Last updated 24 July 2024
Last updated 24 July 2024
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar.
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Last updated 24 July 2024
On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure.
Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions.
Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations.
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient.
An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS does not initialize the SYSENTER MSRs.
Please note that the Red Hat Enterprise Linux with KVM certified guest operating systems do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on KVM hypervisor.
References: http://www.openwall.com/lists/oss-security/2015/01/27/6
Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f3747379accba8e95d70cec0eae0582c8c182050
Acknowledgements:
Red Hat would like to thank Nadav Amit for reporting this issue.
It was reported [1] that iptables can allow protocols that do not have a protocol handler kernel module loaded.
Given following iptables ruleset: -P FORWARD DROP -A FORWARD -m sctp --dport 9 -j ACCEPT -A FORWARD -p tcp --dport 80 -j ACCEPT -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT
One would assume that this allows SCTP on port 9 and TCP on port 80. Unfortunately, if the SCTP conntrack module is not loaded, this allows all SCTP communication to pass through, i.e. -p sctp -j ACCEPT
[1]: http://www.spinics.net/lists/netfilter-devel/msg33430.html
Last updated 24 July 2024
An insufficient policy enforcement flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=849421
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension.
An insufficient policy enforcement flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=863663
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=896725
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=896722
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the ServiceWorker component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=904219
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the Canvas component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=907047
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the WebAPKs component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=902427
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the DevTools component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=805557
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An insufficient data validation flaw was found in the IndexedDB component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=917668
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted Intent.
An inappropriate implementation flaw was found in the QUIC Networking component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=914497
External References:
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html
It was discovered that the DNS client implementation in the JNDI component of OpenJDK did not use random source ports when sending out DNS queries. This would make it easier for a remote attacker to spoof responses to those queries.
It was discovered that the I18n component of OpenJDK could use an untrusted search path when loading resource bundle classes. A local attacker could possibly use this flaw to execute arbitrary code as another local user by making their Java application load an attacker controlled class file.
It was discovered that the LdapLoginModule class in the LDAP component of OpenJDK failed to properly encode special characters in user names when adding them to LDAP search query. A remote attacker could possibly use this flaw to manipulate LDAP queries performed by the LdapLoginModule class.
It was discovered that the Hotspot component of OpenJDK failed to properly validate uses of the invokeinterface Java Virtual Machine instruction. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.
It was discovered that multiple encryption key classes (DESKey, DESedeKey, PBEKey, PBKDF2KeyImpl) in the crypto provider in the Libraries component of OpenJDK did not properly synchronize access to their internal key data from multiple threads. This could possibly cause a multi-threaded Java application to apply weak encryption to data because of use of key that was zeroed out during object finalization.