A flaw was found in the bash functionality that evaluates specially formatted environment variables passed to it from another environment. An attacker could use this feature to override or bypass restrictions to the environment to execute shell commands before restrictions have been applied. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.
Acknowledgements:
Red Hat would like to thank Stephane Chazelas for reporting this issue.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and modcgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
An uninitialized use flaw was found in the rendering component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=101852
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An use after free flaw was found in the WebAudio component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102381
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An integer overflow flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102089
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An use after free flaw was found in the Bluetooth component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102506
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
A heap buffer overflow flaw was found in the password manager component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102715
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the WebSockets component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=944619
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
A type confusion flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102886
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An insufficient validation of untrusted input flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=101195
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An out of bounds write flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102475
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An out of bounds write flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102546
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An use after free flaw was found in the WebSockets component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=102548
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
An insufficient data validation flaw was found in the SQLite component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1025464
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An uninitialized use flaw was found in the SQLite component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1025465
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the developer tools component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=993706
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=101076
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the cookies component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=853670
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=999932
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An out of bounds read flaw was found in the SQLite component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1025470
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An out of bounds read flaw was found in the SQLite component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1025471
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=824715
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=101756
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the autocomplete component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=101388
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An insufficient policy enforcement flaw was found in the navigation component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=101744
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the sharing component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=100559
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
An incorrect security ui flaw was found in the external protocol handling component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=754304
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
A use-after-free vulnerability was discovered in the pngimagefree function in the libpng library. This could lead to denial of service or a potentially exploitable crash when a malformed image is processed.
Oracle Java SE 6u105, 7u91 and 8u65 fixes an unspecified vulnerability in the Deployment component (CVE-2015-4902). Upstream has CVSSv2 scored this issue as: 5.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA