Description of problem:

A specially-crafted UDF filesystem could cause buffer overflow when parsing sparing tables in udfloadlogicalvol()@fs/udf/super.c.

The bug is fixed in upstream kernel via the following commits:

commit 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Author: Jan Kara <jack () suse cz> Date: Wed Jun 27 21:23:07 2012 +0200

udf: Fortify loading of sparing table

Add sanity checks when loading sparing table from disk to avoid accessing unallocated memory or writing to it.

and

commit adee11b2085bee90bd8f4f52123ffb07882d6256 Author: Jan Kara <jack () suse cz> Date: Wed Jun 27 20:20:22 2012 +0200

udf: Avoid run away loop when partition table length is corrupted Check provided length of partition table so that (possibly maliciously) corrupted partition table cannot cause accessing data beyond current buffer.

Upstream fixes: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=1df2ae31c724e57be9d7ac00d78db8a5dabdd050 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=adee11b2085bee90bd8f4f52123ffb07882d6256 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=57b9655d

References: http://seclists.org/oss-sec/2012/q3/2

A peer (or local user) may cause TCP to use a nominal MSS of as little as 88 (actual MSS of 76 with timestamps). Given that we have a sufficiently prodigious local sender and the peer ACKs quickly enough, it is nevertheless possible to grow the window for such a connection to the point that we will try to send just under 64K at once. This results in a single skb that expands to 861 segments.

In some drivers with TSO support, such an skb will require hundreds of DMA descriptors; a substantial fraction of a TX ring or even more than a full ring. The TX queue selected for the skb may stall and trigger the TX watchdog repeatedly (since the problem skb will be retried after the TX reset).

Upstream patch: http://www.spinics.net/lists/netdev/msg206332.html

References: http://seclists.org/oss-sec/2012/q3/171

Acknowledgements:

Red Hat would like to thank Ben Hutchings of Solarflare (tm) for reporting this issue.

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

Multiple heap-based buffer overflow flaws were found in the XML manifest encryption handling code of OpenOffice.org and LibreOffice:

1) Previously it was not checked if the particular tag was contained within expected parent tag, leading to possibility of child tag handler being able to write its data into different (than expected) parent handler sequence, leading to heap buffer overflow,

2) also a fixed size sequence was allocated to record properties of a particular XML tag, associated with XML element. By duplicating certain tags in XML manifest it was possible to write past the heap-based buffer bounds,

3) yet, the Base64 decoder implementation incorrectly assumed the length of ChecksumAttribute (input buffer) to be evenly divisible by 4, leading into the storage for output (Base64 decoded) buffer to be underallocated, resulting into heap buffer overflow.

A remote attacker could provide a specially-crafted Open Document Text (.odt) file, that when opened would cause OpenOffice.org / LibreOffice to crash or, potentially execute arbitrary code with the privileges of the user running a tool from the suite.

Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259.