From http://lists.gnu.org/archive/html/help-libtasn1/2015-03/msg00002.html:

GNU Libtasn1 is a standalone library written in C for manipulating ASN.1 objects including DER/BER encoding/decoding. GNU Libtasn1 is used by GnuTLS to handle X.509 structures and by GNU Shishi to handle Kerberos V5 structures.

Noteworthy changes in release 4.4 (released 2015-03-29) [stable] - Corrected a two-byte stack overflow in asn1derdecoding. Reported by Hanno Böck.

Exact commit that fixes this: http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=4d4f992826a4962790ecd0cce6fbba4a415ce149

CVE request: http://seclists.org/oss-sec/2015/q1/1038

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

SQL injection vector when manually quoting values for sqlsrv extension, using null byte

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.

Go is vulnerable to HTTP request smuggling, caused by a flaw in net/http library in net/textproto/reader.go. By sending a specially-crafted HTTP request with a space instead of a hyphen, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

A vulnerability of auth bypassing was found in Ganglia-web. It's easy to bypass auth by using boolean serialization like this: $ php -r "echo urlencode(serialize(array('user'=>'admin','group'=>'admin', 'token'=>true)));"

Vulnerable code:

https://github.com/ganglia/ganglia-web/blob/4e98ea69e0e18b388cdc73809ce54843a16ff87b/lib/GangliaAuth.php#L34-L46

Upstream report:

https://github.com/ganglia/ganglia-web/issues/267

CVE assignment:

http://seclists.org/oss-sec/2015/q3/502

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

Cross-site request forgery in the REST API in IPython 2 and 3.

zarafa-autorespond in Zarafa Collaboration Platform (ZCP) before 7.2.1 allows local users to gain privileges via a symlink attack on /tmp/zarafa-vacation-.

racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a series of crafted UDP requests.

In scripts/licensecheck.pl, there is executed code, that is vulnerable to shell command injection via shell metacharacters in filename.

my $mime = file --brief --mime --dereference $file;

Upstream patch: https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=c0687bcde23108dd42e146573c368b6905e6b8e8

CVE assignment: http://www.openwall.com/lists/oss-security/2015/08/01/7

Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.

It was reported that it's possible to login as "sddm" user without authentication:

This is since if sddm detects that user in the PamBackend, it has:

if (user == "sddm") service = "sddm-greeter"; else if (mapp->session()->path().isEmpty()) service = "sddm-check"; else if (mautologin) service = "sddm-autologin"; result = mpam->start(service, user);

and the sddm-greeter PAM config basically just has a pampermit. More info is available at [1]. Upstream patch is at [2].

[1]: https://bugzilla.suse.com/showbug.cgi?id=897788#c6 [2]: https://github.com/sddm/sddm/pull/279

It was reported that sddm has several issues leading to local privilege escalation:

[1]

The xauth cookie handling code calls xauth binary via popen() as root, which in turn dumps and creates files as root in users ~.

[2]

After xauth has done its job, sddm chowns() the ~/.Xauthority file to user. This is a race and a local root exploit.

[3]

The .xsession-errors file is created in ~ but as root. This allows to destroy arbitrary system files.

Upstream patch is at [4].

[1] https://bugzilla.suse.com/showbug.cgi?id=897788#c7 [2] https://bugzilla.suse.com/showbug.cgi?id=897788#c8 [3] https://bugzilla.suse.com/showbug.cgi?id=897788#c9 [4] https://github.com/sddm/sddm/pull/280

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Buffer overflow vulnerabilities in functions pnggetPLTE/pngsetPLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bitdepth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8.

Affected versions of libpng are before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19.

Upstream patches:

https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766 https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978 https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466 https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324

CVE assignment:

http://seclists.org/oss-sec/2015/q4/264

Integer overflow in the MallocFrameBuffer function in vncviewer.c in L ...

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

Michal Zalewski reported [1] an out-of-bounds memory access vulnerability in unrtf. Processing a malformed RTF file could lead to a segfault while accessing a pointer that may be under the attacker's control. This would lead to a denial of service (application crash) or, potentially, the execution of arbitrary code.

Hanno Böck also reported [2] a number of other crashes in unrtf.

There has been no response upstream regarding this (it seems that unrtf is no longer being maintained) so there is no patch available as of yet.

[1] https://lists.gnu.org/archive/html/bug-unrtf/2014-11/msg00001.html [2] https://lists.gnu.org/archive/html/bug-unrtf/2014-11/msg00000.html

SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modifyschedule OMP command.

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition."

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition."

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition."

The sanitizecookiepath function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive.

A flaw was found in tcpdump's force printer. A remote attacker could use this flaw to cause tcpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.

Upstream patch:

http://www.ca.tcpdump.org/cve/0002-test-case-files-for-CVE-2015-2153-2154-2155.patch

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a service file.

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUSSTARTPACKET set and then a crafted packet with TXSTATUSDEVICEOWNS set.

The stringpreputf8toucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.

hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WINREADNATIVEMAX command to an empty drive, which triggers a divide-by-zero error and instance crash.