Drupal versions 5.x and 6.x has open redirection
TYPO3 before 4.5.4 allows Information Disclosure in the backend.
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.
libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
An signedness error, leading to out of stack-based buffer read flaw was found in the way lighttpd, a lightning fast webserver with light system requirements, processed certain invalid base64 HTTP authentication tokens. A remote attacker could provide a specially crafted HTTP authentication request, leading to denial of service (lighttpd daemon crash due to an signedness error while processing the token).
Upstream bug report: [1] http://redmine.lighttpd.net/issues/2370
Upstream patch (with testcase and NEWS update): [2] http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2806/diff
References: [3] http://download.lighttpd.net/lighttpd/security/lighttpdsa201101.txt (upstream advisory) [4] http://www.openwall.com/lists/oss-security/2011/11/29/8 (CVE request) [5] http://www.openwall.com/lists/oss-security/2011/11/29/13 (CVE assignment)
An information disclosure flaw was found in the way MediaWiki, the wiki engine, processed 'curid' and 'oldid' request paramaters. A remote attacker could use this flaw to enumerate page titles on private MediaWiki installations.
Upstream bug report: [1] https://bugzilla.wikimedia.org/showbug.cgi?id=32276
An information disclosure flaw was found in the way MediaWiki, the wiki engine, performed action=ajax requests dispatching to relevant internal functions. These requests were dispatched without any read permissions checks being done. A remote attacker could use this flaw to obtain data on private MediaWiki installations.
Upstream bug report: [2] https://bugzilla.wikimedia.org/showbug.cgi?id=32616
References: [3] http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html [4] http://www.openwall.com/lists/oss-security/2011/11/29/6 [5] https://bugs.gentoo.org/showbug.cgi?id=392383
Upstream patch (covering both of the issues): [6] http://www.mediawiki.org/wiki/Special:Code/MediaWiki/104506
Integer overflow in the exifprocessIFDTAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offsetval value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.
A local file inclusion flaw was found in the way XML import plug-in of phpMyAdmin, a tool written in PHP intended to handle the administration of MySQL over the World Wide Web, performed import of malformed XML files. A remote attacker could provide a specially-crafted XML file, which once imported into the phpMyAdmin service instance would lead to arbitrary local file (accessible with the privileges of the phpMyAdmin user) read / retrieval.
References: [1] http://seclists.org/fulldisclosure/2011/Nov/21 [2] http://www.wooyun.org/bugs/wooyun-2010-03185
Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.
It was found that the different user screens (HTML forms) of the Samba Web Administration Tool suite were missing protection against cross-site request forgery (CSRF) attacks. A remote attacker could provide a specially-crafted URL, which once visited by an authenticated Samba SWAT user could lead to unauthorized commands execution with the privileges of that user (for example shut down or start the samba daemons, add or remove shares, printers, user accounts if the victim authenticated as privileged user to Samba SWAT).
Upstream bug report: [1] https://bugzilla.samba.org/showbug.cgi?id=8290 (not public yet)
Acknowledgements:
Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter.
It was found that in libpng, prior to 1.2.45, the error function received a NULL pointer, expressed erroneously as '\0', instead of the empty string "". This error was introduced in libpng-1.2.20, and pngdefaulterror() will crash in this case.
This was be fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.
Patch: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9dad5e37aef295b4ef8dea39392b652deebc9261
It was reported [1] that the fix for CVE-2004-0421 in libpng was inadvertently reverted during the 1.2.23 development cycle. The original flaw could be used to cause a denial of service via a carefully-crafted PNG image.
This would affect all versions of libpng >=1.2.23, including 1.4.x and 1.5.x.
[1] http://sourceforge.net/mailarchive/forum.php?threadname=BANLkTikrnU6FJNQYFvwmt78hwpgKPVRd1Q%40mail.gmail.com&forumname=png-mng-implement
It was found that cURL performed client credentials delegation during the client-to-server GSS security mechanisms negotiation. A remote, rogue server could use this flaw to impersonate the cURL client (victim) against the correct (originally intended) server, potentially leading to denial of cURL tool services for victim client.
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
An infinite loop was found in the way moddavsvn module of the subversion concurrent version control system processed certain data sets, when SVNPathAuthz configuration directive with value of 'shortcircuit' was used. A remote attacker could use this flaw to cause the httpd child process to consume excessive amount of system memory.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Ivan Zhakov of VisualSVN as the original reporter.
A NULL pointer dereference flaw was found in the way moddavsvn module of the subversion concurrent version control system processed requests submitted against the URL of a baselined resource. A remote attacker could use this flaw to cause the httpd child process to crash.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Joe Schaefer of Apache Software Foundation as the original reporter.
Apache Portable Runtime (APR) is vulnerable to a denial of service, caused by an error in the aprfnmatch() function when processing specific patterns with the "" wildcard. A remote attacker could exploit this vulnerability to consume all available CPU and memory resources resulting in a denial of service.
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
The vsffilenamepassesfilter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.
Multiple buffer overflows in demo programs in FreeType before 2.4.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Heap-based buffer overflow in the InsIUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Heap-based buffer overflow in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted length value in a POST fragment header in a font file.
Integer overflow in the grayrenderspan function in smooth/ftgrays.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Buffer overflow in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.
Robert Swiecki reported an invalid free flaw, that could possibly corrupt the heap, in freetype. This could cause applications linked against freetype to crash (SIGABRT) or, possibly, lead to the execution of arbitrary code if an attacker were able to get a victim to load a malicious font file.
The affected code is not present in Red Hat Enterprise Linux 3 (freetype 2.1.4). In Red Hat Enterprise Linux 4 and 5 this code is present, but does not cause a crash.
This issue has been given the name CVE-2010-2498.
Upstream bug report:
http://savannah.nongnu.org/bugs/index.php?30106
Upstream commit that fixes the issue:
http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=8d22746c9e5af80ff4304aef440986403a5072e2
Acknowledgements:
Red Hat would like to thank Robert Święcki of the Google Security Team for the discovery of this issue.
Integer underflow in glyph handling in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
The upstream PHP 5.2.14 and 5.3.3 releases corrected an information disclosure flaw where the varexport() function would disclose data if a fatal error occurred due to recursion, memorylimit, or execution time. The buffer is never cleared and is flushed to the user, regardless of the configured displayerrors setting, because it is considered part of the output. This could lead to a disclosure of possibly sensitive information.
The name CVE-2010-2531 has been assigned to this issue.
An example to test:
% cat test.php #!/usr/bin/php <?php @$obj->p =& $obj; varexport($obj, true); ?> % php test.php PHP Fatal error: Nesting level too deep - recursive dependency? in test.php on line 4 stdClass::setstate(array( 'p' => stdClass::setstate(array( 'p' => stdClass::setstate(array( 'p' => stdClass::setstate(array( % cat test2.php #!/usr/bin/php <?php $a[] =& $a; varexport($a, true); ?> % php test2.php PHP Fatal error: Nesting level too deep - recursive dependency? in test.php on line 4 array ( 0 => array ( 0 => array ( 0 => array ( 0 => array (
The upstream changes prevent any output from displaying, so should only display the "PHP Fatal error".
The upstream fix:
http://svn.php.net/viewvc?view=revision&revision=301143
A memory leak was found in the way libpng processed malformed Portable Network Graphics (PNG) images with Physical Scale (sCAL) extension. A remote attacker could create a specially-crafted PNG image and trick the local user into opening it in an application, using the libpng library, leading to denial of service (relevant libpng-based application crash).
References: [1] http://www.libpng.org/pub/png/libpng.html
CVE Request: [2] http://www.openwall.com/lists/oss-security/2010/06/28/2