Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.237 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.

A check for valid userspace memory was found missing in kvmsetmemoryregion() function. Because of that, memory regions pointing to kernel memory could be registered with KVM and later used when converting guest physical addresses to host virtual ones. Several call sites relied on the validation and were using read/write functions that were missing the accessok() check when accessing userspace memory.

A local unprivileged user on Red Hat Enterprise Linux 6 system could use this flaw to escalate their privileges on the system.

On Red Hat Enterprise Linux 6.2 EUS and Red Hat Enterprise Linux 6.3 EUS the impact is limited to potential information leak only.

A local user on Red Hat Enterprise Linux 5 system able to write to /dev/kvm could possibly use this flaw to leak kernel memory.

Upstream fixes: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa3d315a4ce2c0891cdde262562e710d95fba19e https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9e3bb6b6f6a0c535eb053fbf0005a8e79e053374

Acknowledgements:

This issue was discovered by Michael S. Tsirkin of Red Hat.

Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).

The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.

A denial of service flaw was found in the way ImageMagick, an image display and manipulation tool for the X Window System, decoded certain JPEG images. A remote attacker could provide a JPEG image with specially-crafted values / sequences of RST0 up to RST7 restart markers (used to indicate the input stream to be corrupted), which once processed by some ImageMagick tool would lead that tool to consume excessive amount of CPU time (denial of service).

Upstream patch:

[1] http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629

A XML External Entity (XXE) flaw was found in the way raptor, an Resource Description Framework (RDF) parser toolkit, processed certain RDF/XML format based input files. If an attacker provided a specially-crafted RDF file, and tricked the local user into parsing it, it could lead to local file inclusion, or, potentially arbitrary code execution with the privileges of the user parsing the file (privileges of the "rapper" executable or privileges of an application, linked against the librdf library).

Acknowledgements:

Red Hat would like to thank Timothy D. Morgan of VSR for reporting this issue.

Description of the problem: Lack proper synchronization to manipulate inet->opt ipoptions can lead to system crash.

Problem is that ipmakeskb() calls ipsetupcork() and ipsetupcork() possibly makes a copy of ipc->opt (struct ipoptions), without any protection against another thread manipulating inet->opt. Another thread can change inet->opt pointer and free old one under us.

Given right server application (setting socket options and processing traffic over the same socket at the same time), remote attacker could use this flaw to crash the system. More likely though, local unprivileged user could use this flaw to crash the system.

Potential privilege escalation impact cannot be ruled out.

Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=f6d8bd051c391c1c0458a30b2a7abcd939329259

ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF.

Apache 2.2 fixed a possible crash on shutdown if a child changes the sbtype field in the scoreboard. Since unprivileged children should not be able to affect the parent in this way, this is treated as a Low severity security issue [1].

The reporter has a nice writeup of the flaw as well [2].

[1] http://svn.apache.org/viewvc?view=revision&revision=1230065 [2] http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/

Last updated 24 July 2024

Juliano Rizzo announced: [1] http://www.ekoparty.org/2011/juliano-rizzo.php

that at ekoparty Security Conference, from 2011-09-21 to 2011-09-23 they will present a new fast block-wise chosen-plaintext attack against SSL/TLS. One application of the attack should allow the adversary to efficiently decrypt and obtain authentication tokens and cookies from HTTPS requests.

The Red Hat Security Response Team is watching progress on this one and once further details are available, we will immediately react to ensure timely manner updates for affected packages.

A flaw was found in the default error response for status code 400. This could be used by an attacker to expose "httpOnly" cookies, when no custom ErrorDocument was specified.

This affects all versions of Apache from 2.2.0 up to and including 2.2.21. It will be fixed upstream in 2.2.22 (via r1235454 [1]).

[1] http://svn.apache.org/viewvc?view=revision&revision=1235454

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.237 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux.