A flaw was found in the way ppm2tiff, a tool to create a TIFF file from PPM, PGM and PBM image files, did not check the return value of TIFFScanlineSize() function. When TIFFScanlineSize encountered an integer-overflow and returned zero, this value was not checked. A remote attacker could provide a specially-crafted PPM image format file, that when processed by ppm2tiff would lead to ppm2tiff executable crash or, potentially, arbitrary code execution with the privileges of the user running the ppm2tiff binary.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server.

Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the readpacket function.

Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Use-after-free vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the ruby element and Cascading Style Sheets (CSS) token sequences.

A possible heap-based buffer overflow flaw was found in the readgifimage() function in gif2tiff, a tool to convert GIF images to TIFF. A remote attacker could provide a specially-crafted GIF file that, when processed by gif2tiff, would cause gif2tiff to crash or, potentially, execute arbitrary code with the privileges of the user running gif2tiff.

Pedro Ribeiro discovered a use-after-free flaw in the t2preadwritepdfimage() function in tiff2pdf, a tool for converting a TIFF image to a PDF document. A remote attacker could provide a specially-crafted TIFF file that, when processed by tiff2pdf, would cause tiff2pdf to crash or, potentially, execute arbitrary code with the privileges of the user running tiff2pdf.

References:

http://www.asmail.be/msg0055359936.html http://www.openwall.com/lists/oss-security/2013/08/08/6

Multiple heap-based buffer overflows in the (1) abcMIDIdrum and (2) abcMIDIgchord functions in loadabc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted ABC.

Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.

Google Chrome before 11.0.696.68 does not properly perform casts of variables during interaction with the WebKit engine, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for external entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file containing an external entity expansion, when processed would lead to excessive CPU consumption (denial of service).

This a different flaw from CVE-2013-0338.

Upstream patch:

http://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab

Jouni Malinen discovered that a string supplied from a remote device could be supplied to a system() call in wpacli or hostapdcli when running an action script (with the "-a" option), resulting in arbitrary command execution. This issue could also be triggered by an attacker within radio range.

Patches are available from the following:

http://w1.fi/security/2014-1/

Based on the information about affected configurations in the upstream advisory, Red Hat Enterprise Linux 5 is likely to be not vulnerable, but Red Hat Enterprise Linux 6 and 7 are likely to be vulnerable.

Acknowledgements:

Red Hat would like to thank Jouni Malinen for reporting this issue.

References:

http://w1.fi/security/2014-1/ http://www.openwall.com/lists/oss-security/2014/10/09/28

Created attachment 912217 [details] Patch fixing the overflow

Description of problem: A bug in GPGME crashes my KMail reproducibly when opening the private key selection dialog twice in a row.

The crash is due to an overflow of the gpgsm->colon.attic.line buffer within statushandler() in engine-gpgsm.c. This buffer is getting (re)allocated at line 831 like this:

if (gpgsm->colon.attic.linesize < alinelen + linelen + 1) { char newline = realloc (aline, alinelen + linelen + 1); gpgsm->colon.attic.linesize += linelen + 1; ...

So in other words, the code allocates a buffer to be alinelen + linelen + 1 bytes long, but then thinks its capacity is actually linesize + linelen + 1. This assumption is wrong if alinelen (the number of bytes used in the buffer prior to reallocation) is lower than linesize (the total length of the buffer), or in other words, if the buffer is not completely full.

In that case, a fragment of the input line is subsequently written past the end of the buffer at line 856:

dst = src++;

I'm not sure if it is really exploitable, but in general this routine is processing arbitrary data coming from certificates the user happens to encounter somehow, so one could possibly exploit this using specially crafted certificate or something like that.

Attached is a trivial patch fixing the issue (works fine for me during daily use of KMail with e-mail signing/encryption).

Version-Release number of selected component (if applicable): gpgme-1.3.2-4.fc20.x8664

How reproducible: Perfectly reproducible for me, but as the bug is data-dependent and I'm not going to publish my keys, I don't have a simple testcase. (I don't think it matters at all as the bug is quite obvious just from the source.)

Google Chrome before 13.0.782.107 does not properly track line boxes during rendering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

It was found that the different user screens (HTML forms) of the Samba Web Administration Tool suite were missing protection against cross-site request forgery (CSRF) attacks. A remote attacker could provide a specially-crafted URL, which once visited by an authenticated Samba SWAT user could lead to unauthorized commands execution with the privileges of that user (for example shut down or start the samba daemons, add or remove shares, printers, user accounts if the victim authenticated as privileged user to Samba SWAT).

Upstream bug report: [1] https://bugzilla.samba.org/showbug.cgi?id=8290 (not public yet)

Acknowledgements:

Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Yoshihiro Ishikawa of LAC Co., Ltd. as the original reporter.

A number of vulnerabilities were found and reported by CERT in JasPer which may allow a remote unauthenticated attacker to execute arbitrary code.

Reference: http://www.kb.cert.org/vuls/id/887409

Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

The jpccrggetparms function in libjasper/jpc/jpccs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to display box rendering.

The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read.

The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers.

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

It was reported [1] that the fix for CVE-2004-0421 in libpng was inadvertently reverted during the 1.2.23 development cycle. The original flaw could be used to cause a denial of service via a carefully-crafted PNG image.

This would affect all versions of libpng >=1.2.23, including 1.4.x and 1.5.x.

[1] http://sourceforge.net/mailarchive/forum.php?threadname=BANLkTikrnU6FJNQYFvwmt78hwpgKPVRd1Q%40mail.gmail.com&forumname=png-mng-implement

TYPO3 before 4.5.4 allows Information Disclosure in the backend.

It was found that in libpng, prior to 1.2.45, the error function received a NULL pointer, expressed erroneously as '\0', instead of the empty string "". This error was introduced in libpng-1.2.20, and pngdefaulterror() will crash in this case.

This was be fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.

Patch: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9dad5e37aef295b4ef8dea39392b652deebc9261

Last updated 24 July 2024

Integer overflow in the exifprocessIFDTAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offsetval value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.

Damien Mathieu (42) reports:

Unsafe Query Generation Risk in Ruby on Rails

There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability has been assigned the CVE identifier CVE-2013-0155.

Versions Affected: 3.x series Not affected: 2.x series Fixed Versions: 3.2.11, 3.1.10, 3.0.19

Impact ------

Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with "IS NULL" or empty where clauses. This issue does not let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL or eliminate a WHERE clause when most users wouldn't expect it.

For example, a system has password reset with token functionality:

unless params[:token].nil? user = User.findbytoken(params[:token]) user.resetpassword! end

An attacker can craft a request such that params[:token] will return [nil]. The [nil] value will bypass the test for nil, but will still add an "IN ('xyz', NULL)" clause to the SQL query.

Similarly, an attacker can craft a request such that params[:token] will return an empty hash. An empty hash will eliminate the WHERE clause of the query, but can bypass the nil? check.

Note that this impacts not only dynamic finders (findby) but also relations (User.where(:name => params[:name])).

All users running an affected release should either upgrade or use one of the work arounds immediately. All users running an affected release should upgrade immediately. Please note, this vulnerability is a variant of CVE-2012-2660, and CVE-2012-2694. Even if you upgraded to address those issues, you must take action again.

If this chance in behavior impacts your application, you can manually decode the original values from the request like so:

ActiveSupport::JSON.decode(request.body)

Releases -------- The FIXED releases are available at the normal locations.

Workarounds ----------- This problem can be mitigated by casting the parameter to a string before passing it to Active Record. For example:

unless params[:token].nil? || params[:token].tos.empty? user = User.findbytoken(params[:token].tos) user.resetpassword! end An attacker can craft a request such that params[:token] will return [nil]. The [nil] value will bypass the test for nil, but will still add an "IN ('xyz', NULL)" clause to the SQL query.

Similarly, an attacker can craft a request such that params[:token] will return an empty hash. An empty hash will eliminate the WHERE clause of the query, but can bypass the nil? check.

Note that this impacts not only dynamic finders (findby) but also relations (User.where(:name => params[:name])).

All users running an affected release should either upgrade or use one of the work arounds immediately. All users running an affected release should upgrade immediately. Please note, this vulnerability is a variant of CVE-2012-2660, and CVE-2012-2694. Even if you upgraded to address those issues, you must take action again.

If this chance in behavior impacts your application, you can manually decode the original values from the request like so:

ActiveSupport::JSON.decode(request.body)

Releases -------- The FIXED releases are available at the normal locations.

Workarounds ----------- This problem can be mitigated by casting the parameter to a string before passing it to Active Record. For example:

unless params[:token].nil? || params[:token].tos.empty? user = User.findbytoken(params[:token].tos) user.resetpassword! end

Note the parameter is still cast to a string before being sent to Active Record. This is because an array with a nil value can still bypass the tos.empty? test:

>> ['xyz', nil].tos => "xyz" >> ['xyz', nil].tos.empty? => false

ISC DHCP 4.1.2 through 4.2.4 and 4.1-ESV before 4.1-ESV-R6 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed client identifier.