The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.

A double free flaw was found in the way JasPer's jasperimagestopload() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

Original report:

http://seclists.org/oss-sec/2015/q3/366

A use-after-free which leads to double-free vulnerability was found in Jasper JPEG-2000 library, in src/libjasper/mif/mifcod.c file.

553 case MIFHSAMP: 554 cmpt->sampperx = atoi(jastvparsergetval(tvp)); 555 break; 556 case MIFVSAMP: 557 cmpt->samppery = atoi(jastvparsergetval(tvp)); 558 break;

572 jastvparserdestroy(tvp); 573 if (!cmpt->sampperx || !cmpt->samppery) { 574 goto error; 575 } 576 if (mifhdraddcmpt(hdr, hdr->numcmpts, cmpt)) { 577 goto error; 578 } 579 return 0; 580 581 error: 582 if (cmpt) { 583 mifcmptdestroy(cmpt); 584 } 585 if (tvp) { 586 jastvparserdestroy(tvp); 587 } 588 return -1;

Both tvp and tvp->buf are freed by jastvparserdestroy(tvp), but if one of the two following branch conditions is taken, a second call to jastvparserdestroy(tvp) occurs. It is a use-after-free because before calling free in jastvparserdestroy there is a check to tvp->buf, while tvp could have been freed. Two double free take place just after this check (on tvp->buf and tvp).

Public via:

http://seclists.org/oss-sec/2015/q3/408

Acknowledgements:

Name: Josselin Feist

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.

Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)

Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)

Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)

Last updated 24 July 2024

A vulnerability was found in the Linux kernel in function rdsincinfocopy of file net/rds/recv.c. The last field "flags" of object "minfo" is not initialized. Copying this object out may leak kernel stack data. Assign 0 to it to avoid leak.

Upstream bug:

https://patchwork.ozlabs.org/patch/629110/

Upstream fix:

https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=4116def2337991b39919f3b448326e21c40e0dbb

Last updated 24 July 2024

Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)

Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)

Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)

Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)

Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)

A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root.

Upstream issue:

https://github.com/Supervisor/supervisor/issues/964

Upstream patches:

3.3.3 https://github.com/Supervisor/supervisor/commit/058f46141e346b18dee0497ba11203cb81ecb19e 3.2.4 https://github.com/Supervisor/supervisor/commit/aac3c21893cab7361f5c35c8e20341b298f6462e 3.1.4 https://github.com/Supervisor/supervisor/commit/dbe0f55871a122eac75760aef511efc3a8830b88 3.0.1 https://github.com/Supervisor/supervisor/commit/83060f3383ebd26add094398174f1de34cf7b7f0

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS.

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digestsize.

A vulnerability in lxccontainer, ansible module, was found allowing to get root inside the container. The problem is in the createscript function, which tries to write to /opt/.lxc-attach-script inside of the container. If the attacker can write to /opt/.lxc-attach-script before that, he can overwrite arbitrary files or execute commands as root.

A code injection vulnerability was found in php-gettext. Evaluating the plural form formula in ngettext family of calls can execute arbitrary code if number is passed unsanitized from the untrusted user.

References:

http://seclists.org/fulldisclosure/2016/Aug/76

OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.

A format string vulnerability was found in CmdKeywords function when processing \keywords command in tex file. When the user runs latex2rtf with malicious crafted tex file, an attacker can execute arbitrary code. The variable keywords' in the function CmdKeywords may hold a malicious input string, which can be used as a format argument of vsnprintf.

Vulnerable code:

1789 char keywords = getBraceParam(); ... 1798 fprintRTF(keywords); ...

858 void fprintRTF(char format, ...){ ... 873 vsnprintf(buffer, 1024, format, apf); ...

Public disclosure (includes reproducer and suggested fix):

http://seclists.org/oss-sec/2015/q4/283

Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.

SQL injection vulnerability in the gethashgraphtemplate function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graphtemplateid parameter to graphtemplates.php.

SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.

Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

game-music-emu before 0.6.1 mishandles unspecified integer values.

game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).