Marsh Ray of PhoneFactor has discovered a flaw in the TLS/SSL protocol related to the handling of the session rehandshakes / renegotiations. This flaw can possibly be used in the MITM attacks and allowing an attacker to inject attacker-chosen plain text prefix to the session of the victim.
Further details are available in the "Authentication Gap in TLS Renegotiation" blog post: http://extendedsubset.com/?p=8
Marc Schoenefeld found a flaw in the way OpenOffice.org 3.2.0 and earlier, enforced non-executable permission, when browsing macros, written in Python scripting language. If a local user was tricked into opening a specially-crafted OpenDocument Text (ODT) file, containing macros, and previewed the macro directories structure, it could lead to Python macro execution even when macros execution was disabled.
Multiple unspecified vulnerabilities in abcm2ps before 5.9.13 have unknown impact and attack vectors, a different issue than CVE-2010-3441.
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4204 to the following vulnerability:
Name: CVE-2010-4204 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4204 Assigned: 20101105 Reference: CONFIRM:http://code.google.com/p/chromium/issues/detail?id=60238 Reference: CONFIRM:http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html Upstream Bugzilla: https://bugs.webkit.org/showbug.cgi?id=48281 Trac: http://trac.webkit.org/changeset/70517
Google Chrome before 7.0.517.44 accesses a frame object after this object has been destroyed, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4197 to the following vulnerability:
Name: CVE-2010-4197 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4197 Assigned: 20101105 Reference: CONFIRM:http://code.google.com/p/chromium/issues/detail?id=51602 Reference: CONFIRM:http://googlechromereleases.blogspot.com/2010/11/stable-channel-update.html
Upstream Bugzilla: https://bugs.webkit.org/showbug.cgi?id=48349 Trac: http://trac.webkit.org/changeset/70594
Use-after-free vulnerability in Google Chrome before 7.0.517.44 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving text editing.
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.
Emmanuel Bouillon reported a memory corruption flaw in CUPS daemon. A specially-crafted IPP request can cause daemon to crash or, possibly, execute arbitrary code.
Acknowledgements:
Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting this issue.