Last updated 24 July 2024
The cdfcountchain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash.
Last updated 24 July 2024
Last updated 24 July 2024
Several fonts on OS X display some Tibetan and Arabic characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected.
Last updated 24 July 2024
Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension in X.Org Server (aka xserver and xorg-server) 1.7.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request, which triggers an out-of-bounds read or write.
The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXChangeDeviceControl, (2) ProcXChangeDeviceControl, (3) ProcXChangeFeedbackControl, (4) ProcXSendExtensionEvent, (5) SProcXIAllowEvents, (6) SProcXIChangeCursor, (7) ProcXIChangeHierarchy, (8) SProcXIGetClientPointer, (9) SProcXIGrabDevice, (10) SProcXIUngrabDevice, (11) ProcXIUngrabDevice, (12) SProcXIPassiveGrabDevice, (13) ProcXIPassiveGrabDevice, (14) SProcXIPassiveUngrabDevice, (15) ProcXIPassiveUngrabDevice, (16) SProcXListDeviceProperties, (17) SProcXDeleteDeviceProperty, (18) SProcXIListProperties, (19) SProcXIDeleteProperty, (20) SProcXIGetProperty, (21) SProcXIQueryDevice, (22) SProcXIQueryPointer, (23) SProcXISelectEvents, (24) SProcXISetClientPointer, (25) SProcXISetFocus, (26) SProcXIGetFocus, or (27) SProcXIWarpPointer function.
The GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) glXDispRender, (2) glXDispRenderLarge, (3) glXDispSwapVendorPrivate, (4) glXDispSwapVendorPrivateWithReply, (5) setclientinfo, (6) glXDispSwapSetClientInfoARB, (7) DoSwapInterval, (8) DoGetProgramString, (9) DoGetString, (10) glXDispSwapRenderMode, (11) glXDispGetCompressedTexImage, (12) glXDispSwapGetCompressedTexImage, (13) glXDispFeedbackBuffer, (14) glXDispSwapFeedbackBuffer, (15) glXDispSelectBuffer, (16) glXDispSwapSelectBuffer, (17) glXDispFlush, (18) glXDispSwapFlush, (19) glXDispFinish, (20) glXDispSwapFinish, (21) glXDispReadPixels, (22) glXDispSwapReadPixels, (23) glXDispGetTexImage, (24) glXDispSwapGetTexImage, (25) glXDispGetPolygonStipple, (26) glXDispSwapGetPolygonStipple, (27) glXDispGetSeparableFilter, (28) glXDispGetSeparableFilterEXT, (29) glXDispGetConvolutionFilter, (30) glXDispGetConvolutionFilterEXT, (31) glXDispGetHistogram, (32) glXDispGetHistogramEXT, (33) glXDispGetMinmax, (34) glXDispGetMinmaxEXT, (35) glXDispGetColorTable, (36) glXDispGetColorTableSGI, (37) GetSeparableFilter, (38) GetConvolutionFilter, (39) GetHistogram, (40) GetMinmax, or (41) GetColorTable function.
The SProcXFixesSelectSelectionInput function in the XFixes extension in X.Org X Window System (aka X11 or X) X11R6.8.0 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value.
Last updated 29 November 2024
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Last updated 24 July 2024
Last updated 24 July 2024
From the git commit:
An deadlock condition can occur when sctpaccept() is called by the local software during a heartbeat timeout event after the 4-way handshake. Since sctpassocmigrate() changes both assoc->base.sk and assoc->ep, the bhsocklock in sctpgenerateheartbeatevent() will be taken with the listening socket but released with the new association socket. The result is a deadlock on any future attempts to take the listening socket lock, preventing sctp sockets from working correctly.
The server must be running an service using the sctp protocol to be affected.
Resources:
https://patchwork.ozlabs.org/patch/522411/ https://patchwork.ozlabs.org/patch/522412/
Patch commit notes (net-next.git): https://kernel.googlesource.com/pub/scm/linux/kernel/git/horms/ipvs/+/635682a14427d241bab7bbdeebb48a7d7b91638e
CVE Request: http://seclists.org/oss-sec/2016/q1/66
A race condition flaw was found between the chown() and execve() system calls. When changing the owner of a setuid-user binary to root, the race condition could momentarily make the binary setuid root. When root chown()ed an attacker-owned setuid file to root, the file briefly was setuid root (and executable as such).
An attacker could take advantage of this small window and execute a setuid binary with elevated privileges.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
Additional details:
http://seclists.org/oss-sec/2015/q2/216
A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their privileges on the system.
arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient.
An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS does not initialize the SYSENTER MSRs.
Please note that the Red Hat Enterprise Linux with KVM certified guest operating systems do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on KVM hypervisor.
References: http://www.openwall.com/lists/oss-security/2015/01/27/6
Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f3747379accba8e95d70cec0eae0582c8c182050
Acknowledgements:
Red Hat would like to thank Nadav Amit for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Description of the problem: For a TCP-style socket, while processing the COOKIEECHO chunk in sctpsfdo51Dce(), after it has passed a series of sanity check, a new association would be created in sctpunpackcookie(), but afterwards, some processing maybe failed, and sctpassociationfree() will be called to free the previously allocated association, in sctpassociationfree(), skackbacklog value is decremented for this socket, since the initial value for skackbacklog is 0, after the decrement, it will be 65535, a wrap-around problem happens, and if we want to establish new associations afterward in the same socket, ABORT would be triggered since sctp deem the accept queue as full.
A remote attacker can block further connection to the particular sctp server socket by sending a specially crafted sctp packet.
Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d3217b15a19a4779c39b212358a5c71d725822ee
Acknowledgements:
Red Hat would like to thank Gopal Reddy Kodudula of Nokia Siemens Networks for reporting this issue.
A flaw was found in the way pppol2tpsetsockopt() and pppol2tpgetsockopt() functions in the Linux kernel's PPP over L2TP implementation handled non-SOLPPPOL2TP level.
A local, unprivileged user could use this flaw to escalate their privileges on the system.
Acknowledgements:
Red Hat would like to thank Sasha Levin for reporting this issue.
If the guest writes a noncanonical value to certain MSR registers, KVM will write that value to the MSR in the host context and a #GP will be raised leading to kernel panic.
A privileged guest user can use this flaw to crash the host.
Enabling CONFIGPARAVIRT when building the kernel mitigates this issue because wrmsrl() ends up invoking safe msr write variant.
Acknowledgements:
Red Hat would like to thank Lars Bull of Google and Nadav Amit for reporting this issue.
Last updated 24 July 2024
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PRSETTSC prctl calls within a modified copy of QEMU.
It was reported [1] that iptables can allow protocols that do not have a protocol handler kernel module loaded.
Given following iptables ruleset: -P FORWARD DROP -A FORWARD -m sctp --dport 9 -j ACCEPT -A FORWARD -p tcp --dport 80 -j ACCEPT -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT
One would assume that this allows SCTP on port 9 and TCP on port 80. Unfortunately, if the SCTP conntrack module is not loaded, this allows all SCTP communication to pass through, i.e. -p sctp -j ACCEPT
[1]: http://www.spinics.net/lists/netfilter-devel/msg33430.html