A vulnerability was found in the libxml2 library. A heap-buffer-overflow could happen in xmlStrncat.
References:
https://bugzilla.gnome.org/showbug.cgi?id=763071
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=8fbbf5513d609c1770b391b99e33314cd0742704
An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use.
A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash.
An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.
External References:
https://www.armis.com/blueborne/ https://access.redhat.com/security/vulnerabilities/blueborne https://access.redhat.com/solutions/3177231 https://access.redhat.com/blogs/product-security/posts/blueborne
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3
A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties, after having engineered a scenario whereby an ANY query is sent to the recursive server for the target QNAME. A recursive server will itself only send a query of type ANY if it receives a client query of type ANY for a QNAME for which it has no RRsets at all in cache, otherwise it will respond to the client with the the RRsets that it has available.
This vulnerability occurs during the processing of an answer packet received in response to a query. As a result, recursive servers are at the greatest risk; authoritative servers are at risk only to the extent that they perform a limited set of queries.
This description is borrowed from the upstream advisory.
A local user can trigger a flaw in the Linux kernel's handling of key lookups in the keychain subsystem.
The keyrejectandlink() function contains an error in which a key-lookup can fail and in an attempt to cache the failed lookup may attempt to free memory which can still be in use.
This could crash the system or at worse free a memory block which would then be re-used by another kernel mechanism causing a user after free.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1341352
Upstream patch:
https://www.spinics.net/lists/linux-kernel-janitors/msg26069.html
Go is vulnerable to HTTP request smuggling, caused by a flaw in net/http library in net/textproto/reader.go. By sending a specially-crafted HTTP request with a space instead of a hyphen, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Last updated 29 November 2024
A vulnerability in sosreport was reported, allowing a privilege escalation to unprivileged attacker on RHEL-6, and change the owner and content of certain files on RHEL-7.
sosreport creates temporary directory in /tmp with predictable name sosreport-$hostname-$date with permissions set to 700. Then it creates a tar file with the aforementioned name + .tar suffix. Further it invokes open() with no ONOFOLLOW nor OEXCL set, which can be exploited by placing a file or a symlink in its place.
Attacker can create his own file to steal the content or can create a symlink to create/modify arbitrary files. On RHEL-7, there is fs.protectedsymlinks sysctl provided, which closes this vector. With the setting target of the symlink must match symlink's owner. On RHEL-6 this feature is missing, so the attacker is able to modify arbitrary files and escalate privileges.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.
Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.
It was discovered that the Security component of OpenJDK failed to properly check DSA (Digital Signature Algorithm) parameters. The use of keys with incorrect parameters could lead to disclosure of sensitive data.
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR.
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection.
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order.
A server which is performing recursion can be forced to exit with an assertion failure if it can be caused to receive a response containing CNAME or DNAME resource records with certain ordering. An attacker can cause a denial of service by exploiting this condition. Recursive resolvers are at highest risk but authoritative servers are theoretically vulnerable if they perform recursion.
External References:
https://kb.isc.org/article/AA-01466
BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x, 9.9.0 to 9.9.11, 9.10.0 to 9.10.6, 9.11.0 to 9.11.2, 9.9.3-S1 to 9.9.11-S1, 9.10.5-S1 to 9.10.6-S1, 9.12.0a1 to 9.12.0rc1.
A denial of service flaw was found in the way OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction) inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input could be forced to allocate an excessive amount of data.
A vulnerability was found in the libxml2 library. A heap-based buffer overread could happen in xmlDictAddString.
References:
https://bugzilla.gnome.org/showbug.cgi?id=758605
Upstream fix:
https://git.gnome.org/browse/libxml2/commit/?id=a820dbeac29d330bae4be05d9ecd939ad6b4aa33
An issue with ASN.1 DER decoder was reported that could lead to memory corruptions, possible privilege escalation, or complete local denial of service via x509 certificate DER files.
Tags with indefinite length can be used to corrupt the dp and len pointers in asn1findindefinitelength() in lib/asn1decoder.c
Vulnerable code:
... nexttag: if (unlikely(datalen - dp < 2)) { if (datalen == dp) goto missingeoc; goto dataoverrunerror; } ... n = len - 0x80; if (unlikely(n > sizeof(sizet) - 1)) goto lengthtoolong; if (unlikely(n > datalen - dp)) goto dataoverrunerror; for (len = 0; n > 0; n--) { len <<= 8; len |= data[dp++]; } dp += len; goto nexttag; ...
dp can be corrupted and the check at nexttag is not sufficient to prevent this.
Upstream fix: https://lkml.org/lkml/2016/5/12/270
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa
LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tifnext.c to verify that the BitsPerSample value is 2, and the t2psamplelabsignedtounsigned function in tiff2pdf.c.
Divide by zero was reported in the libtiff tiffdither tool:
- CVE-2014-8130 libtiff: Divide By Zero in the tiffdither tool http://bugzilla.maptools.org/showbug.cgi?id=2483
The above upstream bug was fixed by one of the commits that fix CVE-2014-8127 / CVE-2014-8128 / CVE-2014-8129
BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
An integer truncation flaw leading to a heap-based buffer overflow was found in ImageMagick in pict.c.
Detailed stacktrace with reproducer can be found here:
https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1448803
Upstream patch for the pict.c problem is a subsection (the pict.c part) of the following commit: https://github.com/ImageMagick/ImageMagick/commit/0f6fc2d5bf8f500820c3dbcf0d23ee14f2d9f734
CVE request:
http://seclists.org/oss-sec/2015/q4/45
Multiple memory leaks in kadmin/server/serverstubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.
The xdrnullstring function in lib/kadm5/kadmrpcxdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
It was discovered that pcrecompile function in pcrecompile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression.
Buffer overflow vulnerabilities in functions pnggetPLTE/pngsetPLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bitdepth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8.
Affected versions of libpng are before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19.
Upstream patches:
https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766 https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978 https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466 https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324
CVE assignment:
http://seclists.org/oss-sec/2015/q4/264