A memory leak was found in the way libpng processed malformed Portable Network Graphics (PNG) images with Physical Scale (sCAL) extension. A remote attacker could create a specially-crafted PNG image and trick the local user into opening it in an application, using the libpng library, leading to denial of service (relevant libpng-based application crash).

References: [1] http://www.libpng.org/pub/png/libpng.html

CVE Request: [2] http://www.openwall.com/lists/oss-security/2010/06/28/2

Apache Portable Runtime (APR) is vulnerable to a denial of service, caused by an error in the aprfnmatch() function when processing specific patterns with the "" wildcard. A remote attacker could exploit this vulnerability to consume all available CPU and memory resources resulting in a denial of service.

Devin Carraway of the Debian Security Team discovered that the upstream fix for the CVE-2008-2079 is incomplete and still makes it possible for local users to create tables via INDEX/DATA DIRECTORY directives in the MySQL data directory (/var/lib/mysql) via directory symlinks.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25

CVE-2008-2079 was tracked via bug bug #445222.

An attacker needs following to exploit this issue: - MySQL database account with privileges to create tables - shell access to the host running MySQL database with write access to a directory accessible by the mysqld daemon process

PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the maxfileuploads directive.

The exifreaddata function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353.

In his upcoming Blackhat paper and presentation Dan Kaminsky highlights some more issues he has found relating to SSL hash collisions and related vulnerabilities.

His second issue is all about inconsistencies in the interpretation of subject x509 names in certificates. Specifically "issue 2, attack 2c" regarding NULL terminators in a Common Name field. An attacker could create a malicious certificate containing a NULL, which, if they were able to get it signed, could confuse a client into accepting it by mistake.

According to the paper this is said to affect Firefox.

The kvmarchvcpuioctlsetsregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVMSETSREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfntormap function.

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

The upstream PHP 5.2.14 and 5.3.3 releases corrected an information disclosure flaw where the varexport() function would disclose data if a fatal error occurred due to recursion, memorylimit, or execution time. The buffer is never cleared and is flushed to the user, regardless of the configured displayerrors setting, because it is considered part of the output. This could lead to a disclosure of possibly sensitive information.

The name CVE-2010-2531 has been assigned to this issue.

An example to test:

% cat test.php #!/usr/bin/php <?php @$obj->p =& $obj; varexport($obj, true); ?> % php test.php PHP Fatal error: Nesting level too deep - recursive dependency? in test.php on line 4 stdClass::setstate(array( 'p' => stdClass::setstate(array( 'p' => stdClass::setstate(array( 'p' => stdClass::setstate(array( % cat test2.php #!/usr/bin/php <?php $a[] =& $a; varexport($a, true); ?> % php test2.php PHP Fatal error: Nesting level too deep - recursive dependency? in test.php on line 4 array ( 0 => array ( 0 => array ( 0 => array ( 0 => array (

The upstream changes prevent any output from displaying, so should only display the "PHP Fatal error".

The upstream fix:

http://svn.php.net/viewvc?view=revision&revision=301143

Heap-based buffer overflow in the InsIUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

Multiple buffer overflows in demo programs in FreeType before 2.4.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

Heap-based buffer overflow in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted length value in a POST fragment header in a font file.

Robert Swiecki reported an invalid free flaw, that could possibly corrupt the heap, in freetype. This could cause applications linked against freetype to crash (SIGABRT) or, possibly, lead to the execution of arbitrary code if an attacker were able to get a victim to load a malicious font file.

The affected code is not present in Red Hat Enterprise Linux 3 (freetype 2.1.4). In Red Hat Enterprise Linux 4 and 5 this code is present, but does not cause a crash.

This issue has been given the name CVE-2010-2498.

Upstream bug report:

http://savannah.nongnu.org/bugs/index.php?30106

Upstream commit that fixes the issue:

http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=8d22746c9e5af80ff4304aef440986403a5072e2

Acknowledgements:

Red Hat would like to thank Robert Święcki of the Google Security Team for the discovery of this issue.

Integer underflow in glyph handling in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

Buffer overflow in the MacReadPOSTResource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.

Integer overflow in the grayrenderspan function in smooth/ftgrays.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.

Drupal versions 5.x and 6.x has open redirection

TYPO3 before 4.5.4 allows Information Disclosure in the backend.

Integer overflow in the exifprocessIFDTAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offsetval value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.

MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.

An signedness error, leading to out of stack-based buffer read flaw was found in the way lighttpd, a lightning fast webserver with light system requirements, processed certain invalid base64 HTTP authentication tokens. A remote attacker could provide a specially crafted HTTP authentication request, leading to denial of service (lighttpd daemon crash due to an signedness error while processing the token).

Upstream bug report: [1] http://redmine.lighttpd.net/issues/2370

Upstream patch (with testcase and NEWS update): [2] http://redmine.lighttpd.net/projects/lighttpd/repository/revisions/2806/diff

References: [3] http://download.lighttpd.net/lighttpd/security/lighttpdsa201101.txt (upstream advisory) [4] http://www.openwall.com/lists/oss-security/2011/11/29/8 (CVE request) [5] http://www.openwall.com/lists/oss-security/2011/11/29/13 (CVE assignment)

An information disclosure flaw was found in the way MediaWiki, the wiki engine, processed 'curid' and 'oldid' request paramaters. A remote attacker could use this flaw to enumerate page titles on private MediaWiki installations.

Upstream bug report: [1] https://bugzilla.wikimedia.org/showbug.cgi?id=32276

An information disclosure flaw was found in the way MediaWiki, the wiki engine, performed action=ajax requests dispatching to relevant internal functions. These requests were dispatched without any read permissions checks being done. A remote attacker could use this flaw to obtain data on private MediaWiki installations.

Upstream bug report: [2] https://bugzilla.wikimedia.org/showbug.cgi?id=32616

References: [3] http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html [4] http://www.openwall.com/lists/oss-security/2011/11/29/6 [5] https://bugs.gentoo.org/showbug.cgi?id=392383

Upstream patch (covering both of the issues): [6] http://www.mediawiki.org/wiki/Special:Code/MediaWiki/104506

A local file inclusion flaw was found in the way XML import plug-in of phpMyAdmin, a tool written in PHP intended to handle the administration of MySQL over the World Wide Web, performed import of malformed XML files. A remote attacker could provide a specially-crafted XML file, which once imported into the phpMyAdmin service instance would lead to arbitrary local file (accessible with the privileges of the phpMyAdmin user) read / retrieval.

References: [1] http://seclists.org/fulldisclosure/2011/Nov/21 [2] http://www.wooyun.org/bugs/wooyun-2010-03185

libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

It was found that in libpng, prior to 1.2.45, the error function received a NULL pointer, expressed erroneously as '\0', instead of the empty string "". This error was introduced in libpng-1.2.20, and pngdefaulterror() will crash in this case.

This was be fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.

Patch: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9dad5e37aef295b4ef8dea39392b652deebc9261

It was reported [1] that the fix for CVE-2004-0421 in libpng was inadvertently reverted during the 1.2.23 development cycle. The original flaw could be used to cause a denial of service via a carefully-crafted PNG image.

This would affect all versions of libpng >=1.2.23, including 1.4.x and 1.5.x.

[1] http://sourceforge.net/mailarchive/forum.php?threadname=BANLkTikrnU6FJNQYFvwmt78hwpgKPVRd1Q%40mail.gmail.com&forumname=png-mng-implement

It was found that the different user screens (HTML forms) of the Samba Web Administration Tool suite were missing protection against cross-site request forgery (CSRF) attacks. A remote attacker could provide a specially-crafted URL, which once visited by an authenticated Samba SWAT user could lead to unauthorized commands execution with the privileges of that user (for example shut down or start the samba daemons, add or remove shares, printers, user accounts if the victim authenticated as privileged user to Samba SWAT).

Upstream bug report: [1] https://bugzilla.samba.org/showbug.cgi?id=8290 (not public yet)

Acknowledgements:

Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter.

It was found that cURL performed client credentials delegation during the client-to-server GSS security mechanisms negotiation. A remote, rogue server could use this flaw to impersonate the cURL client (victim) against the correct (originally intended) server, potentially leading to denial of cURL tool services for victim client.

A NULL pointer dereference flaw was found in the way moddavsvn module of the subversion concurrent version control system processed requests submitted against the URL of a baselined resource. A remote attacker could use this flaw to cause the httpd child process to crash.

Acknowledgements:

Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Joe Schaefer of Apache Software Foundation as the original reporter.