Use-after-free vulnerability in kadmin/server/serverstubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.

The pngdecompresschunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

The futexlockpi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly manage a certain reference count, which allows local users to cause a denial of service (OOPS) via vectors involving an unmount of an ext3 filesystem.

Description of problem: A problem was found in the drivers/connector/connector.c code where users could send/allocate arbitrary amounts of NETLINKCONNECTOR messages to the kernel, causing OOM condition, killing selected processes or halting the system.

This is fixed in mainline commit f98bfbd78c37c5946cc53089da32a5f741efdeb7 by removing the code.

commit f98bfbd78c37c5946cc53089da32a5f741efdeb7 Author: Evgeniy Polyakov <zbr> Date: Tue Feb 2 15:58:48 2010 -0800

connector: Delete buggy notification code.

On Tue, Feb 02, 2010 at 02:57:14PM -0800, Greg KH (gregkh) wrote: > > There are at least two ways to fix it: using a big cannon and a small > > one. The former way is to disable notification registration, since it is > > not used by anyone at all. Second way is to check whether calling > > process is root and its destination group is -1 (kind of priveledged > > one) before command is dispatched to workqueue. > > Well if no one is using it, removing it makes the most sense, right? > > No objection from me, care to make up a patch either way for this?

Getting it is not used, let's drop support for notifications about (un)registered events from connector. Another option was to check credentials on receiving, but we can always restore it without bugs if needed, but genetlink has a wider code base and none complained, that userspace can not get notification when some other clients were (un)registered.

Kudos for Sebastian Krahmer <krahmer>, who found a bug in the code.

Signed-off-by: Evgeniy Polyakov <zbr> Acked-by: Greg Kroah-Hartman <gregkh> Signed-off-by: David S. Miller <davem>

Acknowledgements:

Red Hat would like to thank Sebastian Krahmer for reporting this issue.

Description of problem: The problem seams to be located in fs/binfmtelf.c:loadelfbinary(). It calls SETPERSONALITY() prior checking that the ELF interpreter is available. This in turn makes the previously 32 bit process a 64 bit one which would be fine if execve() would succeed. But after the SETPERSONALITY() the openexec() call fails (because it cannot find the interpreter) and execve() almost instantly returns with an error. If you now look at /proc/PID/maps you'll see, that it has the vsyscall page mapped which shouldn't be. But the process is not dead yet, it's still running. By now generating a segmentation fault and in turn trying to generate a core dump the kernel just dies.

Steps to Reproduce: 1. Enable core dumps 2. Start an 32 bit program that tries to execve() an 64 bit program 3. The 64 bit program cannot be started by the kernel because it can't find the interpreter, i.e. execve returns with an error 4. Generate a segmentation fault 5. panic

(EDIT: This is triggerable on 2.6.31.9-174.fc12.x8664).

Upstream commit: http://git.kernel.org/linus/221af7f87b97431e3ee21ce4b0e77d5411cf1549

Discussions: http://marc.info/?t=126466700200002&r=1&w=2

Acknowledgements:

Red Hat would like to thank Mathias Krause for reporting this issue.

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

The aclgroupoverride function in smbd/posixacls.c in smbd in Samba 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6, when dos filemode is enabled, allows remote attackers to modify access control lists for files via vectors related to read access to uninitialized memory.

The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the genericfilesplicewrite, splicefrompipe, and ocfs2filesplicewrite functions.

A single NULL byte buffer overflow flaw was found in apr-util's aprbrigadevprintf() function.

First let's assume the worst case and an attacker can control exactly what is being sent to aprbrigadevprintf and can trigger this issue by filling the buckets just right so you end up with one that is perfectly full as per the explanation at http://www.mail-archive.com/dev@apr.apache.org/msg21592.html

632 APUDECLARE(aprstatust) aprbrigadevprintf(aprbucketbrigade b, ... 638 struct brigadevprintfdatat vd; 639 char buf[APRBUCKETBUFFSIZE]; 640 aprsizet written; ... 656 (vd.vbuff.curpos) = '\0'; ... 659 return aprbrigadewrite(b, flush, ctx, buf, vd.vbuff.curpos - buf);

If we get to line 656 with vd.vbuff.curpos pointing to one past the end of buf we write a single NULL to the next thing on the stack after buf. And on the Linux x86 and x8664 builds we looked at this is actually the first byte of the vd structure, which is in fact the LSB of vd.vbuff.curpos itself.

So the only use of this after the overwrite is on line 659 where vd.vbuff.curpos gets used to calculate how much to write. Before the overwrite vd.vbuff.curpos was buf+APRBUCKETBUFFSIZE (8000), but now it could be between 0 and 255 bytes less. So aprbrigadewrite will end up writing out between 0 and 255 bytes less than it ought to, causing the truncation seen in the original bug report.

So for little endian systems it doesn't seem to have any security consequence. Of course for a big endian system aprbrigadewrite could end up dumping large amounts of memory (so an info disclosure leak or crash).

Description of problem: Frank Filz reported: the problem is that permission checking is skipped if atomic open is possible, but when exec opens a file, it just opens it OREADONLY which means EXEC permission will not be checked at that time.

This problem is observed by the following sequence (executed as root):

mount -t nfs4 server:/ /mnt4 echo "ls" >/mnt4/foo chmod 744 /mnt4/foo su guest -c "mnt4/foo"

Reference: http://article.gmane.org/gmane.linux.nfs/26592

Description of problem: The vmxsetmsr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i386 platform allows guest OS users to cause a denial of service (OOPS) by setting the EFERLME (aka "Long mode enable") bit in the Extended Feature Enable Register (EFER) model-specific register, which is specific to the x8664 platform.

Reference: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiffplain;h=16175a796d061833aacfbd9672235f2d2725df65

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAPMKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the rootsquash option.

FFmpeg could allow a remote attacker to execute arbitrary code on the system, caused by an integer signedness error in the fourxmreadheader() function in libavformat/4xm.c. By persuading a victim to open a specially-crafted 4X movie file with a large currenttrack value, a remote attacker could exploit this vulnerability to corrupt memory, trigger a NULL pointer dereference and execute arbitrary code on the system.

drivers/firmware/dellrbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x before 2.6.28.2, allows local users to cause a denial of service (system crash) via a read system call that specifies zero bytes from the (1) imagetype or (2) packetsize file in /sys/devices/platform/dellrbu/.

fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.

Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with other domains, and conduct cross-site scripting (XSS) attacks via unknown vectors related to restoration of SessionStore data.

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with chrome privileges via unknown vectors in which "page content can pollute XPCNativeWrappers."

The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines.

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions of data from another domain via a JavaScript URL that redirects to the target resource, which generates an error if the target data does not have JavaScript syntax, which can be accessed using the window.onerror DOM API.

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHttpRequest to an attacker-controlled resource that uses a 302 redirect to a resource in a different domain, then reading content from the response, aka "response disclosure."

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy and conduct cross-site scripting (XSS) attacks via an XBL binding to an "unloaded document."

Directory traversal vulnerability in Archive::Tar perl module allows user-assisted remote attackers to overwrite arbitrary files writable by user running application using this module via an absolute path or a .. (dot dot) sequence in filenames in a TAR archive.

Similar issues were reported and fixed for GNU tar during past several years, e.g.: CVE-2001-1267, CVE-2002-0399, CVE-2002-1216 and CVE-2007-4131.

This issue is important when this module is used to extract tar archives from untrusted sources. However, some of such applications either implement workarounds / own checks (sa-update in spamassassin) or dropped module support at all (amavisd-new).