A type confusion flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=602970

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A cross-origin bypass flaw was found in the extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=598165

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

An out-of-bounds access flaw was found in the libxslt component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=583156

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

The following flaw was identified in the Chromium browser: csp bypass for serviceworker.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=579801

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A heap overflow flaw was found in the PDFium component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=613160

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

An out-of-bounds read flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=604897

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A heap use-after-free flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=589848

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A heap use-after-free flaw was found in the V8 bindings component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=606390

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

An information leak flaw was found in the extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=603748

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

An out-of-bounds read flaw was found in the PDFium component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=603518

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

An out-of-bounds read flaw was found in the PDFium component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=601362

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A cross-origin bypass flaw was found in the extension bindings component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=590118

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A cross-origin bypass flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=597532

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

An integer overflow flaw, leading to a buffer overflow, was found in the way the EVPEncodeUpdate() function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application.

A man-in-the-middle (MITM) attacker may be able to execute a padding oracle attack to decrypt traffic when a connection uses an AES-CBC cipher and the server runs on an Intel CPU supporting AES-NI. This is a common configuration for TLS servers.

The OpenSSL project has labelled this vulnerability high severity.

An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.

An old inffast.c optimization turns out to not be optimal anymore with modern compilers, and furthermore was not compliant with the C standard, for which decrementing a pointer before its allocated memory is undefined.

External References:

https://wiki.mozilla.org/images/0/09/Zlib-report.pdf https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7

Upstream patch:

https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb

CVE assignment:

http://seclists.org/oss-sec/2016/q4/602

A vulnerability was found in icoutils in extract.c. It is possible to access unallocated memory via wrestool while parsing maliciously crafted file which would make the application crash or possibly allow code execution.

References:

http://seclists.org/oss-sec/2017/q1/56

Upstream patch:

http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a

idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.

automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

Bug description

OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes sizes arguments to an internal memmove call to be sign-extended from 32 to 64-bits before being passed to the memmove function.

This leads arguments between 2GiB and 4GiB to be interpreted as larger than they are (specifically, a bit below 2^64), causing a buffer overflow.

Arguments between 4GiB and 6GiB are interpreted as 4GiB smaller than they should be, causing a possible information leak.

This commit fixes the bug: https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762 The function camlbitstring is called indirectly from such functions as String.copy. String.copy for instance is supposed to be a "safe" function for which OCaml's memory safety guarantees apply.

SQL injection vulnerability in libraries/centralcolumns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.

The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.

ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

A memory allocation failure was discovered in GraphicsMagick in MagickRealloc in memory.c

References:

http://seclists.org/oss-sec/2016/q4/586 https://blogs.gentoo.org/ago/2016/12/01/graphicsmagick-memory-allocation-failure-in-magickrealloc-memory-c

Multiple issues in GraphicsMagick received CVEs on oss-security mailing list.

CVE-2016-8682:

https://blogs.gentoo.org/ago/2016/09/15/graphicsmagick-stack-based-buffer-overflow-in-readsctimage-sct-c/

AddressSanitizer: stack-buffer-overflow ... READ of size 769 0x7f73e9a8399f in ReadSCTImage ... GraphicsMagick-1.3.25/coders/sct.c:126

Upstream patch:

http://hg.code.sf.net/p/graphicsmagick/code/rev/0a0dfa81906d

CVE-2016-8683:

https://blogs.gentoo.org/ago/2016/09/15/graphicsmagick-memory-allocation-failure-in-readpcximage-pcx-c/

AddressSanitizer failed to allocate 0x4cd6a6000 bytes of LargeMmapAllocator 0x7ff8e887beba in ReadPCXImage ... GraphicsMagick-1.3.25/coders/pcx.c:467:16

Upstream patch:

http://hg.code.sf.net/p/graphicsmagick/code/rev/b9edafd479b9

CVE-2016-8684:

https://blogs.gentoo.org/ago/2016/09/15/graphicsmagick-memory-allocation-failure-in-magickmalloc-memory-c/

AddressSanitizer failed to allocate 0x7fff03000 bytes of LargeMmapAllocator MagickMalloc ... GraphicsMagick-1.3.25/magick/memory.c:156:10 MagickMallocArray ... GraphicsMagick-1.3.25/magick/memory.c:347 ReadSGIImage ... GraphicsMagick-1.3.25/coders/sgi.c:498:19

Upstream patch:

http://hg.code.sf.net/p/graphicsmagick/code/rev/c53725cb5449

CVE-2016-8568

Read out-of-bounds in gitoidnfmt: https://github.com/libgit2/libgit2/issues/3936

CVE-2016-8569

DoS using a null pointer dereference in gitcommitmessage: https://github.com/libgit2/libgit2/issues/3937

Proposed patch:

https://github.com/libgit2/libgit2/pull/3956

Libass released a new 0.13.4 version which fixes multiple issues. CVE-2016-7971 remains unfixed for now.

CVE-2016-7969 upstream patch:

https://github.com/libass/libass/pull/240/commits/b72b283b936a600c730e00875d7d067bded3fc26

CVE-2016-7970 upstream patch:

https://github.com/libass/libass/pull/240/commits/08e754612019ed84d1db0d1fc4f5798248decd75

CVE-2016-7972 upstream patch:

https://github.com/libass/libass/pull/240/commits/aa54e0b59200a994d50a346b5d7ac818ebcf2d4b

External References:

https://github.com/libass/libass/releases/tag/0.13.4

The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."