A missing bounds check was found in the way OpenSSL handled TLS heartbeat extension packets. This flaw could be used to reveal up to 64k of memory from a connected client or server.
Only 1.0.1 releases of OpenSSL are affected including 1.0.1f (and 1.0.2 betas)
The following upstream commit introduced TLS/DTLS heatbeat support and also this issue:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4817504
It was discovered that Java Sound provider caching mechanism is insecure. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that JAXWS incorrectly cached certain data initialized via thread context class loaders. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the AWT toolkit did not properly handle the toolkit threads. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that JAXB incorrectly cached certain data initialized via thread context class loaders. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the activation framework did not properly protect the default command map. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that FlavorMaps were not properly seperated between different AppContexts. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that JAXWS incorrectly cached certain data initialized via thread context class loaders. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
It was discovered that the system logger was not properly protected against using handlers of custom loggers created prior to the system logger. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file.
A flaw was found in the way Linux kernel's floppy driver treated userspace provided data in certain error code path while processing FDRAWCMD ioctl command. An local user with write access to /dev/fdX could use this flaw to kfree() arbitrary data. (CVE-2014-1737)
It was found that Linux kernel's floppy driver leaked internal kernel memory addresses to userspace during processing of FDRAWCMD ioctl command. An local user with write access to /dev/fdX could use this flaw to get information about kernel heap arrangment. (CVE-2014-1738)
An local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.
Acknowledgements:
Red Hat would like to thank Matthew Daley for reporting these issues.
An underflow read was found in pngcheckkeyword in pngwutil.c in libpng-1.2.54:
If the data of "key" is only ' ' (0x20), it will read a byte before the buffer in line 1288.
This issue impacts upstream versions 1.2.55, 1.0.65, 1.4.18, and 1.5.25 of libpng.
An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image.
CVE assignment:
http://seclists.org/oss-sec/2015/q4/469
Upstream issue:
http://sourceforge.net/p/libpng/bugs/244/
Upstream patch:
http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b42ed/
The streamreqbodycl function in modproxyhttp.c in the modproxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
François Guerraz reported in Debian BTS a possible DoS (CPU consumption) a DoS with moddeflate since it does not stop to compress large files even after the network connection has been closed. This allows to use large amounts of CPU if there is a largish file available that has moddeflate enabled.
Original report: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534712
Post to the apache-httpd-dev mailing list: http://marc.info/?l=apache-httpd-dev&m=124621326524824&w=2
Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 do not properly perform cursor handling, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."
Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.
Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG animations.
Google Chrome before 7.0.517.44 does not properly perform a cast of an unspecified variable during processing of an SVG use element, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SVG document.
Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted image.
Sauli Pahlman of CERT-FI provided us with fuzzed PDF file which causes xpdf / poppler PDF parser to crash.
The crash is caused by an attempt to dereference uninitialized Gfx::parser pointer in Gfx::getPos(), which assumes parser is either NULL or valid Parser pointer.
http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Gfx.cc?id=71063d51#n879
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."
Multiple heap-based buffer overflow flaws were found in the XML manifest encryption handling code of OpenOffice.org and LibreOffice:
1) Previously it was not checked if the particular tag was contained within expected parent tag, leading to possibility of child tag handler being able to write its data into different (than expected) parent handler sequence, leading to heap buffer overflow,
2) also a fixed size sequence was allocated to record properties of a particular XML tag, associated with XML element. By duplicating certain tags in XML manifest it was possible to write past the heap-based buffer bounds,
3) yet, the Base64 decoder implementation incorrectly assumed the length of ChecksumAttribute (input buffer) to be evenly divisible by 4, leading into the storage for output (Base64 decoded) buffer to be underallocated, resulting into heap buffer overflow.
A remote attacker could provide a specially-crafted Open Document Text (.odt) file, that when opened would cause OpenOffice.org / LibreOffice to crash or, potentially execute arbitrary code with the privileges of the user running a tool from the suite.
Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259.
Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow.
slim has NULL pointer dereference when using crypt() method from glibc 2.17
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmucontext.h and arch/s390/include/asm/pgalloc.h.