game-music-emu before 0.6.1 mishandles unspecified integer values.
It was discovered that the RMI (Java Remote Method Invocation) server implementation in the JMX (Java Management Extensions) component of OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote unauthenticated attacker able to connect to a JMX port could possibly use this flaw trigger deserialization flaws.
IDE Xcode Server. Multiple issues were addressed by updating nginx to version 1.21.0.
An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.
A vulnerability was found in gnutls. A stack overflow could occur in opencdk in the cdkpkgetkeyid function. A memory corruption could occur when parsing a maliciously crafted OpenPGP certificate.
References:
http://seclists.org/oss-sec/2017/q1/51 https://gnutls.org/security.html#GNUTLS-SA-2017-2
Upstream patch:
https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732
A vulnerability was found in gnutls. A heap read overflow could occur while parsing maliciously crafted OpenPGP certificate.
References:
http://seclists.org/oss-sec/2017/q1/51 https://gnutls.org/security.html#GNUTLS-SA-2017-2
Upstream patch:
https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a
Double free vulnerability in the gnutlsx509extimportproxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
An old inffast.c optimization turns out to not be optimal anymore with modern compilers, and furthermore was not compliant with the C standard, for which decrementing a pointer before its allocated memory is undefined.
External References:
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7
Upstream patch:
https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb
CVE assignment:
http://seclists.org/oss-sec/2016/q4/602
An upgrade to zlib 1.2.11 to fix a number of low severity CVEs that were present in zlib 1.2.8.
distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.
Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.
Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors.
SQL injection vulnerability in libraries/centralcolumns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
An use-after-free flaw was found in the libxml component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=623378
External References:
https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
An upgrade to zlib 1.2.11 to fix a number of low severity CVEs that were present in zlib 1.2.8.
An upgrade to zlib 1.2.11 to fix a number of low severity CVEs that were present in zlib 1.2.8.
libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF file, related to the tiffdecodetag and decodeframe functions.
A vulnerability was found in git concerning the git shell. A user who comes over SSH could run an interactive pager by causing it to spawn "git upload-pack --help".
"git-shell" is a restricted login shell that can be used on a server to prevent SSH clients from running any programs except those needed for git fetches and pushes. If you are not running a server, or if your server has not been explicitly configured to use git-shell as a login shell, you are not affected.
Upstream patch:
https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5
References:
https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/ http://public-inbox.org/git/xmqq8tm5ziat.fsf@gitster.mtv.corp.google.com/
It was discovered that the upstream fix for this issue was not complete. There is still a memory allocation failure in memory.c
References:
http://seclists.org/oss-sec/2016/q4/197 https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/
Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
The movreaddref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via the entries value in a dref box in an MP4 file.
A heap use-after-free flaw was found in the Skia component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=589848
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A cross-origin bypass flaw was found in the extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=598165
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A heap overflow flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=613160
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A heap use-after-free flaw was found in the V8 bindings component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=606390
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A cross-origin bypass flaw was found in the extension bindings component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=590118
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A cross-origin bypass flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=597532
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in modfcgid through 2016-07-07.
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.