Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.
Integer overflow in the MallocFrameBuffer function in vncviewer.c in L ...
Last updated 24 July 2024
It was found that the Linux kernel's Intel early microcode loader was vulnerable to a stack overflow.
On a UEFI Secure Boot enabled system, a local root user could use this flaw to increase their privileges to the kernel (ring0) level despite the additional restrictions in place.
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4
Last updated 24 July 2024
It was reported [1] that running strings, nm or objdump on a constructed PE file [2] leads to out-of bounds write to an unitialized memory area. Upstream path for this issue is at [3].
[1]: https://sourceware.org/bugzilla/showbug.cgi?id=17512#c0 [2]: https://sourceware.org/bugzilla/attachment.cgi?id=7849 [3]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7e1e19887abd24aeb15066b141cdff5541e0ec8e
Last updated 24 July 2024
A heap overflow was reborted [1] when running objdump on a specially crafted PE executable [2]. Upstream patches that address this are at [3] and [4].
[1]: https://sourceware.org/bugzilla/showbug.cgi?id=17512#c17 [2]: https://sourceware.org/bugzilla/attachment.cgi?id=7862 [3]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5a4b0ccc20ba30caef53b01bee2c0aaa5b855339 [4]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=acafeb6056bec47d7211cf462a7c211a8c95cf42
Last updated 24 July 2024
Last updated 24 July 2024
Directory traversal vulnerability allowing random files deleteion/creation was reported [1] in binutils. Upstream patch is in [2]. Reproducer is available in https://sourceware.org/bugzilla/showbug.cgi?id=17552#c0
[1]: https://sourceware.org/bugzilla/showbug.cgi?id=17552 [2]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=dd9b91de2149ee81d47f708e7b0bbf57da10ad42
Go is vulnerable to HTTP request smuggling, caused by a flaw in net/http library in net/textproto/reader.go. By sending a specially-crafted HTTP request with a space instead of a hyphen, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Last updated 24 July 2024
Last updated 24 July 2024
Integer overflow in the makefiltertable function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling.
Cross-site request forgery in the REST API in IPython 2 and 3.
A flaw was found in IPython's notebook handling:
Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it.
Original report:
http://seclists.org/oss-sec/2015/q3/474
Upstream Patches:
3.x: https://github.com/ipython/ipython/commit/3ab41641cf6fce3860c73d5cf4645aa12e1e5892 4.0.x: https://github.com/jupyter/notebook/commit/dd9876381f0ef09873d8c5f6f2063269172331e3 4.x: https://github.com/jupyter/notebook/commit/35f32dd2da804d108a3a3585b69ec3295b2677ed
A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.
fedup 0.9.0 in Fedora 19, 20, and 21 uses a temporary directory with a static name for its download cache, which allows local users to cause a denial of service (prevention of system updates).
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition."
Michal Zalewski reported [1] an out-of-bounds memory access vulnerability in unrtf. Processing a malformed RTF file could lead to a segfault while accessing a pointer that may be under the attacker's control. This would lead to a denial of service (application crash) or, potentially, the execution of arbitrary code.
Hanno Böck also reported [2] a number of other crashes in unrtf.
There has been no response upstream regarding this (it seems that unrtf is no longer being maintained) so there is no patch available as of yet.
[1] https://lists.gnu.org/archive/html/bug-unrtf/2014-11/msg00001.html [2] https://lists.gnu.org/archive/html/bug-unrtf/2014-11/msg00000.html
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modifyschedule OMP command.
strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.
Heap buffer overflow issue was reported in PCRE when processing a specially crafted regular expressions: http://bugs.exim.org/showbug.cgi?id=1546
Upstream patch for this: http://www.exim.org/viewvc/pcre2?view=rev&revision=154
The next upstream release that will contain the above fix is likely to be around Feb/Mar next year (2015).
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name.
Cross-site scripting (XSS) vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality.
Description of problem:
Maybe it is possible to send a malicious kexinit package to eventually cause a server to a double-free.
I guess this is only a DoS.
Source code:
http://git.libssh.org/projects/libssh.git/
Patch:
From f6b9f851b962e3a587f3f99b7cb97d130f0c77b9 Mon Sep 17 00:00:00 2001 From: Jon Simons <jon> Date: Sat, 18 Oct 2014 23:23:26 -0700 Subject: [PATCH] kex: fixup error path in sshpacketkexinit
Before this change, dangling pointers can be unintentionally left in the respective nextcrypto kex methods slots. Ensure to set all slots to NULL in the error-out path.
Signed-off-by: Jon Simons <jon> --- src/kex.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/src/kex.c b/src/kex.c index f1a1b56..ee00ec3 100644 --- a/src/kex.c +++ b/src/kex.c @@ -443,6 +443,11 @@ SSHPACKETCALLBACK(sshpacketkexinit){ error: sshstringfree(str); for (i = 0; i < SSHKEXMETHODS; i++) { + if (serverkex) { + session->nextcrypto->clientkex.methods[i] = NULL; + } else { / client / + session->nextcrypto->serverkex.methods[i] = NULL; + } SAFEFREE(strings[i]); } -- 1.9.1
SQL injection vector when manually quoting values for sqlsrv extension, using null byte
If an authorization script for LuaAuthzProvider were provided in the configuration multiple times, only the arguments of the last specification were used when invoking the script. This could lead to scripts being invoked with unexpected arguments.
Further details are available in the thread of the original report and bug:
http://www.openwall.com/lists/oss-security/2014/11/28/5
https://issues.apache.org/bugzilla/showbug.cgi?id=57204
Upstream fix:
https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb
This affects Apache HTTP Server versions 2.3 and later (such as what is shipped in Red Hat Enterprise Linux 7), as modlua is not available in earlier releases. Note that support for LuaAuthzProvider is experimental.