Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving synthetic mouse movement, related to the RestyleManager::GetHoverGeneration function.

Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection.

From http://lists.gnu.org/archive/html/help-libtasn1/2015-03/msg00002.html:

GNU Libtasn1 is a standalone library written in C for manipulating ASN.1 objects including DER/BER encoding/decoding. GNU Libtasn1 is used by GnuTLS to handle X.509 structures and by GNU Shishi to handle Kerberos V5 structures.

Noteworthy changes in release 4.4 (released 2015-03-29) [stable] - Corrected a two-byte stack overflow in asn1derdecoding. Reported by Hanno Böck.

Exact commit that fixes this: http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=4d4f992826a4962790ecd0cce6fbba4a415ce149

CVE request: http://seclists.org/oss-sec/2015/q1/1038

SQL injection vector when manually quoting values for sqlsrv extension, using null byte

The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.

It was reported [1],[2] that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local file, and send the contents of the specified file to a remote server.

This is fixed upstream via:

svn://svn.zabbix.com/branches/dev/ZBX-8151-18 r46594 for 1.8 svn://svn.zabbix.com/branches/dev/ZBX-8151-20 r46600 for 2.0+

[1] https://support.zabbix.com/browse/ZBX-8151 [2] http://www.pnigos.com/?p=273

An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.

racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.

It was reported that it's possible to login as "sddm" user without authentication:

This is since if sddm detects that user in the PamBackend, it has:

if (user == "sddm") service = "sddm-greeter"; else if (mapp->session()->path().isEmpty()) service = "sddm-check"; else if (mautologin) service = "sddm-autologin"; result = mpam->start(service, user);

and the sddm-greeter PAM config basically just has a pampermit. More info is available at [1]. Upstream patch is at [2].

[1]: https://bugzilla.suse.com/showbug.cgi?id=897788#c6 [2]: https://github.com/sddm/sddm/pull/279

It was reported that sddm has several issues leading to local privilege escalation:

[1]

The xauth cookie handling code calls xauth binary via popen() as root, which in turn dumps and creates files as root in users ~.

[2]

After xauth has done its job, sddm chowns() the ~/.Xauthority file to user. This is a race and a local root exploit.

[3]

The .xsession-errors file is created in ~ but as root. This allows to destroy arbitrary system files.

Upstream patch is at [4].

[1] https://bugzilla.suse.com/showbug.cgi?id=897788#c7 [2] https://bugzilla.suse.com/showbug.cgi?id=897788#c8 [3] https://bugzilla.suse.com/showbug.cgi?id=897788#c9 [4] https://github.com/sddm/sddm/pull/280

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.

Multiple integer overflows in the binary-search implementation in SpiderMonkey in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 might allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.

Integer overflow in the MallocFrameBuffer function in vncviewer.c in L ...

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition."

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption.

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition."

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition."

Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a service file.

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUSSTARTPACKET set and then a crafted packet with TXSTATUSDEVICEOWNS set.

A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.

ReviewBoard: has an access-control problem in REST API

Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit.