Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
Divide by zero vulnerability was found in function opjtcdinittile in tcd.c
Upstream patch:
https://github.com/uclouvain/openjpeg/commit/8f9cc62b3f9a1da9712329ddcedb9750d585505c
CVE request:
http://seclists.org/oss-sec/2016/q2/327
Null pointer dereference vulnerability was found in bmpgetdata triggered by invoking imginfo command on specially crafted BMP image.
Upstream patch:
https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c809b7fca
CVE assignment:
http://www.openwall.com/lists/oss-security/2016/10/16/14
CVE-2016-8568
Read out-of-bounds in gitoidnfmt: https://github.com/libgit2/libgit2/issues/3936
CVE-2016-8569
DoS using a null pointer dereference in gitcommitmessage: https://github.com/libgit2/libgit2/issues/3937
Proposed patch:
https://github.com/libgit2/libgit2/pull/3956
A heap buffer overflow in function colorcmyktorgb in color.c.
Upstream patch:
https://github.com/uclouvain/openjpeg/commit/162f6199c0cd3ec1c6c6dc65e41b2faab92b2d91
CVE request:
http://seclists.org/oss-sec/2016/q2/327
The gitoidnfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
modules/serverdensitydevice.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.