A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation.
The nftverdictinit() function allows positive values as drop error within the hook verdict, and hence the nfhookslow() function can cause a double free vulnerability when NFDROP is issued with a drop error which resembles NFACCEPT.
We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.
A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
An use after free flaw was found in the speech component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1043603
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop18.html
A type confusion flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1051017
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop18.html
An use after free flaw was found in the WebAudio component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1048473
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop18.html
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
An inappropriate implementation flaw was found in the JavaScript component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1029576
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient data validation flaw was found in the streams component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1031895
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An use after free flaw was found in the audio component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1042254
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An inappropriate implementation flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1024256
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the CORS component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1026546
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1006012
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An inappropriate implementation flaw was found in the CORS component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1038036
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An uninitialized use flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1032090
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the downloads component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1029375
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the sharing component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1027408
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An inappropriate implementation flaw was found in the Skia component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1035271
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient validation of untrusted input flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1017871
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1030411
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1035058
External References:
https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html