A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the heap/stack gap, cause controlled memory corruption on process stack or heap, and thus increase their privileges on the system.
This is a tracking bug for the glibc part of the mitigation.
Adam Gowdiak (Security Explorations) reported that the fix for IBM JDK issue CVE-2013-5456 (bug 1027748), also known as "Issue 70", did not correctly address the problem. Applied fix only restricted access to the vulnerable package, rather then addressing the underlying problem of running untrusted code inside doPrivileged block.
Report:
http://seclists.org/fulldisclosure/2016/Apr/43
Write-up of the issue:
http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf
Proof-of-concept code:
http://www.security-explorations.com/materials/se-2012-01-70.2.zip
It was reported that the IBM fix for the issue 67 from this document http://www.security-explorations.com/materials/SE-2012-01-IBM-2.pdf didn't address the problem properly.
References:
http://seclists.org/fulldisclosure/2016/Apr/3
Full report:
http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf
A stack-based buffer overflow was found in libresolv when invoked from nssdns, allowing specially crafted DNS responses to seize control of EIP in the DNS client.
The buffer overflow occurs in the functions senddg (send datagram) and sendvc (send TCP) for the NSS module libnssdns.so.2 when calling getaddrinfo with AFUNSPEC family, or in some cases AFINET6 family. The use of AFUNSPEC (or AFINET6 in some cases) triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by resnquery.
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server.
If the lowest byte of the temp variable is outside of the printable characters range (between 0x20 and 0x7f), the ntp-keygen utility enters an infinite loop. However, if the temp variable is within the aforementioned range, the generated MD5 key will consist of 20 identical characters, meaning only 93 possible keys can be generated.
Upstream bug:
https://bugs.ntp.org/showbug.cgi?id=2797
Upstream patch:
http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg
CVE request:
http://seclists.org/oss-sec/2015/q2/85
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.