A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMALCLASS or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. Depending on the classpath content, remote code execution may be possible.
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.
Versions Affected: httpd 2.0.1 to 2.4.29
External references:
https://httpd.apache.org/security/vulnerabilities24.html
Apache HTTP Server (httpd) through version 2.4.29 has a vulnerability in the handling of HTTP session headers in modsession. When modsession is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header.
Upstream Advisory:
https://httpd.apache.org/security/vulnerabilities24.html
Upstream Patch:
https://svn.apache.org/viewvc?view=revision&sortby=log&revision=1824477
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
A flaw was found in Mozilla Thunderbird before version 52.9. Decrypted S/MIME parts hidden with CSS or <plaintext> can leak plaintext when included in a HTML reply/forward.
References: https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/#CVE-2018-12373 https://bugzilla.mozilla.org/showbug.cgi?id=1464667
A flaw was found in Mozilla Thunderbird before version 52.9. Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field.
References: https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/#CVE-2018-12374