Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the pngrgbtogray function but not the pngsetexpand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.
It was found that libpng read uninitialized memory when it encountered a sCAL chunk that is empty, and improperly handles a sCAL chunk that lacks the terminating zero between the two strings that it conveys.
This was fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.
Patch: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=61a2d8a2a7b03023e63eae9a3e64607aaaa6d339
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
It was found that cURL performed client credentials delegation during the client-to-server GSS security mechanisms negotiation. A remote, rogue server could use this flaw to impersonate the cURL client (victim) against the correct (originally intended) server, potentially leading to denial of cURL tool services for victim client.
A NULL pointer dereference flaw was found in the way moddavsvn module of the subversion concurrent version control system processed requests submitted against the URL of a baselined resource. A remote attacker could use this flaw to cause the httpd child process to crash.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Joe Schaefer of Apache Software Foundation as the original reporter.
An infinite loop was found in the way moddavsvn module of the subversion concurrent version control system processed certain data sets, when SVNPathAuthz configuration directive with value of 'shortcircuit' was used. A remote attacker could use this flaw to cause the httpd child process to consume excessive amount of system memory.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Ivan Zhakov of VisualSVN as the original reporter.
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
Off-by-one error in the convertqueryhexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.
Tavis Ormandy reported that seunshare, part of policycoreutils, was shipped setuid root and failed to enforce proper permissions on an alternate temporary directory mounted as /tmp. This could potentially lead to privilege escalation in certain privileged applications that assume /tmp to be sticky and root-owned.
Acknowledgements:
Red Hat would like to thank Tavis Ormandy for reporting this issue.
Stack-based buffer overflow in the asturiencode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.
A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression.
End of life: 12/9/2011, Latest version: 14