Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM ). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data.

External References:

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL

It was discovered that JAXP the CharInfo object did not properly prevent access to arbitrary files when a SecurityManager is present. An untrusted Java application or applet could possibly use this flaw to disclose sensitive information.

softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.

Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.

Last updated 24 July 2024

Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."

It was discovered that the JNDI DNS client did not properly randomize the DNS query ID. A remote attacker could exploit this flaw to e.g. perfom DNS spoofing attacks.

It was discovered that ICC profiles were not parsed correctly. An untrusted Java application or applet could possibly use this flaw to cause a denial of service.

It was discovered that the Security component in OpenJDK could leak some timing information when preforming PKCS#1 unpadding. This could possibly lead to disclosure of some information meant to be protected by encryption.

This fix improves the fix for CVE-2014-0411 (bug 1053010) applied via via Oracle CPU January 2014.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

It is unexpected and not allowed to call TTY buffer helpers like ttyinsertflipstring concurrently. This may lead to crashes when ECHOing is enabled and concurrect writers call ptywrite in the meantime. In that case the two writers: the ECHOing from a workqueue and ptywrite from the process race and can overflow the corresponding TTY buffer.

An unprivileged local user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

References: http://seclists.org/oss-sec/2014/q2/243

The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

The scan function in ext/date/lib/parseisointervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

It was reported [1],[2] that libjpeg and libjpeg-turbo would use uninitialized memory when decoding images with missing SOS data for the luminance component (Y) in the presence of valid chroma data (Cr, Cb). An example proof of concept that can be viewed in a browser is also available [3].

This was reported and fixed initially in Google Chrome/Chromium; it does not appear to be fixed in upstream libjpeg or libjpeg-turbo yet. Patches to the third party source in Chromium for libjpeg [4] and libjpeg-turbo [5] however are available.

[1] http://googlechromereleases.blogspot.de/2013/11/stable-channel-update.html [2] http://packetstormsecurity.com/files/123989/IJG-jpeg6b-libjpeg-turbo-Uninitialized-Memory.html [3] http://lcamtuf.coredump.cx/jpegleak/ [4] http://src.chromium.org/viewvc/chrome/trunk/src/thirdparty/libjpeg/jdmarker.c?r1=228354&r2=228353&pathrev=228354 [5] http://src.chromium.org/viewvc/chrome/trunk/deps/thirdparty/libjpegturbo/jdmarker.c?r1=228381&r2=228380&pathrev=228381

A heap-based buffer overflow flaw was found in the pdftoopvp filter. If a malicious PDF file were processed, it could lead to arbitrary code execution with the privileges of the "lp" user. This issue was due to the following fix not being present in pdftoopvp:

https://bugs.freedesktop.org/showbug.cgi?id=17326 http://lists.freedesktop.org/archives/poppler/2008-August/004021.html

Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.

It was found that the OPVPWrapper::loadDriver() function in the pdftoopvp filter did not restrict the directory drivers could be loaded from. As the driver name can be configured based on a PPD file, processing a PDF in an attacker-controlled directory containing a malicious driver could lead to arbitrary code execution with the privileges of the "lp" user.

Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.

Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow.

The davxmlgetcdata function in main/util.c in the moddav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5983 to the following vulnerability:

Untrusted search path vulnerability in the PySysSetArgv API function in Python before 2.6 prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983 http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg586010.html http://www.openwall.com/lists/oss-security/2009/01/26/2 http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.

Discussion and a possible patch is available from the following thread:

http://marc.info/?t=138219209900002&r=1&w=2

References:

http://martin.swende.se/blog/HTTPChunked.html

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file.

Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.

An array index bounds overrun flaw has been discovered in the vmxnet3 device as emulated by qemu.

A privileged guest user could use this flaw to corrupt qemu process' memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the qemu process.

Upstream fix: ------------- -> http://thread.gmane.org/gmane.comp.emulators.qemu/265562

Acknowledgements:

This issue was discovered by Michael S. Tsirkin of Red Hat.

Untrusted search path vulnerability in pammotd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.04 LTS, when using certain configurations such as "session optional pammotd.so", allows local users to gain privileges by modifying the PATH environment variable to reference a malicious command, as demonstrated via uname.

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.

Last updated 24 July 2024