Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function pythonmodulepath.
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.
apache. Multiple issues existed in Apache. These were addressed by updating Apache to version 2.4.25.
Apache Tomcat uses a package renamed copy of Apache Commons FileUpload to implement the file upload requirements of the Servlet specification. A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file. This caused the file upload process to take several orders of magnitude longer than if the boundary was the typical tens of bytes long.
External references:
http://tomcat.apache.org/security-8.html http://tomcat.apache.org/security-7.html
Upstream fixes:
Tomcat 8.5.x:
http://svn.apache.org/viewvc?view=revision&revision=1743722
Tomcat 8.0.x:
http://svn.apache.org/viewvc?view=revision&revision=1743738
Last updated 24 July 2024
Last updated 24 July 2024
Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
A vulnerability was found in ImageMagick. Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats.
ImageMagick allows to process files with external libraries. This feature is called 'delegate'. It is implemented as a system() with command string ('command') from the config file delegates.xml with actual value for different params (input/output filenames etc). Due to insufficient %M param filtering it is possible to conduct shell command injection. One of the default delegate's command is used to handle https requests:
"wget" -q -O "%o" "https:%M"
where %M is the actual link from the input. It is possible to pass the value like https://example.com"|ls "-la and execute unexpected 'ls -la'. (wget or curl should be installed).
Buffer overflow in the maingetappheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
If PAM is configured to read user-specified environment variables and UseLogin=yes in sshdconfig, then a hostile local user may attack /bin/login via LDPRELOAD or similar environment variables set via PAM.
Upstream fix:
https://anongit.mindrot.org/openssh.git/commit/?id=85bdcd7c92fe7ff133bbc4e10a65c91810f88755
Debian advisory:
https://www.debian.org/security/2016/dsa-3550
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlNextChar.
References:
https://bugzilla.gnome.org/showbug.cgi?id=759671
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a7a94612aa3b16779e2c74e1fa353b5d9786c602
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.
It was reported that due to buffer overflow, it is possible for remote TCP endpoint to trigger the opposite TCP endpoint to write to a socket in sequence which causes the ethernet driver to send arbitrary kernel data over the ethernet interface instead of a portion of the intended packet data.
Initially this issue was believed to be present in a number of mainline drivers in 3.10.x and 4.4.2 vanilla kernel sources. After further investigation it was found that only [atl2] driver (code in drivers/net/ethernet/atheros/atlx/atl2.c) from the list of suspected drivers is vulnerable.
As a result, certain conditions should be met to trigger the issue: - the [atl2] driver and the corresponding network card (which believed to be not so frequently used) should be present on the target system - an application should make such a sequence of calls that a network buffer for the data to be transmitted is scattered - hardware checksumming should be enabled so the packet checksum is correct
The above makes this vulnerability less probable to be hit.
An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source.
A vulnerable application could be exploited for remote code execution, including executing arbitrary shell commands.
External references:
https://github.com/beanshell/beanshell/releases/tag/2.0b6
Upstream patches:
https://github.com/beanshell/beanshell/commit/7c68fde2d6fc65e362f20863d868c112a90a9b49
https://github.com/beanshell/beanshell/commit/1ccc66bb693d4e46a34a904db8eeff07808d2ced
It was reported that drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(), which is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead.
A local unprivileged user on a system with rdmaucm module loaded could use this flaw to escalate their privileges.
Upstream patch:
https://git.kernel.org/linus/e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q2/269 http://seclists.org/oss-sec/2016/q2/274
Last updated 24 July 2024
The LoadSBitPng function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by embedding a PNG file in a .ttf font file.