl+mod_snmp apache+mod_ssl+mod_snmp+mod_accel apache+mod_ssl+mod_snmp+mod_accel+ipv6 apache+mod_ssl+mod_snmp+mod_deflate apache+mod_ssl+mod_snmp+mod_deflate+ipv6 apache+mod_ssl+mod_snmp+mod_accel+mod_deflate+ipv6 1.3.33+2.8.22_1 apache_fp 0 apache+ipv6 1.3.37 ru-apache 1.3.34+30.22 ru-apache+mod_ssl 1.3.34+30.22+2.8.25

A Watchfire whitepaper reports an vulnerability in the Apache webserver. The vulnerability can be exploited by malicious people causing cross site scripting, web cache poisoining, session hijacking and most importantly the ability to bypass web application firewall protection. Exploiting this vulnerability requires multiple carefully crafted HTTP requests, taking advantage of an caching server, proxy server, web application firewall etc. This only affects installations where Apache is used as HTTP proxy in combination with the following web servers:

  • IIS/6.0 and 5.0
  • Apache 2.0.45 (as web server)
  • apache 1.3.29
  • WebSphere 5.1 and 5.0
  • WebLogic 8.1 SP1
  • Oracle9iAS web server 9.0.2
  • SunONE web server 6.1 SP4
14106 CVE-2005-2088 http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf 2005-07-25 2005-07-26 2009-01-23
clamav -- multiple remote buffer overflows clamav 0.86.2 clamav-devel 20050704

An Secunia Advisory reports:

Neel Mehta and Alex Wheeler have reported some vulnerabilities in Clam AntiVirus, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

  1. Two integer overflow errors in "libclamav/tnef.c" when processing TNEF files can be exploited to cause a heap-based buffer overflow via a specially crafted TNEF file with a length value of -1 in the header.
  2. An integer overflow error in "libclamav/chmunpack.c" can be exploited to cause a heap-based buffer overflow via a specially crafted CHM file with a chunk entry that has a filename length of -1.
  3. A boundary error in "libclamav/fsg.c" when processing a FSG compressed file can cause a heap-based buffer overflow.
http://www.rem0te.com/public/images/clamav.pdf http://secunia.com/advisories/16180/ 2005-07-24 2005-07-25
isc-dhcpd -- format string vulnerabilities isc-dhcp3-client isc-dhcp3-devel isc-dhcp3-relay isc-dhcp3-server isc-dhcp3 isc-dhcp isc-dhcpd 3.0.1

The ISC DHCP programs are vulnerable to several format string vulnerabilities which may allow a remote attacker to execute arbitrary code with the permissions of the DHCP programs, typically root for the DHCP server.

11591 448384 CVE-2004-1006 http://marc.theaimsgroup.com/?l=dhcp-announce&m=109996073218290 2004-11-08 2005-07-23
egroupware -- multiple cross-site scripting (XSS) and SQL injection vulnerabilities egroupware 1.0.0.007

Multiple cross-site scripting (XSS) vulnerabilities in eGroupware before 1.0.0.007 allow remote attackers to inject arbitrary web script or HTML via the (1) ab_id, (2) page, (3) type, or (4) lang parameter to index.php or (5) category_id parameter.

Multiple SQL injection vulnerabilities in index.php in eGroupware before 1.0.0.007 allow remote attackers to execute arbitrary SQL commands via the (1) filter or (2) cats_app parameter.

CVE-2005-1202 CVE-2005-1203 http://sourceforge.net/project/shownotes.php?release_id=320768 2005-04-20 2005-07-23
fetchmail -- denial of service/crash from malicious POP3 server fetchmail 6.2.5.1

In fetchmail 6.2.5.1, the remote code injection via POP3 UIDL was fixed, but a denial of service attack was introduced:

Two possible NULL-pointer dereferences allow a malicous POP3 server to crash fetchmail by respondig with UID lines containing only the article number but no UID (in violation of RFC-1939), or a message without Message-ID when no UIDL support is available.

http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html http://www.fetchmail.info/fetchmail-SA-2005-01.txt 2005-07-21 2005-07-22
dnrd -- remote buffer and stack overflow vulnerabilities dnrd 2.19.1

Natanael Copa reports that dnrd is vulnerable to a remote buffer overflow and a remote stack overflow. These vulnerabilities can be triggered by sending invalid DNS packets to dnrd.

The buffer overflow could potentially be used to execute arbitrary code with the permissions of the dnrd daemon. Note that dnrd runs in an chroot environment and runs as non-root.

The stack overflow vulnerability can cause dnrd to crash.

CVE-2005-2315 CVE-2005-2316 ports/83851 2005-07-21 2005-07-21
PowerDNS -- LDAP backend fails to escape all queries powerdns 2.9.18

The LDAP backend in PowerDNS has issues with escaping queries which could cause connection errors. This would make it possible for a malicious user to temporarily blank domains.

This is known to affect all releases prior to 2.9.18.

CVE-2005-2302 http://doc.powerdns.com/security-policy.html http://marc.theaimsgroup.com/?l=bugtraq&m=112155941310297&w=2 2005-07-16 2005-07-21
fetchmail -- remote root/code injection from malicious POP3 server fetchmail 6.2.5.1

fetchmail's POP3/UIDL code does not truncate received UIDs properly. A malicious or compromised POP3 server can thus corrupt fetchmail's stack and inject code when fetchmail is using UIDL, either through configuration, or as a result of certain server capabilities. Note that fetchmail is run as root on some sites, so an attack might compromise the root account and thus the whole machine.

CVE-2005-2335 ports/83805 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762 http://www.fetchmail.info/fetchmail-SA-2005-01.txt 2005-07-20 2005-07-20 2005-07-21
kdebase -- Kate backup file permission leak kdebase 3.2.03.4.1 linux_base-suse 9.39.3_2

A KDE Security Advisory explains:

Kate / Kwrite create a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set.

Depending on the system security settings, backup files might be readable by other users. Kate / Kwrite are network transparent applications and therefore this vulnerability might not be restricted to local users.

CVE-2005-1920 https://bugs.kde.org/show_bug.cgi?id=103331 http://www.kde.org/info/security/advisory-20050718-1.txt 2005-07-18 2005-07-18 2005-10-09
firefox & mozilla -- multiple vulnerabilities firefox 1.0.5,1 linux-firefox 1.0.5 mozilla 1.7.9,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.9 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

The Mozilla Foundation reports of multiple security vulnerabilities in Firefox and Mozilla:

  • MFSA 2005-56 Code execution through shared function objects
  • MFSA 2005-55 XHTML node spoofing
  • MFSA 2005-54 Javascript prompt origin spoofing
  • MFSA 2005-53 Standalone applications can run arbitrary code through the browser
  • MFSA 2005-52 Same origin violation: frame calling top.focus()
  • MFSA 2005-51 The return of frame-injection spoofing
  • MFSA 2005-50 Possibly exploitable crash in InstallVersion.compareTo()
  • MFSA 2005-49 Script injection from Firefox sidebar panel using data:
  • MFSA 2005-48 Same-origin violation with InstallTrigger callback
  • MFSA 2005-47 Code execution via "Set as Wallpaper"
  • MFSA 2005-46 XBL scripts ran even when Javascript disabled
  • MFSA 2005-45 Content-generated event vulnerabilities
CVE-2005-1937 CVE-2005-2260 CVE-2005-2261 CVE-2005-2262 CVE-2005-2263 CVE-2005-2264 CVE-2005-2265 CVE-2005-2266 CVE-2005-2267 CVE-2005-2268 CVE-2005-2269 CVE-2005-2270 http://www.mozilla.org/projects/security/known-vulnerabilities.html http://www.mozilla.org/security/announce/mfsa2005-45.html http://www.mozilla.org/security/announce/mfsa2005-46.html http://www.mozilla.org/security/announce/mfsa2005-47.html http://www.mozilla.org/security/announce/mfsa2005-48.html http://www.mozilla.org/security/announce/mfsa2005-49.html http://www.mozilla.org/security/announce/mfsa2005-50.html http://www.mozilla.org/security/announce/mfsa2005-51.html http://www.mozilla.org/security/announce/mfsa2005-52.html http://www.mozilla.org/security/announce/mfsa2005-53.html http://www.mozilla.org/security/announce/mfsa2005-54.html http://www.mozilla.org/security/announce/mfsa2005-55.html http://www.mozilla.org/security/announce/mfsa2005-56.html 2005-07-12 2005-07-16
drupal -- PHP code execution vulnerabilities drupal 4.6.2

Kuba Zygmunt discovered a flaw in the input validation routines of Drupal's filter mechanism. An attacker could execute arbitrary PHP code on a target site when public comments or postings are allowed.

CVE-2005-1921 CVE-2005-2106 http://drupal.org/files/sa-2005-002/advisory.txt 2005-06-29 2005-07-16
phpSysInfo -- cross site scripting vulnerability phpSysInfo 2.5.1

A Securityreason.com advisory reports that various cross site scripting vulnerabilities have been found in phpSysInfo. Input is not properly sanitised before it is returned to the user. A malicious person could exploit this to execute arbitrary HTML and script code in a users browser session. Also it is possible to view the full path of certain scripts by accessing them directly.

12887 CVE-2005-0869 CVE-2005-0870 http://marc.theaimsgroup.com/?l=bugtraq&m=111161017209422 2005-03-22 2005-07-09 2005-12-25
mysql-server -- insecure temporary file creation mysql-server 4.14.1.12 5.05.0.6

A Zataz advisory reports that MySQL contains a security flaw which could allow a malicious local user to inject arbitrary SQL commands during the initial database creation process.

The problem lies in the mysql_install_db script which creates temporary files based on the PID used by the script.

13660 CVE-2005-1636 http://www.zataz.net/adviso/mysql-05172005.txt 2005-05-07 2005-07-09
net-snmp -- fixproc insecure temporary file creation net-snmp 5.2.1.2

A Gentoo advisory reports:

Net-SNMP creates temporary files in an insecure manner, possibly allowing the execution of arbitrary code.

A malicious local attacker could exploit a race condition to change the content of the temporary files before they are executed by fixproc, possibly leading to the execution of arbitrary code. A local attacker could also create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When fixproc is executed, this would result in the file being overwritten.

13715 CVE-2005-1740 http://security.gentoo.org/glsa/glsa-200505-18.xml 2005-05-23 2005-07-09 2005-07-13
phpbb -- multiple vulnerabilities phpbb 2.0.12

phpBB is vulnerable to remote exploitation of an input validation vulnerability allows attackers to read the contents of arbitrary system files under the privileges of the webserver. This also allows remote attackers to unlink arbitrary system files under the privileges of the webserver.

12618 12621 12623 CVE-2005-0258 CVE-2005-0259 http://security.gentoo.org/glsa/glsa-200503-02.xml http://www.idefense.com/application/poi/display?id=205&type=vulnerabilities http://www.idefense.com/application/poi/display?id=204&type=vulnerabilities 2005-02-22 2005-07-09
shtool -- insecure temporary file creation shtool 2.0.1

A Zataz advisory reports that shtool contains a security flaw which could allow a malicious local user to create or overwrite the contents of arbitrary files. The attacker could fool a user into executing the arbitrary file possibly executing arbitrary code.

13767 http://www.zataz.net/adviso/shtool-05252005.txt 2005-05-25 2005-07-09
phppgadmin -- "formLanguage" local file inclusion vulnerability phppgadmin 3.5.4

A Secunia Advisory reports:

A vulnerability has been reported in phpPgAdmin, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "formLanguage" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

14142 CVE-2005-2256 http://secunia.com/advisories/15941/ http://sourceforge.net/project/shownotes.php?release_id=342261 2005-07-05 2005-07-08 2005-07-21
pear-XML_RPC -- information disclosure vulnerabilities pear-XML_RPC 1.3.2

The pear-XML_RPC release notes reports that the following issues has been fixed:

Eliminate path disclosure vulnerabilities by suppressing error messages when eval()'ing.

Eliminate path disclosure vulnerability by catching bogus parameters submitted to XML_RPC_Value::serializeval().

http://pear.php.net/package/XML_RPC/download/1.3.2 2005-07-07 2005-07-08
ekg -- insecure temporary file creation pl-ekg 1.6r2,1

Eric Romang reports that ekg creates temporary files in an insecure manner. This can be exploited by an attacker using a symlink attack to overwrite arbitrary files and possibly execute arbitrary commands with the permissions of the user running ekg.

14146 CVE-2005-1916 http://marc.theaimsgroup.com/?l=bugtraq&m=112060146011122 http://bugs.gentoo.org/show_bug.cgi?id=94172 2005-07-05 2005-07-08 2005-07-31
bugzilla -- multiple vulnerabilities bugzilla ja-bugzilla 2.17.12.18.2

A Bugzilla Security Advisory reports:

Any user can change any flag on any bug, even if they don't have access to that bug, or even if they can't normally make bug changes. This also allows them to expose the summary of a bug.

Bugs are inserted into the database before they are marked as private, in Bugzilla code. Thus, MySQL replication can lag in between the time that the bug is inserted and when it is marked as private (usually less than a second). If replication lags at this point, the bug summary will be accessible to all users until replication catches up. Also, on a very slow machine, there may be a pause longer than a second that allows users to see the title of the newly-filed bug.

CVE-2005-2173 CVE-2005-2174 http://www.bugzilla.org/security/2.18.1/ https://bugzilla.mozilla.org/show_bug.cgi?id=292544 https://bugzilla.mozilla.org/show_bug.cgi?id=293159 2005-07-07 2005-07-08 2005-07-18
nwclient -- multiple vulnerabilities nwclient 0

Insecure file permissions, network access control and DNS usage put systems that use Legato NetWorker at risk.

When the software is running, several files that contain sensitive information are created with insecure permissions. The information exposed include passwords and can therefore be used for privilege elevation.

An empty "servers" file, which should normally contain hostnames of authorized backup servers, may allow unauthorized backups to be made. Sensitive information can be extracted from these backups.

When reverse DNS fails for the Legato client IP a weak authorization scheme, containing a flaw that allows unauthorized access, is used. This may allow unauthorized access.

3564 3840 3842 CVE-2001-0910 CVE-2002-0113 CVE-2002-0114 http://portal1.legato.com/resources/bulletins/372.html 2002-01-10 2005-07-08
acroread -- insecure temporary file creation acroread4 acroread5 0 acroread 7.0.0 5.*,17.0.0,1

Secunia Research reports:

Secunia has discovered a security issue in Adobe Reader for Linux, which can be exploited by malicious, local users to gain knowledge of sensitive information.

The problem is caused due to temporary files being created with permissions based on a user's umask in the "/tmp" folder under certain circumstances when documents are opened.

Successful exploitation allows an unprivileged user to read arbitrary users' documents.

CVE-2005-1912 http://secunia.com/secunia_research/2005-6/advisory/ 2005-06-29 2005-07-06
clamav -- cabinet file handling DoS vulnerability clamav 0.86 clamav-devel 20050620

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation error in Clam AntiVirus ClamAV allows attackers to cause a denial of service condition.

The vulnerability specifically exists due to insufficient validation on cabinet file header data. The ENSURE_BITS() macro fails to check for zero length reads, allowing a carefully constructed cabinet file to cause an infinite loop.

ClamAV is used in a number of mail gateway products. Successful exploitation requires an attacker to send a specially constructed CAB file through a mail gateway or personal anti-virus client utilizing the ClamAV scanning engine. The infinate loop will cause the ClamAV software to use all available processor resources, resulting in a denial of service or severe degradation to system performance. Remote exploitation can be achieved by sending a malicious file in an e-mail message or during an HTTP session.

CVE-2005-1923 http://marc.theaimsgroup.com/?l=bugtraq&m=112006456809016 2005-06-29 2005-07-06
clamav -- MS-Expand file handling DoS vulnerability clamav 0.86 clamav-devel 20050620

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation error in Clam AntiVirus ClamAV allows attackers to cause a denial of service condition.

The vulnerability specifically exists due to improper behavior during exceptional conditions.

Successful exploitation allows attackers to exhaust file descriptors pool and memory. Anti-virus detection functionality will fail if there is no file descriptors available with which to open files. Remote exploitation can be achieved by sending a malicious file in an e-mail message or during an HTTP session.

CVE-2005-1922 http://marc.theaimsgroup.com/?l=bugtraq&m=112006402411598 2005-06-29 2005-07-06
zlib -- buffer overflow vulnerability zsync 0.4.1 FreeBSD 5.45.4_4 5.35.3_18

Problem Description

An error in the handling of corrupt compressed data streams can result in a buffer being overflowed.

Impact

By carefully crafting a corrupt compressed data stream, an attacker can overwrite data structures in a zlib-using application. This may cause the application to halt, causing a denial of service; or it may result in the attacker gaining elevated privileges.

CVE-2005-2096 SA-05:16.zlib 2005-07-06 2005-07-06 2005-10-01
acroread -- buffer overflow vulnerability acroread4 acroread5 0 acroread 7.0.0 5.*,17.0.0,1

An Adobe Security Advisory reports:

A vulnerability within Adobe Reader has been identified. Under certain circumstances, remote exploitation of a buffer overflow in Adobe Reader could allow an attacker to execute arbitrary code.

If exploited, it could allow the execution of arbitrary code under the privileges of the local user. Remote exploitation is possible if the malicious PDF document is sent as an email attachment or if the PDF document is accessed via a web link.

CVE-2005-1625 http://www.adobe.com/support/techdocs/329083.html http://marc.theaimsgroup.com/?l=bugtraq&m=112059685332569 2005-07-05 2005-07-06
net-snmp -- remote DoS vulnerability net-snmp 5.2.1.2

A Net-SNMP release announcement reports:

A security vulnerability has been found in Net-SNMP releases that could allow a denial of service attack against Net-SNMP agent's which have opened a stream based protocol (EG, TCP but not UDP; it should be noted that Net-SNMP does not by default open a TCP port).

14168 CVE-2005-2177 http://marc.theaimsgroup.com/?l=net-snmp-announce&m=112059518426328 2005-07-02 2005-07-05 2005-10-26
cacti -- multiple vulnerabilities cacti 0.8.6f

Stefan Esser reports:

Wrongly implemented user input filters lead to multiple SQL Injection vulnerabilities which can lead f.e. to disclosure of the admin password hash.

Wrongly implemented user input filters allows injection of user input into executed commandline.

Alberto Trivero posted his Remote Command Execution Exploit for Cacti <= 0.8.6d to Bugtraq on the 22th June. Having analysed his bug we come to the conclusion, that the malfunctioning input filters, which were already mentioned in the previous advisory are also responsible for this bug still being exploitable.

A HTTP headers bypass switch can also be used to completely bypass the authentification system of Cacti. As admin it is possible to execute shell commands with the permission of the webserver.

While looking at the source of Cacti a HTTP headers bypass switch was discovered, that also switches off a call to session_start() and the manual application of addslashes() in case of magic_quotes_gpc=Off.

When register_globals is turned on* an attacker can use this switch to disables Cacti's use of PHP's session support and therefore supply the session variables on his own through f.e. the URL. Additionally using the switch renders several SQL statements vulnerable to SQL Injections attacks, when magic_quotes_gpc is turned off, which is the recommended setting.

Logged in as an admin it is possible to issue shell commands.

(*) register_globals is turned off by default since PHP 4.2 but is activated on most servers because of older scripts requiring it.

http://marc.theaimsgroup.com/?l=bugtraq&m=111954136315248 http://www.hardened-php.net/advisory-032005.php http://www.hardened-php.net/advisory-042005.php http://www.hardened-php.net/advisory-052005.php 2005-06-22 2005-07-05
wordpress -- multiple vulnerabilities wordpress 1.5.1.3,1

GulfTech Security Research reports:

There are a number of vulnerabilities in WordPress that may allow an attacker to ultimately run arbitrary code on the vulnerable system. These vulnerabilities include SQL Injection, Cross Site Scripting, and also issues that may aid an attacker in social engineering.

CVE-2005-2107 CVE-2005-2108 CVE-2005-2109 CVE-2005-2110 http://marc.theaimsgroup.com/?l=bugtraq&m=112006967221438 2005-06-28 2005-07-05
wordpress -- multiple vulnerabilities wordpress 1.5.1.2,1

A Gentoo Linux Security Advisory reports:

Due to a lack of input validation, WordPress is vulnerable to SQL injection and XSS attacks.

An attacker could use the SQL injection vulnerabilities to gain information from the database. Furthermore the cross-site scripting issues give an attacker the ability to inject and execute malicious script code or to steal cookie-based authentication credentials, potentially compromising the victim's browser.

CVE-2005-1810 http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml 2005-04-12 2005-07-05
phpbb -- remote PHP code execution vulnerability phpbb 2.0.16

FrSIRT Advisory reports:

A vulnerability was identified in phpBB, which may be exploited by attackers to compromise a vulnerable web server. This flaw is due to an input validation error in the "viewtopic.php" script that does not properly filter the "highlight" parameter before calling the "preg_replace()" function, which may be exploited by remote attackers to execute arbitrary PHP commands with the privileges of the web server.

CVE-2005-2086 http://www.frsirt.com/english/advisories/2005/0904 http://www.phpbb.com/phpBB/viewtopic.php?t=302011 2005-06-28 2005-07-03 2005-07-07
pear-XML_RPC -- arbitrary remote code execution pear-XML_RPC 1.3.1

GulfTech Security Research Team reports:

PEAR XML_RPC is vulnerable to a very high risk php code injection vulnerability due to unsanatized data being passed into an eval() call.

CVE-2005-1921 http://www.gulftech.org/?node=research&article_id=00087-07012005 http://www.hardened-php.net/advisory-022005.php 2005-06-29 2005-07-03
kernel -- ipfw packet matching errors with address tables FreeBSD 5.45.4_3

Problem Description

The ipfw tables lookup code caches the result of the last query. The kernel may process multiple packets concurrently, performing several concurrent table lookups. Due to an insufficient locking, a cached result can become corrupted that could cause some addresses to be incorrectly matched against a lookup table.

Impact

When lookup tables are used with ipfw, packets may on very rare occasions incorrectly match a lookup table. This could result in a packet being treated contrary to the defined packet filtering ruleset. For example, a packet may be allowed to pass through when it should have been discarded.

The problem can only occur on Symmetric Multi-Processor (SMP) systems, or on Uni Processor (UP) systems with the PREEMPTION kernel option enabled (not the default).

Workaround

a) Do not use lookup tables.

OR

b) Disable concurrent processing of packets in the network stack by setting the "debug.mpsafenet=0" tunable:

# echo "debug.mpsafenet=0" << /boot/loader.conf

CVE-2005-2019 SA-05:13.ipfw 2005-06-29 2005-06-29 2005-07-06
bzip2 -- denial of service and permission race vulnerabilities FreeBSD 5.45.4_3 5.*5.3_17 4.114.11_11 4.10_16 bzip2 1.0.3_1

Problem Description

Two problems have been discovered relating to the extraction of bzip2-compressed files. First, a carefully constructed invalid bzip2 archive can cause bzip2 to enter an infinite loop. Second, when creating a new file, bzip2 closes the file before setting its permissions.

Impact

The first problem can cause bzip2 to extract a bzip2 archive to an infinitely large file. If bzip2 is used in automated processing of untrusted files this could be exploited by an attacker to create an denial-of-service situation by exhausting disk space or by consuming all available cpu time.

The second problem can allow a local attacker to change the permissions of local files owned by the user executing bzip2 providing that they have write access to the directory in which the file is being extracted.

Workaround

Do not uncompress bzip2 archives from untrusted sources and do not uncompress files in directories where untrusted users have write access.

CVE-2005-0953 CVE-2005-1260 SA-05:14.bzip2 http://scary.beasts.org/security/CESA-2005-002.txt 2005-03-30 2005-06-29 2005-07-06
kernel -- TCP connection stall denial of service FreeBSD 5.45.4_3 5.*5.3_17 4.114.11_11 4.10_16

Problem Description

Two problems have been discovered in the FreeBSD TCP stack.

First, when a TCP packets containing a timestamp is received, inadequate checking of sequence numbers is performed, allowing an attacker to artificially increase the internal "recent" timestamp for a connection.

Second, a TCP packet with the SYN flag set is accepted for established connections, allowing an attacker to overwrite certain TCP options.

Impact

Using either of the two problems an attacker with knowledge of the local and remote IP and port numbers associated with a connection can cause a denial of service situation by stalling the TCP connection. The stalled TCP connection my be closed after some time by the other host.

Workaround

In some cases it may be possible to defend against these attacks by blocking the attack packets using a firewall. Packets used to effect either of these attacks would have spoofed source IP addresses.

637934 CVE-2005-0356 CVE-2005-2068 SA-05:15.tcp 2005-06-29 2005-06-29 2005-07-06
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.140.10.11

An Ethreal Security Advisories reports:

An aggressive testing program as well as independent discovery has turned up a multitude of security issues:

  • The ANSI A dissector was susceptible to format string vulnerabilities. Discovered by Bryan Fulton.
  • The GSM MAP dissector could crash.
  • The AIM dissector could cause a crash.
  • The DISTCC dissector was susceptible to a buffer overflow. Discovered by Ilja van Sprundel
  • The FCELS dissector was susceptible to a buffer overflow. Discovered by Neil Kettle
  • The SIP dissector was susceptible to a buffer overflow. Discovered by Ejovi Nuwere.
  • The KINK dissector was susceptible to a null pointer exception, endless looping, and other problems.
  • The LMP dissector was susceptible to an endless loop.
  • The Telnet dissector could abort.
  • The TZSP dissector could cause a segmentation fault.
  • The WSP dissector was susceptible to a null pointer exception and assertions.
  • The 802.3 Slow protocols dissector could throw an assertion.
  • The BER dissector could throw assertions.
  • The SMB Mailslot dissector was susceptible to a null pointer exception and could throw assertions.
  • The H.245 dissector was susceptible to a null pointer exception.
  • The Bittorrent dissector could cause a segmentation fault.
  • The SMB dissector could cause a segmentation fault and throw assertions.
  • The Fibre Channel dissector could cause a crash.
  • The DICOM dissector could attempt to allocate large amounts of memory.
  • The MGCP dissector was susceptible to a null pointer exception, could loop indefinitely, and segfault.
  • The RSVP dissector could loop indefinitely.
  • The DHCP dissector was susceptible to format string vulnerabilities, and could abort.
  • The SRVLOC dissector could crash unexpectedly or go into an infinite loop.
  • The EIGRP dissector could loop indefinitely.
  • The ISIS dissector could overflow a buffer.
  • The CMIP, CMP, CMS, CRMF, ESS, OCSP, PKIX1Explitit, PKIX Qualified, and X.509 dissectors could overflow buffers.
  • The NDPS dissector could exhaust system memory or cause an assertion, or crash.
  • The Q.931 dissector could try to free a null pointer and overflow a buffer.
  • The IAX2 dissector could throw an assertion.
  • The ICEP dissector could try to free the same memory twice.
  • The MEGACO dissector was susceptible to an infinite loop and a buffer overflow.
  • The DLSw dissector was susceptible to an infinite loop.
  • The RPC dissector was susceptible to a null pointer exception.
  • The NCP dissector could overflow a buffer or loop for a large amount of time.
  • The RADIUS dissector could throw an assertion.
  • The GSM dissector could access an invalid pointer.
  • The SMB PIPE dissector could throw an assertion.
  • The L2TP dissector was susceptible to an infinite loop.
  • The SMB NETLOGON dissector could dereference a null pointer.
  • The MRDISC dissector could throw an assertion.
  • The ISUP dissector could overflow a buffer or cause a segmentation fault.
  • The LDAP dissector could crash.
  • The TCAP dissector could overflow a buffer or throw an assertion.
  • The NTLMSSP dissector could crash.
  • The Presentation dissector could overflow a buffer.
  • Additionally, a number of dissectors could throw an assertion when passing an invalid protocol tree item length.
13391 13504 13567 CVE-2005-1281 CVE-2005-1456 CVE-2005-1457 CVE-2005-1458 CVE-2005-1459 CVE-2005-1460 CVE-2005-1461 CVE-2005-1462 CVE-2005-1463 CVE-2005-1464 CVE-2005-1465 CVE-2005-1466 CVE-2005-1467 CVE-2005-1468 CVE-2005-1469 CVE-2005-1470 http://www.ethereal.com/appnotes/enpa-sa-00019.html 2005-05-04 2005-06-24
tor -- information disclosure tor 0.1.0.10

Roger Dingledine reports:

The Tor 0.1.0.10 release from a few days ago includes a fix for a bug that might allow an attacker to read arbitrary memory (maybe even keys) from an exit server's process space. We haven't heard any reports of exploits yet, but hey.

http://archives.seul.org/or/announce/Jun-2005/msg00001.html 2005-06-16 2005-06-24
linux-realplayer -- RealText parsing heap overflow linux-realplayer 10.0.4_1

An iDEFENSE Security Advisory reports:

Remote exploitation of a heap-based buffer overflow vulnerability in the RealText file format parser within various versions of RealNetworks Inc.'s RealPlayer could allow attackers to execute arbitrary code.

CVE-2005-1277 http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities&flashstatus=false http://service.real.com/help/faq/security/050623_player/EN/ 2005-06-23 2005-06-24
ruby -- arbitrary command execution on XMLRPC server ruby ruby_static 1.8.*1.8.2_3

Nobuhiro IMAI reports:

the default value modification on Module#public_instance_methods (from false to true) breaks s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style security protection.

This problem could allow a remote attacker to execute arbitrary commands on XMLRPC server of libruby.

CVE-2005-1992 http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064 2005-06-22 2005-06-23 2005-11-06
cacti -- potential SQL injection and cross site scripting attacks cacti 0.8.6d

iDEFENSE security group disclosed potential SQL injection attacks from unchecked user input and two security holes regarding potential cross site scripting attacks

http://www.cacti.net/release_notes_0_8_6e.php 2005-06-21 2005-06-21
opera -- XMLHttpRequest security bypass linux-opera opera-devel opera 8.*8.01

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to steal content or to perform actions on other web sites with the privileges of the user.

Normally, it should not be possible for the XMLHttpRequest object to access resources from outside the domain of which the object was opened. However, due to insufficient validation of server side redirects, it is possible to circumvent this restriction.

CVE-2005-1475 http://secunia.com/advisories/15008/ http://secunia.com/secunia_research/2005-4/advisory/ http://www.opera.com/freebsd/changelogs/801/#security 2005-06-16 2005-06-20
opera -- "javascript:" URL cross-site scripting vulnerability linux-opera opera-devel opera 8.01

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to conduct cross-site scripting attacks and to read local files.

The vulnerability is caused due to Opera not properly restricting the privileges of "javascript:" URLs when opened in e.g. new windows or frames.

CVE-2005-1669 http://secunia.com/advisories/15411/ http://www.opera.com/freebsd/changelogs/801/#security 2005-06-16 2005-06-20
opera -- redirection cross-site scripting vulnerability linux-opera opera-devel opera 8.*8.01

A Secunia Advisory reports:

Secunia Research has discovered a vulnerability in Opera, which can be exploited by malicious people to conduct cross-site scripting attacks against users.

The vulnerability is caused due to input not being sanitised, when Opera generates a temporary page for displaying a redirection when "Automatic redirection" is disabled (not default setting).

http://secunia.com/advisories/15423/ http://secunia.com/secunia_research/2003-1/advisory/ http://www.opera.com/freebsd/changelogs/801/#security 2005-06-16 2005-06-20
sudo -- local race condition vulnerability sudo 1.6.8.9

Todd C. Miller reports:

A race condition in Sudo's command pathname handling prior to Sudo version 1.6.8p9 that could allow a user with Sudo privileges to run arbitrary commands.

Exploitation of the bug requires that the user be allowed to run one or more commands via Sudo and be able to create symbolic links in the filesystem. Furthermore, a sudoers entry giving another user access to the ALL pseudo-command must follow the user's sudoers entry for the race to exist.

13993 CVE-2005-1993 http://marc.theaimsgroup.com/?l=bugtraq&m=111928183431376 2005-06-20 2005-06-20 2005-11-14
trac -- file upload/download vulnerability trac 0.8.4

Stefan Esser reports:

Trac's wiki and ticket systems allows to add attachments to wiki entries and bug tracker tickets. These attachments are stored within directories that are determined by the id of the corresponding ticket or wiki entry.

Due to a missing validation of the id parameter it is possible for an attacker to supply arbitrary paths to the upload and attachment viewer scripts. This means that a potential attacker can retrieve any file accessible by the webserver user.

Additionally it is possible to upload arbitrary files (up to a configured file length) to any place the webserver has write access too.

For obvious reasons this can lead to the execution of arbitrary code if it possible to upload files to the document root or it's subdirectories. One example of a configuration would be f.e. running Trac and s9y/wordpress with writeable content directories on the same webserver.

Another potential usage of this exploit would be to abuse Trac powered webservers as storage for f.e. torrent files.

13990 http://www.hardened-php.net/advisory-012005.php http://projects.edgewall.com/trac/wiki/ChangeLog 2005-06-20 2005-06-20
razor-agents -- denial of service vulnerability razor-agents 2.71

A Secunia security advisory reports:

Two vulnerabilities have been reported in Razor-agents, which can be exploited by malicious people to cause a DoS (Denial of Service).

  1. An unspecified error in the preprocessing of certain HTML messages can be exploited to crash the application.
  2. A bug in the discovery logic causes Razor-agents to go into an infinite loop and consume a large amount of memory when discovery fails.
http://secunia.com/advisories/15739/ 2005-06-17 2005-06-20
p5-Mail-SpamAssassin -- denial of service vulnerability p5-Mail-SpamAssassin 3.0.13.0.4

Apache SpamAssassin Security Team reports:

Apache SpamAssassin 3.0.4 was recently released, and fixes a denial of service vulnerability in versions 3.0.1, 3.0.2, and 3.0.3. The vulnerability allows certain misformatted long message headers to cause spam checking to take a very long time.

While the exploit has yet to be seen in the wild, we are concerned that there may be attempts to abuse the vulnerability in the future. Therefore, we strongly recommend all users of these versions upgrade to Apache SpamAssassin 3.0.4 as soon as possible.

CVE-2005-1266 http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e 2005-06-15 2005-06-18
squirrelmail -- Several cross site scripting vulnerabilities squirrelmail ja-squirrelmail 1.4.01.4.4

A SquirrelMail Security Advisory reports:

Several cross site scripting (XSS) vulnerabilities have been discovered in SquirrelMail versions 1.4.0 - 1.4.4.

The vulnerabilities are in two categories: the majority can be exploited through URL manipulation, and some by sending a specially crafted email to a victim. When done very carefully, this can cause the session of the user to be hijacked.

CVE-2005-1769 http://www.squirrelmail.org/security/issue/2005-06-15 2005-06-15 2005-06-18
acroread -- XML External Entity vulnerability acroread7 ja-acroread 7.0.07.0.1

Sverre H. Huseby discovered a vulnerability in Adobe Acrobat and Adobe Reader. Under certain circumstances, using XML scripts it is possible to discover the existence of local files.

CVE-2005-1306 http://shh.thathost.com/secadv/adobexxe/ http://www.adobe.com/support/techdocs/331710.html http://support.adobe.co.jp/faq/faq/qadoc.sv?226360+002+3 2005-06-15 2005-06-18 2005-08-28
gzip -- directory traversal and permission race vulnerabilities FreeBSD 5.45.4_2 5.05.3_16 4.114.11_10 4.104.10_15 4.94.9_18 4.8_33 gzip 1.3.5_2

Problem Description

Two problems related to extraction of files exist in gzip:

The first problem is that gzip does not properly sanitize filenames containing "/" when uncompressing files using the -N command line option.

The second problem is that gzip does not set permissions on newly extracted files until after the file has been created and the file descriptor has been closed.

Impact

The first problem can allow an attacker to overwrite arbitrary local files when uncompressing a file using the -N command line option.

The second problem can allow a local attacker to change the permissions of arbitrary local files, on the same partition as the one the user is uncompressing a file on, by removing the file the user is uncompressing and replacing it with a hardlink before the uncompress operation is finished.

Workaround

Do not use the -N command line option on untrusted files and do not uncompress files in directories where untrusted users have write access.

CVE-2005-0988 CVE-2005-1228 SA-05:11.gzip http://marc.theaimsgroup.com/?l=bugtraq&m=111271860708210 http://marc.theaimsgroup.com/?l=bugtraq&m=111402732406477 2005-04-20 2005-06-18 2005-07-06
tcpdump -- infinite loops in protocol decoding FreeBSD 5.45.4_2 5.35.3_16 tcpdump 3.8.3_2

Problem Description

Several tcpdump protocol decoders contain programming errors which can cause them to go into infinite loops.

Impact

An attacker can inject specially crafted packets into the network which, when processed by tcpdump, could lead to a denial-of-service. After the attack, tcpdump would no longer capture traffic, and would potentially use all available processor time.

CVE-2005-1267 CVE-2005-1278 CVE-2005-1279 CVE-2005-1280 SA-05:10.tcpdump http://marc.theaimsgroup.com/?l=bugtraq&m=111454406222040 http://marc.theaimsgroup.com/?l=bugtraq&m=111454461300644 http://marc.theaimsgroup.com/?l=bugtraq&m=111928309502304 2005-06-09 2005-06-18 2005-06-20
gaim -- Yahoo! remote crash vulnerability gaim ja-gaim ko-gaim ru-gaim 1.3.1

Jacopo Ottaviani reports that Gaim can be crashed by being offered files with names containing non-ASCII characters via the Yahoo! protocol.

13931 CVE-2005-1269 http://gaim.sourceforge.net/security/index.php?id=18 2005-06-10 2005-06-17
gaim -- MSN Remote DoS vulnerability gaim ja-gaim ko-gaim ru-gaim 1.3.1

The GAIM team reports:

Remote attackers can cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation of a large size, possibly due to an integer signedness error.

13932 CVE-2005-1934 http://gaim.sourceforge.net/security/index.php?id=19 2005-06-10 2005-06-17
gallery -- remote code injection via HTTP_POST_VARS gallery 1.4.1.1

A web server running Gallery can be exploited for arbitrary PHP code execution through the use of a maliciously crafted URL.

CVE-2004-2124 http://marc.theaimsgroup.com/?l=bugtraq&m=107524414317693 2004-01-27 2005-06-17
gallery -- cross-site scripting gallery 1.4.4.5

Gallery includes several cross-site scripting vulnerabilities that could allow malicious content to be injected.

CVE-2004-1106 CVE-2005-0219 CVE-2005-0220 CVE-2005-0221 CVE-2005-0222 11602 http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147 http://marc.theaimsgroup.com/?l=bugtraq&m=110608459222364 2005-01-26 2005-06-17
kstars -- exploitable set-user-ID application fliccd kdeedu 3.3.2_1

A KDE Security Advisory explains:

Overview

KStars includes support for the Instrument Neutral Distributed Interface (INDI). The build system of this extra 3rd party software contained an installation hook to install fliccd (part of INDI) as SUID root application.

Erik Sjölund discovered that the code contains several vulnerabilities that allow stack based buffer overflows.

Impact

If the fliccd binary is installed as suid root, it enables root privilege escalation for local users, or, if the daemon is actually running (which it does not by default) and is running as root, remote root privilege escalation.

CVE-2005-0011 http://www.kde.org/info/security/advisory-20050215-1.txt 2005-01-05 2005-06-17
fd_set -- bitmap index overflow in multiple applications gatekeeper 2.2.1 citadel 6.29 3proxy 0.5.b jabber 1.4.3.1_1,1 1.4.4 bnc 2.9.3 rinetd 0.62_1 dante 1.1.15 bld 0.3.3

3APA3A reports:

If programmer fails to check socket number before using select() or fd_set macros, it's possible to overwrite memory behind fd_set structure. Very few select() based application actually check FD_SETSIZE value. [...]

Depending on vulnerable application it's possible to overwrite portions of memory. Impact is close to off-by-one overflows, code execution doesn't seems exploitable.

http://www.gotbnc.com/changes.html#2.9.3 http://www.security.nnov.ru/advisories/sockets.asp http://marc.theaimsgroup.com/?l=bugtraq&m=110660879328901 2004-12-12 2005-06-17 2006-09-03
leafnode -- denial of service vulnerability leafnode 1.11.3

Matthias Andree reports:

A vulnerability was found in the fetchnews program (the NNTP client) that may under some circumstances cause a wait for input that never arrives, fetchnews "hangs". [...]

As only one fetchnews program can run at a time, subsequently started fetchnews and texpire programs will terminate. [...]

Upgrade your leafnode package to version 1.11.3.

CVE-2005-1911 http://leafnode.sourceforge.net/leafnode-SA-2005-02.txt ports/82056 http://marc.theaimsgroup.com/?l=vulnwatch&m=111827180929063 2005-06-08 2005-06-09
gforge -- directory traversal vulnerability gforge 4.0

An STG Security Advisory reports:

GForge CVS module made by Dragos Moinescu and another module made by Ronald Petty have a directory traversal vulnerability. [...] malicious attackers can read arbitrary directory lists.

CVE-2005-0299 12318 http://marc.theaimsgroup.com/?l=bugtraq&m=110627132209963 2005-01-20 2005-06-03
imap-uw -- authentication bypass when CRAM-MD5 is enabled imap-uw 2004b,1

The CRAM-MD5 authentication support of the University of Washington IMAP and POP3 servers contains a vulnerability that may allow an attacker to bypass authentication and impersonate arbitrary users. Only installations with CRAM-MD5 support configured are affected.

CVE-2005-0198 702777 2005-01-04 2005-06-03
squid -- denial-of-service vulnerabilities squid 2.5.9

The Squid team reported several denial-of-service vulnerabilities related to the handling of DNS responses and NT Lan Manager messages. These may allow an attacker to crash the Squid cache.

CVE-2005-0446 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert CVE-2005-0096 CVE-2005-0097 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-fakeauth_auth 2005-01-16 2005-06-03
racoon -- remote denial-of-service racoon 20050510a

Sebastian Krahmer discovered that the racoon ISAKMP daemon could be crashed with a maliciously crafted UDP packet. No authentication is required in order to perform the attack.

CVE-2005-0398 http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000 http://xforce.iss.net/xforce/xfdb/19707 https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=109966&action=view 2005-03-12 2005-06-03
xli -- integer overflows in image size calculations xli 1.17.0_1

Tavis Ormandy discovered several integer overflows in xli's image size handling. A maliciously crafted image may be able to cause a heap buffer overflow and execute arbitrary code.

CVE-2005-0639 http://bugs.gentoo.org/show_bug.cgi?id=79762 http://pantransit.reptiles.org/prog/xli/CHANGES 2005-02-08 2005-06-03
xloadimage -- arbitrary command execution when handling compressed files xli 1.17.0_1 xloadimage 4.1.10

Tavis Ormandy discovered that xli and xloadimage attempt to decompress images by piping them through gunzip or similar decompression tools. Unfortunately, the unsanitized file name is included as part of the command. This is dangerous, as in some situations, such as mailcap processing, an attacker may control the input file name. As a result, an attacker may be able to cause arbitrary command execution.

CVE-2005-0638 http://bugs.gentoo.org/show_bug.cgi?id=79762 2005-02-18 2005-06-03
xloadimage -- buffer overflow in FACES image handling xli 1.17.0_1 xloadimage 4.1.9

In 2001, zen-parse discovered a buffer overflow in xloadimage's FACES image loader. A maliciously crafted image could cause xloadimage to execute arbitrary code. A published exploit exists for this vulnerability.

In 2005, Rob Holland discovered that the same vulnerability was present in xli.

CVE-2001-0775 http://marc.theaimsgroup.com/?l=bugtraq&m=99477230306845 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=46186 http://bugs.gentoo.org/show_bug.cgi?id=79762 2000-02-19 2005-06-03
yamt -- buffer overflow and directory traversal issues yamt 0.5_2

Stanislav Brabec discovered errors in yamt's path name handling that lead to buffer overflows and directory traversal issues. When processing a file with a maliciously crafted ID3 tag, yamt might overwrite arbitrary files or possibly execute arbitrary code.

The SuSE package ChangeLog contains:

  • Several security fixes (#49337):
  • directory traversal in rename
  • directory traversal in sort
  • buffer overflow in sort
  • buffer overflow in rename
CVE-2005-1846 CVE-2005-1847 http://rpmfind.net/linux/RPM/suse/updates/8.2/i386/rpm/i586/yamt-0.5-1277.i586.html ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/yamt-0.5-1277.src.rpm 2005-01-20 2005-06-03
xview -- multiple buffer overflows in xv_parse_one xview 3.2.1_3

A Debian Security Advisory reports:

Erik Sjölund discovered that programs linked against xview are vulnerable to a number of buffer overflows in the XView library. When the overflow is triggered in a program which is installed setuid root a malicious user could perhaps execute arbitrary code as privileged user.

CVE-2005-0076 http://www.debian.org/security/2005/dsa-672 http://xforce.iss.net/xforce/xfdb/19271 2005-02-09 2005-06-01
xtrlock -- X display locking bypass xtrlock 2.0.10

The X display locking program xtrlock contains an integer overflow bug. It is possible for an attacker with physical access to the system to bypass the display lock.

CVE-2005-0079 http://www.debian.org/security/2005/dsa-649 http://xforce.iss.net/xforce/xfdb/18991 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278191 2004-10-25 2005-06-01
linux_base -- vulnerabilities in Red Hat 7.1 libraries linux_base 7.3

Trevor Johnson reported that the Red Hat Linux RPMs used by linux_base contained multiple older vulnerabilities, such as a DNS resolver issue and critical bugs in X font handling and XPM image handling.

http://fedoralegacy.org/updates/RH7.3/2004-10-23-FLSA_2004_1947__Updated_glibc_packages_fix_flaws.html http://rhn.redhat.com/errata/RHSA-2004-059.html http://rhn.redhat.com/errata/RHSA-2004-478.html http://rhn.redhat.com/errata/RHSA-2004-612.html CVE-2002-0029 CVE-2004-0083 CVE-2004-0084 CVE-2004-0106 CVE-2004-0687 CVE-2004-0688 CVE-2004-0692 CVE-2004-0914 2004-09-27 2005-06-01
squirrelmail -- XSS and remote code injection vulnerabilities squirrelmail ja-squirrelmail 1.4.4

A SquirrelMail Security Advisory reports:

SquirrelMail 1.4.4 has been released to resolve a number of security issues disclosed below. It is strongly recommended that all running SquirrelMail prior to 1.4.4 upgrade to the latest release.

Remote File Inclusion

Manoel Zaninetti reported an issue in src/webmail.php which would allow a crafted URL to include a remote web page. This was assigned CAN-2005-0103 by the Common Vulnerabilities and Exposures.

Cross Site Scripting Issues

A possible cross site scripting issue exists in src/webmail.php that is only accessible when the PHP installation is running with register_globals set to On. This issue was uncovered internally by the SquirrelMail Development team. This isssue was assigned CAN-2005-0104 by the Common Vulnerabilities and Exposures.

A second issue which was resolved in the 1.4.4-rc1 release was uncovered and assigned CAN-2004-1036 by the Common Vulnerabilities and Exposures. This issue could allow a remote user to send a specially crafted header and cause execution of script (such as javascript) in the client browser.

Local File Inclusion

A possible local file inclusion issue was uncovered by one of our developers involving custom preference handlers. This issue is only active if the PHP installation is running with register_globals set to On.

CVE-2004-1036 CVE-2005-0075 CVE-2005-0103 CVE-2005-0104 http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662 http://www.squirrelmail.org/security/issue/2005-01-14 http://www.squirrelmail.org/security/issue/2005-01-19 http://www.squirrelmail.org/security/issue/2005-01-20 2005-01-29 2005-06-01
sympa -- buffer overflow in "queue" sympa 4.1.2_1

Erik Sjölund discovered a vulnerability in Sympa. The queue application processes messages received via aliases. It contains a buffer overflow in the usage of sprintf. In some configurations, it may allow an attacker to execute arbitrary code as the sympa user.

CVE-2005-0073 http://www.debian.org/security/2005/dsa-677 2005-02-11 2005-06-01
mailman -- generated passwords are poor quality mailman ja-mailman 2.1.6

Florian Weimer wrote:

Mailman 2.1.5 uses weak auto-generated passwords for new subscribers. These passwords are assigned when members subscribe without specifying their own password (either by email or the web frontend). Knowledge of this password allows an attacker to gain access to the list archive even though she's not a member and the archive is restricted to members only. [...]

This means that only about 5 million different passwords are ever generated, a number that is in the range of brute force attacks -- you only have to guess one subscriber address (which is usually not that hard).

CVE-2004-1143 http://mail.python.org/pipermail/mailman-developers/2004-December/017553.html http://mail.python.org/pipermail/mailman-developers/attachments/20041215/be238297/attachment.mht 2004-12-15 2005-06-01
mailman -- password disclosure mailman ja-mailman 2.1.5

Barry Warsaw reports:

Today I am releasing Mailman 2.1.5, a bug fix release [...] This version also contains a fix for an exploit that could allow 3rd parties to retrieve member passwords. It is thus highly recommended that all existing sites upgrade to the latest version.

CVE-2004-0412 http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html 2004-05-15 2005-06-01
tomcat -- Tomcat Manager cross-site scripting jakarta-tomcat 5.0.*5.0.30_5 5.5.*5.5.7

Oliver Karow discovered cross-site scripting issues in the Apache Jakarta Tomcat manager. The developers refer to the issues as minor.

http://www.oliverkarow.de/research/jakarta556_xss.txt http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html 2005-01-03 2005-06-01 2006-09-12
fswiki -- XSS problem in file upload form fswiki 3.5.6

A Secunia security advisory reports:

A vulnerability has been reported in FreeStyle Wiki and FSWikiLite, which can be exploited by malicious people to conduct script insertion attacks.

Input passed in uploaded attachments is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious attachment is viewed.

CVE-2005-1799 http://secunia.com/advisories/15538 ports/81520 http://fswiki.poi.jp/wiki.cgi?page=%CD%FA%CE%F2%2F2005%2D5%2D19 http://jvn.jp/jp/JVN%23465742E4/index.html 2005-05-19 2005-05-29 2005-06-01
freeradius -- sql injection and denial of service vulnerability freeradius 1.0.2_1 freeradius-devel 1.0.2

A Gentoo Advisory reports:

The FreeRADIUS server is vulnerable to an SQL injection attack and a buffer overflow, possibly resulting in disclosure and modification of data and Denial of Service.

13540 13541 http://www.gentoo.org/security/en/glsa/glsa-200505-13.xml 2005-05-17 2005-05-22 2008-01-20
ppxp -- local root exploit ppxp 0 ja-ppxp 0

A Debian Advisory reports:

Jens Steube discovered that ppxp, yet another PPP program, does not release root privileges when opening potentially user supplied log files. This can be tricked into opening a root shell.

CVE-2005-0392 http://www.debian.org/security/2005/dsa-725 2005-05-19 2005-05-22
oops -- format string vulnerability oops 1.5.24

A RST/GHC Advisory reports that there is an format string vulnerability in oops. The vulnerability can be found in the MySQL/PgSQL authentication module. Succesful exploitation may allow execution of arbitrary code.

13172 CVE-2005-1121 http://rst.void.ru/papers/advisory24.txt 2005-04-14 2005-05-22
cdrdao -- unspecified privilege escalation vulnerability cdrdao 1.2.0

The developers of cdrdao report that there is a potential root exploit in the software. In order to be able to succesfully exploit this vulnerability cdrdao must be installed setuid root. When succesfully exploited a local user might get escalated privileges. By default this port is not installed setuid root.

http://secunia.com/advisories/15354/ http://sourceforge.net/forum/forum.php?forum_id=466399 2005-05-13 2005-05-19
gaim -- MSN remote DoS vulnerability gaim ja-gaim ko-gaim ru-gaim 1.3.0

The GAIM team reports:

Potential remote denial of service bug resulting from not checking a pointer for non-NULL before passing it to strncmp, which results in a crash. This can be triggered by a remote client sending an SLP message with an empty body.

CVE-2005-1262 http://gaim.sourceforge.net/security/index.php?id=17 2005-05-10 2005-05-14
gaim -- remote crash on some protocols gaim ja-gaim ko-gaim ru-gaim 1.3.0

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to crash:

It is possible for a remote user to overflow a static buffer by sending an IM containing a very large URL (greater than 8192 bytes) to the Gaim user. This is not possible on all protocols, due to message length restrictions. Jabber are SILC are known to be vulnerable.

CVE-2005-1261 http://gaim.sourceforge.net/security/index.php?id=16 2005-05-10 2005-05-14
kernel -- information disclosure when using HTT FreeBSD 5.45.4_1 5.05.3_15 4.114.11_9 4.10_14

Problem description and impact

When running on processors supporting Hyper-Threading Technology, it is possible for a malicious thread to monitor the execution of another thread.

Information may be disclosed to local users, allowing in many cases for privilege escalation. For example, on a multi-user system, it may be possible to steal cryptographic keys used in applications such as OpenSSH or SSL-enabled web servers.

NOTE: Similar problems may exist in other simultaneous multithreading implementations, or even some systems in the absence of simultaneous multithreading. However, current research has only demonstrated this flaw in Hyper-Threading Technology, where shared memory caches are used.

Workaround

Systems not using processors with Hyper-Threading Technology support are not affected by this issue. On systems which are affected, the security flaw can be eliminated by setting the "machdep.hlt_logical_cpus" tunable:

# echo "machdep.hlt_logical_cpus=1" >> /boot/loader.conf

The system must be rebooted in order for tunables to take effect.

Use of this workaround is not recommended on "dual-core" systems, as this workaround will also disable one of the processor cores.

CVE-2005-0109 SA-05:09.htt http://www.daemonology.net/hyperthreading-considered-harmful/ 2005-05-13 2005-05-13
leafnode -- fetchnews denial-of-service triggered by transmission abort/timeout leafnode 1.9.481.11.2

When an upstream server aborts the transmission or stops sending data after the fetchnews program has requested an article header or body, fetchnews may crash, without querying further servers that are configured. This can prevent articles from being fetched.

http://leafnode.sourceforge.net/leafnode-SA-2005-01.txt CVE-2005-1453 ports/80663 13489 13492 http://sourceforge.net/mailarchive/forum.php?thread_id=7186974&forum_id=10210 http://article.gmane.org/gmane.network.leafnode.announce/52 http://www.dt.e-technik.uni-dortmund.de/pipermail/leafnode-list/2005q2/000900.html http://www.fredi.de/maillist/msg00111.html http://archives.neohapsis.com/archives/vulnwatch/2005-q2/0037.html http://www.frsirt.com/english/advisories/2005/0468 http://secunia.com/advisories/15252 2005-05-04 2005-05-13
mozilla -- privilege escalation via non-DOM property overrides firefox 1.0.4,1 linux-firefox 1.0.4 mozilla 1.7.8,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.8 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Additional checks were added to make sure Javascript eval and Script objects are run with the privileges of the context that created them, not the potentially elevated privilege of the context calling them in order to protect against an additional variant of MFSA 2005-41.

The Mozilla Foundation Security Advisory MFSA 2005-41 reports:

moz_bug_r_a4 reported several exploits giving an attacker the ability to install malicious code or steal data, requiring only that the user do commonplace actions like click on a link or open the context menu.

http://www.mozilla.org/security/announce/mfsa2005-44.html 2005-05-11 2005-05-12
mozilla -- "Wrapped" javascript: urls bypass security checks firefox 1.0.4,1 linux-firefox 1.0.4 mozilla 1.7.8,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.8 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Some security checks intended to prevent script injection were incorrect and could be bypassed by wrapping a javascript: url in the view-source: pseudo-protocol. Michael Krax demonstrated that a variant of his favicon exploit could still execute arbitrary code, and the same technique could also be used to perform cross-site scripting.

Georgi Guninski demonstrated the same flaw wrapping javascript: urls with the jar: pseudo-protocol.

L. David Baron discovered a nested variant that defeated checks in the script security manager.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-43.html 2005-05-11 2005-05-12
mozilla -- code execution via javascript: IconURL vulnerability firefox 1.0.4,1 linux-firefox 1.0.4 mozilla 1.7.8,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.8 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Two vulnerabilities have been discovered in Firefox, which can be exploited by malicious people to conduct cross-site scripting attacks and compromise a user's system.

  1. The problem is that "IFRAME" JavaScript URLs are not properly protected from being executed in context of another URL in the history list. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site.
  2. Input passed to the "IconURL" parameter in "InstallTrigger.install()" is not properly verified before being used. This can be exploited to execute arbitrary JavaScript code with escalated privileges via a specially crafted JavaScript URL.

Successful exploitation requires that the site is allowed to install software (default sites are "update.mozilla.org" and "addons.mozilla.org").

A combination of vulnerability 1 and 2 can be exploited to execute arbitrary code.

CVE-2005-1476 CVE-2005-1477 http://www.mozilla.org/security/announce/mfsa2005-42.html 2005-05-08 2005-05-11
groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files ja-groff 1.18.11.18.1_8

The eqn2graph and pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files.

ports/80671 12058 CVE-2004-1296 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286371 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286372 2004-12-20 2005-05-09
groff -- groffer uses temporary files unsafely ja-groff 1.181.18.1_8

The groffer script in the groff package 1.18 and later versions allows local users to overwrite files via a symlink attack on temporary files.

ports/80671 11287 CVE-2004-0969 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278265 2004-09-30 2005-05-09
sharutils -- unshar insecure temporary file creation sharutils 4.3.80

An Ubuntu Advisory reports:

Joey Hess discovered that "unshar" created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

12981 CVE-2005-0990 http://www.ubuntulinux.org/support/documentation/usn/usn-104-1 2005-04-04 2005-05-01
rsnapshot -- local privilege escalation rsnapshot 1.1.7

An rsnapshot Advisory reports:

The copy_symlink() subroutine in rsnapshot incorrectly changes file ownership on the files pointed to by symlinks, not on the symlinks themselves. This would allow, under certain circumstances, an arbitrary user to take ownership of a file on the main filesystem.

13095 CVE-2005-1064 http://www.rsnapshot.org/security/2005/001.html 2005-04-10 2005-05-01
coppermine -- IP spoofing and XSS vulnerability coppermine 1.3.2

GHC team reports about coppermine

The lack of sanitizing of user defined variables may result in undesirable consequences such as IP spoofing or XSS attack.

Generally users of Coppermine Gallery can post comments. Remote address & x-forwarded-for variables are logged for admin's eyes. X-Forwarded-for variable does not pass throu any filtration before logging into database. User can define/redefine this variable.

http://www.securityfocus.com/archive/1/396080 13218 CVE-2005-1172 http://coppermine.sourceforge.net/board/index.php?topic=17134.0 2005-04-18 2005-05-01
ImageMagick -- ReadPNMImage() heap overflow vulnerability ImageMagick ImageMagick-nox11 6.2.2

Damian Put reports about ImageMagick:

Remote exploitation of a heap overflow vulnerability could allow execution of arbitrary code or course denial of service.

A heap overflow exists in ReadPNMImage() function, that is used to decode a PNM image files.

13351 http://marc.theaimsgroup.com/?l=bugtraq&m=111445767107869 2005-04-25 2005-04-27
mplayer & libxine -- MMS and Real RTSP buffer overflow vulnerabilities mplayer mplayer-gtk mplayer-gtk2 mplayer-esound mplayer-gtk-esound mplayer-gtk2-esound 0.99.7 libxine 0.9.91.0.1

A xine security announcement reports:

By a user receiving data from a malicious network streaming server, an attacker can overrun a heap buffer, which can, on some systems, lead to or help in executing attacker-chosen malicious code with the permissions of the user running a xine-lib based media application.

Both the MMS and Real RTSP streaming client code made some too-strong assumptions on the transferred data. Several critical bounds checks were missing, resulting in the possibility of heap overflows, should the remote server not adhere to these assumptions. In the MMS case, a remote server could present content with too many individual streams; in the RTSP case, a remote server's reply could have too many lines.

An attacker can set up a server delivering malicious data to the users. This can be used to overflow a heap buffer, which can, with certain implementations of heap management, lead to attacker chosen data written to the stack. This can cause attacker-chosen code being executed with the permissions of the user running the application. By tricking users to retrieve a stream, which can be as easy as providing a link on a website, this vulnerability can be exploited remotely.

13270 13271 CVE-2005-1195 http://www.mplayerhq.hu/homepage/design7/news.html#vuln10 http://www.mplayerhq.hu/homepage/design7/news.html#vuln11 http://xinehq.de/index.php/security/XSA-2004-8 2005-04-16 2005-04-25
gaim -- AIM/ICQ remote denial of service vulnerability gaim ja-gaim ko-gaim ru-gaim 1.1.3

The GAIM team reports that GAIM is vulnerable to a denial-of-service vulnerability which can cause GAIM to freeze:

Certain malformed SNAC packets sent by other AIM or ICQ users can trigger an infinite loop in Gaim when parsing the SNAC. The remote user would need a custom client, able to generate malformed SNACs.

CVE-2005-0472 http://gaim.sourceforge.net/security/index.php?id=10 2005-02-17 2005-04-25
gaim -- remote DoS on receiving malformed HTML gaim ja-gaim ko-gaim ru-gaim 1.1.4

The GAIM team reports:

Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.

CVE-2005-0208 CVE-2005-0473 http://gaim.sourceforge.net/security/index.php?id=11 http://gaim.sourceforge.net/security/index.php?id=12 2005-02-17 2005-04-25
kdewebdev -- kommander untrusted code execution vulnerability kdewebdev 3.2,23.4.0_1,2

A KDE Security Advisory reports:

Kommander executes without user confirmation data files from possibly untrusted locations. As they contain scripts, the user might accidentally run arbitrary code.

Impact: Remotly supplied kommander files from untrusted sources are executed without confirmation.

CVE-2005-0754 http://www.kde.org/info/security/advisory-20050420-1.txt 2005-04-20 2005-04-23 2008-08-04
junkbuster -- heap corruption vulnerability and configuration modification vulnerability junkbuster 2.0.2_3 junkbuster-zlib 0

A Debian advisory reports:

James Ranson discovered that an attacker can modify the referrer setting with a carefully crafted URL by accidently overwriting a global variable.

Tavis Ormandy from the Gentoo Security Team discovered several heap corruptions due to inconsistent use of an internal function that can crash the daemon or possibly lead to the execution of arbitrary code.

13146 13147 CVE-2005-1108 CVE-2005-1109 http://www.debian.org/security/2005/dsa-713 http://www.gentoo.org/security/en/glsa/glsa-200504-11.xml 2005-04-13 2005-04-22
kdelibs -- kimgio input validation errors kdelibs 3.23.4.0_2

A KDE Security Advisory reports:

kimgio contains a PCX image file format reader that does not properly perform input validation. A source code audit performed by the KDE security team discovered several vulnerabilities in the PCX and other image file format readers, some of them exploitable to execute arbitrary code.

Impact: Remotely supplied, specially crafted image files can be used to execute arbitrary code.

CVE-2005-1046 http://bugs.kde.org/102328 http://www.kde.org/info/security/advisory-20050421-1.txt 2005-04-21 2005-04-22
gld -- format string and buffer overflow vulnerabilities gld 1.5

Gld has been found vulnerable to multiple buffer overflows as well as multiple format string vulnerabilities.

An attacker could exploit this vulnerability to execute arbitrary code with the permissions of the user running Gld, the default user being root.

The FreeBSD port defaults to running gld as the root user. The risk of exploitation can be minimized by making gld listen on the loopback address only, or configure it to only accept connections from trusted smtp servers.

13129 13133 CVE-2005-1099 CVE-2005-1100 http://marc.theaimsgroup.com/?l=bugtraq&m=111339935903880 http://marc.theaimsgroup.com/?l=bugtraq&m=111342432325670 2005-04-12 2005-04-19
axel -- remote buffer overflow axel 1.0a_4

A Debian Security Advisory reports:

Ulf Härnhammar from the Debian Security Audit Project discovered a buffer overflow in axel, a light download accelerator. When reading remote input the program did not check if a part of the input can overflow a buffer and maybe trigger the execution of arbitrary code.

13059 CVE-2005-0390 http://www.debian.org/security/2005/dsa-706 2005-04-16 2005-04-17
firefox -- PLUGINSPAGE privileged javascript execution firefox 1.0.3,1 linux-firefox 1.0.3

A Mozilla Foundation Security Advisory reports:

When a webpage requires a plugin that is not installed the user can click to launch the Plugin Finder Service (PFS) to find an appropriate plugin. If the service does not have an appropriate plugin the EMBED tag is checked for a PLUGINSPAGE attribute, and if one is found the PFS dialog will contain a "manual install" button that will load the PLUGINSPAGE url.

Omar Khan reported that if the PLUGINSPAGE attribute contains a javascript: url then pressing the button could launch arbitrary code capable of stealing local data or installing malicious code.

Doron Rosenberg reported a variant that injects script by appending it to a malformed URL of any protocol.

CVE-2005-0752 http://www.mozilla.org/security/announce/mfsa2005-34.html https://bugzilla.mozilla.org/show_bug.cgi?id=288556 https://bugzilla.mozilla.org/show_bug.cgi?id=289171 2005-03-31 2005-04-16
jdk -- jar directory traversal vulnerability jdk 1.2.2p11_3 1.3.*1.3.1p9_4 1.4.*1.4.2p7 1.5.*1.5.0p1_1 linux-ibm-jdk 1.4.2_1 linux-sun-jdk 1.4.2.08_1 1.5.0b1 1.5.0b1,1 1.5.0,21.5.0.02,2 linux-blackdown-jdk 1.4.2_2 diablo-jdk 1.3.1.0_1 diablo-jdk-freebsd6 i386.1.5.0.07.00 linux-jdk 0

Pluf has discovered a vulnerability in Sun Java JDK/SDK, which potentially can be exploited by malicious people to compromise a user's system.

The jar tool does not check properly if the files to be extracted have the string "../" on its names, so it's possible for an attacker to create a malicious jar file in order to overwrite arbitrary files within the filesystem.

CVE-2005-1080 http://marc.theaimsgroup.com/?l=bugtraq&m=111331593310508 http://www.securiteam.com/securitynews/5IP0C0AFGW.html http://secunia.com/advisories/14902/ 2005-04-11 2005-04-16 2006-09-12
mozilla -- privilege escalation via DOM property overrides firefox 1.0.3,1 linux-firefox 1.0.3 mozilla 1.7.7,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.7 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

moz_bug_r_a4 reported several exploits giving an attacker the ability to install malicious code or steal data, requiring only that the user do commonplace actions like click on a link or open the context menu. The common cause in each case was privileged UI code ("chrome") being overly trusting of DOM nodes from the content window. Scripts in the web page can override properties and methods of DOM nodes and shadow the native values, unless steps are taken to get the true underlying values.

We found that most extensions also interacted with content DOM in a natural, but unsafe, manner. Changes were made so that chrome code using this natural DOM coding style will now automatically use the native DOM value if it exists without having to use cumbersome wrapper objects.

Most of the specific exploits involved tricking the privileged code into calling eval() on an attacker-supplied script string, or the equivalent using the Script() object. Checks were added in the security manager to make sure eval and Script objects are run with the privileges of the context that created them, not the potentially elevated privileges of the context calling them.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-41.html 2005-04-15 2005-04-16
mozilla -- code execution through javascript: favicons firefox 1.0.3,1 linux-firefox 1.0.3 mozilla 1.7.7,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.7 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Firefox and the Mozilla Suite support custom "favicons" through the <LINK rel="icon"> tag. If a link tag is added to the page programmatically and a javascript: url is used, then script will run with elevated privileges and could run or install malicious software.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-37.html 2005-04-12 2005-04-16
mozilla -- javascript "lambda" replace exposes memory contents firefox 1.0.3,1 linux-firefox 1.0.3 mozilla 1.7.7,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.7 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

A bug in javascript's regular expression string replacement when using an anonymous function as the replacement argument allows a malicious script to capture blocks of memory allocated to the browser. A web site could capture data and transmit it to a server without user interaction or knowledge.

Workaround: Disable Javascript

CVE-2005-0989 http://www.mozilla.org/security/announce/mfsa2005-33.html https://bugzilla.mozilla.org/show_bug.cgi?id=288688 2005-04-01 2005-04-16
firefox -- arbitrary code execution in sidebar panel firefox 1.0.3,1 linux-firefox 1.0.3

A Mozilla Foundation Security Advisory reports:

Sites can use the _search target to open links in the Firefox sidebar. Two missing security checks allow malicious scripts to first open a privileged page (such as about:config) and then inject script using a javascript: url. This could be used to install malicious code or steal data without user interaction.

Workaround: Disable Javascript

http://www.mozilla.org/security/announce/mfsa2005-39.html 2005-04-12 2005-04-16
openoffice -- DOC document heap overflow vulnerability openoffice ar-openoffice ca-openoffice cs-openoffice de-openoffice dk-openoffice el-openoffice es-openoffice et-openoffice fi-openoffice fr-openoffice gr-openoffice hu-openoffice it-openoffice ja-openoffice ko-openoffice nl-openoffice pl-openoffice pt-openoffice pt_BR-openoffice ru-openoffice se-openoffice sk-openoffice sl-openoffice-SI tr-openoffice zh-openoffice-CN zh-openoffice-TW jp-openoffice kr-openoffice sl-openoffice-SL zh-openoffice zh_TW-openoffice 1.1.4_2 2.*2.0.20050406 openoffice ja-openoffice 6.0.a6096.0.a638 641c645 1.1RC4 1.1rc5

AD-LAB reports that a heap-based buffer overflow vulnerability exists in OpenOffice's handling of DOC documents. When reading a DOC document 16 bit from a 32 bit integer is used for memory allocation, but the full 32 bit is used for further processing of the document. This can allow an attacker to crash OpenOffice, or potentially execute arbitrary code as the user running OpenOffice, by tricking an user into opening a specially crafted DOC document.

13092 CVE-2005-0941 http://marc.theaimsgroup.com/?l=bugtraq&m=111325305109137 http://www.openoffice.org/issues/show_bug.cgi?id=46388 2005-04-11 2005-04-13 2005-04-20
portupgrade -- insecure temporary file handling vulnerability portupgrade 20041226_2

Simon L. Nielsen discovered that portupgrade handles temporary files in an insecure manner. This could allow an unprivileged local attacker to execute arbitrary commands or overwrite arbitrary files with the permissions of the user running portupgrade, typically root, by way of a symlink attack.

The following issues exist where the temporary files are created, by default in the world writeable directory /var/tmp, with the permissions of the user running portupgrade:

  • pkg_fetch download packages with a predictable local filename allowing a local attacker to overwrite arbitrary local files or potentially replace the downloaded package after download but before install with a package with malicious content, allowing the attacker to run arbitrary commands.
  • portupgrade will, when upgrading ports/packages, write the old package to a predictable temporary file, allowing an attacker to overwrite arbitrary files via a symlink attack.
  • portupgrade will touch a temporary file with a constant filename (pkgdb.fixme) allowing an attacker to create arbitrary zero-byte files via a symlink attack.

A workaround for these issues is to set the PKG_TMPDIR environment variable to a directory only write-able by the user running portupgrade.

CVE-2005-0610 2005-04-12 2005-04-12
gaim -- jabber remote crash gaim ja-gaim ko-gaim ru-gaim 1.2.1

The GAIM team reports:

A remote jabber user can cause Gaim to crash by sending a specific file transfer request.

13004 CVE-2005-0967 http://gaim.sourceforge.net/security/?id=15 2005-04-04 2005-04-10
gaim -- remote DoS on receiving certain messages over IRC gaim ja-gaim ko-gaim ru-gaim 1.2.1

The GAIM team reports:

The IRC protocol plugin in Gaim 1.2.0, and possibly earlier versions, allows (1) remote attackers to inject arbitrary Gaim markup via irc_msg_kick, irc_msg_mode, irc_msg_part, irc_msg_quit, (2) remote attackers to inject arbitrary Pango markup and pop up empty dialog boxes via irc_msg_invite, or (3) malicious IRC servers to cause a denial of service (application crash) by injecting certain Pango markup into irc_msg_badmode, irc_msg_banned, irc_msg_unknown, irc_msg_nochan functions.

13003 CVE-2005-0966 http://gaim.sourceforge.net/security/?id=14 2005-04-02 2005-04-10
gaim -- remote DoS on receiving malformed HTML gaim ja-gaim ko-gaim ru-gaim 1.2.1

The GAIM team reports:

The gaim_markup_strip_html function in Gaim 1.2.0, and possibly earlier versions, allows remote attackers to cause a denial of service (application crash) via a string that contains malformed HTML, which causes an out-of-bounds read.

12999 CVE-2005-0965 http://gaim.sourceforge.net/security/?id=13 2005-04-02 2005-04-10
php -- readfile() DoS vulnerability mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.3.5_7 mod_php mod_php4 4.3.5_7,1

A SUSE Security advisory reports:

A bug in the readfile() function of php4 could be used to to crash the httpd running the php4 code when accessing files with a multiple of the architectures page size leading to a denial of service.

12665 CVE-2005-0596 http://bugs.php.net/bug.php?id=27037 http://www.novell.com/linux/security/advisories/2005_06_sr.html 2004-01-25 2005-04-10
squid -- DoS on failed PUT/POST requests vulnerability squid 2.5.7_12

The squid patches page notes:

An inconsistent state is entered on a failed PUT/POST request making a high risk for segmentation faults or other strange errors

CVE-2005-0718 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post http://www.squid-cache.org/bugs/show_bug.cgi?id=1224 2005-02-03 2005-04-10
horde -- Horde Page Title Cross-Site Scripting Vulnerability horde horde-php5 3.*3.0.4

Secunia Advisory: SA14730

A vulnerability has been reported in Horde, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed when setting the parent frame's page title via JavaScript is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability has been reported in version 3.0.4-RC2. Prior versions may also be affected.

CVE-2005-0961 http://lists.horde.org/archives/announce/2005/000176.html http://cvs.horde.org/diff.php/horde/docs/CHANGES?r1=1.515.2.49&r2=1.515.2.93&ty=h 2005-03-29 2005-04-05
wu-ftpd -- remote globbing DoS vulnerability wu-ftpd 2.6.2_6 wu-ftpd+ipv6 2.6.2_7

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation vulnerability in version 2.6.2 of WU-FPTD could allow for a denial of service of the system by resource exhaustion.

The vulnerability specifically exists in the wu_fnmatch() function in wu_fnmatch.c. When a pattern containing a '*' character is supplied as input, the function calls itself recursively on a smaller substring. By supplying a string which contains a large number of '*' characters, the system will take a long time to return the results, during which time it will be using a large amount of CPU time.

CVE-2005-0256 http://marc.theaimsgroup.com/?l=bugtraq&m=110935886414939 2005-02-05 2005-04-04
hashcash -- format string vulnerability hashcash 1.17

A Gentoo Linux Security Advisory reports:

Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw in the Hashcash utility that an attacker could expose by specifying a malformed reply address.

Successful exploitation would permit an attacker to disrupt Hashcash users, and potentially execute arbitrary code.

CVE-2005-0687 http://www.gentoo.org/security/en/glsa/glsa-200503-12.xml 2005-03-06 2005-04-02 2005-04-03
clamav -- zip handling DoS vulnerability clamav 0.81 clamav-devel 20050408

The clamav daemon is vulnerable to a DoS vulnerability due to insufficient handling of malformed zip files which can crash the clamav daemon.

12408 CVE-2005-0133 http://sourceforge.net/project/shownotes.php?release_id=300116 2005-01-27 2005-03-26 2005-04-09
wine -- information disclosure due to insecure temporary file handling wine 20050310

Due to insecure temporary file creation in the Wine Windows emulator, it is possible for any user to read potentially sensitive information from temporary registry files.

When a Win32 application is launched by wine, wine makes a dump of the Windows registry in /tmp with name regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal value of the current wine process and yyyy is an integer value usually equal to zero.

regxxxxyyyy.tmp is created with 0644 (-rw-r--r--) permissions. This could represent a security problem in a multi-user environment. Indeed, any local user could access to windows regstry's dump and get sensitive information, like passwords and other private data.

CVE-2005-0787 http://marc.theaimsgroup.com/?l=bugtraq&m=111082537009842 http://bugs.winehq.org/show_bug.cgi?id=2715 http://www.securitytracker.com/alerts/2005/Mar/1013428.html http://www.zone-h.org/advisories/read/id=7300 http://www.securityfocus.com/bid/12791 http://xforce.iss.net/xforce/xfdb/19697 2005-03-13 2005-03-24
firefox -- arbitrary code execution from sidebar panel firefox 1.0.2,1 linux-firefox 1.0.2

A Mozilla Foundation Security Advisory states:

If a user bookmarked a malicious page as a Firefox sidebar panel that page could execute arbitrary programs by opening a privileged page and injecting javascript into it.

CVE-2005-0402 http://www.mozilla.org/security/announce/mfsa2005-31.html 2005-03-03 2005-03-24
mozilla -- heap buffer overflow in GIF image processing firefox 1.0.2,1 thunderbird linux-firefox 1.0.2 mozilla 1.7.6,2 1.8.*,2 linux-mozilla linux-mozilla-devel 1.7.6 1.8.* netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory states:

An (sic) GIF processing error when parsing the obsolete Netscape extension 2 can lead to an exploitable heap overrun, allowing an attacker to run arbitrary code on the user's machine.

CVE-2005-0399 http://www.mozilla.org/security/announce/mfsa2005-30.html http://xforce.iss.net/xforce/alerts/id/191 https://bugzilla.mozilla.org/show_bug.cgi?id=285595 2005-03-10 2005-03-24
sylpheed -- buffer overflow in header processing sylpheed sylpheed-claws sylpheed-gtk2 0.8.*1.0.3 1.9.*1.9.5

The Sylpheed web site states:

A buffer overflow which occurred when replying to a message with certain headers which contain non-ascii characters was fixed.

CVE-2005-0667 http://sylpheed.good-day.net/index.cgi.en#changes 2005-03-07 2005-03-23
xv -- filename handling format string vulnerability xv ja-xv 3.10a_5

A Gentoo Linux Security Advisory reports:

Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw in the handling of image filenames by xv.

Successful exploitation would require a victim to process a specially crafted image with a malformed filename, potentially resulting in the execution of arbitrary code.

CVE-2005-0665 http://www.gentoo.org/security/en/glsa/glsa-200503-09.xml 2005-03-01 2005-03-21
kdelibs -- local DCOP denial of service vulnerability ja-kdelibs kdelibs-nocups kdelibs 3.4.0

A KDE Security Advisory reports:

Sebastian Krahmer of the SUSE LINUX Security Team reported a local denial of service vulnerability in KDE's Desktop Communication Protocol (DCOP) daemon better known as dcopserver.

A local user can lock up the dcopserver of arbitrary other users on the same machine. This can cause a significant reduction in desktop functionality for the affected users including, but not limited to, the inability to browse the internet and the inability to start new applications.

CVE-2005-0396 http://www.kde.org/info/security/advisory-20050316-1.txt 2005-03-16 2005-03-21
phpmyadmin -- increased privilege vulnerability phpmyadmin phpMyAdmin 2.6.1.3

The phpMyAdmin team reports:

Escaping of the "_" character was not properly done, giving a wildcard privilege when editing db-specific privileges with phpMyAdmin.

CVE-2005-0653 http://sourceforge.net/forum/forum.php?forum_id=450948 http://sourceforge.net/tracker/index.php?func=detail&aid=1113788&group_id=23067&atid=377408 2005-02-01 2005-03-15
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.9.10.10.10

An Ethreal Security Advisories reports:

Issues have been discovered in the following protocol dissectors:

  • Matevz Pustisek discovered a buffer overflow in the Etheric dissector. CVE: CAN-2005-0704
  • The GPRS-LLC dissector could crash if the "ignore cipher bit" option was enabled. CVE: CAN-2005-0705
  • Diego Giago discovered a buffer overflow in the 3GPP2 A11 dissector. This flaw was later reported by Leon Juranic. CVE: CAN-2005-0699
  • Leon Juranic discovered a buffer overflow in the IAPP dissector. CVE: CAN-2005-0739
  • A bug in the JXTA dissector could make Ethereal crash.
  • A bug in the sFlow dissector could make Ethereal crash.
12759 CVE-2005-0699 CVE-2005-0704 CVE-2005-0705 CVE-2005-0739 http://www.ethereal.com/appnotes/enpa-sa-00018.html 2005-03-09 2005-03-14 2005-06-24
grip -- CDDB response multiple matches buffer overflow vulnerability grip 3.2.0_7

Joseph VanAndel reports that grip is vulnerability to a buffer overflow vulnerability when receiving more than 16 CDDB responses. This could lead to a crash in grip and potentially execution arbitrary code.

A workaround is to disable CDDB lookups.

12770 CVE-2005-0706 http://sourceforge.net/tracker/index.php?func=detail&aid=834724&group_id=3714&atid=103714 2003-11-02 2005-03-14 2005-03-18
mysql-server -- multiple remote vulnerabilities mysql-server 4.0.04.0.24 4.1.04.1.10a

SecurityFocus reports:

MySQL is reported prone to an insecure temporary file creation vulnerability.

Reports indicate that an attacker that has 'CREATE TEMPORARY TABLE' privileges on an affected installation may leverage this vulnerability to corrupt files with the privileges of the MySQL process.

MySQL is reported prone to an input validation vulnerability that can be exploited by remote users that have INSERT and DELETE privileges on the 'mysql' administrative database.

Reports indicate that this issue may be leveraged to load an execute a malicious library in the context of the MySQL process.

Finally, MySQL is reported prone to a remote arbitrary code execution vulnerability. It is reported that the vulnerability may be triggered by employing the 'CREATE FUNCTION' statement to manipulate functions in order to control sensitive data structures.

This issue may be exploited to execute arbitrary code in the context of the database process.

12781 CVE-2005-0709 CVE-2005-0710 CVE-2005-0711 2005-03-11 2005-03-14
rxvt-unicode -- buffer overflow vulnerability rxvt-unicode 5.3

A rxvt-unicode changelog reports:

Fix a bug that allowed to overflow a buffer via a long escape sequence, which is probably exploitable (fix by Rob Holland / Yoann Vandoorselaere / Gentoo Audit Team).

http://dist.schmorp.de/rxvt-unicode/Changes 2005-03-13 2005-03-13
phpmyadmin -- information disclosure vulnerability phpmyadmin phpMyAdmin 2.6.1.2

A phpMyAdmin security announcement reports:

By calling some scripts that are part of phpMyAdmin in an unexpected way (especially scripts in the libraries subdirectory), it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed.

Mitigation factor: This path disclosure is possible on servers where the recommended setting of the PHP configuration directive display_errors is set to on, which is against the recommendations given in the PHP manual.

CVE-2005-0544 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-2 2005-02-22 2005-03-08
phpmyadmin -- arbitrary file include and XSS vulnerabilities phpmyadmin phpMyAdmin 1.3.12.6.1.2

A phpMyAdmin security announcement reports:

We received two bug reports by Maksymilian Arciemowicz about those vulnerabilities and we wish to thank him for his work. The vulnerabilities apply to those points:

  1. css/phpmyadmin.css.php was vulnerable against $cfg and GLOBALS variable injections. This way, a possible attacker could manipulate any configuration parameter. Using phpMyAdmin's theming mechanism, he was able to include arbitrary files. This is especially dangerous if php is not running in safe mode.
  2. A possible attacker could manipulate phpMyAdmin's localized strings via the URL and inject harmful JavaScript code this way, which could be used for XSS attacks.
12644 12645 CVE-2005-0543 CVE-2005-0567 http://marc.theaimsgroup.com/?l=bugtraq&m=110929725801154 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1 2005-02-21 2005-03-08
libexif -- buffer overflow vulnerability libexif 0.6.10_1

Sylvain Defresne reports that libexif is vulnerable to a buffer overflow vulnerability due to insufficient input checking. This could lead crash of applications using libexif.

12744 CVE-2005-0664 https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7152 2005-03-03 2005-03-08
phpbb -- Insuffient check against HTML code in usercp_register.php phpbb 2.0.13

Neo Security Team reports:

If we specify a variable in the html code (any type: hidden, text, radio, check, etc) with the name allowhtml, allowbbcode or allowsmilies, is going to be on the html, bbcode and smilies in our signature.

This is a low risk vulnerability that allows users to bypass forum-wide configuration.

http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274 http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204 2005-02-28 2005-03-05 2005-03-07
postnuke -- SQL injection vulnerabilities postnuke 0.760

Two separate SQL injection vulnerabilities have been identified in the PostNuke PHP content management system. An attacker can use this vulnerability to potentially insert executable PHP code into the content management system (to view all files within the PHP scope, for instance). Various other SQL injection vulnerabilities exist, which give attackers the ability to run SQL queries on any tables within the database.

CVE-2005-0617 CVE-2005-0615 http://marc.theaimsgroup.com/?l=bugtraq&m=110962710805864 http://marc.theaimsgroup.com/?l=bugtraq&m=110962819232255 http://news.postnuke.com/Article2669.html 2005-02-28 2005-03-04
postnuke -- cross-site scripting (XSS) vulnerabilities postnuke 0.760

A cross-site scripting vulnerability is present in the PostNuke PHP content management system. By passing data injected through exploitable errors in input validation, an attacker can insert code which will run on the machine of anybody viewing the page. It is feasible that this attack could be used to retrieve session information from cookies, thereby allowing the attacker to gain administrative access to the CMS.

CVE-2005-0616 http://marc.theaimsgroup.com/?l=bugtraq&m=110962768300373 http://news.postnuke.com/Article2669.html 2005-02-28 2005-03-04
realplayer -- remote heap overflow linux-realplayer 10.0.2

Two exploits have been identified in the Linux RealPlayer client. RealNetworks states:

RealNetworks, Inc. has addressed recently discovered security vulnerabilities that offered the potential for an attacker to run arbitrary or malicious code on a customer's machine. RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities. RealNetworks takes all security vulnerabilities very seriously.

The specific exploits were:

  • Exploit 1: To fashion a malicious WAV file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.
  • Exploit 2: To fashion a malicious SMIL file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.
CVE-2005-0611 http://marc.theaimsgroup.com/?l=vulnwatch&m=110977858619314 http://service.real.com/help/faq/security/050224_player/EN/ 2005-03-01 2005-03-04
ImageMagick -- format string vulnerability ImageMagick ImageMagick-nox11 6.2.0.3

Tavis Ormandy reports:

magemagick-6.2.0-3 fixes an potential issue handling malformed filenames, the flaw may affect webapps or scripts that use the imagemagick utilities for image processing, or applications linked with libMagick.

This vulnerability could crash ImageMagick or potentially lead to the execution of arbitrary code with the permissions of the user running ImageMagick.

CVE-2005-0397 http://www.ubuntulinux.org/support/documentation/usn/usn-90-1 2005-03-02 2005-03-03
uim -- privilege escalation vulnerability ja-uim 0.4.6

The uim developers reports:

Takumi ASAKI discovered that uim always trusts environment variables. But this is not correct behavior, sometimes environment variables shouldn't be trusted. This bug causes privilege escalation when libuim is linked against setuid/setgid application. Since GTK+ prohibits setuid/setgid applications, the bug appears only in 'immodule for Qt' enabled Qt. (Normal Qt is also safe.)

CVE-2005-0503 http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html 12604 http://secunia.com/advisories/13981 2005-02-21 2005-03-01
lighttpd -- script source disclosure vulnerability lighttpd 1.3.8

The lighttpd website reports:

In lighttpd 1.3.7 and below it is possible to fetch the source files which should be handled by CGI or FastCGI applications.

The vulnerability is in the handling of urlencoded trailing NUL bytes. Installations that do not use CGI or FastCGI are not affected.

CVE-2005-0453 http://article.gmane.org/gmane.comp.web.lighttpd/1171 http://www.lighttpd.net/news/ http://xforce.iss.net/xforce/xfdb/19350 12567 2005-02-12 2005-03-01
phpbb -- privilege elevation and path disclosure phpbb 2.0.13

The phpbb developer group reports:

phpBB Group announces the release of phpBB 2.0.13, the "Beware of the furries" edition. This release addresses two recent security exploits, one of them critical. They were reported a few days after .12 was released and no one is more annoyed than us, having to release a new version ini such a short period of time. Fortunately both fixes are easy and in each case just one line needs to be edited.

http://www.phpbb.com/phpBB/viewtopic.php?t=267563 12678 2005-02-27 2005-02-28 2005-03-05
curl -- authentication buffer overflow vulnerability curl 7.13.1

Two iDEFENSE Security Advisories reports:

An exploitable stack-based buffer overflow condition exists when using NT Lan Manager (NTLM) authentication. The problem specifically exists within Curl_input_ntlm() defined in lib/http_ntlm.c.

Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using NTLM authentication.

An exploitable stack-based buffer overflow condition exists when using Kerberos authentication. The problem specifically exists within the functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c.

Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using Kerberos authentication.

12615 12616 CVE-2005-0490 http://marc.theaimsgroup.com/?l=bugtraq&m=110902850731457 http://marc.theaimsgroup.com/?l=bugtraq&m=110902601221592 2004-12-21 2005-02-27
cyrus-imapd -- multiple buffer overflow vulnerabilities cyrus-imapd 2.1.18 2.2.*2.2.11

The Cyrus IMAP Server ChangeLog states:

  • Fix possible single byte overflow in mailbox handling code.
  • Fix possible single byte overflows in the imapd annotate extension.
  • Fix stack buffer overflows in fetchnews (exploitable by peer news server), backend (exploitable by admin), and in imapd (exploitable by users though only on platforms where a filename may be larger than a mailbox name).

The 2.1.X series are reportedly only affected by the second issue.

These issues may lead to execution of arbitrary code with the permissions of the user running the Cyrus IMAP Server.

12636 CVE-2005-0546 http://asg.web.cmu.edu/cyrus/download/imapd/changes.html 2005-02-14 2005-02-27 2005-04-05
sup -- format string vulnerability sup 2.0.20050226

Debian Security Advisory reports:

jaguar@felinemenace.org discovered a format string vulnerability in sup, a set of programs to synchronize collections of files across a number of machines, whereby a remote attacker could potentially cause arbitrary code to be executed with the privileges of the supfilesrv process (this process does not run automatically by default).

10571 CVE-2004-0451 http://www.securityfocus.com/advisories/6874 2004-06-19 2005-02-27
mozilla -- insecure temporary directory vulnerability firefox 1.0.1,1 mozilla 1.7.6,2 linux-mozilla linux-mozilla-devel 1.7.6 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

A predictable name is used for the plugin temporary directory. A malicious local user could symlink this to the victim's home directory and wait for the victim to run Firefox. When Firefox shuts down the victim's directory would be erased.

http://www.mozilla.org/security/announce/mfsa2005-28.html https://bugzilla.mozilla.org/show_bug.cgi?id=281284 2005-02-06 2005-02-26
mozilla -- arbitrary code execution vulnerability firefox 1.0.1,1 mozilla 1.7.6,2 linux-mozilla linux-mozilla-devel 1.7.6 netscape7 0 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0 de-linux-netscape de-netscape7 fr-linux-netscape fr-netscape7 ja-linux-netscape ja-netscape7 linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk1 mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix pt_BR-netscape7 0

A Mozilla Foundation Security Advisory reports:

Plugins (such as flash) can be used to load privileged content into a frame. Once loaded various spoofs can be applied to get the user to interact with the privileged content. Michael Krax's "Fireflashing" example demonstrates that an attacker can open about:config in a frame, hide it with an opacity setting, and if the attacker can get the victim to click at a particular spot (design some kind of simple game) you could toggle boolean preferences, some of which would make further attacks easier.

The "firescrolling" example demonstrates arbitrary code execution (in this case downloading a file) by convincing the user to scroll twice.

Workaround: Disable JavaScript.

CVE-2005-0527 http://www.mikx.de/fireflashing/ http://www.mikx.de/firescrolling/ http://www.mozilla.org/security/announce/mfsa2005-27.html 2005-02-24 2005-02-26
mkbold-mkitalic -- format string vulnerability mkbold-mkitalic 0.07

The version 0.06_1 and prior have a format string vulnerability which can be triggered by using a carefully-crafted BDF font file.

http://home.jp.FreeBSD.org/cgi-bin/showmail/ports-jp/15568 2005-02-23 2005-02-24
phpbb -- multiple information disclosure vulnerabilities phpbb 2.0.12

psoTFX reports:

phpBB Group are pleased to announce the release of phpBB 2.0.12 the "Horray for Furrywood" release. This release addresses a number of bugs and a couple of potential exploits. [...] one of the potential exploits addressed in this release could be serious in certain situations and thus we urge all users, as always, to upgrade to this release as soon as possible. Mostly this release is concerned with eliminating disclosures of information which while useful in debug situations may allow third parties to gain information which could be used to do harm via unknown or unfixed exploits in this or other applications.

The ChangeLog for phpBB 2.0.12 states:

  • Prevented full path display on critical messages
  • Fixed full path disclosure in username handling caused by a PHP 4.3.10 bug - AnthraX101
  • Added exclude list to unsetting globals (if register_globals is on) - SpoofedExistence
  • Fixed arbitrary file disclosure vulnerability in avatar handling functions - AnthraX101
  • Fixed arbitrary file unlink vulnerability in avatar handling functions - AnthraX101
  • Fixed path disclosure bug in search.php caused by a PHP 4.3.10 bug (related to AnthraX101's discovery)
  • Fixed path disclosure bug in viewtopic.php caused by a PHP 4.3.10 bug - matrix_killer
http://www.phpbb.com/support/documents.php?mode=changelog http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=265423 ports/77943 2005-02-22 2005-02-23 2005-02-25
unace -- multiple vulnerabilities unace 1.2b_2 linux-unace 0

Ulf Härnhammar reports:

  • There are buffer overflows when extracting, testing or listing specially prepared ACE archives.
  • There are directory traversal bugs when extracting ACE archives.
  • There are also buffer overflows when dealing with long (>17000 characters) command line arguments.

Secunia reports:

The vulnerabilities have been confirmed in version 1.2b. One of the buffer overflow vulnerabilities have also been reported in version 2.04, 2.2 and 2.5. Other versions may also be affected.

Successful exploitation may allow execution of arbitrary code.

215006 CVE-2005-0160 CVE-2005-0161 http://marc.theaimsgroup.com/?l=full-disclosure&m=110911451613135 http://secunia.com/advisories/14359/ 2005-02-14 2005-02-22 2006-09-26
putty -- pscp/psftp heap corruption vulnerabilities putty 0.57

Simon Tatham reports:

This version fixes a security hole in previous versions of PuTTY, which can allow a malicious SFTP server to attack your client. If you use either PSCP or PSFTP, you should upgrade. Users of the main PuTTY program are not affected. (However, note that the server must have passed host key verification before this attack can be launched, so a man-in-the-middle shouldn't be able to attack you if you're careful.)

12601 CVE-2005-0467 http://lists.tartarus.org/pipermail/putty-announce/2005/000012.html http://marc.theaimsgroup.com/?l=bugtraq&m=110902510713763 http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-readdir.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-sftp-string.html 2005-02-20 2005-02-20 2005-02-23
kdelibs -- insecure temporary file creation kdelibs ja-kdelibs 3.3.2_5

Davide Madrisan reports:

The `dcopidlng' script in the KDE library package (kdelibs-3.3.2/dcop/dcopidlng/dcopidlng) creates temporary files in a unsecure manner.

Note: dcopidlng is only used at build time, so only users installing KDE are vulnerable, not users already running KDE.

CVE-2005-0365 http://bugs.kde.org/show_bug.cgi?id=97608 http://marc.theaimsgroup.com/?l=bugtraq&m=110814653804757 2005-01-21 2005-02-18 2005-02-20
bidwatcher -- format string vulnerability bidwatcher 1.3.17

A Debian Security Advisory reports:

Ulf Härnhammer from the Debian Security Audit Project discovered a format string vulnerability in bidwatcher, a tool for watching and bidding on eBay auctions. This problem can be triggered remotely by a web server of eBay, or someone pretending to be eBay, sending certain data back.

12590 CVE-2005-0158 http://www.debian.org/security/2005/dsa-687 2005-02-18 2005-02-18
gftp -- directory traversal vulnerability gftp 2.0.18

A Debian Security Advisory reports:

Albert Puigsech Galicia discovered a directory traversal vulnerability in a proprietary FTP client (CAN-2004-1376) which is also present in gftp, a GTK+ FTP client. A malicious server could provide a specially crafted filename that could cause arbitrary files to be overwritten or created by the client.

12539 CVE-2005-0372 http://www.debian.org/security/2005/dsa-686 http://www.gftp.org/changelog.html 2005-02-04 2005-02-18
opera -- "data:" URI handler spoofing vulnerability opera opera-devel linux-opera 7.54.20050131

A Secunia Advisory reports:

Michael Holzt has discovered a vulnerability in Opera, which can be exploited by malicious people to trick users into executing malicious files.

The vulnerability is caused due to an error in the processing of "data:" URIs, causing wrong information to be shown in a download dialog. This can be exploited by e.g. a malicious website to trick users into executing a malicious file by supplying a specially crafted "data:" URI.

CVE-2005-0456 882926 http://secunia.com/advisories/13818/ http://www.opera.com/freebsd/changelogs/754u2/ 2005-01-12 2005-02-18
opera -- kfmclient exec command execution vulnerability opera opera-devel linux-opera 7.54.20050131

Giovanni Delvecchio reports:

Opera for linux uses "kfmclient exec" as "Default Application" to handle saved files. This could be used by malicious remote users to execute arbitrary shell commands on a target system.

CVE-2004-1491 http://secunia.com/advisories/13447/ http://www.opera.com/freebsd/changelogs/754u2/ http://www.zone-h.org/advisories/read/id=6503 2004-12-12 2005-02-18
postgresql -- multiple buffer overflows in PL/PgSQL parser postgresql postgresql-server ja-postgresql 7.3.9_1 7.4.*7.4.7_1 8.*8.0.1_1

The PL/PgSQL parser in postgresql is vulnerable to several buffer overflows. These could be exploited by a remote attacker to execute arbitrary code with the permissions of the postgresql server by running a specially crafted query.

CVE-2005-0247 http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php 2005-02-07 2005-02-17 2005-02-19
awstats -- arbitrary command execution awstats 6.4

Several input validation errors exist in AWStats that allow a remote unauthenticated attacker to execute arbitrary commands with the priviliges of the web server. These programming errors involve CGI parameters including loadplugin, logfile, pluginmode, update, and possibly others.

Additionally, the debug and other CGI parameters may be used to cause AWStats to disclose AWStats and system configuration information.

CVE-2005-0362 CVE-2005-0363 CVE-2005-0435 CVE-2005-0436 CVE-2005-0437 CVE-2005-0438 12543 12545 http://marc.theaimsgroup.com/?l=bugtraq&m=110840530924124 http://awstats.sourceforge.net/docs/awstats_changelog.txt http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=294488 http://packetstormsecurity.nl/0501-exploits/AWStatsVulnAnalysis.pdf 2005-02-10 2005-02-16 2005-02-23
powerdns -- DoS vulnerability powerdns 2.9.17

PowerDNS is vulnerable to a temporary denial-of-service vulnerability that can be triggered using a random stream of bytes.

12446 http://ds9a.nl/cgi-bin/cvstrac/pdns/tktview?tn=21 http://doc.powerdns.com/changelog.html#CHANGELOG-2-9-17 2004-09-18 2005-02-14
emacs -- movemail format string vulnerability movemail 1.0 zh-emacs emacs 20.7_4 21.*21.3_4 xemacs xemacs-mule zh-xemacs zh-xemacs-mule 21.4.17 xemacs-devel 21.5.b19,1 xemacs-devel-21.5 b11 xemacs-devel-mule 21.5.b19 mule-common hanemacs 0

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs. They can be exploited when connecting to a malicious POP server and can allow an attacker can execute arbitrary code under the privileges of the user running Emacs.

CVE-2005-0100 12462 2005-01-31 2005-02-14
ngircd -- format string vulnerability ngircd 0.8.3

A No System Group security advisory reports that ngircd is vulnerable to a format string vulnerability in the Log_Resolver() function of log.c, if IDENT support is enabled. This could allow a remote attacker to execute arbitrary code with the permissions of the ngircd daemon, which is root by default.

Note: By default the FreeBSD ngircd port does not enable IDENT support.

CVE-2005-0226 12434 http://marc.theaimsgroup.com/?l=bugtraq&m=110746413108183 2005-02-03 2005-02-13
ngircd -- buffer overflow vulnerability ngircd 0.8.2

Florian Westphal discovered a buffer overflow in ngircd which can be used remotely crash the server and possibly execute arbitrary code.

CVE-2005-0199 12397 http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html 2005-01-26 2005-02-13
mod_python -- information leakage vulnerability mod_python 2.7.11 3.*3.1.4

Mark J Cox reports:

Graham Dumpleton discovered a flaw which can affect anyone using the publisher handle of the Apache Software Foundation mod_python. The publisher handle lets you publish objects inside modules to make them callable via URL. The flaw allows a carefully crafted URL to obtain extra information that should not be visible (information leak).

CVE-2005-0088 2005-01-30 2005-02-13
mailman -- directory traversal vulnerability mailman ja-mailman 2.1.5_2

A directory traversal vulnerability in mailman allow remote attackers to read arbitrary files due to inadequate input sanitizing. This could, among other things, lead remote attackers to gaining access to the mailman configuration database (which contains subscriber email addresses and passwords) or to the mail archives for private lists.

CVE-2005-0202 http://marc.theaimsgroup.com/?l=full-disclosure&m=110797575304304 2005-01-02 2005-02-12
enscript -- multiple vulnerabilities enscript-a4 enscript-letter enscript-letterdj 1.6.4_1

Erik Sjölund discovered several issues in enscript: it suffers from several buffer overflows, quotes and shell escape characters are insufficiently sanitized in filenames, and it supported taking input from an arbitrary command pipe, with unwanted side effects.

CVE-2004-1184 CVE-2004-1185 CVE-2004-1186 http://www.gentoo.org/security/en/glsa/glsa-200502-03.xml 2005-02-02 2005-02-11
postgresql -- privilege escalation vulnerability postgresql postgresql-server ja-postgresql 7.3.9 7.4.*7.4.7 8.*8.0.1 postgresql-devel 8.0.1,1

John Heasman and others disovered that non-privileged users could use the LOAD extension to load arbitrary libraries into the postgres server process space. This could be used by non-privileged local users to execute arbitrary code with the privileges of the postgresql server.

12411 CVE-2005-0227 http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php 2005-01-21 2005-02-08
ethereal -- multiple protocol dissectors vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.8.100.10.9

An Ethreal Security Advisories reports:

Issues have been discovered in the following protocol dissectors:

  • The COPS dissector could go into an infinite loop. CVE: CAN-2005-0006
  • The DLSw dissector could cause an assertion. CVE: CAN-2005-0007
  • The DNP dissector could cause memory corruption. CVE: CAN-2005-0008
  • The Gnutella dissector could cuase an assertion. CVE: CAN-2005-0009
  • The MMSE dissector could free statically-allocated memory. CVE: CAN-2005-0010
  • The X11 dissector is vulnerable to a string buffer overflow. CVE: CAN-2005-0084

Impact: It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

CVE-2005-0006 CVE-2005-0007 CVE-2005-0008 CVE-2005-0009 CVE-2005-0010 CVE-2005-0084 12326 http://www.ethereal.com/appnotes/enpa-sa-00017.html 2005-01-18 2005-02-08
squid -- correct handling of oversized HTTP reply headers squid 2.5.7_12

The squid patches page notes:

This patch addresses a HTTP protocol mismatch related to oversized reply headers. In addition it enhances the cache.log reporting on reply header parsing failures to make it easier to track down which sites are malfunctioning.

It is believed that this bug may lead to cache pollution or allow access controls to be bypassed.

CVE-2005-0241 http://www.squid-cache.org/bugs/show_bug.cgi?id=1216 http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch ports/76967 823350 2005-01-31 2005-02-08
python -- SimpleXMLRPCServer.py allows unrestricted traversal python python+ipv6 2.22.2.3_7 2.32.3.4_4 2.42.4_1 2.5.a0.200501292.5.a0.20050129_1

According to Python Security Advisory PSF-2005-001,

The Python development team has discovered a flaw in the SimpleXMLRPCServer library module which can give remote attackers access to internals of the registered object or its module or possibly other modules. The flaw only affects Python XML-RPC servers that use the register_instance() method to register an object without a _dispatch() method. Servers using only register_function() are not affected.

On vulnerable XML-RPC servers, a remote attacker may be able to view or modify globals of the module(s) containing the registered instance's class(es), potentially leading to data loss or arbitrary code execution. If the registered object is a module, the danger is particularly serious. For example, if the registered module imports the os module, an attacker could invoke the os.system() function.

Note: This vulnerability affects your system only if you're running SimpleXMLRPCServer-based server. This isn't harmful at all if you don't run any internet server written in Python or your server doesn't serve in XML-RPC protocol.

CVE-2005-0089 http://www.python.org/security/PSF-2005-001/ 2005-02-03 2005-02-03 2006-10-08
perl -- vulnerabilities in PERLIO_DEBUG handling perl perl-threaded 5.85.8.6_2

Kevin Finisterre discovered bugs in perl's I/O debug support:

  • The environmental variable PERLIO_DEBUG is honored even by the set-user-ID perl command (usually named sperl or suidperl). As a result, a local attacker may be able to gain elevated privileges. (CVE-2005-0155)
  • A buffer overflow may occur in threaded versions of perl when the full pathname of the script being executed is very long. (CVE-2005-0156).

Note: By default, no set-user-ID perl binary is installed. An administrator must enable it manually at build time with the ENABLE_SUIDPERL port flag.

CVE-2005-0155 CVE-2005-0156 2005-02-02 2005-02-02 2007-11-07
newsgrab -- insecure file and directory creation newsgrab 0.4.0

The newsgrab script uses insecure permissions during the creation of the local output directory and downloaded files.

After a file is created, permissions on it are set using the mode value of the newsgroup posting. This can potentially be a problem when the mode is not restrictive enough. In addition, the output directory is created with world writable permissions allowing other users to drop symlinks or other files at that location.

http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt http://sourceforge.net/project/shownotes.php?release_id=300562 CVE-2005-0154 2005-01-18 2005-02-01
newsgrab -- directory traversal vulnerability newsgrab 0.4.0

The newsgrab script creates files by using the names provided in the newsgroup messages in a perl open() call. This is done without performing any security checks to prevent a directory traversal. A specially crafted newsgroup message could cause newsgrab to drop an attachment anywhere on the file system using the permissions of the user running the script.

http://people.freebsd.org/~niels/issues/newsgrab-20050114.txt http://sourceforge.net/project/shownotes.php?release_id=300562 CVE-2005-0153 2005-01-18 2005-02-01
newspost -- server response buffer overflow vulnerability newspost 2.1.1

The newspost program uses a function named socket_getline to read server responses from the network socket. Unfortunately this function does not check the length of the buffer in which the read data is stored and only stops reading when a newline character is found.

A malicious NNTP server could use this bug to cause a buffer overflow by sending an overly long response. Such an overflow allows arbitrary code to be executed, with the privileges of the newspost process, on the affected systems.

http://people.freebsd.org/~niels/issues/newspost-20050114.txt CVE-2005-0101 2005-01-14 2005-02-01
newsfetch -- server response buffer overflow vulnerability newsfetch 1.21_1

The newsfetch program uses the sscanf function to read information from server responses into static memory buffers. Unfortunately this is done without any proper bounds checking. As a result long server responses may cause an overflow when a newsgroup listing is requested from an NNTP server.

http://people.freebsd.org/~niels/issues/newsfetch-20050119.txt CVE-2005-0132 2005-01-18 2005-02-01
squid -- buffer overflow in WCCP recvfrom() call squid 2.5.7_10

According to the Squid Proxy Cache Security Update Advisory SQUID-2005:3,

The WCCP recvfrom() call accepts more data than will fit in the allocated buffer. An attacker may send a larger-than-normal WCCP message to Squid and overflow this buffer.

Severity:

The bug is important because it allows remote attackers to crash Squid, causing a disription in service. However, the bug is exploitable only if you have configured Squid to send WCCP messages to, and expect WCCP replies from, a router.

Sites that do not use WCCP are not vulnerable.

Note that while the default configuration of the FreeBSD squid port enables WCCP support in general, the default configuration supplied does not actually configure squid to send and receive WCCP messages.

CVE-2005-0211 886006 http://www.squid-cache.org/Advisories/SQUID-2005_3.txt http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_buffer_overflow http://www.squid-cache.org/bugs/show_bug.cgi?id=1217 2005-01-28 2005-01-28 2005-02-13
xpdf -- makeFileKey2() buffer overflow vulnerability xpdf 3.00_6 kdegraphics 3.3.2_2 gpdf 2.8.3 teTeX-base 2.0.2_9 cups-base 1.1.23.0_3 koffice 1.3.5_2,1 pdftohtml 0.36_2

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow vulnerability in the xpdf PDF viewer included in multiple Unix and Linux distributions could allow for arbitrary code execution as the user viewing a PDF file.

The vulnerability specifically exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. The offending code can be found in the Decrypt::makeFileKey2 function in the source file xpdf/Decrypt.cc.

CVE-2005-0064 http://marc.theaimsgroup.com/?l=bugtraq&m=110608898221554 http://www.koffice.org/security/advisory-20050120-1.txt 2005-01-06 2005-01-26 2005-02-03
zhcon -- unauthorized file access zhcon zh-zhcon 0.2.3_3

Martin Joey Schulze reports:

Erik Sjöund discovered that zhcon, a fast console CJK system using the Linux framebuffer, accesses a user-controlled configuration file with elevated privileges. Thus, it is possible to read arbitrary files.

When installed from the FreeBSD Ports Collection, zhcon is installed set-user-ID root.

CVE-2005-0072 2005-01-25 2005-01-25
evolution -- arbitrary code execution vulnerability evolution 2.0.3_1

Martin Joey Schulze reports:

Max Vozeler discovered an integer overflow in the helper application camel-lock-helper which runs setuid root or setgid mail inside of Evolution, a free groupware suite. A local attacker can cause the setuid root helper to execute arbitrary code with elevated privileges via a malicious POP server.

12354 CVE-2005-0102 http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&view=log#rev1.5.74.1 2005-01-20 2005-01-25 2005-02-02
mod_dosevasive -- insecure temporary file creation mod_dosevasive20 1.10

An LSS Security Advisory reports:

When a denial of service attack is detected, mod_dosevasive will, among other things, create a temporary file which it will use to trace actions from the offensive IP address. This file is insecurely created in /tmp and it's name is easily predictable.

It is then easy for an attacker to create arbitrary files in any directory that the user under which apache runs has privileges to write.

[...] once the target file is opened, there is a race attack (although difficult to exploit) which can lead to mod_dosevasive overwriting any file that the user under which apache runs has privileges to write.

ports/77513 http://security.lss.hr/en/index.php?page=details&ID=LSS-2005-01-01 2005-01-04 2005-01-24 2005-02-22
squid -- possible cache-poisoning via malformed HTTP responses squid 2.5.7_9

The squid patches page notes:

This patch makes Squid considerably stricter while parsing the HTTP protocol.

  1. A Content-length header should only appear once in a valid request or response. Multiple Content-length headers, in conjunction with specially crafted requests, may allow Squid's cache to be poisoned with bad content in certain situations.
  2. CR characters is only allowed as part of the CR NL line terminator, not alone. This to ensure that all involved agrees on the structure of HTTP headers.
  3. Rejects requests/responses that have whitespace in an HTTP header name.

To enable these strict parsing rules, update to at least squid-2.5.7_9 and specify relaxed_header_parser off in squid.conf.

CVE-2005-0174 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing 768702 2005-01-24 2005-01-24 2006-01-02
bugzilla -- cross-site scripting vulnerability bugzilla ja-bugzilla 2.16.8 2.17.*2.18

A Bugzilla advisory states:

This advisory covers a single cross-site scripting issue that has recently been discovered and fixed in the Bugzilla code: If a malicious user links to a Bugzilla site using a specially crafted URL, a script in the error page generated by Bugzilla will display the URL unaltered in the page, allowing scripts embedded in the URL to execute.

CVE-2004-1061 http://www.bugzilla.org/security/2.16.7-nr/ https://bugzilla.mozilla.org/show_bug.cgi?id=272620 2004-12-01 2005-01-24
web browsers -- window injection vulnerabilities firefox 1.0.1,1 mozilla 1.7.6,2 linux-mozilla linux-mozilla-devel 1.7.6 de-linux-mozillafirebird el-linux-mozillafirebird ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 mozilla-gtk1 0 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0 kdebase kdelibs 3.3.2 opera opera-devel linux-opera 7.54.20050131

A Secunia Research advisory reports:

Secunia Research has reported a vulnerability in multiple browsers, which can be exploited by malicious people to spoof the content of websites.

The problem is that a website can inject content into another site's window if the target name of the window is known. This can e.g. be exploited by a malicious website to spoof the content of a pop-up window opened on a trusted website.

Secunia has constructed a test, which can be used to check if your browser is affected by this issue: http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

A workaround for Mozilla-based browsers is available.

http://secunia.com/secunia_research/2004-13/advisory/ http://secunia.com/multiple_browsers_window_injection_vulnerability_test/ CVE-2004-1156 http://secunia.com/advisories/13129/ https://bugzilla.mozilla.org/show_bug.cgi?id=273699 https://bugzilla.mozilla.org/show_bug.cgi?id=103638 http://mozillanews.org/?article_date=2004-12-08+06-48-46 CVE-2004-1157 http://secunia.com/advisories/13253/ CVE-2004-1158 http://secunia.com/advisories/13254/ http://www.kde.org/info/security/advisory-20041213-1.txt CVE-2004-1160 http://secunia.com/advisories/13402/ 2004-12-08 2005-01-24 2005-02-26
yamt -- arbitrary command execution vulnerability yamt 0.5_2

Manigandan Radhakrishnan discovered a security vulnerability in YAMT which can lead to execution of arbitrary commands with the privileges of the user running YAMT when sorting based on MP3 tags. The problem exist in the id3tag_sort() routine which does not properly sanitize the artist tag from the MP3 file before using it as an argument to the mv command.

11999 CVE-2004-1302 http://tigger.uic.edu/~jlongs2/holes/yamt.txt 2004-12-15 2005-01-23 2005-01-25
squid -- HTTP response splitting cache pollution attack squid 2.5.7_8

According to a whitepaper published by Sanctum, Inc., it is possible to mount cache poisoning attacks against, among others, squid proxies by inserting false replies into the HTTP stream.

The squid patches page notes:

This patch additionally strengthens Squid from the HTTP response attack described by Sanctum.

CVE-2005-0175 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting http://www.squid-cache.org/bugs/show_bug.cgi?id=1200 https://www.watchfire.com/securearea/whitepapers.aspx?id=8 625878 2004-03-01 2005-01-22 2005-02-07
horde -- XSS vulnerabilities horde horde-php5 3.*3.0.1

A Hyperdose Security Advisory reports:

Horde contains two XSS attacks that can be exploited through GET requests. Once exploited, these requests could be used to execute any javascript commands in the context of that user, potentially including but not limited to reading and deleting email, and stealing auth tokens.

12255 http://marc.theaimsgroup.com/?l=bugtraq&m=110564059322774 http://lists.horde.org/archives/announce/2005/000159.html 2005-01-04 2005-01-22
mc -- multiple vulnerabilities mc 4.6.0

Andrew V. Samoilov reported several vulnerabilities that were corrected in MidnightCommand 4.6.0:

  • Format string issues (CVE-2004-1004)
  • Buffer overflows (CVE-2004-1005)
  • Denial-of-service, infinite loop (CVE-2004-1009)
  • Denial-of-service, corrupted section header (CVE-2004-1090)
  • Denial-of-service, null pointer dereference (CVE-2004-1091)
  • Freeing unallocated memory (CVE-2004-1092)
  • Using already freed memory (CVE-2004-1093)
CVE-2004-1004 CVE-2004-1005 CVE-2004-1009 CVE-2004-1090 CVE-2004-1091 CVE-2004-1092 CVE-2004-1093 2004-12-01 2005-01-21
perl -- File::Path insecure file/directory permissions perl perl-threaded 05.6.2 5.8.05.8.6

Jeroen van Wolffelaar reports that the Perl module File::Path contains a race condition wherein traversed directories and files are temporarily made world-readable/writable.

CVE-2004-0452 http://www.debian.org/security/2004/dsa-620 http://xforce.iss.net/xforce/xfdb/18650 2004-12-30 2005-01-21 2007-11-07
opera -- multiple vulnerabilities in Java implementation opera opera-devel linux-opera 7.54.20041210

Marc Schoenefeld reports:

Opera 7.54 is vulnerable to leakage of the java sandbox, allowing malicious applets to gain unacceptable privileges. This allows them to be used for information gathering (spying) of local identity information and system configurations as well as causing annoying crash effects.

Opera 754 [sic] which was released Aug 5,2004 is vulnerable to the XSLT processor covert channel attack, which was corrected with JRE 1.4.2_05 [released in July 04], but in disadvantage to the users the opera packaging guys chose to bundle the JRE 1.4.2_04 [...]

Internal pointer DoS exploitation: Opera.jar contains the opera replacement of the java plugin. It therefore handles communication between javascript and the Java VM via the liveconnect protocol. The public class EcmaScriptObject exposes a system memory pointer to the java address space, by constructing a special variant of this type an internal cache table can be polluted by false entries that infer proper function of the JSObject class and in the following proof-of-concept crash the browser.

Exposure of location of local java installation Sniffing the URL classpath allows to retrieve the URLs of the bootstrap class path and therefore the JDK installation directory.

Exposure of local user name to an untrusted applet An attacker could use the sun.security.krb5.Credentials class to retrieve the name of the currently logged in user and parse his home directory from the information which is provided by the thrown java.security.AccessControlException.

http://marc.theaimsgroup.com/?l=bugtraq&m=110088923127820 2004-11-19 2005-01-24
sudo -- environmental variable CDPATH is not cleared sudo 1.6.8.4

A sudo bug report says:

sudo doesn't unset the CDPATH variable, which leads to possible security problems.

http://www.sudo.ws/bugs/show_bug.cgi?id=155 http://www.sudo.ws/pipermail/sudo-announce/2004-November/000044.html 2004-10-18 2005-01-21 2013-06-19
fcron -- multiple vulnerabilities fcron 2.9.5.1

An iDEFENSE Security Advisory states:

Multiple vulnerabilities have been found in Fcron.

  1. File contents disclosure
  2. Configuration Bypass Vulnerability
  3. File Removal and Empty File Creation Vulnerability
  4. Information Disclosure Vulnerability
http://www.idefense.com/application/poi/display?id=157&type=vulnerabilities&flashstatus=false CVE-2004-1030 CVE-2004-1031 CVE-2004-1032 CVE-2004-1033 2004-11-15 2005-01-21
realplayer -- arbitrary file deletion and other vulnerabilities linux-realplayer 10.0.2

An NGSSoftware Insight Security Research Advisory reports:

Two vulnerabilities have been discovered in RealPlayer which may potentially be leveraged to allow remote code execution, or may used in combination with the Real Metadata Package File Deletion vulnerability to reliably delete files from a users system.

http://www.ngssoftware.com/advisories/real-02full.txt http://www.ngssoftware.com/advisories/real-03full.txt http://service.real.com/help/faq/security/040928_player/EN/ 2004-10-06 2005-01-21
imlib -- xpm heap buffer overflows and integer overflows imlib 1.9.15_2 imlib2 1.1.2_1

Pavel Kankovsky reports:

Imlib affected by a variant of CAN-2004-0782 too.

I've discovered more vulnerabilities in Imlib (1.9.13). In particular, it appears to be affected by a variant of Chris Evans' libXpm flaw #1 (CAN-2004-0782, see http://scary.beasts.org/security/CESA-2004-003.txt). Look at the attached image, it kills ee on my 7.3.

The flaws also affect imlib2.

CVE-2004-1025 CVE-2004-1026 11830 https://bugzilla.fedora.us/show_bug.cgi?id=2051#c11 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=138516 http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/src/modules/loaders/loader_xpm.c#rev1.3 2004-12-06 2005-01-21
egroupware -- arbitrary file download in JiNN eGroupWare 1.0.0.006

eGroupWare contains a bug in the JiNN component that allows a remote attacker to download arbitrary files.

http://cvs.sourceforge.net/viewcvs.py/egroupware/jinn/CHANGELOG#rev1.24 http://sourceforge.net/mailarchive/forum.php?thread_id=5915445&forum_id=35178 2004-10-15 2005-01-21
quake2 -- multiple critical vulnerabilities quake2forge 0 quake2lnx 0.16.2

An advisory published by Richard Stanway describes numerous critical vulnerabilities in the Quake II engine:

Due to unchecked input at various stages in the server, remote users are able to cause the server to crash, reveal sensitive information or potentially execute arbitrary code.

http://secur1ty.net/advisories/001 http://marc.theaimsgroup.com/?l=bugtraq&m=109892527321706 2004-10-27 2005-01-21 2005-03-15
konversation -- shell script command injection konversation 0.15

Konversation comes with Perl scripts that do not properly escape shell characters on executing a script. This makes it possible to attack Konversation with shell script command injection.

CVE-2005-0129 CVE-2005-0130 CVE-2005-0131 http://marc.theaimsgroup.com/?l=full-disclosure&m=110616016509114 2005-01-19 2005-01-19 2005-01-21
squid -- no sanity check of usernames in squid_ldap_auth squid 2.5.7_7

The LDAP authentication helper did not strip leading or trailing spaces from the login name. According to the squid patches page:

LDAP is very forgiving about spaces in search filters and this could be abused to log in using several variants of the login name, possibly bypassing explicit access controls or confusing accounting.

Workaround: Block logins with spaces

	    acl login_with_spaces proxy_auth_regex [:space:]
		    http_access deny login_with_spaces
	    
CVE-2005-0173 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-ldap_spaces http://www.squid-cache.org/bugs/show_bug.cgi?id=1187 924198 2005-01-10 2005-01-19 2005-02-08
cups-base -- CUPS server remote DoS vulnerability cups-base 1.1.211.1.23

Kenshi Muto discovered that the CUPS server would enter an infinite loop when processing a URL containing /...

12200 CVE-2005-2874 http://www.cups.org/str.php?L1042 2004-12-30 2005-01-18 2005-09-21
tiff -- divide-by-zero denial-of-service tiff linux-tiff 3.6.0 pdflib pdflib-perl 6.0.1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

A US-CERT vulnerability note reports:

An Integer overflow in the LibTIFF library may allow a remote attacker to cause a divide-by-zero error that results in a denial-of-service condition.

CVE-2004-0804 555304 http://bugzilla.remotesensing.org/show_bug.cgi?id=111 2002-03-27 2005-01-18 2006-06-08
zgv -- exploitable heap overflows zgv 5.8_1 xzgv 0.8_2

infamous41md reports:

zgv uses malloc() frequently to allocate memory for storing image data. When calculating how much to allocate, user supplied data from image headers is multiplied and/or added without any checks for arithmetic overflows. We can overflow numerous calculations, and cause small buffers to be allocated. Then we can overflow the buffer, and eventually execute code. There are a total of 11 overflows that are exploitable to execute arbitrary code.

These bugs exist in both zgv and xzgv.

http://marc.theaimsgroup.com/?l=bugtraq&m=109886210702781 http://marc.theaimsgroup.com/?l=bugtraq&m=109898111915661 http://rus.members.beeb.net/xzgv.html http://www.svgalib.org/rus/zgv/ CVE-2004-0994 http://www.idefense.com/application/poi/display?id=160&type=vulnerabilities&flashstatus=false 2004-10-26 2005-01-18 2005-01-21
mozilla -- insecure permissions for some downloaded files thunderbird 0.9 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 1.0.r2,1 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7.5 mozilla 1.7.5,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

In a Mozilla bug report, Daniel Kleinsinger writes:

I was comparing treatment of attachments opened directly from emails on different platforms. I discovered that Linux builds save attachments in /tmp with world readable rights. This doesn't seem like a good thing. Couldn't someone else logged onto the same machine read your attachments?

This could expose the contents of downloaded files or email attachments to other users on a multi-user system.

https://bugzilla.mozilla.org/show_bug.cgi?id=251297 http://marc.theaimsgroup.com/?l=full-disclosure&m=109865078103911 2004-07-13 2005-01-18
awstats -- remote command execution vulnerability awstats 6.3

An iDEFENSE Security Advisory reports:

Remote exploitation of an input validation vulnerability in AWStats allows attackers to execute arbitrary commands under the privileges of the web server.

The problem specifically exists when the application is running as a CGI script on a web server. The "configdir" parameter contains unfiltered user-supplied data that is utilized in a call to the Perl routine open()...

Successful exploitation allows remote attackers to execute arbitrary commands under the privileges of the web server. This can lead to further compromise as it provides remote attackers with local access.

12270 CVE-2005-0116 272296 http://marc.theaimsgroup.com/?l=full-disclosure&m=110600949323439 http://awstats.sourceforge.net/docs/awstats_changelog.txt http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false 2004-10-21 2005-01-18 2005-02-23
ImageMagick -- PSD handler heap overflow vulnerability ImageMagick ImageMagick-nox11 6.1.8.8

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow vulnerability in The ImageMagick's Project's ImageMagick PSD image-decoding module could allow an attacker to execute arbitrary code.

Exploitation may allow attackers to run arbitrary code on a victim's computer if the victim opens a specially formatted image. Such images could be delivered by e-mail or HTML, in some cases, and would likely not raise suspicion on the victim's part. Exploitation is also possible when a web-based application uses ImageMagick to process user-uploaded image files.

CVE-2005-0005 http://www.idefense.com/application/poi/display?id=184&type=vulnerabilities 2004-12-21 2005-01-18
cups-lpr -- lppasswd multiple vulnerabilities cups-lpr fr-cups-lpr 1.1.23

D. J. Bernstein reports that Bartlomiej Sieka has discovered several security vulnerabilities in lppasswd, which is part of CUPS. In the following excerpt from Bernstein's email, CVE names have been added for each issue:

First, lppasswd blithely ignores write errors in fputs(line,outfile) at lines 311 and 315 of lppasswd.c, and in fprintf(...) at line 346. An attacker who fills up the disk at the right moment can arrange for /usr/local/etc/cups/passwd to be truncated. (CAN-2004-1268)

Second, if lppasswd bumps into a file-size resource limit while writing passwd.new, it leaves passwd.new in place, disabling all subsequent invocations of lppasswd. Any local user can thus disable lppasswd... (CAN-2004-1269)

Third, line 306 of lppasswd.c prints an error message to stderr but does not exit. This is not a problem on systems that ensure that file descriptors 0, 1, and 2 are open for setuid programs, but it is a problem on other systems; lppasswd does not check that passwd.new is different from stderr, so it ends up writing a user-controlled error message to passwd if the user closes file descriptor 2. (CAN-2004-1270)

Note: The third issue, CVE-2004-1270, does not affect FreeBSD 4.6-RELEASE or later systems, as these systems ensure that the file descriptors 0, 1, and 2 are always open for set-user-ID and set-group-ID programs.

CVE-2004-1268 CVE-2004-1269 CVE-2004-1270 12007 12004 http://www.cups.org/str.php?L1023 http://tigger.uic.edu/~jlongs2/holes/cups2.txt 2004-12-11 2005-01-17
cups-base -- HPGL buffer overflow vulnerability cups-base fr-cups-base 1.1.22.0_2

Ariel Berkman has discovered a buffer overflow vulnerability in CUPS's HPGL input driver. This vulnerability could be exploited to execute arbitrary code with the permission of the CUPS server by printing a specially crated HPGL file.

11968 CVE-2004-1267 http://tigger.uic.edu/~jlongs2/holes/cups.txt http://www.cups.org/str.php?L1024 2004-12-15 2005-01-17
mysql-scripts -- mysqlaccess insecure temporary file creation mysql-scripts 3.23.58_2 4.*4.0.23a_1 4.1.*4.1.9_1 5.*5.0.2_1

The Debian Security Team reports:

Javier Fernández-Sanguino Peña from the Debian Security Audit Project discovered a temporary file vulnerability in the mysqlaccess script of MySQL that could allow an unprivileged user to let root overwrite arbitrary files via a symlink attack and could also could unveil the contents of a temporary file which might contain sensitive information.

CVE-2005-0004 http://lists.mysql.com/internals/20600 2005-01-12 2005-01-16 2005-01-17
unrtf -- buffer overflow vulnerability unrtf 0.19.3_1

Yosef Klein and Limin Wang have found a buffer overflow vulnerability in unrtf that can allow an attacker to execute arbitrary code with the permissions of the user running unrtf, by running unrtf on a specially crafted rtf document.

12030 CVE-2004-1297 http://tigger.uic.edu/~jlongs2/holes/unrtf.txt 2004-12-15 2005-01-16 2005-02-11
mozilla -- heap overflow in NNTP handler de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 0 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7.5 mozilla 1.7.5,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape mozilla+ipv6 mozilla-embedded mozilla-gtk2 mozilla-gtk 0

Maurycy Prodeus reports a critical vulnerability in Mozilla-based browsers:

Mozilla browser supports NNTP urls. Remote side is able to trigger news:// connection to any server. I found a flaw in NNTP handling code which may cause heap overflow and allow remote attacker to execute arbitrary code on client machine.

CVE-2004-1316 http://isec.pl/vulnerabilities/isec-0020-mozilla.txt http://marc.theaimsgroup.com/?l=bugtraq&m=110436284718949 2004-12-29 2005-01-13
mpg123 -- buffer overflow vulnerability mpg123 mpg123-nas mpg123-esound 0.59r_17

Yuri D'Elia has found a buffer overflow vulnerability in mpg123's parsing of frame headers in input streams. This vulnerability can potentially lead to execution of arbitrary code with the permissions of the user running mpg123, if the user runs mpg123 on a specially crafted MP2 or MP3 file.

CVE-2004-0991 2005-01-01 2005-01-13
squid -- denial of service with forged WCCP messages squid 2.5.7_6

The squid patches page notes:

WCCP_I_SEE_YOU messages contain a 'number of caches' field which should be between 1 and 32. Values outside that range may crash Squid if WCCP is enabled, and if an attacker can spoof UDP packets with the WCCP router's IP address.

CVE-2005-0095 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-wccp_denial_of_service http://www.squid-cache.org/bugs/show_bug.cgi?id=1190 http://www.squid-cache.org/Advisories/SQUID-2005_2.txt 2005-01-07 2005-01-12 2005-01-22
squid -- buffer overflow vulnerability in gopherToHTML squid 2.5.7_6

The squid patches page notes:

A malicious gopher server may return a response with very long lines that cause a buffer overflow in Squid.

Workaround: Since gopher is very obscure these days, do not allow Squid to any gopher servers. Use an ACL rule like:

acl Gopher proto gopher
http_access deny Gopher
CVE-2005-0094 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-gopher_html_parsing http://www.squid-cache.org/bugs/show_bug.cgi?id=1189 http://www.squid-cache.org/Advisories/SQUID-2005_1.txt 2005-01-11 2005-01-12 2005-01-22
libxine -- DVD subpicture decoder heap overflow libxine 1.0.r6

A xine security announcement states:

A heap overflow has been found in the DVD subpicture decoder of xine-lib. This can be used for a remote heap overflow exploit, which can, on some systems, lead to or help in executing malicious code with the permissions of the user running a xine-lib based media application.

CVE-2004-1379 http://xinehq.de/index.php/security/XSA-2004-5 2004-09-06 2005-01-12 2005-01-19
libxine -- multiple vulnerabilities in VideoCD handling libxine 1.0.r21.0.r6

A xine security announcement states:

Several string overflows on the stack have been fixed in xine-lib, some of them can be used for remote buffer overflow exploits leading to the execution of arbitrary code with the permissions of the user running a xine-lib based media application.

Stack-based string overflows have been found:

  1. in the code which handles VideoCD MRLs
  2. in VideoCD code reading the disc label
  3. in the code which parses text subtitles and prepares them for display
http://xinehq.de/index.php/security/XSA-2004-4 2004-09-07 2005-01-12
libxine -- multiple buffer overflows in RTSP mplayer mplayer-gtk mplayer-gtk2 mplayer-esound mplayer-gtk-esound mplayer-gtk2-esound 0.99.4 libxine 1.0.r4

A xine security announcement states:

Multiple vulnerabilities have been found and fixed in the Real-Time Streaming Protocol (RTSP) client for RealNetworks servers, including a series of potentially remotely exploitable buffer overflows. This is a joint advisory by the MPlayer and xine teams as the code in question is common to these projects.

Severity: High (arbitrary remote code execution under the user ID running the player) when playing Real RTSP streams. At this time, there is no known exploit for these vulnerabilities.

CVE-2004-0433 http://xinehq.de/index.php/security/XSA-2004-3 http://xforce.iss.net/xforce/xfdb/16019 10245 2004-05-25 2005-01-12
hylafax -- unauthorized login vulnerability hylafax 4.2.1

A flaw in HylaFAX may allow an attacker to bypass normal authentication by spoofing their DNS PTR records.

CVE-2004-1182 http://marc.theaimsgroup.com/?l=bugtraq&m=110546971307585 2005-01-11 2005-01-11
xshisen -- local buffer overflows xshisen 1.36_1

Steve Kemp has found buffer overflows in the handling of the command line flag -KCONV and the XSHISENLIB environment variable. Ulf Härnhammer has detected an unbounded copy from the GECOS field to a char array. All overflows can be exploited to gain group games privileges.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=213957 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289784 CVE-2003-1053 CVE-2005-0117 2005-01-11 2005-01-11 2005-01-19
helvis -- arbitrary file deletion problem ko-helvis 1.8h2_1 helvis 1.8h2_1

The setuid root elvprsv utility, used to preserve recovery helvis files, can be abused by local users to delete with root privileges.

The problem is that elvprsv deletes files when it thinks they have become corrupt. When elvprsv is pointed to a normal file then it will almost always think the file is corrupt and deletes it. This behavior may be exploited by local attackers to delete critical files.

CVE-2005-0120 http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt 2004-11-24 2005-01-10 2005-01-19
helvis -- information leak vulnerabilities ko-helvis 1.8h2_1 helvis 1.8h2_1

Once a recovery file has been preserved by the setuid root elvprsv utility it is placed in a worldreadable directory with worldreadable permissions. This possibly allows sensitive information to leak.

In addition to this information leak, it is possible for users to recover files that belong to other users by using elvrec, another setuid root binary.

CVE-2005-0118 CVE-2005-0119 http://people.freebsd.org/~niels/ports/korean/helvis/issues.txt 2004-11-24 2005-01-10 2005-01-19
dillo -- format string vulnerability dillo 0.8.3_1

dillo contains a format string vulnerability which could lead to execution of arbitrary code simply by viewing a web page or opening a HTML file.

CVE-2005-0012 http://bugs.gentoo.org/show_bug.cgi?id=76665 2005-01-04 2005-01-08
tnftp -- mget does not check for directory escapes tnftp 20050103

When downloading a batch of files from an FTP server the mget command does not check for directory escapes. A specially crafted file on the FTP server could then potentially overwrite an existing file of the user.

CVE-2004-1294 http://tigger.uic.edu/~jlongs2/holes/tnftp.txt http://cvsweb.netbsd.org/bsdweb.cgi/othersrc/usr.bin/tnftp/src/cmds.c?rev=1.1.1.3&content-type=text/x-cvsweb-markup http://it.slashdot.org/article.pl?sid=04/12/15/2113202 http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 2004-12-15 2005-01-07 2005-01-13
tiff -- tiffdump integer overflow vulnerability tiff 3.7.1_2 linux-tiff 3.6.1_1

Dmitry V. Levin found a potential integer overflow in the tiffdump utility which could lead to execution of arbitrary code. This could be exploited by tricking an user into executing tiffdump on a specially crafted tiff image.

CVE-2004-1183 2005-01-06 2005-01-06 2005-03-01
tiff -- directory entry count integer overflow vulnerability tiff 3.7.1 linux-tiff 3.6.1_1 pdflib pdflib-perl 6.0.1_1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

In an iDEFENSE Security Advisory infamous41md reports:

Remote exploitation of a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code.

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry. A TIFF file includes a number of directory entry header fields that describe the data in the file. Included in these entries is an entry count and offset value that are calculated to determine the size and location of the data for that entry.

12075 CVE-2004-1308 http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities 125598 2004-12-17 2005-01-06 2006-06-08
vim -- vulnerabilities in modeline handling vim vim-lite vim+ruby 6.3.45

Ciaran McCreesh discovered news ways in which a VIM modeline can be used to trojan a text file. The patch by Bram Moolenaar reads:

Problem: Unusual characters in an option value may cause unexpected behavior, especially for a modeline. (Ciaran McCreesh)

Solution: Don't allow setting termcap options or 'printdevice' or 'titleold' in a modeline. Don't list options for "termcap" and "all" in a modeline. Don't allow unusual characters in 'filetype', 'syntax', 'backupext', 'keymap', 'patchmode' and 'langmenu'.

Note: It is generally recommended that VIM users use set nomodeline in ~/.vimrc to avoid the possibility of trojaned text files.

CVE-2004-1138 ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.045 http://groups.yahoo.com/group/vimdev/message/38084 2004-12-09 2005-01-06 2005-01-13
pcal -- buffer overflow vulnerabilities pcal 4.8.0

Danny Lungstrom has found two buffer overflow vulnerabilities in pcal which can lead to execution of arbitrary code by making a user run pcal on a specially crafted calendar file.

CVE-2004-1289 12035 12036 http://securesoftware.list.cr.yp.to/archive/0/46 2004-12-15 2005-01-06
exim -- two buffer overflow vulnerabilities exim exim-ldap exim-ldap2 exim-mysql exim-postgresql exim-sa-exim 4.43+28_1

1. The function host_aton() can overflow a buffer if it is presented with an illegal IPv6 address that has more than 8 components.

2. The second report described a buffer overflow in the function spa_base64_to_bits(), which is part of the code for SPA authentication.

http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html http://marc.theaimsgroup.com/?l=bugtraq&m=110573573800377 CVE-2005-0021 CVE-2005-0022 12185 12188 12268 2005-01-05 2005-01-05 2005-01-18
mpg123 -- playlist processing buffer overflow vulnerability mpg123 mpg123-nas mpg123-esound 0.59r_15

A buffer overflow vulnerability exists in the playlist processing of mpg123. A specially crafted playlist entry can cause a stack overflow that can be used to inject arbitrary code into the mpg123 process.

Note that a malicious playlist, demonstrating this vulnerability, was released by the bug finder and may be used as a template by attackers.

CVE-2004-1284 http://tigger.uic.edu/~jlongs2/holes/mpg123.txt http://secunia.com/advisories/13511/ http://xforce.iss.net/xforce/xfdb/18626 11958 http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 2004-12-15 2005-01-03 2005-01-13
greed -- insecure GRX file processing greed 0.81p

A buffer overflow vulnerability has been detected in the greed URL handling code. This bug can especially be a problem when greed is used to process GRX (GetRight) files that originate from untrusted sources.

The bug finder, Manigandan Radhakrishnan, gave the following description:

Here are the bugs. First, in main.c, DownloadLoop() uses strcat() to copy an input filename to the end of a 128-byte COMMAND array. Second, DownloadLoop() passes the input filename to system() without checking for special characters such as semicolons.

CVE-2004-1273 CVE-2004-1274 http://tigger.uic.edu/~jlongs2/holes/greed.txt http://secunia.com/advisories/13534/ http://marc.theaimsgroup.com/?l=bugtraq&m=110321888413132 2004-12-15 2005-01-03 2005-01-13
golddig -- local buffer overflow vulnerabilities golddig 2.0

Two buffer overflow vulnerabilities where detected. Both issues can be used by local users to gain group games privileges on affected systems.

The first overflow exists in the map name handling and can be triggered when a very long name is given to the program during command-line execution

The second overflow exists in the username processing while writing the players score to disk. Excessivly long usernames, set via the USER environment variable, are stored without any length checks in a memory buffer.

CVE-2005-0121 http://docs.FreeBSD.org/cgi/mid.cgi?200412021055.iB2AtweU067125 2004-11-11 2005-01-03 2005-01-19
up-imapproxy -- multiple vulnerabilities up-imapproxy 1.2.4 pop3proxy 1.1

Timo Sirainen reports:

There are various bugs in up-imapproxy which can crash it. Since up-imapproxy runs in a single process with each connection handled in a separate thread, any crash kills all the connections and stops listening for new ones.

In 64bit systems it might be possible to make it leak data (mails, passwords, ..) from other connections to attacker's connection. However I don't think up-imapproxy actually works in any 64bit system so this is just a theoretical problem.

CVE-2004-1035 11630 http://marc.theaimsgroup.com/?l=bugtraq&m=109995749510773 2004-11-17 2005-01-02 2008-02-27
kdelibs3 -- konqueror FTP command injection vulnerability ja-kdelibs kdelibs 3.3.2_2

Albert Puigsech Galicia reports that Konqueror (more specifically kio_ftp) and Microsoft Internet Explorer are vulnerable to a FTP command injection vulnerability which can be exploited by tricking an user into clicking a specially crafted FTP URI.

It is also reported by Ian Gulliver and Emanuele Balla that this vulnerability can be used to tricking a client into sending out emails without user interaction.

11827 CVE-2004-1165 http://marc.theaimsgroup.com/?l=bugtraq&m=110245752232681 http://marc.theaimsgroup.com/?l=full-disclosure&m=110387390226693 http://marc.theaimsgroup.com/?l=full-disclosure&m=110390734925183 http://www.kde.org/info/security/advisory-20050101-1.txt 2004-12-01 2005-01-01 2005-01-04
a2ps -- insecure temporary file creation a2ps-a4 a2ps-letter a2ps-letterdj 4.13b_3

A Secunia Security Advisory reports that Javier Fernández-Sanguino Peña has found temporary file creation vulnerabilities in the fixps and psmandup scripts which are part of a2ps. These vulnerabilities could lead to an attacker overwriting arbitrary files with the credentials of the user running the vulnerable scripts.

CVE-2004-1377 12108 12109 http://secunia.com/advisories/13641/ 2004-12-27 2004-12-30 2005-01-19
libxine -- buffer-overflow vulnerability in aiff support libxine 1.0.r5_3

Due to a buffer overflow in the open_aiff_file function in demux_aiff.c, a remote attacker is able to execute arbitrary code via a modified AIFF file.

CVE-2004-1300 http://tigger.uic.edu/~jlongs2/holes/xine-lib.txt http://xinehq.de/index.php/security/XSA-2004-7 2004-12-15 2004-12-29 2005-01-12
jabberd -- denial-of-service vulnerability jabber 1.4.3.1

José Antonio Calvo discovered a bug in the Jabber 1.x server. According to Matthias Wimmer:

Without this patch, it is possible to remotly crash jabberd14, if there is access to one of the following types of network sockets:

  • Socket accepting client connections
  • Socket accepting connections from other servers
  • Socket connecting to an other Jabber server
  • Socket accepting connections from server components
  • Socket connecting to server components

This is any socket on which the jabberd server parses XML!

The problem existed in the included expat XML parser code. This patch removes the included expat code from jabberd14 and links jabberd against an installed version of expat.

CVE-2004-1378 http://devel.amessage.info/jabberd14/README.html http://mail.jabber.org/pipermail/jabberd/2004-September/002004.html 2004-09-19 2004-12-26 2005-01-19
squid -- confusing results on empty acl declarations squid 2.5.7_5

Applying an empty ACL list results in unexpected behavior: anything will match an empty ACL list. For example,

The meaning of the configuration gets very confusing when we encounter empty ACLs such as

acl something src "/path/to/empty_file.txt"
http_access allow something somewhere

gets parsed (with warnings) as

http_access allow somwhere

And similarily if you are using proxy_auth acls without having any auth schemes defined.

CVE-2005-0194 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-empty_acls http://www.squid-cache.org/bugs/show_bug.cgi?id=1166 2004-12-21 2004-12-23 2005-02-08
ethereal -- multiple vulnerabilities ethereal ethereal-lite tethereal tethereal-lite 0.10.8

An Ethreal Security Advisories reports:

Issues have been discovered in the following protocol dissectors:

  • Matthew Bing discovered a bug in DICOM dissection that could make Ethereal crash.
  • An invalid RTP timestamp could make Ethereal hang and create a large temporary file, possibly filling available disk space.
  • The HTTP dissector could access previously-freed memory, causing a crash.
  • Brian Caswell discovered that an improperly formatted SMB packet could make Ethereal hang, maximizing CPU utilization.

Impact: It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file.

CVE-2004-1139 CVE-2004-1140 CVE-2004-1141 CVE-2004-1142 http://www.ethereal.com/appnotes/enpa-sa-00016.html 2004-12-14 2004-12-23
xpdf -- buffer overflow vulnerability xpdf 3.00_5 kdegraphics 3.3.2_1 gpdf 2.8.1 teTeX-base 2.0.2_6 cups-base 1.1.22.0 koffice 1.3.5,1 pdftohtml 0.36_1

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow vulnerability in the xpdf PDF viewer, as included in multiple Linux distributions, could allow attackers to execute arbitrary code as the user viewing a PDF file. The offending code can be found in the Gfx::doImage() function in the source file xpdf/Gfx.cc.

CVE-2004-1125 http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities 2004-11-23 2004-12-23 2005-01-13
acroread5 -- mailListIsPdf() buffer overflow vulnerability acroread acroread4 acroread5 5.10

An iDEFENSE Security Advisory reports:

Remote exploitation of a buffer overflow in version 5.09 of Adobe Acrobat Reader for Unix could allow for execution of arbitrary code.

The vulnerability specifically exists in a the function mailListIsPdf(). This function checks if the input file is an email message containing a PDF. It unsafely copies user supplied data using strcat into a fixed sized buffer.

CVE-2004-1152 253024 http://www.adobe.com/support/techdocs/331153.html http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities 2004-10-14 2004-12-21 2005-01-06
ecartis -- unauthorised access to admin interface ecartis 1.0.0.s20031228_2,1

A Debian security advisory reports:

A problem has been discovered in ecartis, a mailing-list manager, which allows an attacker in the same domain as the list admin to gain administrator privileges and alter list settings.

CVE-2004-0913 http://www.debian.org/security/2004/dsa-572 http://secunia.com/advisories/12918/ 2004-10-12 2004-12-21
mplayer -- multiple vulnerabilities mplayer mplayer-gtk mplayer-gtk2 mplayer-esound mplayer-gtk-esound mplayer-gtk2-esound 0.99.5_5 libxine 1.0.r5_3

iDEFENSE and the MPlayer Team have found multiple vulnerabilities in MPlayer:

  • Potential heap overflow in Real RTSP streaming code
  • Potential stack overflow in MMST streaming code
  • Multiple buffer overflows in BMP demuxer
  • Potential heap overflow in pnm streaming code
  • Potential buffer overflow in mp3lib

These vulnerabilities could allow a remote attacker to execute arbitrary code as the user running MPlayer. The problem in the pnm streaming code also affects xine.

CVE-2004-1187 CVE-2004-1188 http://mplayerhq.hu/homepage/design7/news.html#mplayer10pre5try2 http://marc.theaimsgroup.com/?l=bugtraq&m=110322526210300 http://www.idefense.com/application/poi/display?id=166 http://marc.theaimsgroup.com/?l=bugtraq&m=110322829807443 http://www.idefense.com/application/poi/display?id=167 http://marc.theaimsgroup.com/?l=bugtraq&m=110323022605345 http://www.idefense.com/application/poi/display?id=168 http://xinehq.de/index.php/security/XSA-2004-6 2004-12-10 2004-12-21 2005-01-12
krb5 -- heap buffer overflow vulnerability in libkadm5srv krb5 krb5-beta 1.3.6

A MIT krb5 Security Advisory reports:

The MIT Kerberos 5 administration library (libkadm5srv) contains a heap buffer overflow in password history handling code which could be exploited to execute arbitrary code on a Key Distribution Center (KDC) host. The overflow occurs during a password change of a principal with a certain password history state. An administrator must have performed a certain password policy change in order to create the vulnerable state.

An authenticated user, not necessarily one with administrative privileges, could execute arbitrary code on the KDC host, compromising an entire Kerberos realm.

CVE-2004-1189 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt 2004-12-06 2004-12-21
samba -- integer overflow vulnerability samba 3.0.10 *,13.0.10,1 ja-samba 2.2.12.j1.0beta1_2 3.*3.0.10 3.*,13.0.10,1

Greg MacManus, iDEFENSE Labs reports:

Remote exploitation of an integer overflow vulnerability in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, and Samba 3.0.x prior to and including 3.0.9 could allow an attacker to cause controllable heap corruption, leading to execution of arbitrary commands with root privileges.

Successful remote exploitation allows an attacker to gain root privileges on a vulnerable system. In order to exploit this vulnerability an attacker must possess credentials that allow access to a share on the Samba server. Unsuccessful exploitation attempts will cause the process serving the request to crash with signal 11, and may leave evidence of an attack in logs.

CVE-2004-1154 http://www.idefense.com/application/poi/display?id=165&type=vulnerabilities http://www.samba.org/samba/security/CAN-2004-1154.html 2004-12-02 2004-12-21 2008-09-26
php -- multiple vulnerabilities mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.3.10 mod_php mod_php4 44.3.10,1 php5 php5-cgi php5-cli 5.0.3 mod_php5 5.0.3,1

Secunia reports:

Multiple vulnerabilities have been reported in PHP, which can be exploited to gain escalated privileges, bypass certain security restrictions, gain knowledge of sensitive information, or compromise a vulnerable system.

http://secunia.com/advisories/13481/ CVE-2004-1019 CVE-2004-1065 http://www.php.net/release_4_3_10.php http://www.hardened-php.net/advisories/012004.txt 2004-12-16 2004-12-17 2004-12-18
mysql -- GRANT access restriction problem mysql-server 3.23.58_3 4.*4.0.21

When a user is granted access to a database with a name containing an underscore and the underscore is not escaped then that user might also be able to access other, similarly named, databases on the affected system.

The problem is that the underscore is seen as a wildcard by MySQL and therefore it is possible that an admin might accidently GRANT a user access to multiple databases.

CVE-2004-0957 11435 http://bugs.mysql.com/bug.php?id=3933 http://rhn.redhat.com/errata/RHSA-2004-611.html http://www.openpkg.org/security/OpenPKG-SA-2004.045-mysql.html 2004-03-29 2004-12-16 2005-03-15
mysql -- ALTER MERGE denial of service vulnerability mysql-server 3.23.58_3 4.*4.0.21 4.1.*4.1.1

Dean Ellis reported a denial of service vulnerability in the MySQL server:

Multiple threads ALTERing the same (or different) MERGE tables to change the UNION eventually crash the server or hang the individual threads.

Note that a script demonstrating the problem is included in the MySQL bug report. Attackers that have control of a MySQL account can easily use a modified version of that script during an attack.

CVE-2004-0837 11357 http://bugs.mysql.com/bug.php?id=2408 http://rhn.redhat.com/errata/RHSA-2004-611.html 2004-01-15 2004-12-16 2005-03-15
mysql -- FTS request denial of service vulnerability mysql-server 4.*4.0.21

A special crafted MySQL FTS request can cause the server to crash. Malicious MySQL users can abuse this bug in a denial of service attack against systems running an affected MySQL daemon.

Note that because this bug is related to the parsing of requests, it may happen that this bug is triggered accidently by a user when he or she makes a typo.

http://bugs.mysql.com/bug.php?id=3870 CVE-2004-0956 11432 2004-03-23 2004-12-16
mysql -- mysql_real_connect buffer overflow vulnerability mysql-server 3.23.58_3 4.*4.0.21 mysql-client 3.23.58_3 4.*4.0.21

The mysql_real_connect function doesn't properly handle DNS replies by copying the IP address into a buffer without any length checking. A specially crafted DNS reply may therefore be used to cause a buffer overflow on affected systems.

Note that whether this issue can be exploitable depends on the system library responsible for the gethostbyname function. The bug finder, Lukasz Wojtow, explaines this with the following words:

In glibc there is a limitation for an IP address to have only 4 bytes (obviously), but generally speaking the length of the address comes with a response for dns query (i know it sounds funny but read rfc1035 if you don't believe). This bug can occur on libraries where gethostbyname function takes length from dns's response

CVE-2004-0836 10981 http://bugs.mysql.com/bug.php?id=4017 http://lists.mysql.com/internals/14726 http://rhn.redhat.com/errata/RHSA-2004-611.html http://www.osvdb.org/displayvuln.php?osvdb_id=10658 2004-06-04 2004-12-16 2005-03-15
mysql -- erroneous access restrictions applied to table renames mysql-server 3.23.58_3 4.*4.0.21

A Red Hat advisory reports:

Oleksandr Byelkin discovered that "ALTER TABLE ... RENAME" checked the CREATE/INSERT rights of the old table instead of the new one.

Table access restrictions, on the affected MySQL servers, may accidently or intentially be bypassed due to this bug.

CVE-2004-0835 11357 http://bugs.mysql.com/bug.php?id=3270 http://rhn.redhat.com/errata/RHSA-2004-611.html http://xforce.iss.net/xforce/xfdb/17666 2004-03-23 2004-12-16 2005-03-15
phpmyadmin -- command execution vulnerability phpMyAdmin 2.6.0.22.6.1.r1

A phpMyAdmin security announcement reports:

Command execution: since phpMyAdmin 2.6.0-pl2, on a system where external MIME-based transformations are activated, an attacker can put into MySQL data an offensive value that starts a shell command when browsed.

Enabling PHP safe mode on the server can be used as a workaround for this vulnerability.

CVE-2004-1147 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4 http://www.exaprobe.com/labs/advisories/esa-2004-1213.html 2004-12-13 2004-12-15 2004-12-19
phpmyadmin -- file disclosure vulnerability phpMyAdmin 2.6.1.r1

A phpMyAdmin security announcement reports:

File disclosure: on systems where the UploadDir mecanism is active, read_dump.php can be called with a crafted form; using the fact that the sql_localfile variable is not sanitized can lead to a file disclosure.

Enabling PHP safe mode on the server can be used as a workaround for this vulnerability.

CVE-2004-1148 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-4 http://www.exaprobe.com/labs/advisories/esa-2004-1213.html 2004-12-13 2004-12-15 2004-12-19
wget -- multiple vulnerabilities wget wget-devel 1.10.a1 wgetpro wget+ipv6 0

Jan Minar reports that there exists multiple vulnerabilities in wget:

Wget erroneously thinks that the current directory is a fair game, and will happily write in any file in and below it. Malicious HTTP response or malicious HTML file can redirect wget to a file that is vital to the system, and wget will create/append/overwrite it.

Wget apparently has at least two methods of ``sanitizing'' the potentially malicious data it receives from the HTTP stream, therefore a malicious redirects can pass the check. We haven't find a way to trick wget into writing above the parent directory, which doesn't mean it's not possible.

Malicious HTTP response can overwrite parts of the terminal so that the user will not notice anything wrong, or will believe the error was not fatal.

CVE-2004-1487 CVE-2004-1488 11871 http://marc.theaimsgroup.com/?l=bugtraq&m=110269474112384 http://bugs.debian.org/261755 2004-12-09 2004-12-14 2005-04-15
konqueror -- Password Disclosure for SMB Shares kdebase kdelibs 3.2.03.3.1

When browsing SMB shares with Konqueror, shares with authentication show up with hidden password in the browser bar. It is possible to store the URL as a shortcut on the desktop where the password is then available in plain text.

CVE-2004-1171 305294 http://www.kde.org/info/security/advisory-20041209-1.txt http://marc.theaimsgroup.com/?l=bugtraq&m=110178786809694 2004-10-06 2004-12-12 2005-01-13
mod_access_referer -- null pointer dereference vulnerability mod_access_referer 1.0.2_1

A malformed Referer header field causes the Apache ap_parse_uri_components function to discard it with the result that a pointer is not initialized. The mod_access_referer module does not take this into account with the result that it may use such a pointer.

The null pointer vulnerability may possibly be used in a remote denial of service attack against affected Apache servers.

CVE-2003-1054 7375 http://secunia.com/advisories/8612/ http://marc.theaimsgroup.com/?l=full-disclosure&m=105053485515811 2003-04-16 2004-12-11 2005-01-19
squid -- possible information disclosure squid 2.5.7_4

The squid-2.5 patches pages notes:

In certain conditions Squid returns random data as error messages in response to malformed host name, possibly leaking random internal information which may come from other requests.

http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-dothost 2004-11-23 2004-12-09
viewcvs -- information leakage viewcvs 0.9.2_2

The hide_cvsroot and forbidden configuration options are not properly honored by viewcvs when exporting to a tar file which can lead to information leakage.

CVE-2004-0915 11819 2004-11-25 2004-12-08 2004-12-12
cscope -- symlink attack vulnerability cscope 15.5_1

cscope is vulnerable to a symlink attack which could lead to an attacker overwriting arbitrary files with the permissions of the user running cscope.

CVE-2004-0996 11697 http://marc.theaimsgroup.com/?l=bugtraq&m=110133485519690 http://marc.theaimsgroup.com/?l=bugtraq&m=110072752707293 http://sourceforge.net/tracker/index.php?func=detail&aid=1062807&group_id=4664&atid=104664 2003-04-03 2004-12-07
bnc -- remotely exploitable buffer overflow in getnickuserhost bnc 2.9.1

A LSS Security Advisory reports:

There is a buffer overflow vulnerability in getnickuserhost() function that is called when BNC is processing response from IRC server.

Vulnerability can be exploited if attacker tricks user to connect to his fake IRC server that will exploit this vulnerability. If the attacker has access to BNC proxy server, this vulnerability can be used to gain shell access on machine where BNC proxy server is set.

CVE-2004-1052 http://marc.theaimsgroup.com/?l=bugtraq&m=110011817627839 http://security.lss.hr/en/index.php?page=details&ID=LSS-2004-11-03 http://www.gotbnc.com/changes.html 2004-11-10 2004-12-04 2005-02-22
rssh & scponly -- arbitrary command execution rssh 2.2.2 scponly 4.0

Jason Wies identified both rssh & scponly have a vulnerability that allows arbitrary command execution. He reports:

The problem is compounded when you recognize that the main use of rssh and scponly is to allow file transfers, which in turn allows a malicious user to transfer and execute entire custom scripts on the remote machine.

11791 11792 ports/74633 http://marc.theaimsgroup.com/?l=bugtraq&m=110202047507273 2004-11-28 2004-12-02 2004-12-12
rockdodger -- buffer overflows rockdodger 0.6_3

The environment variable HOME is copied without regard to buffer size, which can be used to gain elevated privilege if the binary is installed setgid games, and a string is read from the high score file without bounds check.

The port installs the binary without setgid, but with a world-writable high score file.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=278878 2004-10-29 2004-12-02
zip -- long path buffer overflow zip 2.3_2

A HexView security advisory reports:

When zip performs recursive folder compression, it does not check for the length of resulting path. If the path is too long, a buffer overflow occurs leading to stack corruption and segmentation fault. It is possible to exploit this vulnerability by embedding a shellcode in directory or file name. While the issue is not of primary concern for regular users, it can be critical for environments where zip archives are re-compressed automatically using Info-Zip application.

CVE-2004-1010 11603 http://www.hexview.com/docs/20041103-1.txt 2004-10-03 2004-12-01 2004-12-12
sudoscript -- signal delivery vulnerability sudoscript 2.1.2

If non-root access is enabled in sudoscript, any member of the ssers group can send a SIGHUP signal to any process.

http://egbok.com/sudoscript/archives/2004/11/sudoscript_212.html 2004-11-14 2004-12-01
jabberd -- remote buffer overflow vulnerability jabberd 2.*2.0.4

Caused by improper bounds-checking of username and password in the C2S module, it is possible for an attacker to cause a remote buffer overflow. The server directly handles the userinput with SQL backend functions - malicious input may lead to buffer overflow.

http://marc.theaimsgroup.com/?l=bugtraq&m=110144303826709 2004-11-24 2004-11-30
Open DC Hub -- remote buffer overflow vulnerability opendchub 0.7.14_2

Donato Ferrante reported an exploitable buffer overflow in this software package. Any user that can login with 'admin' privileges can abuse it, trough the $RedirectAll command, to execute arbitrary code.

http://marc.theaimsgroup.com/?l=bugtraq&m=110144606411674 http://www.gentoo.org/security/en/glsa/glsa-200411-37.xml 2004-11-24 2004-11-27 2005-02-13
unarj -- long filename buffer overflow unarj 2.43_2

Ludwig Nussel has discovered a buffer overflow vulnerability in unarj's handling of long filenames which could potentially lead to execution of arbitrary code with the permissions of the user running unarj.

CVE-2004-0947 11665 2004-11-09 2004-11-26
unarj -- directory traversal vulnerability unarj 2.43_2

unarj has insufficient checks for filenames that contain ... This can allow an attacker to overwrite arbitrary files with the permissions of the user running unarj.

CVE-2004-1027 11436 http://marc.theaimsgroup.com/?l=full-disclosure&m=109748984030292 2004-10-10 2004-11-26
jdk/jre -- Security Vulnerability With Java Plugin jdk 1.4.01.4.2p6_6 1.3.01.3.1p9_5 linux-jdk linux-sun-jdk 1.4.01.4.2.05 1.3.01.3.1.13 linux-blackdown-jdk 1.3.01.4.2 linux-ibm-jdk 1.3.01.4.2 diablo-jdk diablo-jre 1.3.1.01.3.1.0_1

The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code.

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57591-1&searchclause=%22category:security%22%20%22availability,%20security%22 http://www.securityfocus.com/archive/1/382072 CVE-2004-1029 http://marc.theaimsgroup.com/?l=bugtraq&m=110125046627909 2004-11-24 2004-11-25 2005-04-27
ProZilla -- server response buffer overflow vulnerabilities prozilla 1.3.6_3

Buffer overflow vulnerabilities have been reported to exist in this software package. The vulnerabilities can be triggered by a remote server and can be used to inject malicious code in the ProZilla process.

CVE-2004-1120 http://www.gentoo.org/security/en/glsa/glsa-200411-31.xml http://bugs.gentoo.org/show_bug.cgi?id=70090 http://marc.theaimsgroup.com/?l=bugtraq&m=110136626320497 2004-11-23 2004-11-25 2005-10-01
Cyrus IMAPd -- APPEND command uses undefined programming construct cyrus-imapd 2.2.72.2.8

To support MULTIAPPENDS the cmd_append handler uses the global stage array. This array is one of the things that gets destructed when the fatal() function is triggered. When the Cyrus IMAP code adds new entries to this array this is done with the help of the postfix increment operator in combination with memory allocation functions. The increment is performed on a global variable counting the number of allocated stages. Because the memory allocation function can fail and therefore internally call fatal() this construct is undefined arcording to ANSI C. This means that it is not clearly defined if the numstage counter is already increased when fatal() is called or not. While older gcc versions increase the counter after the memory allocation function has returned, on newer gcc versions (3.x) the counter gets actually increased before. In such a case the stage destructing process will try to free an uninitialised and maybe attacker supplied pointer. Which again could lead to remote code execution. (Because it is hard for an attacker to let the memory allocation functions fail in the right moment no PoC code for this problem was designed)

http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22
Cyrus IMAPd -- FETCH command out of bounds memory corruption cyrus-imapd 2.1.17 2.2.*2.2.8

The argument parser of the fetch command suffers a bug very similiar to the partial command problem. Arguments like "body[p", "binary[p" or "binary[p" will be wrongly detected and the bufferposition can point outside of the allocated buffer for the rest of the parsing process. When the parser triggers the PARSE_PARTIAL macro after such a malformed argument was received this can lead to a similiar one byte memory corruption and allows remote code execution, when the heap layout was successfully controlled by the attacker.

CVE-2004-1013 http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22 2004-11-24
Cyrus IMAPd -- PARTIAL command out of bounds memory corruption cyrus-imapd 2.1.17 2.2.*2.2.6

Due to a bug within the argument parser of the partial command an argument like "body[p" will be wrongly detected as "body.peek". Because of this the bufferposition gets increased by 10 instead of 5 and could therefore point outside the allocated memory buffer for the rest of the parsing process. In imapd versions prior to 2.2.7 the handling of "body" or "bodypeek" arguments was broken so that the terminating ']' got overwritten by a '\0'. Combined the two problems allow a potential attacker to overwrite a single byte of malloc() control structures, which leads to remote code execution if the attacker successfully controls the heap layout.

CVE-2004-1012 http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22 2004-11-24
Cyrus IMAPd -- IMAPMAGICPLUS preauthentification overflow cyrus-imapd 2.2.42.2.8

When the option imapmagicplus is activated on a server the PROXY and LOGIN commands suffer a standard stack overflow, because the username is not checked against a maximum length when it is copied into a temporary stack buffer. This bug is especially dangerous because it can be triggered before any kind of authentification took place.

CVE-2004-1011 http://security.e-matters.de/advisories/152004.html 2004-11-06 2004-11-22
phpMyAdmin -- cross-site scripting vulnerabilities phpMyAdmin 2.6.0.2

Multiple cross-site scripting vulnerabilities, caused by improper input parameter sanitizing, were detected in phpMyAdmin, which may enable an attacker to do cross-site scripting attacks.

http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3 2004-11-18 2004-11-20
Overflow error in fetch FreeBSD 5.35.3_1 5.2.15.2.1_12 5.15.1_18 5.05.0_22 4.104.10_4 4.94.9_13 4.84.8_26 4.7_28

An integer overflow condition in fetch(1) in the processing of HTTP headers can result in a buffer overflow.

A malicious server or CGI script can respond to an HTTP or HTTPS request in such a manner as to cause arbitrary portions of the client's memory to be overwritten, allowing for arbitrary code execution.

SA-04:16.fetch CVE-2004-1053 11702 2004-11-14 2004-11-18
smbd -- buffer-overrun vulnerability samba 3.*3.0.8 3.*,13.0.8,1

Caused by improper bounds checking of certain trans2 requests, there is a possible buffer overrun in smbd. The attacker needs to be able to create files with very specific Unicode filenames on the share to take advantage of this issue.

CVE-2004-0882 11678 http://marc.theaimsgroup.com/?l=bugtraq&m=110055646329581 2004-11-15 2004-11-17 2008-09-26
twiki -- arbitrary shell command execution twiki 20040902

Hans Ulrich Niedermann reports:

The TWiki search function uses a user supplied search string to compose a command line executed by the Perl backtick (``) operator.

The search string is not checked properly for shell metacharacters and is thus vulnerable to search string containing quotes and shell commands.

IMPACT: An attacker is able to execute arbitrary shell commands with the privileges of the TWiki process.

CVE-2004-1037 http://marc.theaimsgroup.com/?l=bugtraq&m=110037207516456 http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithSearch 2004-11-12 2004-11-15 2004-11-23
proxytunnel -- format string vulnerability proxytunnel 1.2.3

A Gentoo Linux Security Advisory reports:

Florian Schilhabel of the Gentoo Linux Security Audit project found a format string vulnerability in Proxytunnel. When the program is started in daemon mode (-a [port]), it improperly logs invalid proxy answers to syslog.

A malicious remote server could send specially-crafted invalid answers to exploit the format string vulnerability, potentially allowing the execution of arbitrary code on the tunnelling host with the rights of the Proxytunnel process.

CVE-2004-0992 http://proxytunnel.sourceforge.net/news.html http://www.gentoo.org/security/en/glsa/glsa-200411-07.xml 2004-11-01 2004-11-15
sudo -- privilege escalation with bash scripts sudo 1.6.8.2

A Sudo Security Alerts reports:

A flaw in exists in sudo's environment sanitizing prior to sudo version 1.6.8p2 that could allow a malicious user with permission to run a shell script that utilized the bash shell to run arbitrary commands.

http://www.courtesan.com/sudo/alerts/bash_functions.html 2004-11-11 2004-11-13
ruby -- CGI DoS ruby ruby_r 1.7.*1.8.2.p2_2 1.6.8.2004.07.28_1 ruby-1.7.0 a2001.05.12a2001.05.26

The Ruby CGI.rb module contains a bug which can cause the CGI module to go into an infinite loop, thereby causing a denial-of-service situation on the web server by using all available CPU time.

CVE-2004-0983 http://www.debian.org/security/2004/dsa-586 2004-11-06 2004-11-13 2004-11-25
samba -- potential remote DoS vulnerability samba 3.*3.0.8 3.*,13.0.8,1

Karol Wiesek at iDEFENSE reports:

A remote attacker could cause an smbd process to consume abnormal amounts of system resources due to an input validation error when matching filenames containing wildcard characters.

Although samba.org classifies this as a DoS vulnerability, several members of the security community believe it may be exploitable for arbitrary code execution.

ports/73701 CVE-2004-0930 http://us4.samba.org/samba/security/CAN-2004-0930.html 2004-09-30 2004-11-12 2008-09-26
gnats -- format string vulnerability gnats 4.*4.0_2 3.113.1_9

Gnats suffers from a format string bug, which may enable an attacker to execute arbitary code.

CVE-2004-0623 http://marc.theaimsgroup.com/?l=bugtraq&m=108820000823191 2004-06-21 2004-11-12
squirrelmail -- cross site scripting vulnerability ja-squirrelmail 1.4.3a_4,2 squirrelmail 1.4.3a_3

A SquirrelMail Security Notice reports:

There is a cross site scripting issue in the decoding of encoded text in certain headers. SquirrelMail correctly decodes the specially crafted header, but doesn't sanitize the decoded strings.

http://marc.theaimsgroup.com/?l=bugtraq&m=110012133608004 2004-11-03 2004-11-12
hafiye -- lack of terminal escape sequence filtering hafiye 1.0_1

A siyahsapka.org advisory reads:

Hafiye-1.0 doesnt filter the payload when printing it to the terminal. A malicious attacker can send packets with escape sequence payloads to exploit this vulnerability.

If Hafiye has been started with -n packet count option , the vulnerability could allow remote code execution. For remote code execution the victim must press Enter after program exit.

Note that it appears that this bug can only be exploited in conjunction with a terminal emulator that honors the appropriate escape sequences.

ports/70978 http://deicide.siyahsapka.org/hafiye_esc.txt http://www.enderunix.org/hafiye/ 2004-08-23 2004-11-11
ez-ipupdate -- format string vulnerability ez-ipupdate 3.0.11b8_2

Data supplied by a remote server is used as the format string instead of as parameters in a syslog() call. This may lead to crashes or potential running of arbitrary code. It is only a problem when running in daemon mode (very common) and when using some service types.

CVE-2004-0980 http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html 2004-11-11 2004-11-11
ImageMagick -- EXIF parser buffer overflow ImageMagick ImageMagick-nox11 6.1.3

There exists a buffer overflow vulnerability in ImageMagick's EXIF parsing code which may lead to execution of arbitrary code.

11548 CVE-2004-0981 http://secunia.com/advisories/12995/ http://www.imagemagick.org/www/Changelog.html 2004-10-25 2004-11-11 2004-12-12
apache2 multiple space header denial-of-service vulnerability apache 2.*2.0.52_2

It is possible for remote attackers to cause a denial-of-service scenario on Apache 2.0.52 and earlier by sending an HTTP GET request with a MIME header containing multiple lines full of whitespaces.

CVE-2004-0942 http://marc.theaimsgroup.com/?l=full-disclosure&m=109930632317208 2004-11-01 2004-11-10 2004-11-11
socat -- format string vulnerability socat 1.4.0.3

Socat Security Advisory 1 states:

socat up to version 1.4.0.2 contains a syslog() based format string vulnerability. This issue was originally reported by CoKi on 19 Oct.2004 http://www.nosystem.com.ar/advisories/advisory-07.txt. Further investigation showed that this vulnerability could under some circumstances lead to local or remote execution of arbitrary code with the privileges of the socat process.

http://www.dest-unreach.org/socat/advisory/socat-adv-1.html http://www.nosystem.com.ar/advisories/advisory-07.txt 2004-10-18 2004-11-10
libxml -- remote buffer overflows libxml 1.8.17_3 libxml2 2.6.15

infamous41md reports that libxml contains multiple buffer overflows in the URL parsing and DNS name resolving functions. These vulnerabilities could lead to execution of arbitrary code.

CVE-2004-0989 11526 http://marc.theaimsgroup.com/?l=bugtraq&m=109880813013482 http://www.debian.org/security/2004/dsa-582 2004-10-26 2004-11-09 2004-11-10
p5-Archive-Zip -- virus detection evasion p5-Archive-Zip 1.14

An AMaViS Security Announcement reports that a vulnerability exist in the Archive::Zip Perl module which may lead to bypass of malicious code in anti-virus programs by creating specially crafted ZIP files.

http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities http://www.amavis.org/security/asa-2004-6.txt http://rt.cpan.org/NoAuth/Bug.html?id=8077 2004-10-18 2004-11-08
apache mod_include buffer overflow vulnerability apache 1.3.33 apache+mod_ssl 1.3.32+2.8.21_1 apache+mod_ssl+ipv6 1.3.32+2.8.21_1 apache+mod_perl 1.3.31 apache+ipv6 1.3.33 apache+ssl 1.3.29.1.55 ru-apache 1.3.33+30.21 ru-apache+mod_ssl 1.3.33+30.21+2.8.22

There is a buffer overflow in a function used by mod_include that may enable a local user to gain privileges of a httpd child. Only users that are able to create SSI documents can take advantage of that vulnerability.

CVE-2004-0940 http://www.securitylab.ru/48807.html 2004-10-22 2004-11-06
postgresql-contrib -- insecure temporary file creation postgresql-contrib 7.2.6 7.3.*7.3.8 7.4.*7.4.6

The make_oidjoins_check script in the PostgreSQL RDBMS has insecure handling of temporary files, which could lead to an attacker overwriting arbitrary files with the credentials of the user running the make_oidjoins_check script.

CVE-2004-0977 11295 http://www.postgresql.org/news/234.html http://www.trustix.net/errata/2004/0050/ 2004-09-10 2004-11-06
gd -- integer overflow gd uk-gd ja-gd 2.0.29,1 1.*,22.*,2

infamous41md reports about the GD Graphics Library:

There is an integer overflow when allocating memory in the routine that handles loading PNG image files. This later leads to heap data structures being overwritten. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image.

11523 CVE-2004-0990 http://marc.theaimsgroup.com/?l=bugtraq&m=109882489302099 http://www.boutell.com/gd/manual2.0.29.html#whatsnew2.0.29 2004-10-26 2004-11-05
putty -- buffer overflow vulnerability in ssh2 support putty 0.56

There is a bug in SSH2 support that allows a server to execute malicious code on a connecting PuTTY client. This attack can be performed before host key verification happens, so a different machine -- man in the middle attack -- could fake the machine you are connecting to.

http://marc.theaimsgroup.com/?l=bugtraq&m=109890310929207 http://www.gentoo.org/security/en/glsa/glsa-200410-29.xml http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ssh2-debug.html 2004-10-26 2004-11-04 2005-01-19
wzdftpd -- remote DoS wzdftpd 0.4.3

wzdftpd contains a potential remote Denial-of-Service.

http://sourceforge.net/project/shownotes.php?release_id=263573 2004-10-28 2004-11-03
rssh -- format string vulnerability rssh 2.2.1

There is a format string bug in rssh that enables an attacker to execute arbitrary code from an account configured to use rssh. On FreeBSD it is only possible to compromise the rssh running account, not root.

http://www.pizzashack.org/rssh/security.shtml http://marc.theaimsgroup.com/?l=bugtraq&m=109855982425122 2004-10-23 2004-10-25
horde -- cross-site scripting vulnerability in help window horde horde-devel 2.2.7

A Horde Team announcement states that a potential cross-site scripting vulnerability in the help window has been corrected. The vulnerability appears to involve the handling of the topic and module parameters of the help window template.

http://marc.theaimsgroup.com/?l=horde-announce&m=109879164718625 2004-10-06 2004-10-27
bogofilter -- RFC 2047 decoder denial-of-service vulnerability bogofilter bogofilter-qdbm bogofilter-tdb ru-bogofilter 0.17.40.92.8

The bogofilter team has been provided with a test case of a malformatted (non-conformant) RFC-2047 encoded word that can cause bogofilter versions 0.92.7 and prior to try to write a NUL byte into a memory location that is either one byte past the end of a flex buffer or to a location that is the negative of the encoded word's start of payload data, causing a segmentation fault.

ports/73144 CVE-2004-1007 http://article.gmane.org/gmane.mail.bogofilter.devel/3308 http://article.gmane.org/gmane.mail.bogofilter.devel/3317 http://bugs.debian.org/275373 http://bogofilter.sourceforge.net/security/bogofilter-SA-2004-01 2004-10-09 2004-10-26 2015-09-28
xpdf -- integer overflow vulnerabilities gpdf cups-base 1.1.22.0 xpdf 3.00_4 kdegraphics 3.3.0_1 koffice 1.3.2_1,1 teTeX-base 2.0.2_4

Chris Evans discovered several integer arithmetic overflows in the xpdf 2 and xpdf 3 code bases. The flaws have impacts ranging from denial-of-service to arbitrary code execution.

CVE-2004-0888 CVE-2004-0889 http://scary.beasts.org/security/CESA-2004-002.txt http://scary.beasts.org/security/CESA-2004-007.txt http://www.kde.org/info/security/advisory-20041021-1.txt 2004-10-21 2004-10-25
gaim -- MSN denial-of-service vulnerabilities gaim ja-gaim ko-gaim ru-gaim 1.0.2 gaim 20030000

The Gaim team discovered denial-of-service vulnerabilities in the MSN protocol handler:

After accepting a file transfer request, Gaim will attempt to allocate a buffer of a size equal to the entire filesize, this allocation attempt will cause Gaim to crash if the size exceeds the amount of available memory.

Gaim allocates a buffer for the payload of each message received based on the size field in the header of the message. A malicious peer could specify an invalid size that exceeds the amount of available memory.

http://gaim.sourceforge.net/security/?id=7 http://gaim.sourceforge.net/security/?id=8 2004-10-19 2004-10-25
gaim -- Content-Length header denial-of-service vulnerability gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

Sean infamous42md reports:

When a remote server provides a large "content-length" header value, Gaim will attempt to allocate a buffer to store the content, however this allocation attempt will cause Gaim to crash if the length exceeds the amount of possible memory. This happens when reading profile information on some protocols. It also happens when smiley themes are installed via drag and drop.

http://gaim.sourceforge.net/security/?id=6 2004-08-26 2004-10-25
gaim -- multiple buffer overflows gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

Sean infamous42md reports several situations in gaim that may result in exploitable buffer overflows:

  • Rich Text Format (RTF) messages in Novell GroupWise protocol
  • Unsafe use of gethostbyname in zephyr protocol
  • URLs which are over 2048 bytes long once decoded
CVE-2004-0785 http://gaim.sourceforge.net/security/?id=3 http://gaim.sourceforge.net/security/?id=4 http://gaim.sourceforge.net/security/?id=5 2004-08-26 2004-10-25
gaim -- heap overflow exploitable by malicious GroupWise server gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

Sean infamous42md reports that a malicous GroupWise messaging server may be able to exploit a heap buffer overflow in gaim, leading to arbitrary code execution.

CVE-2004-0754 http://gaim.sourceforge.net/security/?id=2 2004-08-26 2004-10-25
gaim -- malicious smiley themes gaim ja-gaim ko-gaim ru-gaim 0.82 gaim 20030000

The Gaim Security Issues page documents a problem with installing smiley themes from an untrusted source:

To install a new smiley theme, a user can drag a tarball from a graphical file manager, or a hypertext link to one from a web browser. When a tarball is dragged, Gaim executes a shell command to untar it. However, it does not escape the filename before sending it to the shell. Thus, a specially crafted filename could execute arbitrary commands if the user could be convinced to drag a file into the smiley theme selector.

CVE-2004-0784 http://gaim.sourceforge.net/security/?id=1 2004-08-22 2004-10-25
gaim -- buffer overflow in MSN protocol support gaim ja-gaim ru-gaim 0.791.0.1 gaim 20030000

Due to a buffer overflow in the MSN protocol support for gaim 0.79 to 1.0.1, it is possible for remote clients to do a denial-of-service attack on the application. This is caused by an unbounded copy operation, which writes to the wrong buffer.

CVE-2004-0891 http://gaim.sourceforge.net/security/?id=9 2004-10-19 2004-10-25
mod_ssl -- SSLCipherSuite bypass ru-apache+mod_ssl 1.3.31+30.20+2.8.18 apache+mod_ssl 1.3.31+2.8.20 apache+mod_ssl+ipv6 1.3.31+2.8.18_4 apache2 2.0.52_1

It is possible for clients to use any cipher suite configured by the virtual host, whether or not a certain cipher suite is selected for a specific directory. This might result in clients using a weaker encryption than originally configured.

CVE-2004-0885 http://marc.theaimsgroup.com/?l=apache-modssl&m=109724918128044 http://issues.apache.org/bugzilla/show_bug.cgi?id=31505 2004-10-01 2004-10-23
mpg123 -- buffer overflow in URL handling mpg123 mpg123-nas mpg123-esound 0.59r_15

Carlos Barros reports that mpg123 contains two buffer overflows. These vulnerabilities can potentially lead to execution of arbitrary code.

The first buffer overflow can occur when mpg123 parses a URL with a user-name/password field that is more than 256 characters long. This problem can be triggered either locally or remotely via a specially crafted play list. The second potential buffer overflow may be triggered locally by a specially crafted symlink to the mpg123 binary. This problem is not as serious, since mpg123 is not installed setuid by default.

11468 CVE-2004-0982 http://marc.theaimsgroup.com/?l=bugtraq&m=109834486312407 2004-10-02 2004-10-23 2004-12-30
apache2 -- SSL remote DoS apache 2.02.0.51

The Apache HTTP Server 2.0.51 release notes report that the following issues have been fixed:

A segfault in mod_ssl which can be triggered by a malicious remote server, if proxying to SSL servers has been configured. [CAN-2004-0751]

A potential infinite loop in mod_ssl which could be triggered given particular timing of a connection abort. [CAN-2004-0748]

11094 11154 CVE-2004-0748 CVE-2004-0751 http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=109527608022322 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=30134 2004-07-07 2004-10-21
phpmyadmin -- remote command execution vulnerability phpMyAdmin phpmyadmin 2.6.0.2

From the phpMyAdmin 2.6.0p2 release notes:

If PHP is not running in safe mode, a problem in the MIME-based transformation system (with an "external" transformation) allows to execute any command with the privileges of the web server's user.

11391 http://sourceforge.net/project/shownotes.php?release_id=274709 http://sourceforge.net/tracker/index.php?func=detail&aid=1044864&group_id=23067&atid=377408 2004-10-11 2004-10-20
cabextract -- insecure directory handling cabextract 1.1

cabextract has insufficient checks for file names that contain ../. This can cause files to be extracted to the parent directory.

CVE-2004-0916 http://www.kyz.uklinux.net/cabextract.php#changes 2004-10-18 2004-10-20 2004-10-22
a2ps -- insecure command line argument handling a2ps-a4 4.13b_2 a2ps-letter 4.13b_2 a2ps-letterdj 4.13b_2

Rudolf Polzer reports:

a2ps builds a command line for file() containing an unescaped version of the file name, thus might call external programs described by the file name. Running a cronjob over a public writable directory a2ps-ing all files in it - or simply typing "a2ps *.txt" in /tmp - is therefore dangerous.

CVE-2004-1170 ports/70618 11025 http://www.osvdb.org/9176 http://marc.theaimsgroup.com/?l=full-disclosure&m=109334851517137 2004-08-18 2004-10-20 2004-12-30
ifmail -- unsafe set-user-ID application ifmail 2.15_4

Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID `news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the `news' user.

https://svnweb.freebsd.org/changeset/ports/120295 2004-08-23 2004-10-19 2015-05-01
imwheel -- insecure handling of PID file imwheel 1.0.0.p12

A Computer Academic Underground advisory describes the consequences of imwheel's handling of the process ID file (PID file):

imwheel exclusively uses a predictably named PID file for management of multiple imwheel processes. A race condition exists when the -k command-line option is used to kill existing imwheel processes. This race condition may be used by a local user to Denial of Service another user using imwheel, lead to resource exhaustion of the host system, or append data to arbitrary files.

http://www.caughq.org/advisories/CAU-2004-0002.txt http://imwheel.sourceforge.net/files/DEVELOPMENT.txt 2004-08-20 2004-10-19
squid -- NTLM authentication denial-of-service vulnerability squid 2.5.7

A remote attacker is able to cause a denial-of-service situation, when NTLM authentication is enabled in squid. NTLM authentication uses two functions which lack correct offset checking.

CVE-2004-0832 http://www.squid-cache.org/bugs/show_bug.cgi?id=1045 2004-08-18 2004-10-18
cacti -- SQL injection cacti 0.8.6

Fernando Quintero reports that Cacti 0.8.5a suffers from a SQL injection attack where an attacker can change the password for any Cacti user. This attack is not possible if the PHP option magic_quotes_gpc is set to On, which is the default for PHP in FreeBSD.

http://marc.theaimsgroup.com/?l=full-disclosure&m=109269427427368 2004-08-16 2004-10-17
apache13-modssl -- format string vulnerability in proxy support apache+mod_ssl 1.3.31+2.8.19 apache+mod_ssl+ipv6 1.3.31+2.8.19 ru-apache+mod_ssl 1.3.31+30.20+2.8.19

A OpenPKG Security Advisory reports:

Triggered by a report to Packet Storm from Virulent, a format string vulnerability was found in mod_ssl, the Apache SSL/TLS interface to OpenSSL, version (up to and including) 2.8.18 for Apache 1.3. The mod_ssl in Apache 2.x is not affected. The vulnerability could be exploitable if Apache is used as a proxy for HTTPS URLs and the attacker established a own specially prepared DNS and origin server environment.

10736 303448 CVE-2004-0700 http://www.openpkg.org/security/OpenPKG-SA-2004.032-apache.html http://packetstormsecurity.org/0407-advisories/modsslFormat.txt http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749 2004-07-16 2004-10-17
tor -- remote DoS and loss of anonymity tor 0.0.8.1

Tor has various remote crashes which could lead to a remote denial-of-service and be used to defeat clients anonymity. It is not expected that these vulnerabilities are exploitable for arbitrary code execution.

http://archives.seul.org/or/announce/Aug-2004/msg00001.html http://archives.seul.org/or/announce/Oct-2004/msg00000.html 2004-08-25 2004-10-15
icecast -- Cross-Site Scripting Vulnerability icecast 1.3.12_2

Caused by improper filtering of HTML code in the status display, it is possible for a remote user to execute scripting code in the target user's browser.

CVE-2004-0781 http://www.securitytracker.com/alerts/2004/Aug/1011047.html 2004-08-24 2004-10-13
icecast -- HTTP header overflow icecast2 2.0.2,1

It is possible to execute remote code simply using HTTP request plus 31 headers followed by a shellcode that will be executed directly.

http://marc.theaimsgroup.com/?l=full-disclosure&m=109646043512722 2004-09-29 2004-10-13
freeradius -- denial-of-service vulnerability freeradius 0.8.01.0.1

A remote attacker may be able to crash the freeRADIUS Server due to three independant bugs in the function which does improper checking values while processing RADIUS attributes.

CVE-2004-0938 CVE-2004-0960 CVE-2004-0961 http://www.securitytracker.com/alerts/2004/Sep/1011364.html 541574 11222 2004-09-20 2004-10-13 2004-10-19
xerces-c2 -- Attribute blowup denial-of-service xerces-c2 2.6.0

Amit Klein reports about Xerces-C++:

An attacker can craft a malicious XML document, which uses XML attributes in a way that inflicts a denial of service condition on the target machine (XML parser). The result of this attack is that the XML parser consumes all the CPU.

11312 http://marc.theaimsgroup.com/?l=bugtraq&m=109674050017645 2004-10-02 2004-10-13 2004-10-14
wordpress -- XSS in administration panel wordpress 1.2.1

Pages in the administration panel of Wordpress are vulnerable for XSS attacks.

http://wordpress.org/development/2004/10/wp-121/ http://marc.theaimsgroup.com/?l=bugtraq&m=109641484723194 2004-09-27 2004-10-13
tiff -- multiple integer overflows tiff 3.6.1_2 linux-tiff 3.6.1 pdflib pdflib-perl 6.0.1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

Dmitry V. Levin discovered numerous integer overflow bugs in libtiff. Most of these bugs are related to memory management, and are believed to be exploitable for arbitrary code execution.

687568 CVE-2004-0886 http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities 2004-10-13 2004-10-13 2006-06-08
CUPS -- local information disclosure cups-base 1.1.22

Certain methods of authenticated remote printing in CUPS can disclose user names and passwords in the log files.

A workaround for this problem is to set more strict access permissions on the CUPS logfiles.

http://docs.info.apple.com/article.html?artnum=61798 http://secunia.com/advisories/12690/ http://www.cups.org/str.php?L920 CVE-2004-0923 557062 2004-09-23 2004-10-13
zinf -- potential buffer overflow playlist support zinf 2.2.5 freeamp 0

The audio player Zinf is vulnerable to a buffer-overflow bug in the management of the playlist files.

http://marc.theaimsgroup.com/?l=bugtraq&m=109608092609200 2004-09-24 2004-10-12
tiff -- RLE decoder heap overflows tiff 3.6.1_1 linux-tiff 3.6.1 pdflib pdflib-perl 6.0.1 gdal 1.2.1_2 ivtools 1.2.3 paraview 2.4.3 fractorama 1.6.7_1 iv ja-iv ja-libimg 0

Chris Evans discovered several heap buffer overflows in libtiff's RLE decoder. These overflows could be triggered by a specially-crafted TIFF image file, resulting in an application crash and possibly arbitrary code execution.

948752 CVE-2004-0803 http://scary.beasts.org/security/CESA-2004-006.txt 2004-10-13 2004-10-13 2006-06-08
sharutils -- buffer overflows sharutils 4.2.1_2

From Gentoo advisory GLSA 200410-01:

sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer overflow in shar.c, where the length of data returned by the wc command is not checked. Florian Schilhabel discovered another buffer overflow in unshar.c.

An attacker could exploit these vulnerabilities to execute arbitrary code as the user running one of the sharutils programs.

11298 http://www.gentoo.org/security/en/glsa/glsa-200410-01.xml http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=265904 2004-08-15 2004-10-13
mail-notification -- denial-of-service vulnerability mail-notification 0.7.0

Caused by an untested return value, and a resulting null pointer dereference, it is possible for an attacker to crash the application. However, the attacker must first hijack the connection between Mail Notification and the Gmail or IMAP server.

http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:2.asc http://www.nongnu.org/mailnotify/sa/mail-notification-SA-04:3.asc 2004-10-06 2004-10-12
squid -- SNMP module denial-of-service vulnerability squid 2.5.7 3.0.03.0.7

The Squid-2.5 patches page notes:

If a certain malformed SNMP request is received squid restarts with a Segmentation Fault error.

This only affects squid installations where SNMP is explicitly enabled via "make config". As a workaround, SNMP can be disabled by defining "snmp_port 0" in squid.conf.

Squid security advisory SQUID-2008:1 explains that Squid-3 versions up to and including Squid-3.0.STABLE6 are affected by this error, too.

CVE-2004-0918 http://www.idefense.com/application/poi/display?id=152&type=vulnerabilities http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE6-SNMP_core_dump http://www.squid-cache.org/Advisories/SQUID-2004_3.txt http://www.squid-cache.org/Advisories/SQUID-2008_1.txt 2004-09-29 2004-10-12 2008-06-28
cyrus-sasl -- potential buffer overflow in DIGEST-MD5 plugin cyrus-sasl 2.*2.1.19

The Cyrus SASL DIGEST-MD5 plugin contains a potential buffer overflow when quoting is required in the output.

https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/plugins/digestmd5.c#rev1.171 2004-07-06 2004-10-12
cyrus-sasl -- dynamic library loading and set-user-ID applications cyrus-sasl 1.5.28_3 2.*2.1.19

The Cyrus SASL library, libsasl, contains functions which may load dynamic libraries. These libraries may be loaded from the path specified by the environmental variable SASL_PATH, which in some situations may be fully controlled by a local attacker. Thus, if a set-user-ID application (such as chsh) utilizes libsasl, it may be possible for a local attacker to gain superuser privileges.

CVE-2004-0884 https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c#rev1.104 2004-09-22 2004-10-08
imp3 -- XSS hole in the HTML viewer imp 3.2.6

The script vulnerabilities can only be exposed with certain browsers and allow XSS attacks when viewing HTML messages with the HTML MIME viewer

http://thread.gmane.org/gmane.comp.horde.imp/15488 http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.389.2.109&r2=1.389.2.111&ty=h 2004-08-20 2004-10-05
bmon -- unsafe set-user-ID application bmon 1.2.1_2

Jon Nistor reported that the FreeBSD port of bmon was installed set-user-ID root, and executes commands using relative paths. This could allow local user to easily obtain root privileges.

ports/67340 2004-05-29 2004-10-05
gnutls -- certificate chain verification DoS gnutls 1.0.17 gnutls-devel 1.1.*1.1.12

Patric Hornik reports on a problem in the certificate chain verification procedures of GnuTLS that may result in a denial-of-service vulnerability:

The certificate chain should be verified from last root certificate to the first certificate. Otherwise a lot of unauthorized CPU processing can be forced to check certificate signatures signed with arbitrary RSA/DSA keys chosen by attacker.

In GnuTLS the signatures are checked from first to last certificate, there is no limit on size of keys and no limit on length of certificate chain.

http://www.hornik.sk/SA/SA-20040802.txt http://secunia.com/advisories/12156 2004-08-02 2004-10-05
php -- vulnerability in RFC 1867 file upload processing php4 php4-cgi 4.3.8_2 mod_php4 4.3.8_2,1 php5 php5-cgi 5.0.1 mod_php5 5.0.1,1

Stefano Di Paola discovered an issue with PHP that could allow someone to upload a file to any directory writeable by the httpd process. Any sanitizing performed on the prepended directory path is ignored. This bug can only be triggered if the $_FILES element name contains an underscore.

http://marc.theaimsgroup.com/?l=bugtraq&m=109534848430404 http://marc.theaimsgroup.com/?l=bugtraq&m=109648426331965 2004-09-15 2004-09-15 2004-10-12
php -- php_variables memory disclosure mod_php4-twig php4-cgi php4-cli php4-dtc php4-horde php4-nms php4 4.3.8_2 mod_php mod_php4 44.3.8_2,1 php5 php5-cgi php5-cli 5.0.1 mod_php5 5.0.1,1

Stefano Di Paola reports:

Bad array parsing in php_variables.c could lead to show arbitrary memory content such as pieces of php code and other data. This affects all GET, POST or COOKIES variables.

http://marc.theaimsgroup.com/?l=bugtraq&m=109527531130492 2004-09-15 2004-10-05
xv -- exploitable buffer overflows xv xv-m17n 3.10a_4

In a Bugtraq posting, infamous41md(at)hotpop.com reported:

there are at least 5 exploitable buffer and heap overflows in the image handling code. this allows someone to craft a malicious image, trick a user into viewing the file in xv, and upon viewing that image execute arbitrary code under privileges of the user viewing image. note the AT LEAST part of the above sentence. there is such a plethora of bad code that I just stopped reading after a while. there are at least 100 calls to sprintf() and strcpy() with no regards for bounds of buffers. 95% of these deal with program arguments or filenames, so they are of no interest to exploit. however I just got sick of reading this code after not too long. so im sure there are still other overflows in the image handling code for other image types.

The posting also included an exploit.

http://marc.theaimsgroup.com/?l=bugtraq&m=109302498125092 2004-08-20 2004-10-05 2004-10-12
getmail -- symlink vulnerability during maildir delivery getmail 3.2.5

David Watson reports a symlink vulnerability in getmail. If run as root (not the recommended mode of operation), a local user may be able to cause getmail to write files in arbitrary directories via a symlink attack on subdirectories of the maildir.

http://marc.theaimsgroup.com/?l=bugtraq&m=109571883130372 CVE-2004-0881 11224 2004-09-19 2004-10-04
Boundary checking errors in syscons FreeBSD 5.05.2.1_11

The syscons CONS_SCRSHOT ioctl(2) does insufficient validation of its input arguments. In particular, negative coordinates or large coordinates may cause unexpected behavior.

It may be possible to cause the CONS_SCRSHOT ioctl to return portions of kernel memory. Such memory might contain sensitive information, such as portions of the file cache or terminal buffers. This information might be directly useful, or it might be leveraged to obtain elevated privileges in some way. For example, a terminal buffer might include a user-entered password.

This bug may be exploitable by users who have access to the physical console or can otherwise open a /dev/ttyv* device node.

CVE-2004-0919 SA-04:15.syscons https://svnweb.freebsd.org/changeset/base/135942 2004-09-30 2004-10-04
racoon -- improper certificate handling racoon 20040818a

Thomas Walpuski noted when OpenSSL would detect an error condition for a peer certificate, racoon mistakenly ignored the error. This could allow five invalid certificate states to properly be used for authentication.

http://marc.theaimsgroup.com/?l=bugtraq&m=108726102304507 http://www.kame.net/racoon/racoon-ml/msg00517.html 2004-01-31 2004-10-03
distcc -- incorrect parsing of IP access control rules distcc 2.16

Fix bug that might cause IP-based access control rules not to be interpreted correctly on 64-bit platforms.

CVE-2004-0601 http://distcc.samba.org/ftp/distcc/distcc-2.16.NEWS 2004-06-23 2004-10-03
mozilla -- scripting vulnerabilities thunderbird 0.8 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 1.p de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7.3 mozilla 1.7.3,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

Several scripting vulnerabilities were discovered and corrected in Mozilla:

CVE-2004-0905

javascript; links dragged onto another frame or page allows an attacker to steal or modify sensitive information from other sites. The user could be convinced to drag obscurred links in the context of a game or even a fake scrollbar. If the user could be convinced to drag two links in sequence into a separate window (not frame) the attacker would be able to run arbitrary programs.

CVE-2004-0908

Untrusted javascript code can read and write to the clipboard, stealing any sensitive data the user might have copied. Workaround: disable javascript

CVE-2004-0909

Signed scripts requesting enhanced abilities could construct the request in a way that led to a confusing grant dialog, possibly fooling the user into thinking the privilege requested was inconsequential while actually obtaining explicit permission to run and install software. Workaround: Never grant enhanced abilities of any kind to untrusted web pages.

CVE-2004-0905 CVE-2004-0908 CVE-2004-0909 http://bugzilla.mozilla.org/show_bug.cgi?id=250862 http://bugzilla.mozilla.org/show_bug.cgi?id=257523 http://bugzilla.mozilla.org/show_bug.cgi?id=253942 2004-09-13 2004-09-30
mozilla -- users may be lured into bypassing security dialogs thunderbird 0.7 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0.9.2 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7 mozilla 1.7,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

According to the Mozilla project:

An attacker who could lure users into clicking in particular places, or typing specific text, could cause a security permission or software installation dialog to pop up under the user's mouse click, clicking on the grant (or install) button.

CVE-2004-0762 http://bugzilla.mozilla.org/show_bug.cgi?id=162020 2004-06-05 2004-09-30
mozilla -- hostname spoofing bug thunderbird 0.7 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0.9.2 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 mozilla-gtk1 linux-mozilla linux-mozilla-devel 1.7 mozilla 1.7,2 de-linux-netscape fr-linux-netscape ja-linux-netscape linux-netscape linux-phoenix mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk2 mozilla-gtk mozilla-thunderbird phoenix 0

When processing URIs that contain an unqualified host name-- specifically, a domain name of only one component-- Mozilla will perform matching against the first component of the domain name in SSL certificates. In other words, in some situations, a certificate issued to "www.example.com" will be accepted as matching "www".

CVE-2004-0765 http://bugzilla.mozilla.org/show_bug.cgi?id=234058 2004-02-12 2004-09-30
samba -- remote file disclosure samba 2.2.12 3.*3.0.2a 3.*,13.0.2a_1,1 ja-samba 2.2.11.j1.0_1

According to a Samba Team security notice:

A security vulnerability has been located in Samba 2.2.x <= 2.2.11 and Samba 3.0.x <= 3.0.5. A remote attacker may be able to gain access to files which exist outside of the share's defined path. Such files must still be readable by the account used for the connection.

The original notice for CAN-2004-0815 indicated that Samba 3.0.x <= 3.0.5 was vulnerable to the security issue. After further research, Samba developers have confirmed that only Samba 3.0.2a and earlier releases contain the exploitable code.

CVE-2004-0815 http://www.samba.org/samba/news/#security_2.2.12 2004-09-30 2004-09-30 2008-09-26
mozilla -- BMP decoder vulnerabilities thunderbird 0.7.3_1 de-linux-mozillafirebird el-linux-mozillafirebird firefox ja-linux-mozillafirebird-gtk1 ja-mozillafirebird-gtk2 linux-mozillafirebird linux-phoenix phoenix ru-linux-mozillafirebird zhCN-linux-mozillafirebird zhTW-linux-mozillafirebird 0.9.3_1 de-netscape7 fr-netscape7 ja-netscape7 netscape7 pt_BR-netscape7 7.2 linux-mozilla linux-mozilla-devel 1.7.3 mozilla-gtk1 1.7.2_3 mozilla 1.7.2_2,2 1.8.a,21.8.a3_1,2 mozilla+ipv6 mozilla-embedded mozilla-firebird mozilla-gtk mozilla-gtk2 mozilla-thunderbird linux-netscape de-linux-netscape fr-linux-netscape ja-linux-netscape 0

Gael Delalleau discovered several integer overflows in Mozilla's BMP decoder that can result in denial-of-service or arbitrary code execution.

CVE-2004-0904 http://bugzilla.mozilla.org/show_bug.cgi?id=255067 TA04-261A 847200 2004-09-13 2004-09-28 2004-09-30
mozilla -- vCard stack buffer overflow thunderbird 0.7.3_1 mozilla 1.7.2_2,2 1.8.a,21.8.a3_1,2 mozilla-gtk1 1.7.2_3 linux-mozilla 1.7.3

Georgi Guninski discovered a stack buffer overflow which may be triggered when viewing email messages with vCard attachments.

CVE-2004-0903 http://bugzilla.mozilla.org/show_bug.cgi?id=257314 TA04-261A 414240 2004-09-13 2004-09-28 2004-09-30
mozilla -- multiple heap buffer overflows thunderbird 0.7.3_1 firefox 0.9.3_1 mozilla 1.7.2_2,2 1.8.a,21.8.a3_1,2 mozilla-gtk1 1.7.2_3 linux-mozilla 1.7.3 linux-mozillafirebird 0

Several heap buffer overflows were discovered and fixed in the most recent versions of Mozilla, Firefox, and Thunderbird. These overflows may occur when:

  • Using the "Send Page" function.
  • Checking mail on a malicious POP3 server.
  • Processing non-ASCII URLs.

Each of these vulnerabilities may be exploited for remote code execution.

CVE-2004-0902 http://bugzilla.mozilla.org/show_bug.cgi?id=258005 http://bugzilla.mozilla.org/show_bug.cgi?id=245066 http://bugzilla.mozilla.org/show_bug.cgi?id=226669 http://bugzilla.mozilla.org/show_bug.cgi?id=256316 TA04-261A 2004-09-13 2004-09-28
php -- strip_tags cross-site scripting vulnerability mod_php4-twig php4 php4-cgi php4-cli php4-dtc php4-horde php4-nms 4.3.7_3 mod_php4 4.3.7_3,1 php5 php5-cgi php5-cli 5.0.0.r3_2 mod_php5 5.0.0.r3_2,1

Stefan Esser of e-matters discovered that PHP's strip_tags() function would ignore certain characters during parsing of tags, allowing these tags to pass through. Select browsers could then parse these tags, possibly allowing cross-site scripting attacks.

CVE-2004-0595 http://marc.theaimsgroup.com/?l=bugtraq&m=108981589117423 http://security.e-matters.de/advisories/122004.html 10724 2004-07-07 2004-09-27 2013-06-19
php -- memory_limit related vulnerability mod_php4-twig php4 php4-cgi php4-cli php4-dtc php4-horde php4-nms 4.3.7_3 mod_php4 4.3.7_3,1 php5 php5-cgi php5-cli 5.0.0.r3_2 mod_php5 5.0.0.r3_2,1

Stefan Esser of e-matters discovered a condition within PHP that may lead to remote execution of arbitrary code. The memory_limit facility is used to notify functions when memory contraints have been met. Under certain conditions, the entry into this facility is able to interrupt functions such as zend_hash_init() at locations not suitable for interruption. The result would leave these functions in a vulnerable state.

An attacker that is able to trigger the memory_limit abort within zend_hash_init() and is additionally able to control the heap before the HashTable itself is allocated, is able to supply his own HashTable destructor pointer. [...]

All mentioned places outside of the extensions are quite easy to exploit, because the memory allocation up to those places is deterministic and quite static throughout different PHP versions. [...]

Because the exploit itself consist of supplying an arbitrary destructor pointer this bug is exploitable on any platform.

CVE-2004-0594 http://marc.theaimsgroup.com/?l=bugtraq&m=108981780109154 http://security.e-matters.de/advisories/112004.html 10725 2004-07-07 2004-09-27 2004-10-02
subversion -- WebDAV fails to protect metadata subversion subversion-perl subversion-python 1.0.8

In some situations, subversion metadata may be unexpectedly disclosed via WebDAV. A subversion advisory states:

mod_authz_svn, the Apache httpd module which does path-based authorization on Subversion repositories, is not correctly protecting all metadata on unreadable paths.

This security issue is not about revealing the contents of protected files: it only reveals metadata about protected areas such as paths and log messages. This may or may not be important to your organization, depending on how you're using path-based authorization, and the sensitivity of the metadata.

CVE-2004-0749 http://subversion.tigris.org/security/CAN-2004-0749-advisory.txt 2004-09-15 2004-09-26
lha -- numerous vulnerabilities when extracting archives lha 1.14i_6

Source code reviews of lha by Lukasz Wojtow, Thomas Biege, and others uncovered a number of vulnerabilities affecting lha:

  • Buffer overflows when handling archives and filenames. (CVE-2004-0694)
  • Possible command execution via shell meta-characters when built with NOMKDIR. (CVE-2004-0745)
  • Buffer overflow resulting in arbitrary code execution when handling long pathnames in LHZ archives. (CVE-2004-0769)
  • Buffer overflow in the extract_one. (CVE-2004-0771)
CVE-2004-0694 CVE-2004-0745 CVE-2004-0769 CVE-2004-0771 http://marc.theaimsgroup.com/?l=bugtraq&m=108464470103227 http://marc.theaimsgroup.com/?l=bugtraq&m=108668791510153 http://bugs.gentoo.org/show_bug.cgi?id=51285 http://xforce.iss.net/xforce/xfdb/16196 10354 2004-05-17 2004-09-23
mysql -- heap buffer overflow with prepared statements mysql-server mysql-client 4.1.04.1.4

There is a buffer overflow in the prepared statements API (libmysqlclient) when a statement containing thousands of placeholders is executed.

http://bugs.mysql.com/bug.php?id=5194 http://dev.mysql.com/doc/mysql/en/News-4.1.5.html http://mysql.bkbits.net:8080/mysql-4.1/cset@1.1932.152.4 2004-09-08 2004-09-23
mozilla -- security icon spoofing firefox 0.9 linux-mozilla linux-mozilla-devel 1.7 mozilla 1.7,2 mozilla-gtk1 1.7

Under certain situations it is possible for the security icon which Mozilla displays when connected to a site using SSL to be spoofed. This could be used to make so-called "phishing attacks" more difficult to detect.

CVE-2004-0761 https://bugzilla.mozilla.org/show_bug.cgi?id=240053 2004-04-08 2004-09-22
mozilla -- NULL bytes in FTP URLs firefox 0.9.3 linux-mozilla linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8.a,2 mozilla-gtk1 1.7.2

When handling FTP URLs containing NULL bytes, Mozilla will interpret the file content as HTML. This may allow unexpected execution of Javascript when viewing plain text or other file types via FTP.

CVE-2004-0760 http://bugzilla.mozilla.org/show_bug.cgi?id=250906 2004-07-11 2004-09-22 2004-09-24
mozilla -- automated file upload mozilla 1.7.a,21.7,2 1.8.a,21.8.a2,2 mozilla-gtk1 1.7.a1.7

A malicious web page can cause an automated file upload from the victim's machine when viewed with Mozilla with Javascript enabled. This is due to a bug permitting default values for type="file" <input> elements in certain situations.

CVE-2004-0759 https://bugzilla.mozilla.org/show_bug.cgi?id=241924 2004-04-28 2004-09-22 2004-09-26
mozilla -- built-in CA certificates may be overridden firefox 0.9.3 linux-mozilla linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8.a,2 mozilla-gtk1 1.7.2

Under some situations, Mozilla will automatically import a certificate from an email message or web site. This behavior can be used as a denial-of-service attack: if the certificate has a distinguished name (DN) identical to one of the built-in Certificate Authorities (CAs), then Mozilla will no longer be able to certify sites with certificates issued from that CA.

CVE-2004-0758 https://bugzilla.mozilla.org/show_bug.cgi?id=249004 160360 http://banquo.inf.ethz.ch:8080/ 2004-06-29 2004-09-22
rssh -- file name disclosure bug rssh 2.2.1

rssh expands command line paramters before invoking chroot. This could result in the disclosure to the client of file names outside of the chroot directory. A posting by the rssh author explains:

The cause of the problem identified by Mr. McCaw is that rssh expanded command-line arguments prior to entering the chroot jail. This bug DOES NOT allow a user to access any of the files outside the jail, but can allow them to discover what files are in a directory which is outside the jail, if their credentials on the server would normally allow them read/execute access in the specified directory.

CVE-2004-0609 http://marc.theaimsgroup.com/?l=bugtraq&m=108787373022844 10574 http://www.osvdb.org/7239 2004-06-19 2004-09-21
gnu-radius -- SNMP-related denial-of-service gnu-radius 1.2.94

An iDEFENSE security advisory reports:

Remote exploitation of an input validation error in version 1.2 of GNU radiusd could allow a denial of service.

The vulnerability specifically exists within the asn_decode_string() function defined in snmplib/asn1.c. When a very large unsigned number is supplied, it is possible that an integer overflow will occur in the bounds-checking code. The daemon will then attempt to reference unallocated memory, resulting in an access violation that causes the process to terminate.

CVE-2004-0849 http://www.idefense.com/application/poi/display?id=141&type=vulnerabilities 2004-09-15 2004-09-20 2005-05-03
sudo -- sudoedit information disclosure sudo 1.6.8

A new feature of sudo 1.6.8 called "sudoedit" (a safe editing facility) may allow users to read files to which they normally have no access.

http://www.sudo.ws/sudo/alerts/sudoedit.html 2004-09-18 2004-09-20
apache -- heap overflow in mod_proxy apache 1.3.31_1 apache13-ssl 1.3.29.1.53_2 apache13-modssl 1.3.31+2.8.18_4 apache13+ipv6 1.3.29_2 apache13-modperl 1.3.31

A buffer overflow exists in mod_proxy which may allow an attacker to launch local DoS attacks and possibly execute arbitrary code.

CVE-2004-0492 http://www.guninski.com/modproxy1.html 2004-06-10 2004-09-19 2004-10-05
cvs -- numerous vulnerabilities cvs+ipv6 1.11.17 FreeBSD 5.25.2.1_10 4.104.10_3 4.94.9_12 4.84.8_25

A number of vulnerabilities were discovered in CVS by Stefan Esser, Sebastian Krahmer, and Derek Price.

  • Insufficient input validation while processing "Entry" lines. (CVE-2004-0414)
  • A double-free resulting from erroneous state handling while processing "Argumentx" commands. (CVE-2004-0416)
  • Integer overflow while processing "Max-dotdot" commands. (CVE-2004-0417)
  • Erroneous handling of empty entries handled while processing "Notify" commands. (CVE-2004-0418)
  • A format string bug while processing CVS wrappers.
  • Single-byte buffer underflows while processing configuration files from CVSROOT.
  • Various other integer overflows.

Additionally, iDEFENSE reports an undocumented command-line flag used in debugging does not perform input validation on the given path names.

CVS servers ("cvs server" or :pserver: modes) are affected by these vulnerabilities. They vary in impact but include information disclosure (the iDEFENSE-reported bug), denial-of-service (CVE-2004-0414, CVE-2004-0416, CVE-2004-0417 and other bugs), or possibly arbitrary code execution (CVE-2004-0418). In very special situations where the attacker may somehow influence the contents of CVS configuration files in CVSROOT, additional attacks may be possible.

CVE-2004-0414 CVE-2004-0416 CVE-2004-0417 CVE-2004-0418 CVE-2004-0778 http://secunia.com/advisories/11817 http://secunia.com/advisories/12309 http://security.e-matters.de/advisories/092004.html http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities&flashstatus=false https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104 http://www.osvdb.org/6830 http://www.osvdb.org/6831 http://www.osvdb.org/6832 http://www.osvdb.org/6833 http://www.osvdb.org/6834 http://www.osvdb.org/6835 http://www.osvdb.org/6836 10499 SA-04:14.cvs 2004-05-20 2004-08-17 2004-09-19
gdk-pixbuf -- image decoding vulnerabilities linux-gdk-pixbuf 0.22.0.11.3.5 gtk 2.02.4.9_1 gdk-pixbuf 0.22.0_2

Chris Evans discovered several flaws in the gdk-pixbuf XPM image decoder:

  • Heap-based overflow in pixbuf_create_from_xpm
  • Stack-based overflow in xpm_extract_color
  • Integer overflows in io-ico.c

Some of these flaws are believed to be exploitable.

CVE-2004-0782 CVE-2004-0783 CVE-2004-0788 http://scary.beasts.org/security/CESA-2004-005.txt 2004-09-15 2004-09-15 2004-11-09
xpm -- image decoding vulnerabilities agenda-snow-libs linux_base open-motif-devel mupad zh-cle_base 0 libXpm 3.5.1_1 XFree86-libraries 4.4.0_1 xorg-libraries 6.7.0_2 lesstif 0.93.96,2 xpm 3.4k_1 linux-openmotif 2.2.4 open-motif 2.2.3_1

Chris Evans discovered several vulnerabilities in the libXpm image decoder:

  • A stack-based buffer overflow in xpmParseColors
  • An integer overflow in xpmParseColors
  • A stack-based buffer overflow in ParsePixels and ParseAndPutPixels

The X11R6.8.1 release announcement reads:

This version is purely a security release, addressing multiple integer and stack overflows in libXpm, the X Pixmap library; all known versions of X (both XFree86 and X.Org) are affected, so all users of X are strongly encouraged to upgrade.

CVE-2004-0687 CVE-2004-0688 http://freedesktop.org/pipermail/xorg/2004-September/003172.html http://scary.beasts.org/security/CESA-2004-003.txt 537878 882750 2004-09-15 2004-09-15 2005-01-03
cups -- print queue browser denial-of-service cups-base 1.1.21

If the CUPS server (cupsd) receives a zero-length UDP message, it will disable its print queue browser service.

CVE-2004-0558 http://www.cups.org/str.php?L863 2004-08-23 2004-09-15
apache -- apr_uri_parse IPv6 address handling vulnerability apache 2.02.0.50_3

The Apache Software Foundation Security Team discovered a programming error in the apr-util library function apr_uri_parse. When parsing IPv6 literal addresses, it is possible that a length is incorrectly calculated to be negative, and this value is passed to memcpy. This may result in an exploitable vulnerability on some platforms, including FreeBSD.

CVE-2004-0786 http://httpd.apache.org 2004-09-15 2004-09-15
mod_dav -- lock related denial-of-service apache 2.02.0.50_3 mod_dav 1.0.3_1

A malicious user with DAV write privileges can trigger a null pointer dereference in the Apache mod_dav module. This could cause the server to become unavailable.

CVE-2004-0809 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=31183 2004-09-15 2004-09-15
apache -- ap_resolve_env buffer overflow apache 2.02.0.50_3

SITIC discovered a vulnerability in Apache 2's handling of environmental variable settings in the httpd configuration files (the main `httpd.conf' and `.htaccess' files). According to a SITIC advisory:

The buffer overflow occurs when expanding ${ENVVAR} constructs in .htaccess or httpd.conf files. The function ap_resolve_env() in server/util.c copies data from environment variables to the character array tmp with strcat(3), leading to a buffer overflow.

CVE-2004-0747 http://lists.netsys.com/pipermail/full-disclosure/2004-September/026463.html 2004-09-15 2004-09-15
webmin -- insecure temporary file creation at installation time webmin 1.150_5

The Webmin developers documented a security issue in the release notes for version 1.160:

Fixed a security hole in the maketemp.pl script, used to create the /tmp/.webmin directory at install time. If an un-trusted user creates this directory before Webmin is installed, he could create in it a symbolic link pointing to a critical file on the system, which would be overwritten when Webmin writes to the link filename.

CVE-2004-0559 http://www.webmin.com/changes-1.160.html 2004-09-05 2004-09-14 2004-09-15
samba3 DoS attack samba3 3.0.7 *,13.0.7,1

Code found in nmbd and smbd may allow a remote attacker to effectively crash the nmbd server or use the smbd server to exhaust the system memory.

CVE-2004-0807 CVE-2004-0808 http://www.idefense.com/application/poi/display?id=139&type=vulnerabilities 2004-09-02 2004-09-14 2008-09-26
mozilla -- POP client heap overflow mozilla 1.7,2 linux-mozilla 1.7 netscape7 7.2 thunderbird 0.7

zen-parse discovered a heap buffer overflow in Mozilla's POP client implementation. A malicious POP server could exploit this vulnerability to cause Mozilla to execute arbitrary code.

CVE-2004-0757 http://bugzilla.mozilla.org/show_bug.cgi?id=229374 http://bugzilla.mozilla.org/show_bug.cgi?id=157644 2004-07-22 2004-09-14
mozilla -- SOAPParameter integer overflow firefox 0.9 linux-mozilla linux-mozilla-devel mozilla-gtk1 1.7 mozilla 1.7,2 netscape7 7.2

zen-parse discovered and iDEFENSE reported an exploitable integer overflow in a scriptable Mozilla component `SOAPParameter':

Improper input validation to the SOAPParameter object constructor in Netscape and Mozilla allows execution of arbitrary code. The SOAPParameter object's constructor contains an integer overflow which allows controllable heap corruption. A web page can be constructed to leverage this into remote execution of arbitrary code.

CVE-2004-0722 http://bugzilla.mozilla.org/show_bug.cgi?id=236618 2004-08-02 2004-09-14 2004-09-22
openoffice -- document disclosure openoffice ar-openoffice ca-openoffice cs-openoffice de-openoffice dk-openoffice el-openoffice es-openoffice et-openoffice fi-openoffice fr-openoffice gr-openoffice hu-openoffice it-openoffice ja-openoffice ko-openoffice nl-openoffice pl-openoffice pt-openoffice pt_BR-openoffice ru-openoffice se-openoffice sk-openoffice sl-openoffice-SI tr-openoffice zh-openoffice-CN zh-openoffice-TW 1.1.2_1 2.0

OpenOffice creates a working directory in /tmp on startup, and uses this directory to temporarily store document content. However, the permissions of the created directory may allow other user on the system to read these files, potentially exposing information the user likely assumed was inaccessible.

CVE-2004-0752 http://www.openoffice.org/issues/show_bug.cgi?id=33357 http://securitytracker.com/alerts/2004/Sep/1011205.html http://marc.theaimsgroup.com/?l=bugtraq&m=109483308421566 2004-08-24 2004-09-14
mpg123 buffer overflow mpg123 mpg123-nas mpg123-esound 0.59r

The mpg123 software version 0.59r contains a buffer overflow vulnerability which may permit the execution of arbitrary code as the owner of the mpg123 process.

CVE-2004-0805 http://www.alighieri.org/advisories/advisory-mpg123.txt 2003-08-16 2004-09-14
ImageMagick -- BMP decoder buffer overflow ImageMagick ImageMagick-nox11 6.0.6.2

Marcus Meissner discovered that ImageMagick's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability.

CVE-2004-0827 http://www.imagemagick.org/www/Changelog.html 2004-08-25 2004-08-31 2004-09-14
Mutiple browser frame injection vulnerability kdelibs 3.2.3_3 kdebase 3.2.3_1 linux-opera opera 7.507.52 firefox 0.9 linux-mozilla linux-mozilla-devel mozilla-gtk1 1.7 mozilla 1.7,2 netscape7 7.2

A class of bugs affecting many web browsers in the same way was discovered. A Secunia advisory reports:

The problem is that the browsers don't check if a target frame belongs to a website containing a malicious link, which therefore doesn't prevent one browser window from loading content in a named frame in another window.

Successful exploitation allows a malicious website to load arbitrary content in an arbitrary frame in another browser window owned by e.g. a trusted site.

A KDE Security Advisory reports:

A malicious website could abuse Konqueror to insert its own frames into the page of an otherwise trusted website. As a result the user may unknowingly send confidential information intended for the trusted website to the malicious website.

Secunia has provided a demonstration of the vulnerability at http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/.

CVE-2004-0717 CVE-2004-0718 CVE-2004-0721 http://secunia.com/advisories/11978/ http://bugzilla.mozilla.org/show_bug.cgi?id=246448 ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-htmlframes.patch ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdebase-htmlframes.patch 2004-08-11 2004-08-12 2004-09-14
isakmpd payload handling denial-of-service vulnerabilities isakmpd 20030903

Numerous errors in isakmpd's input packet validation lead to denial-of-service vulnerabilities. From the Rapid7 advisory:

The ISAKMP packet processing functions in OpenBSD's isakmpd daemon contain multiple payload handling flaws that allow a remote attacker to launch a denial of service attack against the daemon.

Carefully crafted ISAKMP packets will cause the isakmpd daemon to attempt out-of-bounds reads, exhaust available memory, or loop endlessly (consuming 100% of the CPU).

CVE-2004-0218 CVE-2004-0219 CVE-2004-0220 CVE-2004-0221 CVE-2004-0222 http://www.rapid7.com/advisories/R7-0018.html http://www.openbsd.org/errata34.html 2004-03-17 2004-03-31 2004-09-14
imlib -- BMP decoder heap buffer overflow imlib 1.9.14_4

Marcus Meissner discovered that imlib's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. It is believed that this bug could be exploited for arbitrary code execution.

CVE-2004-0817 http://bugzilla.gnome.org/show_bug.cgi?id=151034 2004-08-25 2004-08-31 2004-09-02
krb5 -- double-free vulnerabilities krb5 1.3.4_1

An advisory published by the MIT Kerberos team says:

The MIT Kerberos 5 implementation's Key Distribution Center (KDC) program contains a double-free vulnerability that potentially allows a remote attacker to execute arbitrary code. Compromise of a KDC host compromises the security of the entire authentication realm served by the KDC. Additionally, double-free vulnerabilities exist in MIT Kerberos 5 library code, making client programs and application servers vulnerable.

Double-free vulnerabilities of this type are not believed to be exploitable for code execution on FreeBSD systems. However, the potential for other ill effects may exist.

CVE-2004-0642 CVE-2004-0643 CVE-2004-0772 795632 866472 350792 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt 2004-08-31 2004-08-31
krb5 -- ASN.1 decoder denial-of-service vulnerability krb5 1.2.21.3.4

An advisory published by the MIT Kerberos team says:

The ASN.1 decoder library in the MIT Kerberos 5 distribution is vulnerable to a denial-of-service attack causing an infinite loop in the decoder. The KDC is vulnerable to this attack.

An unauthenticated remote attacker can cause a KDC or application server to hang inside an infinite loop.

An attacker impersonating a legitimate KDC or application server may cause a client program to hang inside an infinite loop.

CVE-2004-0644 550464 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-003-asn1.txt 2004-08-31 2004-08-31
imlib2 -- BMP decoder buffer overflow imlib2 1.1.1

Marcus Meissner discovered that imlib2's BMP decoder would crash when loading the test BMP file created by Chris Evans for testing the previous Qt vulnerability. There appears to be both a stack-based and a heap-based buffer overflow that are believed to be exploitable for arbitrary code execution.

CVE-2004-0802 http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/libs/imlib2/ChangeLog?rev=1.20&view=markup 2004-08-31 2004-08-31
SpamAssassin -- denial-of-service in tokenize_headers p5-Mail-SpamAssassin 2.64

According to the SpamAssassin 2.64 release announcement:

Security fix prevents a denial of service attack open to certain malformed messages; this DoS affects all SpamAssassin 2.5x and 2.6x versions to date.

The issue appears to be triggered by overly long message headers.

CVE-2004-0796 10957 http://marc.theaimsgroup.com/?l=spamassassin-announce&m=109168121628767 http://search.cpan.org/src/JMASON/Mail-SpamAssassin-2.64/Changes 2004-08-04 2004-08-23 2004-08-28
tnftpd -- remotely exploitable vulnerability tnftpd 20040810 lukemftpd 0 FreeBSD 4.7

lukemftpd(8) is an enhanced BSD FTP server produced within the NetBSD project. The sources for lukemftpd are shipped with some versions of FreeBSD, however it is not built or installed by default. The build system option WANT_LUKEMFTPD must be set to build and install lukemftpd. [NOTE: An exception is FreeBSD 4.7-RELEASE, wherein lukemftpd was installed, but not enabled, by default.]

Przemyslaw Frasunek discovered several vulnerabilities in lukemftpd arising from races in the out-of-band signal handling code used to implement the ABOR command. As a result of these races, the internal state of the FTP server may be manipulated in unexpected ways.

A remote attacker may be able to cause FTP commands to be executed with the privileges of the running lukemftpd process. This may be a low-privilege `ftp' user if the `-r' command line option is specified, or it may be superuser privileges if `-r' is *not* specified.

CVE-2004-0794 10967 http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpd.c#rev1.158 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-009.txt.asc http://lists.netsys.com/pipermail/full-disclosure/2004-August/025418.html 2004-08-17 2004-08-17 2004-08-28
MySQL authentication bypass / buffer overflow mysql-server 4.14.1.3 55.0.0_2

By submitting a carefully crafted authentication packet, it is possible for an attacker to bypass password authentication in MySQL 4.1. Using a similar method, a stack buffer used in the authentication mechanism can be overflowed.

CVE-2004-0627 CVE-2004-0628 184030 645326 http://www.nextgenss.com/advisories/mysql-authbypass.txt http://dev.mysql.com/doc/mysql/en/News-4.1.3.html http://secunia.com/advisories/12020 http://www.osvdb.org/7475 http://www.osvdb.org/7476 http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0003.html 2004-07-01 2004-07-05 2004-08-28
Ruby insecure file permissions in the CGI session management ruby 1.6.8.2004.07.26 1.7.01.8.1.2004.07.23

According to a Debian Security Advisory:

Andres Salomon noticed a problem in the CGI session management of Ruby, an object-oriented scripting language. CGI::Session's FileStore (and presumably PStore [...]) implementations store session information insecurely. They simply create files, ignoring permission issues. This can lead an attacker who has also shell access to the webserver to take over a session.

CVE-2004-0755 http://xforce.iss.net/xforce/xfdb/16996 http://www.debian.org/security/2004/dsa-537 http://marc.theaimsgroup.com/?l=bugtraq&m=109267579822250&w=2 2004-08-16 2004-08-16 2004-08-28
nss -- exploitable buffer overflow in SSLv2 protocol handler nss 3.9.2

ISS X-Force reports that a remotely exploitable buffer overflow exists in the Netscape Security Services (NSS) library's implementation of SSLv2. From their advisory:

The NSS library contains a flaw in SSLv2 record parsing that may lead to remote compromise. When parsing the first record in an SSLv2 negotiation, the client hello message, the server fails to validate the length of a record field. As a result, it is possible for an attacker to trigger a heap-based overflow of arbitrary length.

Note that the vulnerable NSS library is also present in Mozilla-based browsers. However, it is not believed that browsers are affected, as the vulnerability is present only in code used by SSLv2 *servers*.

http://xforce.iss.net/xforce/alerts/id/180 http://www.osvdb.org/9116 http://secunia.com/advisories/12362 11015 2004-08-23 2004-08-27
ripMIME -- decoding bug allowing content filter bypass ripmime 1.3.2.3

ripMIME may prematurely terminate decoding Base64 encoded messages when it encounters multiple blank lines or other non-standard Base64 constructs. Virus scanning and content filtering tools that use ripMIME may therefore be bypassed.

The ripMIME CHANGELOG file says:

There's viruses going around exploiting the ability to hide the majority of their data in an attachment by using blank lines and other tricks to make scanning systems prematurely terminate their base64 decoding.

10848 http://www.osvdb.org/8287 http://www.pldaniels.com/ripmime/CHANGELOG http://secunia.com/advisories/12201 http://xforce.iss.net/xforce/xfdb/16867 2004-07-30 2004-08-27
moinmoin -- ACL group bypass moinmoin 1.2.3

The moinmoin package contains two bugs with ACLs and anonymous users. Both bugs may permit anonymous users to gain access to administrative functions; for example the delete function.

There is no known workaround, the vulnerability exists regardless if a site is using ACLs or not.

http://www.osvdb.org/8194 http://www.osvdb.org/8195 http://security.gentoo.org/glsa/glsa-200408-25.xml http://secunia.com/advisories/11832 10805 10801 2004-07-21 2004-08-26
rsync -- path sanitizing vulnerability rsync 2.6.2_2

An rsync security advisory reports:

There is a path-sanitizing bug that affects daemon mode in all recent rsync versions (including 2.6.2) but only if chroot is disabled.

The bug may allow a remote user to access files outside of an rsync module's configured path with the privileges configured for that module.

CVE-2004-0792 http://samba.org/rsync/#security_aug04 http://lists.samba.org/archive/rsync-announce/2004/000017.html http://secunia.com/advisories/12294 http://www.osvdb.org/8829 2004-08-12 2004-08-26
gnomevfs -- unsafe URI handling gnomevfs2 2.6.2_1 gnomevfs 1.0.5_6 mc 4.6.0_12

Alexander Larsson reports that some versions of gnome-vfs and MidnightCommander contain a number of `extfs' scripts that do not properly validate user input. If an attacker can cause her victim to process a specially-crafted URI, arbitrary commands can be executed with the privileges of the victim.

CVE-2004-0494 10864 http://www.ciac.org/ciac/bulletins/o-194.shtml http://xforce.iss.net/xforce/xfdb/16897 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127263 2004-08-04 2004-08-26
SoX buffer overflows when handling .WAV files sox 12.17.112.17.4_1

Ulf Härnhammar discovered a pair of buffer overflows in the WAV file handling code of SoX. If an attacker can cause her victim to process a specially-crafted WAV file with SoX (e.g. through social engineering or through some other program that relies on SoX), arbitrary code can be executed with the privileges of the victim.

CVE-2004-0557 http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0014.html http://secunia.com/advisories/12175 http://www.osvdb.org/8267 2004-07-28 2004-08-26
kdelibs -- konqueror cross-domain cookie injection kdelibs 3.2.3_3

According to a KDE Security Advisory:

WESTPOINT internet reconnaissance services alerted the KDE security team that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains.

Web sites operating under the affected domains can set HTTP cookies in such a way that the Konqueror web browser will send them to all other web sites operating under the same domain. A malicious website can use this as part of a session fixation attack. See e.g. http://www.acros.si/papers/session_fixation.pdf

Affected are all country specific secondary top level domains that use more than 2 characters in the secondary part of the domain name and that use a secondary part other than com, net, mil, org, gov, edu or int. Examples of affected domains are .ltd.uk, .plc.uk and .firm.in

It should be noted that popular domains such as .co.uk, .co.in and .com are NOT affected.

CVE-2004-0746 http://www.kde.org/info/security/advisory-20040823-1.txt http://www.osvdb.org/9117 http://secunia.com/advisories/12341 http://www.acros.si/papers/session_fixation.pdf 10991 2004-08-23 2004-08-26
fidogate -- write files as `news' user fidogate 4.4.9_3 fidogate-ds 5.1.1_1

Neils Heinen reports that the setuid `news' binaries installed as part of fidogate may be used to create files or append to file with the privileges of the `news' user by setting the LOGFILE environmental variable.

http://cvs.sourceforge.net/viewcvs.py/fidogate/fidogate/ChangeLog?rev=4.320&view=markup 2004-08-21 2004-08-22 2004-08-23
Arbitrary code execution via a format string vulnerability in jftpgw jftpgw 0.13.5

The log functions in jftpgw may allow remotely authenticated user to execute arbitrary code via the format string specifiers in certain syslog messages.

CVE-2004-0448 http://www.debian.org/security/2004/dsa-510 10438 http://xforce.iss.net/xforce/xfdb/16271 2004-05-30 2004-08-13 2004-08-23
qt -- image loader vulnerabilities qt 3.3.3

Qt contains several vulnerabilities related to image loading, including possible crashes when loading corrupt GIF, BMP, or JPEG images. Most seriously, Chris Evans reports that the BMP crash is actually due to a heap buffer overflow. It is believed that an attacker may be able to construct a BMP image that could cause a Qt-using application to execute arbitrary code when it is loaded.

CVE-2004-0691 CVE-2004-0692 CVE-2004-0693 http://www.trolltech.com/developer/changes/changes-3.3.3.html http://scary.beasts.org/security/CESA-2004-004.txt 2004-08-11 2004-08-22
courier-imap -- format string vulnerability in debug mode courier-imap 3.0.7,1

An iDEFENSE security advisory describes a format string vulnerability that could be exploited when Courier-IMAP is run in debug mode (DEBUG_LOGIN set).

CVE-2004-0777 http://lists.netsys.com/pipermail/full-disclosure/2004-August/025478.html http://www.idefense.com/application/poi/display?id=131&type=vulnerabilities&flashstatus=false 10976 2004-08-18 2004-08-22 2013-06-19
mysql -- mysqlhotcopy insecure temporary file creation mysql-scripts 3.23.58 44.0.20 4.14.1.3 55.0.0_1

According to Christian Hammers:

[mysqlhotcopy created] temporary files in /tmp which had predictable filenames and such could be used for a tempfile run attack.

Jeroen van Wolffelaar is credited with discovering the issue.

CVE-2004-0457 http://www.debian.org/security/2004/dsa-540 http://lists.mysql.com/internals/15185 2004-08-18 2004-08-22
Multiple Potential Buffer Overruns in Samba samba 3.*3.0.5 3.*,13.0.5,1 2.2.10 ja-samba 2.2.10.j1.0

Evgeny Demidov discovered that the Samba server has a buffer overflow in the Samba Web Administration Tool (SWAT) on decoding Base64 data during HTTP Basic Authentication. Versions 3.0.2 through 3.0.4 are affected.

Another buffer overflow bug has been found in the code used to support the "mangling method = hash" smb.conf option. The default setting for this parameter is "mangling method = hash2" and therefore not vulnerable. Versions between 2.2.0 through 2.2.9 and 3.0.0 through 3.0.4 are affected.

CVE-2004-0600 CVE-2004-0686 http://www.securityfocus.com/archive/1/369698 http://www.securityfocus.com/archive/1/369706 http://www.samba.org/samba/whatsnew/samba-3.0.5.html http://www.samba.org/samba/whatsnew/samba-2.2.10.html http://www.osvdb.org/8190 http://www.osvdb.org/8191 http://secunia.com/advisories/12130 2004-07-14 2004-07-21 2008-09-26
Mozilla / Firefox user interface spoofing vulnerability firefox 0.9.1_1 linux-mozilla 1.7.1 linux-mozilla-devel 1.7.1 mozilla 1.7.1,2 1.8.a,21.8.a2,2 mozilla-gtk1 1.7.1_1

The Mozilla project's family of browsers contain a design flaw that can allow a website to spoof almost perfectly any part of the Mozilla user interface, including spoofing web sites for phishing or internal elements such as the "Master Password" dialog box. This achieved by manipulating "chrome" through remote XUL content. Recent versions of Mozilla have been fixed to not allow untrusted documents to utilize "chrome" in this way.

CVE-2004-0764 http://bugzilla.mozilla.org/show_bug.cgi?id=22183 http://bugzilla.mozilla.org/show_bug.cgi?id=244965 http://bugzilla.mozilla.org/show_bug.cgi?id=252198 http://www.nd.edu/~jsmith30/xul/test/spoof.html http://secunia.com/advisories/12188 10832 2004-07-19 2004-07-30 2004-08-15
libpng stack-based buffer overflow and other code concerns png 1.2.5_7 linux-png 1.0.14_3 1.21.2.2 firefox 0.9.3 thunderbird 0.7.3 linux-mozilla 1.7.2 linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8.a,21.8.a2,2 mozilla-gtk1 1.7.2 netscape-communicator netscape-navigator 4.78 linux-netscape-communicator linux-netscape-navigator ko-netscape-navigator-linux ko-netscape-communicator-linux ja-netscape-communicator-linux ja-netscape-navigator-linux 4.8 netscape7 ja-netscape7 7.1 pt_BR-netscape7 fr-netscape7 de-netscape7 7.02

Chris Evans has discovered multiple vulnerabilities in libpng, which can be exploited by malicious people to compromise a vulnerable system or cause a DoS (Denial of Service).

http://www.securityfocus.com/archive/1/370853 http://scary.beasts.org/security/CESA-2004-001.txt http://www.osvdb.org/8312 http://www.osvdb.org/8313 http://www.osvdb.org/8314 http://www.osvdb.org/8315 http://www.osvdb.org/8316 CVE-2004-0597 CVE-2004-0598 CVE-2004-0599 388984 236656 160448 477512 817368 286464 http://secunia.com/advisories/12219 http://secunia.com/advisories/12232 http://bugzilla.mozilla.org/show_bug.cgi?id=251381 TA04-217A http://dl.sourceforge.net/sourceforge/libpng/ADVISORY.txt 2004-08-04 2004-08-04 2004-08-15
kdelibs insecure temporary file handling kdelibs 3.2.3_3

According to a KDE Security Advisory, KDE may sometimes create temporary files without properly checking the ownership and type of the target path. This could allow a local attacker to cause KDE applications to overwrite arbitrary files.

CVE-2004-0689 CVE-2004-0690 http://www.kde.org/info/security/advisory-20040811-1.txt http://www.kde.org/info/security/advisory-20040811-2.txt ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-kstandarddirs.patch ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdelibs-dcopserver.patch 2004-08-11 2004-08-12
gaim remotely exploitable vulnerabilities in MSN component gaim ja-gaim ko-gaim ru-gaim 0.81_1 gaim 20030000

Sebastian Krahmer discovered several remotely exploitable buffer overflow vulnerabilities in the MSN component of gaim.

In two places in the MSN protocol plugins (object.c and slp.c), strncpy was used incorrectly; the size of the array was not checked before copying to it. Both bugs affect MSN's MSNSLP protocol, which is peer-to-peer, so this could potentially be easy to exploit.

CVE-2004-0500 http://gaim.sourceforge.net/security/?id=0 2004-08-12 2004-08-12 2004-10-25
acroread uudecoder input validation error acroread acroread4 acroread5 5.0.9

An iDEFENSE security advisory reports:

Remote exploitation of an input validation error in the uudecoding feature of Adobe Acrobat Reader (Unix) 5.0 allows an attacker to execute arbitrary code.

The Unix and Linux versions of Adobe Acrobat Reader 5.0 automatically attempt to convert uuencoded documents back into their original format. The vulnerability specifically exists in the failure of Acrobat Reader to check for the backtick shell metacharacter in the filename before executing a command with a shell. This allows a maliciously constructed filename to execute arbitrary programs.

CVE-2004-0630 http://www.idefense.com/application/poi/display?id=124&type=vulnerabilities 2004-08-12 2004-08-12 2005-01-06
popfile file disclosure popfile 0.21.1_2

John Graham-Cumming reports that certain configurations of POPFile may allow the retrieval of any files with the extensions .gif, .png, .ico, .css, as well as some files with the extension .html.

http://sourceforge.net/mailarchive/forum.php?thread_id=5248725&forum_id=12356 2004-08-02 2004-08-12
isc-dhcp3-server buffer overflow in logging mechanism isc-dhcp3-relay isc-dhcp3-server 3.0.1.r123.0.1.r14

A buffer overflow exists in the logging functionality of the DHCP daemon which could lead to Denial of Service attacks and has the potential to allow attackers to execute arbitrary code.

CVE-2004-0460 http://www.osvdb.org/7237 TA04-174A 317350 http://www.securityfocus.com/archive/1/366801 http://www.securityfocus.com/archive/1/367286 2004-06-22 2004-06-25 2004-08-12
libpng denial-of-service linux-png 1.0.14_3 1.21.2.2 png 1.2.5_4

Steve Grubb reports a buffer read overrun in libpng's png_format_buffer function. A specially constructed PNG image processed by an application using libpng may trigger the buffer read overrun and possibly result in an application crash.

CVE-2004-0421 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120508 http://rhn.redhat.com/errata/RHSA-2004-181.html http://secunia.com/advisories/11505 http://www.osvdb.org/5726 10244 2004-04-29 2004-05-02 2004-08-12
Mozilla certificate spoofing firefox 0.9.10.9.2 linux-mozilla 1.7.2 linux-mozilla-devel 1.7.2 mozilla 1.7.2,2 1.8,21.8.a2,2 mozilla-gtk1 1.7.2

Mozilla and Mozilla Firefox contains a flaw that may allow a malicious user to spoof SSL certification.

http://www.securityfocus.com/archive/1/369953 http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory http://secunia.com/advisories/12160 http://bugzilla.mozilla.org/show_bug.cgi?id=253121 http://www.osvdb.org/8238 10796 CVE-2004-0763 2004-07-25 2004-07-30 2004-08-12
ImageMagick png vulnerability fix ImageMagick ImageMagick-nox11 6.0.4.2

Glenn Randers-Pehrson has contributed a fix for the png vulnerabilities discovered by Chris Evans.

http://studio.imagemagick.org/pipermail/magick-users/2004-August/013218.html http://freshmeat.net/releases/169228 http://secunia.com/advisories/12236 http://www.freebsd.org/ports/portaudit/f9e3e60b-e650-11d8-9b0a-000347a4fa7d.html 2004-08-04 2004-08-04 2004-08-12
Courier mail services: remotely exploitable buffer overflows courier 0.45 courier-imap 3.0,1 sqwebmail 4.0

The Courier set of mail services use a common Unicode library. This library contains buffer overflows in the converters for two popular Japanese character encodings. These overflows may be remotely exploitable, triggered by a maliciously formatted email message that is later processed by one of the Courier mail services. From the release notes for the corrected versions of the Courier set of mail services:

iso2022jp.c: Converters became (upper-)compatible with ISO-2022-JP (RFC1468 / JIS X 0208:1997 Annex 2) and ISO-2022-JP-1 (RFC2237). Buffer overflow vulnerability (when Unicode character is out of BMP range) has been closed. Convert error handling was implemented.

shiftjis.c: Broken SHIFT_JIS converters has been fixed and became (upper-)compatible with Shifted Encoding Method (JIS X 0208:1997 Annex 1). Buffer overflow vulnerability (when Unicode character is out of BMP range) has been closed. Convert error handling was implemented.

CVE-2004-0224 http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/iso2022jp.c?rev=1.10&view=markup http://cvs.sourceforge.net/viewcvs.py/courier/libs/unicode/shiftjis.c?rev=1.6&view=markup 9845 http://secunia.com/advisories/11087 http://www.osvdb.org/4194 http://www.osvdb.org/6927 2004-02-01 2004-03-31 2004-07-16
multiple vulnerabilities in ethereal ethereal tethereal 0.10.3

Stefan Esser of e-matters Security discovered a baker's dozen of buffer overflows in Ethereal's decoders, including:

  • NetFlow
  • IGAP
  • EIGRP
  • PGM
  • IRDA
  • BGP
  • ISUP
  • TCAP
  • UCP

In addition, a vulnerability in the RADIUS decoder was found by Jonathan Heusser.

Finally, there is one uncredited vulnerability described by the Ethereal team as:

A zero-length Presentation protocol selector could make Ethereal crash.

http://www.ethereal.com/appnotes/enpa-sa-00013.html CVE-2004-0176 CVE-2004-0365 CVE-2004-0367 119876 124454 125156 433596 591820 644886 659140 695486 740188 792286 864884 931588 http://security.e-matters.de/advisories/032004.html http://secunia.com/advisories/11185 9952 http://www.osvdb.org/4462 http://www.osvdb.org/4463 http://www.osvdb.org/4464 2004-03-23 2004-03-26 2004-07-11
multiple vulnerabilities in ethereal ethereal ethereal-lite tethereal tethereal-lite 0.10.4

Issues have been discovered in multiple protocol dissectors.

http://www.ethereal.com/appnotes/enpa-sa-00014.html CVE-2004-0504 CVE-2004-0505 CVE-2004-0506 CVE-2004-0507 http://secunia.com/advisories/11608 10347 http://www.osvdb.org/6131 http://www.osvdb.org/6132 http://www.osvdb.org/6133 http://www.osvdb.org/6134 2004-05-13 2004-07-11
multiple vulnerabilities in ethereal ethereal ethereal-lite tethereal tethereal-lite 0.10.5

Issues have been discovered in multiple protocol dissectors.

http://www.ethereal.com/appnotes/enpa-sa-00015.html CVE-2004-0633 CVE-2004-0634 CVE-2004-0635 http://secunia.com/advisories/12024 10672 http://www.osvdb.org/7536 http://www.osvdb.org/7537 http://www.osvdb.org/7538 2004-07-06 2004-07-11
Format string vulnerability in SSLtelnet SSLtelnet 0.13_1

SSLtelnet contains a format string vulnerability that could allow remote code execution and privilege escalation.

CVE-2004-0640 http://www.idefense.com/application/poi/display?id=114&type=vulnerabilities 2003-04-03 2004-07-05
"Content-Type" XSS vulnerability affecting other webmail systems openwebmail 2.32 ilohamail 0.8.13

Roman Medina-Heigl Hernandez did a survey which other webmail systems where vulnerable to a bug he discovered in SquirrelMail. This advisory summarizes the results.

http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt http://www.freebsd.org/ports/portaudit/89a0de27-bf66-11d8-a252-02e0185c0b53.html http://www.freebsd.org/ports/portaudit/911f1b19-bd20-11d8-84f9-000bdb1444a4.html http://www.freebsd.org/ports/portaudit/c3e56efa-c42f-11d8-864c-02e0185c0b53.html CVE-2004-0519 2004-05-29 2004-07-05
Pavuk HTTP Location header overflow pavuk 0.9.28_5

When pavuk sends a request to a web server and the server sends back the HTTP status code 305 (Use Proxy), pavuk copies data from the HTTP Location header in an unsafe manner. This leads to a stack-based buffer overflow with control over EIP.

CVE-2004-0456 http://lists.netsys.com/pipermail/full-disclosure/2004-July/023322.html http://www.osvdb.org/7319 2004-06-30 2004-07-03
Several vulnerabilities found in PHPNuke phpnuke 7.3

Janek Vind "waraxe" reports that several issues in the PHPNuke software may be exploited via carefully crafted URL requests. These URLs will permit the injection of SQL code, cookie theft, and the readability of the PHPNuke administrator account.

CVE-2003-0279 CVE-2003-0318 CVE-2004-0266 CVE-2004-0269 http://www.waraxe.us/index.php?modname=sa&id=27 http://secunia.com/advisories/11920 2004-05-05 2004-07-03 2004-09-28
Remote code injection in phpMyAdmin phpMyAdmin 2.5.7.1

This vulnerability would allow remote user to inject PHP code to be executed by eval() function. This vulnerability is only exploitable if variable $cfg['LeftFrameLight'] is set to FALSE (in file config.inc.php).

http://sf.net/forum/forum.php?forum_id=387635 http://www.securityfocus.com/archive/1/367486 http://secunia.com/advisories/11974 http://eagle.kecapi.com/sec/fd/phpMyAdmin.html 2004-06-29 2004-07-02 2004-09-28
GNATS local privilege elevation gnats 3.113.1_9

GNATS 3.113.1 contains multiple buffer overflows, through which a local attacker could gain elevated privileges on the system.

ports/56006 http://www.securityfocus.com/archive/1/326337 http://www.securiteam.com/unixfocus/5CP0N0UAAA.html http://secunia.com/advisories/9096 http://x82.inetcop.org/h0me/adv1sor1es/INCSA.2003-0x82-018-GNATS-bt.txt http://www.gnu.org/software/gnats/gnats.html http://www.osvdb.org/2190 http://www.osvdb.org/4600 http://www.osvdb.org/4601 http://www.osvdb.org/4607 2003-06-21 2004-07-02
Linux binary compatibility mode input validation error FreeBSD 4.94.9_10 4.84.8_23

A programming error in the handling of some Linux system calls may result in memory locations being accessed without proper validation.

It may be possible for a local attacker to read and/or overwrite portions of kernel memory, resulting in disclosure of sensitive information or potential privilege escalation. A local attacker can cause a system panic.

CVE-2004-0602 SA-04:13.linux 2004-06-18 2004-06-30
Remote Denial of Service of HTTP server and client giFT-FastTrack 0.8.7

giFT-FastTrack is susceptible to a remote Denial of Service attack which could allow a remote attacker to render HTTP services unusable. According to the developers, no code execution is possible; however, they recommend an immediate upgrade.

http://developer.berlios.de/forum/forum.php?forum_id=5814 http://www.osvdb.org/7266 http://secunia.com/advisories/11941 10604 2004-06-19 2004-06-25 2004-06-29
XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0 xorg-clients 6.7.0

When the IPv6 code was added to xdm a critical test to disable xdmcp was accidentally removed. This caused xdm to create the chooser socket regardless if DisplayManager.requestPort was disabled in xdm-config or not.

CVE-2004-0419 http://bugs.xfree86.org/show_bug.cgi?id=1376 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124900 2004-05-19 2004-06-28 2004-06-28
MoinMoin administrative group name privilege escalation vulnerability moinmoin 1.2.2

A serious flaw exists in the MoinMoin software which may allow a malicious user to gain access to unauthorized privileges.

http://www.osvdb.org/6704 CVE-2004-0708 10568 http://secunia.com/advisories/11807 2004-05-04 2004-06-28
Cyrus IMAP pre-authentication heap overflow vulnerability cyrus 2.0.17 2.12.1.11

In December 2002, Timo Sirainen reported:

Cyrus IMAP server has a remotely exploitable pre-login buffer overflow. [...] Note that you don't have to log in before exploiting this, and since Cyrus runs everything under one UID, it's possible to read every user's mail in the system.

It is unknown whether this vulnerability is exploitable for code execution on FreeBSD systems.

CVE-2002-1580 6298 740169 http://marc.theaimsgroup.com/?l=bugtraq&m=103886607825605 http://asg.web.cmu.edu/archive/message.php?mailbox=archive.info-cyrus&msg=19349 2002-12-02 2004-05-12 2004-06-27
Cyrus IMSPd multiple vulnerabilities cyrus-imspd 1.6a5

The Cyrus team reported multiple vulnerabilities in older versions of Cyrus IMSPd:

These releases correct a recently discovered buffer overflow vulnerability, as well as clean up a significant amount of buffer handling throughout the code.

http://asg.web.cmu.edu/archive/message.php?mailbox=archive.cyrus-announce&msg=25 2004-05-12 2004-09-20 2013-06-19
mplayer heap overflow in http requests mplayer mplayer-gtk mplayer-esound mplayer-gtk-esound 0.92.1

A remotely exploitable heap buffer overflow vulnerability was found in MPlayer's URL decoding code. If an attacker can cause MPlayer to visit a specially crafted URL, arbitrary code execution with the privileges of the user running MPlayer may occur. A `visit' might be caused by social engineering, or a malicious web server could use HTTP redirects which MPlayer would then process.

http://www.mplayerhq.hu/homepage/design6/news.html http://marc.theaimsgroup.com/?l=bugtraq&m=108066964709058 ports/64974 2004-03-30 2004-03-31 2004-06-27
ecartis buffer overflows and input validation bugs ecartis 1.0.0.s20030814,1

Timo Sirainen reports multiple buffer overflows that may be triggered while parsing messages, as well as input validation errors that could result in disclosure of mailing list passwords.

These bugs were resolved in the August 2003 snapshot of ecartis.

CVE-2003-0781 CVE-2003-0782 http://www.securiteam.com/unixfocus/5YP0H2AAUY.html ports/57082 2003-08-14 2004-03-29 2004-06-27
ModSecurity for Apache 2.x remote off-by-one overflow mod_security 1.7.5

When the directive "SecFilterScanPost" is enabled, the Apache 2.x version of ModSecurity is vulnerable to an off-by-one overflow

http://www.s-quadra.com/advisories/Adv-20040315.txt 9885 http://secunia.com/advisories/11138 779438 2004-02-09 2004-03-17 2004-06-27
clamav remote denial-of-service clamav 0.65_7

clamav will exit when a programming assertion is not met. A malformed uuencoded message can trigger this assertion, allowing an attacker to trivially crash clamd or other components of clamav.

ports/62586 http://www.securityfocus.com/archive/1/353186 http://www.osvdb.org/3894 9610 http://secunia.com/advisories/10826 CVE-2004-0270 http://xforce.iss.net/xforce/xfdb/15077 2004-02-09 2004-02-12 2004-06-27
neon date parsing vulnerability neon 0.24.5_1 sitecopy 0.13.4_1

Stefan Esser reports:

A vulnerability within a libneon date parsing function could cause a heap overflow which could lead to remote code execution, depending on the application using libneon.

The vulnerability is in the function ne_rfc1036_parse, which is in turn used by the function ne_httpdate_parse. Applications using either of these neon functions may be vulnerable.

CVE-2004-0398 http://security.e-matters.de/advisories/062004.html http://secunia.com/advisories/11785 2004-05-19 2004-05-19 2004-06-25
neon format string vulnerabilities neon 0.24.5 tla 1.2_1 sitecopy 0.13.4_1

Greuff reports that the neon WebDAV client library contains several format string bugs within error reporting code. A malicious server may exploit these bugs by sending specially crafted PROPFIND or PROPPATCH responses.

Although several applications include neon, such as cadaver and subversion, the FreeBSD Ports of these applications are not impacted. They are specifically configured to NOT use the included neon. Only packages listed as affected in this notice are believed to be impacted.

CVE-2004-0179 http://www.webdav.org/neon/ http://secunia.com/advisories/11785 2004-04-14 2004-04-15 2004-06-25
Gallery 1.4.3 and ealier user authentication bypass gallery 1.4.3.2

A flaw exists in Gallery versions previous to 1.4.3-pl1 and post 1.2 which may give an attacker the potential to log in under the "admin" account. Data outside of the gallery is unaffected and the attacker cannot modify any data other than the photos or photo albums.

CVE-2004-0522 http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=123 http://secunia.com/advisories/11752 2004-06-01 2004-06-24
Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling mc 4.6.0_10

Jakub Jelinek reports several security related bugs in Midnight Commander, including:

  • Multiple buffer overflows (CVE-2004-0226)
  • Insecure temporary file handling (CVE-2004-0231)
  • Format string bug (CVE-2004-0232)
CVE-2004-0226 CVE-2004-0231 CVE-2004-0232 2004-04-29 2004-05-02 2004-06-14
Buffer overflow in Squid NTLM authentication helper squid 2.5.5_9

Remote exploitation of a buffer overflow vulnerability in the NTLM authentication helper routine of the Squid Web Proxy Cache could allow a remote attacker to execute arbitrary code. A remote attacker can compromise a target system if the Squid Proxy is configured to use the NTLM authentication helper. The attacker can send an overly long password to overflow the buffer and execute arbitrary code.

http://www.idefense.com/application/poi/display?id=107&type=vulnerabilities&flashstatus=false CVE-2004-0541 http://www.osvdb.org/6791 http://secunia.com/advisories/11804 10500 http://www.squid-cache.org/bugs/show_bug.cgi?id=998 2004-05-20 2004-06-09
Vulnerabilities in H.323 implementations pwlib 1.5.0_5 asterisk 0.7.2 openh323 1.12.0_4

The NISCC and the OUSPG developed a test suite for the H.323 protocol. This test suite has uncovered vulnerabilities in several H.323 implementations with impacts ranging from denial-of-service to arbitrary code execution.

In the FreeBSD Ports Collection, `pwlib' is directly affected. Other applications such as `asterisk' and `openh323' incorporate `pwlib' statically and so are also independently affected.

http://www.uniras.gov.uk/vuls/2004/006489/h323.htm http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/h2250v4/index.html CA-2004-01 749342 CVE-2004-0097 http://www.southeren.com/blog/archives/000055.html 2004-01-13 2004-02-22 2004-06-08
jailed processes can manipulate host routing tables FreeBSD 4.94.9_10 4.84.8_23

A programming error resulting in a failure to verify that an attempt to manipulate routing tables originated from a non-jailed process.

Jailed processes running with superuser privileges could modify host routing tables. This could result in a variety of consequences including packets being sent via an incorrect network interface and packets being discarded entirely.

CVE-2004-0125 SA-04:12.jailroute 2004-02-03 2004-06-07
buffer cache invalidation implementation issues FreeBSD 5.05.2_8 4.94.9_9 4.04.8_22

Programming errors in the implementation of the msync(2) system call involving the MS_INVALIDATE operation lead to cache consistency problems between the virtual memory system and on-disk contents.

In some situations, a user with read access to a file may be able to prevent changes to that file from being committed to disk.

CVE-2004-0435 SA-04:11.msync 2004-04-24 2004-05-26
leafnode denial-of-service triggered by article request leafnode 1.9.201.9.30

The leafnode NNTP server may go into an unterminated loop with 100% CPU use when an article is requested by Message-ID that has been crossposted to several news groups when one of the group names is the prefix of another group name that the article was cross-posted to. Found by Jan Knutar.

http://leafnode.sourceforge.net/leafnode-SA-2002-01.txt CVE-2002-1661 http://sourceforge.net/mailarchive/message.php?msg_id=2796226 http://article.gmane.org/gmane.network.leafnode.announce/8 6490 ports/46613 2002-11-06 2004-05-21 2005-05-13
leafnode fetchnews denial-of-service triggered by missing header leafnode 1.9.31.9.41

Fetchnews could hang when a news article to be downloaded lacked one of the mandatory headers. Found by Joshua Crawford.

CVE-2003-0744 http://leafnode.sourceforge.net/leafnode-SA-2003-01.txt http://sourceforge.net/mailarchive/message.php?msg_id=5975563 http://article.gmane.org/gmane.network.leafnode.announce/21 8541 ports/53838 2003-06-20 2004-05-21 2005-05-13
leafnode fetchnews denial-of-service triggered by truncated transmission leafnode 1.9.47

When a downloaded news article ends prematurely, i. e. when the server sends [CR]LF.[CR]LF before sending a blank line, fetchnews may wait indefinitely for data that never arrives. Workaround: configure "minlines=1" (or use a bigger value) in the configuration file. Found by Toni Viemerö.

CVE-2004-2068 http://leafnode.sourceforge.net/leafnode-SA-2004-01.txt http://sourceforge.net/tracker/index.php?func=detail&aid=873149&group_id=57767&atid=485349 http://article.gmane.org/gmane.network.leafnode.announce/32 http://sourceforge.net/mailarchive/message.php?msg_id=6922570 ports/61105 2004-01-08 2004-05-21 2005-05-13
MySQL insecure temporary file creation (mysqlbug) mysql-client 4.04.0.20 4.14.1.1_2 5.05.0.0_2

Shaun Colley reports that the script `mysqlbug' included with MySQL sometimes creates temporary files in an unsafe manner. As a result, an attacker may create a symlink in /tmp so that if another user invokes `mysqlbug' and quits without making any changes, an arbitrary file may be overwritten with the bug report template.

http://marc.theaimsgroup.com/?l=bugtraq&m=108023246916294&w=2 http://bugs.mysql.com/bug.php?id=3284 9976 CVE-2004-0381 2004-03-25 2004-04-16 2004-05-21
subversion date parsing vulnerability subversion 1.0.2_1

Stefan Esser reports:

Subversion versions up to 1.0.2 are vulnerable to a date parsing vulnerability which can be abused to allow remote code execution on Subversion servers and therefore could lead to a repository compromise.

NOTE: This vulnerability is similar to the date parsing issue that affected neon. However, it is a different and distinct bug.

CVE-2004-0397 http://security.e-matters.de/advisories/082004.html 2004-05-19 2004-05-19
cvs pserver remote heap buffer overflow FreeBSD 5.25.2_7 5.15.1_17 5.05.0_21 4.94.9_8 4.84.8_21 4.04.7_27

Due to a programming error in code used to parse data received from the client, malformed data can cause a heap buffer to overflow, allowing the client to overwrite arbitrary portions of the server's memory.

A malicious CVS client can exploit this to run arbitrary code on the server at the privilege level of the CVS server software.

CVE-2004-0396 SA-04:10.cvs 2004-05-02 2004-05-19
Apache 2 mod_ssl denial-of-service apache 2.02.0.48_3

Joe Orton reports a memory leak in Apache 2's mod_ssl. A remote attacker may issue HTTP requests on an HTTPS port, causing an error. Due to a bug in processing this condition, memory associated with the connection is not freed. Repeated requests can result in consuming all available memory resources, probably resulting in termination of the Apache process.

CVE-2004-0113 http://www.apacheweek.com/features/security-20 http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.100.2.11&r2=1.100.2.12 http://marc.theaimsgroup.com/?l=apache-cvs&m=107869699329638 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106 9826 2004-02-20 2004-03-08 2004-05-19
URI handler vulnerabilities in several browsers linux-opera opera 7.50 kdelibs 3.2.2_3

Karol Wiesek and Greg MacManus reported via iDEFENSE that the Opera web browser contains a flaw in the handling of certain URIs. When presented with these URIs, Opera would invoke external commands to process them after some validation. However, if the hostname component of a URI begins with a `-', it may be treated as an option by an external command. This could have undesirable side-effects, from denial-of-service to code execution. The impact is very dependent on local configuration.

After the iDEFENSE advisory was published, the KDE team discovered similar problems in KDE's URI handlers.

CVE-2004-0411 http://www.idefense.com/application/poi/display?id=104&type=vulnerabilities http://www.kde.org/info/security/advisory-20040517-1.txt http://freebsd.kde.org/index.php#n20040517 2004-05-12 2004-05-18
fsp buffer overflow and directory traversal vulnerabilities fspd 2.8.1.19

The Debian security team reported a pair of vulnerabilities in fsp:

A vulnerability was discovered in fsp, client utilities for File Service Protocol (FSP), whereby a remote user could both escape from the FSP root directory (CAN-2003-1022), and also overflow a fixed-length buffer to execute arbitrary code (CAN-2004-0011).

CVE-2003-1022 CVE-2004-0011 http://www.debian.org/security/2004/dsa-416 2004-01-06 2004-01-19 2004-05-17
proftpd IP address access control list breakage proftpd 1.2.91.2.10.r1

Jindrich Makovicka reports a regression in proftpd's handling of IP address access control lists (IP ACLs). Due to this regression, some IP ACLs are treated as ``allow all''.

CVE-2004-0432 http://bugs.proftpd.org/show_bug.cgi?id=2267 2003-11-04 2004-05-02 2004-05-15
insecure temporary file creation in xine-check, xine-bugreport xine 0.9.23_3

Some scripts installed with xine create temporary files insecurely. It is recommended that these scripts (xine-check, xine-bugreport) not be used. They are not needed for normal operation.

http://marc.theaimsgroup.com/?l=bugtraq&m=107997911025558 9939 2004-03-20 2004-03-26 2004-05-09
exim buffer overflow when verify = header_syntax is used exim exim-ldap2 exim-mysql exim-postgresql 4.33+20_1

A remote exploitable buffer overflow has been discovered in exim when verify = header_syntax is used in the configuration file. This does not affect the default configuration.

http://www.guninski.com/exim1.html CVE-2004-0400 2004-05-06 2004-05-06
phpBB session table exhaustion phpbb 2.0.8_2

The includes/sessions.php unnecessarily adds session item into session table and therefore vulnerable to a denial-of-service attack.

http://marc.theaimsgroup.com/?l=bugtraq&m=108256462710010 2004-03-05 2004-05-06
heimdal kadmind remote heap buffer overflow heimdal 0.6.1_1 FreeBSD 4.94.9_7 4.04.8_20

An input validation error was discovered in the kadmind code that handles the framing of Kerberos 4 compatibility administration requests. The code assumed that the length given in the framing was always two or more bytes. Smaller lengths will cause kadmind to read an arbitrary amount of data into a minimally-sized buffer on the heap.

A remote attacker may send a specially formatted message to kadmind, causing it to crash or possibly resulting in arbitrary code execution.

The kadmind daemon is part of Kerberos 5 support. However, this bug will only be present if kadmind was built with additional Kerberos 4 support. Thus, only systems that have *both* Heimdal Kerberos 5 and Kerberos 4 installed might be affected.

NOTE: On FreeBSD 4 systems, `kadmind' may be installed as `k5admind'.

CVE-2004-0434 SA-04:09.kadmind 2004-05-05 2004-05-05
CVS path validation errors cvs+ipv6 1.11.5_1 FreeBSD 5.25.2.1_5 4.94.9_5 4.84.8_18

Two programming errors were discovered in which path names handled by CVS were not properly validated. In one case, the CVS client accepts absolute path names from the server when determining which files to update. In another case, the CVS server accepts relative path names from the client when determining which files to transmit, including those containing references to parent directories (`../').

These programming errors generally only have a security impact when dealing with remote CVS repositories.

A malicious CVS server may cause a CVS client to overwrite arbitrary files on the client's system.

A CVS client may request RCS files from a remote system other than those in the repository specified by $CVSROOT. These RCS files need not be part of any CVS repository themselves.

CVE-2004-0180 CVE-2004-0405 http://ccvs.cvshome.org/servlets/NewsItemView?newsID=102 SA-04:07.cvs 2004-04-14 2004-04-14 2004-05-05
mksnap_ffs clears file system options FreeBSD 5.25.2_1 5.15.1_12

The kernel interface for creating a snapshot of a filesystem is the same as that for changing the flags on that filesystem. Due to an oversight, the mksnap_ffs(8) command called that interface with only the snapshot flag set, causing all other flags to be reset to the default value.

A regularly scheduled backup of a live filesystem, or any other process that uses the mksnap_ffs command (for instance, to provide a rough undelete functionality on a file server), will clear any flags in effect on the filesystem being snapshot. Possible consequences depend on local usage, but can include disabling extended access control lists or enabling the use of setuid executables stored on an untrusted filesystem.

The mksnap_ffs command is normally only available to the superuser and members of the `operator' group. There is therefore no risk of a user gaining elevated privileges directly through use of the mksnap_ffs command unless it has been intentionally made available to unprivileged users.

CVE-2004-0099 SA-04:01.mksnap_ffs 2004-01-30 2004-04-07 2004-05-05
shmat reference counting bug FreeBSD 5.25.2_2 5.15.1_14 5.05.0_20 4.94.9_2 4.84.8_15 4.7_25

A programming error in the shmat(2) system call can result in a shared memory segment's reference count being erroneously incremented.

It may be possible to cause a shared memory segment to reference unallocated kernel memory, but remain valid. This could allow a local attacker to gain read or write access to a portion of kernel memory, resulting in sensitive information disclosure, bypass of access control mechanisms, or privilege escalation.

CVE-2004-0114 SA-04:02.shmat http://www.pine.nl/press/pine-cert-20040201.txt 2004-02-01 2004-04-07 2004-05-05
jailed processes can attach to other jails FreeBSD 5.15.1_14 5.25.2.1

A programming error has been found in the jail_attach(2) system call which affects the way that system call verifies the privilege level of the calling process. Instead of failing immediately if the calling process was already jailed, the jail_attach system call would fail only after changing the calling process's root directory.

A process with superuser privileges inside a jail could change its root directory to that of a different jail, and thus gain full read and write access to files and directories within the target jail.

CVE-2004-0126 SA-04:03.jail 2004-02-19 2004-04-07 2004-05-05
many out-of-sequence TCP packets denial-of-service FreeBSD 5.25.2.1_2 5.05.1_15 4.94.9_3 4.84.8_16 4.7_26

FreeBSD does not limit the number of TCP segments that may be held in a reassembly queue. A remote attacker may conduct a low-bandwidth denial-of-service attack against a machine providing services based on TCP (there are many such services, including HTTP, SMTP, and FTP). By sending many out-of-sequence TCP segments, the attacker can cause the target machine to consume all available memory buffers (``mbufs''), likely leading to a system crash.

CVE-2004-0171 SA-04:04.tcp http://www.idefense.com/application/poi/display?id=78&type=vulnerabilities 2004-02-18 2004-04-07 2004-05-05
setsockopt(2) IPv6 sockets input validation error FreeBSD 5.25.2.1_4

From the FreeBSD Security Advisory:

A programming error in the handling of some IPv6 socket options within the setsockopt(2) system call may result in memory locations being accessed without proper validation.

It may be possible for a local attacker to read portions of kernel memory, resulting in disclosure of sensitive information. A local attacker can cause a system panic.

CVE-2004-0370 SA-04:06.ipv6 2004-03-29 2004-03-29 2004-05-05
OpenSSL ChangeCipherSpec denial-of-service vulnerability openssl openssl-beta 0.9.7d FreeBSD 4.04.8_17 4.94.9_4 5.05.1_16 5.25.2.1_3

A remote attacker could cause an application using OpenSSL to crash by performing a specially crafted SSL/TLS handshake.

CVE-2004-0079 http://www.openssl.org/news/secadv_20040317.txt SA-04:05.openssl 288574 9899 2004-03-17 2004-03-17 2004-05-05
bind8 negative cache poison attack bind 8.38.3.7 8.48.4.3 FreeBSD 5.15.1_11 5.05.0_19 4.94.9_1 4.84.8_14 4.74.7_24 4.64.6.2_27 4.54.5_37 4.4_47

A programming error in BIND 8 named can result in a DNS message being incorrectly cached as a negative response. As a result, an attacker may arrange for malicious DNS messages to be delivered to a target name server, and cause that name server to cache a negative response for some target domain name. The name server would thereafter respond negatively to legitimate queries for that domain name, resulting in a denial-of-service for applications that require DNS.

CVE-2003-0914 SA-03:19.bind 734644 2003-11-28 2003-12-12 2004-05-05
Incorrect cross-realm trust handling in Heimdal heimdal 0.6.1 FreeBSD 5.05.2_6 4.94.9_6 4.04.8_19

Heimdal does not correctly validate the `transited' field of Kerberos tickets when computing the authentication path. This could allow a rogue KDC with which cross-realm relationships have been established to impersonate any KDC in the authentication path.

CVE-2004-0371 SA-04:08.heimdal http://www.pdc.kth.se/heimdal/advisory/2004-04-01/ 2004-04-01 2004-04-02 2004-05-05
lha buffer overflows and path traversal issues lha 1.14i_4

Ulf Härnhammar discovered several vulnerabilities in LHa for UNIX's path name handling code. Specially constructed archive files may cause LHa to overwrite files or execute arbitrary code with the privileges of the user invoking LHa. This could be particularly harmful for automated systems that might handle archives such as virus scanning processes.

CVE-2004-0234 CVE-2004-0235 2004-04-29 2004-05-02 2004-05-03
xchat remotely exploitable buffer overflow (Socks5) xchat2 1.82.0.8_2

A straightforward stack buffer overflow exists in XChat's Socks5 proxy support.

The XChat developers report that `tsifra' discovered this issue.

NOTE: XChat Socks5 support is disabled by support in the FreeBSD Ports Collection.

CVE-2004-0409 http://xchat.org/files/source/2.0/patches/xc208-fixsocks5.diff http://marc.theaimsgroup.com/?l=xchat-announce&m=108114935507357 2004-04-05 2004-04-23 2004-05-03
rsync path traversal issue rsync 2.6.1

When running rsync in daemon mode, no checks were made to prevent clients from writing outside of a module's `path' setting.

CVE-2004-0426 http://rsync.samba.org/#security_apr04 2004-04-26 2004-05-02
xine-lib arbitrary file overwrite libxine 0.91.0.r3_5

From the xinehq advisory:

By opening a malicious MRL in any xine-lib based media player, an attacker can write arbitrary content to an arbitrary file, only restricted by the permissions of the user running the application.

The flaw is a result of a feature that allows MRLs (media resource locator URIs) to specify arbitrary configuration options.

10193 http://www.xinehq.de/index.php/security/XSA-2004-1 2004-04-20 2004-05-02
pound remotely exploitable vulnerability pound 1.6

An unknown remotely exploitable vulnerability was disclosed. Robert Segall writes:

a security vulnerability was brought to my attention (many thanks to Akira Higuchi). Everyone running any previous version should upgrade to 1.6 immediately - the vulnerability may allow a remote exploit. No exploits are currently known and none have been observed in the wild till now. The danger is minimised if you run Pound in a root jail and/or you run Pound as non-root user.

http://www.apsis.ch/pound/pound_list/archive/2003/2003-12/1070234315000 2003-12-01 2004-05-02
phpBB IP address spoofing phpbb 2.0.8_2

The common.php script always trusts the `X-Forwarded-For' header in the client's HTTP request. A remote user could forge this header in order to bypass any IP address access control lists (ACLs).

http://marc.theaimsgroup.com/?l=bugtraq&m=108239864203144 2004-04-18 2004-04-23
TCP denial-of-service attacks against long lived connections FreeBSD 0

NISCC / UNIRAS has published an advisory that re-visits the long discussed spoofed TCP RST denial-of-service vulnerability. This new look emphasizes the fact that for some applications such attacks are practically feasible.

CVE-2004-0230 http://www.uniras.gov.uk/vuls/2004/236929/index.htm 1995-06-01 2004-04-23
ident2 double byte buffer overflow ident2 1.04

Jack of RaptureSecurity reported a double byte buffer overflow in ident2. The bug may allow a remote attacker to execute arbitrary code within the context of the ident2 daemon. The daemon typically runs as user-ID `nobody', but with group-ID `wheel'.

CVE-2004-0408 2004-04-15 2004-04-23
kdepim exploitable buffer overflow in VCF reader kdepim 3.1.03.1.4_1

A buffer overflow is present in some versions of the KDE personal information manager (kdepim) which may be triggered when processing a specially crafted VCF file.

CVE-2003-0988 http://www.kde.org/info/security/advisory-20040114-1.txt 2004-01-14 2004-04-15
racoon remote denial of service vulnerability (ISAKMP header length field) racoon 20040408a

When racoon receives an ISAKMP header, it will attempt to allocate sufficient memory for the entire ISAKMP message according to the header's length field. If an attacker crafts an ISAKMP header with a ridiculously large value in the length field, racoon may exceed operating system resource limits and be terminated, resulting in a denial of service.

CVE-2004-0403 http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/isakmp.c.diff?r1=1.180&r2=1.181 2004-03-31 2004-04-14
racoon remote denial of service vulnerability (IKE Generic Payload Header) racoon 20040407b

When racoon receives an IKE message with an incorrectly constructed Generic Payload Header, it may behave erratically, going into a tight loop and dropping connections.

CVE-2004-0392 http://orange.kame.net/dev/query-pr.cgi?pr=555 2003-12-03 2004-04-07 2004-04-14
tcpdump ISAKMP payload handling remote denial-of-service tcpdump 3.8.3 racoon 20040408a FreeBSD 0

Chad Loder has discovered vulnerabilities in tcpdump's ISAKMP protocol handler. During an audit to repair these issues, Bill Fenner discovered some related problems.

These vulnerabilities may be used by an attacker to crash a running `tcpdump' process. They can only be triggered if the `-v' command line option is being used.

NOTE: the racoon ISAKMP/IKE daemon incorporates the ISAKMP protocol handler from tcpdump, and so is also affected by this issue.

http://marc.theaimsgroup.com/?l=bugtraq&m=108067265931525 http://www.rapid7.com/advisories/R7-0017.html CVE-2004-0183 CVE-2004-0184 2004-03-12 2004-03-31 2004-04-14
Midnight Commander buffer overflow during symlink resolution mc 4.6.0_9

Midnight Commander uses a fixed sized stack buffer while resolving symbolic links within file archives (tar or cpio). If an attacker can cause a user to process a specially crafted file archive with Midnight Commander, the attacker may be able to obtain the privileges of the target user.

CVE-2003-1023 http://marc.theaimsgroup.com/?l=bugtraq&m=106399528518704 8658 2003-09-19 2004-04-03 2004-04-13
racoon fails to verify signature during Phase 1 racoon 20040407b

Ralf Spenneberg discovered a serious flaw in racoon. When using Phase 1 main or aggressive mode, racoon does not verify the client's RSA signature. Any installations using X.509 authentication are strongly urged to upgrade.

Installations using pre-shared keys are believed to be unaffected.

CVE-2004-0155 http://www.kame.net/dev/cvsweb2.cgi/kame/kame/kame/racoon/crypto_openssl.c?rev=1.84&content-type=text/x-cvsweb-markup 2004-04-05 2004-04-07
Several remotely exploitable buffer overflows in gaim gaim ja-gaim ko-gaim ru-gaim 0.75_3 0.75_5 0.76 gaim 20030000

Stefan Esser of e-matters found almost a dozen remotely exploitable vulnerabilities in Gaim. From the e-matters advisory:

While developing a custom add-on, an integer overflow in the handling of AIM DirectIM packets was revealed that could lead to a remote compromise of the IM client. After disclosing this bug to the vendor, they had to make a hurried release because of a change in the Yahoo connection procedure that rendered GAIM useless. Unfourtunately at the same time a closer look onto the sourcecode revealed 11 more vulnerabilities.

The 12 identified problems range from simple standard stack overflows, over heap overflows to an integer overflow that can be abused to cause a heap overflow. Due to the nature of instant messaging many of these bugs require man-in-the-middle attacks between client and server. But the underlying protocols are easy to implement and MIM attacks on ordinary TCP sessions is a fairly simple task.

In combination with the latest kernel vulnerabilities or the habit of users to work as root/administrator these bugs can result in remote root compromises.

http://security.e-matters.de/advisories/012004.txt CVE-2004-0005 CVE-2004-0006 CVE-2004-0007 CVE-2004-0008 2004-01-26 2004-02-12 2004-10-25
oftpd denial-of-service vulnerability (PORT command) oftpd 0.3.7

Philippe Oechslin reported a denial-of-service vulnerability in oftpd. The oftpd server can be crashed by sending a PORT command containing an integer over 8 bits long (over 255).

http://www.time-travellers.org/oftpd/oftpd-dos.html 9980 CVE-2004-0376 2004-03-04 2004-03-28 2004-04-05
squid ACL bypass due to URL decoding bug squid 2.5.5

From the Squid advisory:

Squid versions 2.5.STABLE4 and earlier contain a bug in the "%xx" URL decoding function. It may insert a NUL character into decoded URLs, which may allow users to bypass url_regex ACLs.

http://www.squid-cache.org/Advisories/SQUID-2004_1.txt CVE-2004-0189 2004-02-29 2004-03-26 2015-05-01
zebra/quagga denial of service vulnerability zebra 0.93b_7 quagga 0.96.4

A remote attacker could cause zebra/quagga to crash by sending a malformed telnet command to their management port.

CVE-2003-0858 http://rhn.redhat.com/errata/RHSA-2003-305.html http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=107140 http://lists.quagga.net/pipermail/quagga-users/2003-November/000906.html 2003-11-20 2004-03-29
multiple vulnerabilities in phpBB phpbb 2.0.8

Users with admin rights can severly damage an phpBB installation, potentially triggered by viewing a page with a malicious link sent by an attacker.

http://www.gulftech.org/03202004.php http://www.phpbb.com/phpBB/viewtopic.php?t=183982 9942 2004-03-20 2004-03-26 2004-03-29
ezbounce remote format string vulnerability ezbounce 1.04.a_1

A security hole exists that can be used to crash the proxy and execute arbitrary code. An exploit is circulating that takes advantage of this, and in some cases succeeds in obtaining a login shell on the machine.

CVE-2003-0510 http://ezbounce.dc-team.com/ 8071 2003-07-01 2004-03-26 2004-03-29
racoon security association deletion vulnerability racoon 20040116a

A remote attacker may use specially crafted IKE/ISAKMP messages to cause racoon to delete security associations. This could result in denial-of-service or possibly cause sensitive traffic to be transmitted in plaintext, depending upon configuration.

http://www.securityfocus.com/archive/1/349756 9416 9417 CVE-2004-0164 2004-01-13 2004-03-25 2004-03-29
wu-ftpd ftpaccess `restricted-uid'/`restricted-gid' directive may be bypassed wu-ftpd 2.6.2_3 wu-ftpd+ipv6 2.6.2_5

Glenn Stewart reports a bug in wu-ftpd's ftpaccess `restricted-uid'/`restricted-gid' directives:

Users can get around the restriction to their home directory by issuing a simple chmod command on their home directory. On the next ftp log in, the user will have '/' as their root directory.

Matt Zimmerman discovered that the cause of the bug was a missing check for a restricted user within a code path that is executed only when a certain error is encountered.

CVE-2004-0148 9832 2004-02-17 2004-03-08 2004-03-29
GNU Anubis buffer overflows and format string vulnerabilities anubis 3.6.2_1

Ulf Härnhammar discovered several vulnerabilities in GNU Anubis.

  • Unsafe uses of `sscanf'. The `%s' format specifier is used, which allows a classical buffer overflow. (auth.c)
  • Format string bugs invoking `syslog'. (log.c, errs.c, ssl.c)

Ulf notes that these vulnerabilities can be exploited by a malicious IDENT server as a denial-of-service attack.

http://lists.netsys.com/pipermail/full-disclosure/2004-March/018290.html 9772 CVE-2004-0353 CVE-2004-0354 2004-03-04 2004-03-06 2004-03-29
Buffer overflows in XFree86 servers XFree86-Server 4.3.0_13 4.3.994.3.99.15_1

A number of buffer overflows were recently discovered in XFree86, prompted by initial discoveries by iDEFENSE. These buffer overflows are present in the font alias handling. An attacker with authenticated access to a running X server may exploit these vulnerabilities to obtain root privileges on the machine running the X server.

http://www.idefense.com/application/poi/display?id=72 http://www.idefense.com/application/poi/display?id=73 CVE-2004-0083 CVE-2004-0084 CVE-2004-0106 9636 9652 9655 2004-02-10 2004-02-12 2004-03-29
multiple buffer overflows in xboing xboing 2.4_2

Steve Kemp reports (in a Debian bug submission):

Due to improper bounds checking it is possible for a malicious user to gain a shell with membership group 'games'. (The binary is installed setgid games).

Environmental variables are used without being bounds-checked in any way, from the source code:

highscore.c:
   /* Use the environment variable if it exists */
   if ((str = getenv("XBOING_SCORE_FILE")) != NULL)
	strcpy(filename, str);
   else
	strcpy(filename, HIGH_SCORE_FILE);

misc.c:
    if ((ptr = getenv("HOME")) != NULL)
	(void) strcpy(dest, ptr);

Neither of these checks are boundschecked, and will allow arbitary shell code to be run.

CVE-2004-0149 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=174924 9764 2003-01-01 2004-03-05 2004-03-29
metamail format string bugs and buffer overflows metamail 2.7_2

Ulf Härnhammar reported four bugs in metamail: two are format string bugs and two are buffer overflows. The bugs are in SaveSquirrelFile(), PrintHeader(), and ShareThisHeader().

These vulnerabilities could be triggered by a maliciously formatted email message if `metamail' or `splitmail' is used to process it, possibly resulting in arbitrary code execution with the privileges of the user reading mail.

CVE-2004-0104 CVE-2004-0105 9692 2004-02-18 2004-02-18 2004-03-29
Buffer overflows and format string bugs in Emil emil 2.1b9

Ulf Härnhammar reports multiple buffer overflows in Emil, some of which are triggered during the parsing of attachment filenames. In addition, some format string bugs are present in the error reporting code.

Depending upon local configuration, these vulnerabilities may be exploited using specially crafted messages in order to execute arbitrary code running with the privileges of the user invoking Emil.

http://lists.netsys.com/pipermail/full-disclosure/2004-March/019325.html http://www.debian.org/security/2004/dsa-468 CVE-2004-0152 CVE-2004-0153 2004-03-24 2004-03-28
Critical SQL injection in phpBB phpbb 2.0.8

Anyone can get admin's username and password's md5 hash via a single web request. A working example is provided in the advisory.

http://marc.theaimsgroup.com/?l=bugtraq&m=108032454818873 9984 2004-03-26 2004-03-28
uudeview buffer overflows uulib uudeview xdeview 0.5.20

The authors of UUDeview report repairing two buffer overflows in their software.

http://www.fpx.de/fp/Software/UUDeview/HISTORY.txt 2004-03-01 2004-03-18 2004-03-25
Apache 1.3 IP address access control failure on some 64-bit platforms apache 1.3.29_2 apache+mod_ssl 1.3.29+2.8.16_1 apache+ssl 1.3.29.1.53_1 ru-apache 1.3.29+30.19_1 ru-apache+mod_ssl 1.3.29+30.19+2.8.16_1

Henning Brauer discovered a programming error in Apache 1.3's mod_access that results in the netmasks in IP address access control rules being interpreted incorrectly on 64-bit, big-endian platforms. In some cases, this could cause a `deny from' IP address access control rule including a netmask to fail.

CVE-2003-0993 http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&r2=1.47 http://www.apacheweek.com/features/security-13 http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850 http://marc.theaimsgroup.com/?l=apache-cvs&m=107869603013722 9829 2004-03-07 2004-03-08 2004-03-12
mod_python denial-of-service vulnerability in parse_qs mod_python 2.72.7.10 3.03.0.4

An attacker may cause Apache with mod_python to crash by using a specially constructed query string.

CVE-2003-0973 9129 http://www.modpython.org/pipermail/mod_python/2003-November/014532.html http://www.modpython.org/pipermail/mod_python/2004-January/014879.html 2003-11-28 2004-03-03 2004-03-11
mpg123 vulnerabilities mpg123 mpg123-nas mpg123-esound 0.59r_12

In 2003, two vulnerabilities were discovered in mpg123 that could result in remote code execution when using untrusted input or streaming from an untrusted server.

CVE-2003-0577 CVE-2003-0865 6629 8680 2003-01-16 2004-03-07
fetchmail -- denial-of-service vulnerability fetchmail 6.2.5

Dave Jones discovered a denial-of-service vulnerability in fetchmail. An email message containing a very long line could cause fetchmail to segfault due to missing NUL termination in transact.c.

Eric Raymond decided not to mention this issue in the release notes for fetchmail 6.2.5, but it was fixed there.

CVE-2003-0792 8843 http://xforce.iss.net/xforce/xfdb/13450 http://www.openbsd.org/cgi-bin/cvsweb/ports/mail/fetchmail/patches/Attic/patch-rfc822_c?rev=1.1 2003-10-16 2004-02-25 2012-09-04
mailman denial-of-service vulnerability in MailCommandHandler mailman 2.1

A malformed message could cause mailman to crash.

CVE-2003-0991 http://umn.dl.sourceforge.net/sourceforge/mailman/mailman-2.0.13-2.0.14-diff.txt 2003-11-18 2004-02-25
mailman XSS in admin script mailman 2.1.4

Dirk Mueller reports:

I've found a cross-site scripting vulnerability in the admin interface of mailman 2.1.3 that allows, under certain circumstances, for anyone to retrieve the (valid) session cookie.

CVE-2003-0965 http://mail.python.org/pipermail/mailman-announce/2003-December/000066.html http://xforce.iss.net/xforce/xfdb/14121 2003-12-31 2004-02-25
mailman XSS in create script mailman 2.1.3

From the 2.1.3 release notes:

Closed a cross-site scripting exploit in the create cgi script.

CVE-2003-0992 http://mail.python.org/pipermail/mailman-announce/2003-September/000061.html 2003-09-28 2004-02-25
mailman XSS in user options page mailman 2.1.1

From the 2.1.1 release notes:

Closed a cross-site scripting vulnerability in the user options page.

CVE-2003-0038 http://mail.python.org/pipermail/mailman-announce/2003-February/000056.html 2003-02-08 2004-02-25
SQL injection vulnerability in phpnuke phpnuke 6.9

Multiple researchers have discovered multiple SQL injection vulnerabilities in some versions of Php-Nuke. These vulnerabilities may lead to information disclosure, compromise of the Php-Nuke site, or compromise of the back-end database.

http://security.nnov.ru/search/document.asp?docid=5748 http://www.securityfocus.com/archive/1/348375 http://www.security-corporation.com/advisories-027.html http://www.securityfocus.com/archive/1/353201 2003-12-12 2004-02-25
lbreakout2 vulnerability in environment variable handling lbreakout2 2.2.2_1

Ulf Härnhammar discovered an exploitable vulnerability in lbreakout2's environmental variable handling. In several instances, the contents of the HOME environmental variable are copied to a stack or global buffer without range checking. A local attacker may use this vulnerability to acquire group-ID `games' privileges.

An exploit for this vulnerability has been published by ``Li0n7 voila fr''.

CVE-2004-0158 http://www.debian.org/security/2004/dsa-445 http://www.securityfocus.com/archive/1/354760 2004-02-21 2004-02-25
hsftp format string vulnerabilities hsftp 1.14

Ulf Härnhammar discovered a format string bug in hsftp's file listing code may allow a malicious server to cause arbitrary code execution by the client.

http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00044.html 2004-02-22 2004-02-25
Darwin Streaming Server denial-of-service vulnerability DarwinStreamingServer 4.1.3g

An attacker can cause an assertion to trigger by sending a long User-Agent field in a request.

CVE-2004-0169 http://www.idefense.com/application/poi/display?id=75 2004-02-23 2004-02-25
libxml2 stack buffer overflow in URI parsing libxml2 2.6.6

Yuuichi Teranishi reported a crash in libxml2's URI handling when a long URL is supplied. The implementation in nanohttp.c and nanoftp.c uses a 4K stack buffer, and longer URLs will overwrite the stack. This could result in denial-of-service or arbitrary code execution in applications using libxml2 to parse documents.

CVE-2004-0110 http://www.xmlsoft.org/news.html http://mail.gnome.org/archives/xml/2004-February/msg00070.html 2004-02-08 2004-02-25
file disclosure in phpMyAdmin phpMyAdmin 2.5.4

Lack of proper input validation in phpMyAdmin may allow an attacker to obtain the contents of any file on the target system that is readable by the web server.

CVE-2004-0129 http://marc.theaimsgroup.com/?l=bugtraq&m=107582619125932&w=2 http://cvs.sourceforge.net/viewcvs.py/phpmyadmin/phpMyAdmin/export.php#rev2.3.2.1 2004-02-17 2004-02-22
mnGoSearch buffer overflow in UdmDocToTextBuf() mnogosearch 3.2.*3.2.15

Jedi/Sector One <j@pureftpd.org> reported the following on the full-disclosure list:

Every document is stored in multiple parts according to its sections (description, body, etc) in databases. And when the content has to be sent to the client, UdmDocToTextBuf() concatenates those parts together and skips metadata.

Unfortunately, that function lacks bounds checking and a buffer overflow can be triggered by indexing a large enough document.

'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c . S->val length depends on the length of the original document and on the indexer settings (the sample configuration file has low limits that work around the bug, though).

Exploitation should be easy, moreover textbuf points to the stack.

http://lists.netsys.com/pipermail/full-disclosure/2004-February/017366.html 2004-02-15 2004-02-15
GNU libtool insecure temporary file handling libtool 1.31.3.5_2 1.41.4.3_3 1.51.5.2

libtool attempts to create a temporary directory in which to write scratch files needed during processing. A malicious user may create a symlink and then manipulate the directory so as to write to files to which she normally has no permissions.

This has been reported as a ``symlink vulnerability'', although I do not think that is an accurate description.

This vulnerability could possibly be used on a multi-user system to gain elevated privileges, e.g. root builds some packages, and another user successfully exploits this vulnerability to write to a system file.

http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405 http://www.securityfocus.com/archive/1/352333 2004-01-30 2004-02-13
seti@home remotely exploitable buffer overflow setiathome 3.0.8

The seti@home client contains a buffer overflow in the HTTP response handler. A malicious, spoofed seti@home server can exploit this buffer overflow to cause remote code execution on the client. Exploit programs are widely available.

http://setiathome.berkeley.edu/version308.html http://web.archive.org/web/20030609204812/http://spoor12.edup.tudelft.nl/ 2003-04-08 2004-02-12
icecast 1.x multiple vulnerabilities icecast 1.3.12

icecast 1.3.11 and earlier contained numerous security vulnerabilities, the most severe allowing a remote attacker to execute arbitrary code as root.

CVE-2002-0177 CVE-2001-1230 CVE-2001-1229 CVE-2001-1083 CVE-2001-0784 4415 2933 2002-04-28 2004-02-12
nap allows arbitrary file access nap 1.4.5

According to the author:

Fixed security loophole which allowed remote clients to access arbitrary files on our system.

http://quasar.mathstat.uottawa.ca/~selinger/nap/NEWS 2001-04-12 2004-02-12
CCE contains exploitable buffer overflows zh-cce 0.40

The Chinese Console Environment contains exploitable buffer overflows.

http://programmer.lib.sjtu.edu.cn/cce/cce.html 2000-06-22 2004-02-12
ChiTeX/ChiLaTeX unsafe set-user-id root zh-chitex 0

Niels Heinen reports that ChiTeX installs set-user-id root executables that invoked system(3) without setting up the environment, trivially allowing local root compromise.

https://docs.freebsd.org/cgi/mid.cgi?200303251301.h2PD1m9Y053389 2003-04-25 2004-02-12
pine remotely exploitable buffer overflow in newmail.c zh-pine iw-pine pine pine4-ssl 4.21

Kris Kennaway reports a remotely exploitable buffer overflow in newmail.c. Mike Silbersack submitted the fix.

https://docs.freebsd.org/cgi/mid.cgi?200009290728.AAA69097 2000-09-29 2004-02-12
pine insecure URL handling pine zh-pine iw-pine 4.44

An attacker may send an email message containing a specially constructed URL that will execute arbitrary commands when viewed.

SA-02:05.pine 2002-01-04 2004-02-12
pine remote denial-of-service attack pine zh-pine iw-pine 4.50

An attacker may send a specially-formatted email message that will cause pine to crash.

http://marc.theaimsgroup.com/?l=bugtraq&m=103668430620531&w=2 CVE-2002-1320 2002-10-23 2004-02-12
pine remotely exploitable vulnerabilities pine zh-pine iw-pine 4.58

Pine versions prior to 4.58 are affected by two vulnerabilities discovered by iDEFENSE, a buffer overflow in mailview.c and an integer overflow in strings.c. Both vulnerabilities can result in arbitrary code execution when processing a malicious message.

CVE-2003-0720 CVE-2003-0721 http://www.idefense.com/application/poi/display?id=5 2003-09-10 2004-02-12
rsync buffer overflow in server mode rsync 2.5.7

When rsync is run in server mode, a buffer overflow could allow a remote attacker to execute arbitrary code with the privileges of the rsync server. Anonymous rsync servers are at the highest risk.

CVE-2003-0962 http://lists.samba.org/archive/rsync-announce/2003/000011.html http://rsync.samba.org/#security 2003-12-04 2004-02-12
Samba 3.0.x password initialization bug samba 3.0,13.0.1_2,1

From the Samba 3.0.2 release notes:

Security Announcement: It has been confirmed that previous versions of Samba 3.0 are susceptible to a password initialization bug that could grant an attacker unauthorized access to a user account created by the mksmbpasswd.sh shell script.

http://www.samba.org/samba/whatsnew/samba-3.0.2.html CVE-2004-0082 2004-02-09 2004-02-12
Buffer overflow in Mutt 1.4 mutt ja-mutt 1.41.4.2

Mutt 1.4 contains a buffer overflow that could be exploited with a specially formed message, causing Mutt to crash or possibly execute arbitrary code.

CVE-2004-0078 http://www.mutt.org/news.html 2004-02-11 2004-02-12
Apache-SSL optional client certificate vulnerability apache+ssl 1.3.29.1.53

From the Apache-SSL security advisory:

If configured with SSLVerifyClient set to 1 or 3 (client certificates optional) and SSLFakeBasicAuth, Apache-SSL 1.3.28+1.52 and all earlier versions would permit a client to use real basic authentication to forge a client certificate.

All the attacker needed is the "one-line DN" of a valid user, as used by faked basic auth in Apache-SSL, and the fixed password ("password" by default).

http://www.apache-ssl.org/advisory-20040206.txt 2004-02-06 2004-02-10
L2TP, ISAKMP, and RADIUS parsing vulnerabilities in tcpdump tcpdump 3.8.1_351 FreeBSD 5.2.1

Jonathan Heusser discovered vulnerabilities in tcpdump's L2TP, ISAKMP, and RADIUS protocol handlers. These vulnerabilities may be used by an attacker to crash a running `tcpdump' process.

CVE-2003-0989 CVE-2003-1029 CVE-2004-0057 http://www.tcpdump.org/lists/workers/2003/12/msg00083.html http://marc.theaimsgroup.com/?l=tcpdump-workers&m=107325073018070&w=2 2003-12-24 2004-01-19
Buffer overflow in INN control message handling inn 2.4.*2.4.1 inn-stable 20031022_1

A small, fixed-size stack buffer is used to construct a filename based on a received control message. This could result in a stack buffer overflow.

http://marc.theaimsgroup.com/?l=inn-workers&m=107351974008605 2004-01-07 2004-01-08 2004-10-21
ProFTPD ASCII translation bug resulting in remote root compromise proftpd 1.2.8_1

A buffer overflow exists in the ProFTPD code that handles translation of newline characters during ASCII-mode file uploads. An attacker may exploit this buffer overflow by uploading a specially crafted file, resulting in code execution and ultimately a remote root compromise.

http://xforce.iss.net/xforce/alerts/id/154 CVE-2003-0831 2003-09-23 2004-01-05
ElGamal sign+encrypt keys created by GnuPG can be compromised gnupg 1.0.21.2.3_4

Any ElGamal sign+encrypt keys created by GnuPG contain a cryptographic weakness that may allow someone to obtain the private key. These keys should be considered unusable and should be revoked.

The following summary was written by Werner Koch, GnuPG author:

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. Note that this is a real world vulnerability which will reveal your private key within a few seconds.

...

Please take immediate action and revoke your ElGamal signing keys. Furthermore you should take whatever measures necessary to limit the damage done for signed or encrypted documents using that key.

Note that the standard keys as generated by GnuPG (DSA and ElGamal encryption) as well as RSA keys are NOT vulnerable. Note also that ElGamal signing keys cannot be generated without the use of a special flag to enable hidden options and even then overriding a warning message about this key type. See below for details on how to identify vulnerable keys.

CVE-2003-0971 http://lists.gnupg.org/pipermail/gnupg-devel/2003-November/020570.html 2003-11-27 2003-12-12
Mathopd buffer overflow mathopd 1.4p2

Mathopd contains a buffer overflow in the prepare_reply() function that may be remotely exploitable.

http://www.mail-archive.com/mathopd%40mathopd.org/msg00136.html 2003-12-04 2003-12-12
lftp HTML parsing vulnerability lftp 2.6.10

A buffer overflow exists in lftp which may be triggered when requesting a directory listing from a malicious server over HTTP.

CVE-2003-0963 http://lftp.yar.ru/news.html#2.6.10 2003-12-11 2003-12-12
qpopper format string vulnerability qpopper 2.53_1

An authenticated user may trigger a format string vulnerability present in qpopper's UIDL code, resulting in arbitrary code execution with group ID `mail' privileges.

1241 CVE-2000-0442 http://www.netsys.com/suse-linux-security/2000-May/att-0137/01-b0f5-Qpopper.txt 2000-05-23 2003-12-12
fetchmail -- address parsing vulnerability fetchmail 6.2.0

Fetchmail can be crashed by a malicious email message.

http://security.e-matters.de/advisories/052002.html 2003-10-25 2003-10-25 2012-09-04
Buffer overflow in pam_smb password handling pam_smb 1.9.9_3

Applications utilizing pam_smb can be compromised by any user who can enter a password. In many cases, this is a remote root compromise.

http://www.skynet.ie/~airlied/pam_smb/ CVE-2003-0686 2003-10-25 2003-10-25 2003-10-25
Buffer overflows in libmcrypt libmcrypt 2.5.6

libmcrypt does incomplete input validation, leading to several buffer overflows. Additionally, a memory leak is present. Both of these problems may be exploited in a denial-of-service attack.

http://marc.theaimsgroup.com/?l=bugtraq&m=104162752401212&w=2 CVE-2003-0031 CVE-2003-0032 2003-10-25 2003-10-25 2003-10-25
phpbb -- arbitrary command execution and other vulnerabilities phpbb 2.0.11

The ChangeLog for phpBB 2.0.11 states:

Changes since 2.0.10

  • Fixed vulnerability in highlighting code (very high severity, please update your installation as soon as possible)
  • Fixed unsetting global vars - Matt Kavanagh
  • Fixed XSS vulnerability in username handling - AnthraX101
  • Fixed not confirmed sql injection in username handling - warmth
  • Added check for empty topic id in topic_review function
  • Added visual confirmation mod to code base

Additionally, a US-CERT Technical Cyber Security Alert reports:

phpBB contains an user input validation problem with regard to the parsing of the URL. An intruder can deface a phpBB website, execute arbitrary commands, or gain administrative privileges on a compromised bulletin board.

CVE-2004-1315 ports/74106 TA04-356A 497400 http://www.phpbb.com/support/documents.php?mode=changelog http://marc.theaimsgroup.com/?l=bugtraq&m=110029415208724 http://marc.theaimsgroup.com/?l=bugtraq&m=110079436714518 http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240636 2004-11-18 2004-12-22 2005-01-24
squid -- possible abuse of cachemgr.cgi squid 2.5.10

The squid patches page notes:

This patch adds access controls to the cachemgr.cgi script, preventing it from being abused to reach other servers than allowed in a local configuration file.

CVE-1999-0710 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-cachemgr_conf http://www.squid-cache.org/bugs/show_bug.cgi?id=1094 1999-07-29 2005-05-19
squid -- DNS lookup spoofing vulnerability squid 2.5.10

The squid patches page notes:

Malicious users may spoof DNS lookups if the DNS client UDP port (random, assigned by OS as startup) is unfiltered and your network is not protected from IP spoofing.

CVE-2005-1519 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-dns_reply http://secunia.com/advisories/15294 2005-05-11 2005-05-19
jabberd -- 3 buffer overflows jabberd 2.0.9

There are 3 buffer overflows in jid.c that are triggered during parsing of JID strings when components (user, host or resource) are too long.

  1. jid.c, line 103: overflow in `str' buffer through strcpy() when "user" part is too long.
  2. jid.c, line 115: overflow in `str' buffer through strcpy() when "host" part is too long.
  3. jid.c, line 127: overflow in `str' buffer through strcpy() when "resource" part is too long.

These overflows can be used to perform a DoS attack on the server (sm process segfaults) and can possible be used for arbitrary code execution.

http://j2.openaether.org/bugzilla/show_bug.cgi?id=99 2005-07-25 2005-07-30
squid -- possible denial of service condition regarding NTLM authentication squid 2.5.10_6

The squid patches page notes:

Squid may crash with the above error [FATAL: Incorrect scheme in auth header] when given certain request sentences.

Workaround: disable NTLM authentication.

14977 CVE-2005-2917 http://www.squid-cache.org/bugs/show_bug.cgi?id=1391 http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE10-NTLM-scheme_assert http://secunia.com/advisories/16992/ 2005-09-12 2005-09-15 2005-10-02
phpmyfaq -- SQL injection, takeover, path disclosure, remote code execution phpmyfaq 1.5.2

If magic quotes are off there's a SQL injection when sending a forgotten password. It's possible to overwrite the admin password and to take over the whole system. In some files in the admin section there are some cross site scripting vulnerabilities. In the public frontend it's possible to include arbitrary php files.

14927 14928 14929 14930 CVE-2005-3046 CVE-2005-3047 CVE-2005-3048 CVE-2005-3049 CVE-2005-3050 http://www.phpmyfaq.de/advisory_2005-09-23.php 2005-09-23 2005-09-29