Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and SeaMonkey before 2.10 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) methodjit/ImmutableSync.cpp, (2) the JSObject::makeDenseArraySlow function in js/src/jsarray.cpp, and unknown other components.
Integer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code via unspecified vectors.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2034.
Stack-based buffer overflow in Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code via unspecified vectors.
ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.
A check for valid userspace memory was found missing in kvmsetmemoryregion() function. Because of that, memory regions pointing to kernel memory could be registered with KVM and later used when converting guest physical addresses to host virtual ones. Several call sites relied on the validation and were using read/write functions that were missing the accessok() check when accessing userspace memory.
A local unprivileged user on Red Hat Enterprise Linux 6 system could use this flaw to escalate their privileges on the system.
On Red Hat Enterprise Linux 6.2 EUS and Red Hat Enterprise Linux 6.3 EUS the impact is limited to potential information leak only.
A local user on Red Hat Enterprise Linux 5 system able to write to /dev/kvm could possibly use this flaw to leak kernel memory.
Upstream fixes: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa3d315a4ce2c0891cdde262562e710d95fba19e https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9e3bb6b6f6a0c535eb053fbf0005a8e79e053374
Acknowledgements:
This issue was discovered by Michael S. Tsirkin of Red Hat.
Description of the problem: Lack proper synchronization to manipulate inet->opt ipoptions can lead to system crash.
Problem is that ipmakeskb() calls ipsetupcork() and ipsetupcork() possibly makes a copy of ipc->opt (struct ipoptions), without any protection against another thread manipulating inet->opt. Another thread can change inet->opt pointer and free old one under us.
Given right server application (setting socket options and processing traffic over the same socket at the same time), remote attacker could use this flaw to crash the system. More likely though, local unprivileged user could use this flaw to crash the system.
Potential privilege escalation impact cannot be ruled out.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f6d8bd051c391c1c0458a30b2a7abcd939329259
The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers.
ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
Last updated 24 July 2024