The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

The Samba vfsfruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfsfruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virtext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

An uninitialized use flaw was found in the rendering component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=101852

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An use after free flaw was found in the WebAudio component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102381

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An integer overflow flaw was found in the PDFium component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102089

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An use after free flaw was found in the Bluetooth component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102506

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

A heap buffer overflow flaw was found in the password manager component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102715

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An insufficient policy enforcement flaw was found in the WebSockets component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=944619

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

A type confusion flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102886

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An insufficient validation of untrusted input flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=101195

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An out of bounds write flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102475

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An out of bounds write flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102546

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

An use after free flaw was found in the WebSockets component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=102548

External References:

https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html

FreeIPA supports the Kerberos PKINIT protocol extension (RFC 4556). PKINIT enables a client to authenticate to the KDC using an X.509 certificate and the corresonding private key, rather than a passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT authentication request to the corresponding principal. The mapping filter is vulnerable to LDAP filter injection. The search result can be influenced by values in the certificate, which may be attacker controlled. In the most extreme case, an attacker could gain control of the admin account, leading to full domain takeover.

FreeIPA is not vulnerable in its default configuration.

The problem is in libssscertmap, which is part of SSSD. FreeIPA servers use this library in ipakdb Kerberos plugin implementation.

The issue was introduced in SSSD 1.15.3 (when libssscertmap was introduced) and resolved in SSSD 2.3.1.

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.

CVE-2023-0494/ZDI-CAN-19596: X.Org Server DeepCopyPointerClasses use-after-free

A dangling pointer in DeepCopyPointerClasses can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read/write into freed memory.

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash.

A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server.

If the lowest byte of the temp variable is outside of the printable characters range (between 0x20 and 0x7f), the ntp-keygen utility enters an infinite loop. However, if the temp variable is within the aforementioned range, the generated MD5 key will consist of 20 identical characters, meaning only 93 possible keys can be generated.

Upstream bug:

https://bugs.ntp.org/showbug.cgi?id=2797

Upstream patch:

http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg

CVE request:

http://seclists.org/oss-sec/2015/q2/85

Important: tigervnc security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.Security Fix(es): gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: xorg-x11-server security update

Important: kernel security and bug fix update

Important: X.Org server security update

Important: shim security update