Last updated 24 July 2024

Last updated 24 July 2024

Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.

Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.

Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property.

It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed.

A local user can trigger a flaw in the Linux kernel's handling of key lookups in the keychain subsystem.

The keyrejectandlink() function contains an error in which a key-lookup can fail and in an attempt to cache the failed lookup may attempt to free memory which can still be in use.

This could crash the system or at worse free a memory block which would then be re-used by another kernel mechanism causing a user after free.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1341352

Upstream patch:

https://www.spinics.net/lists/linux-kernel-janitors/msg26069.html

It was discovered that the Security component of OpenJDK failed to properly check DSA (Digital Signature Algorithm) parameters. The use of keys with incorrect parameters could lead to disclosure of sensitive data.

browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.

Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.

Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.

It was found that process could allocate and accumulate far more FDs than the process' limit by sending them over a unix socket then closing them to keep the process' fd count low, which could result into a local DoS against kernel by depleting all available memory.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=712f4aad406b

Discussion:

https://lkml.org/lkml/2015/12/28/155

db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.

Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions, which allows local users to perform unauthorized named commands, such as causing a denial of service by stopping named.