An insufficient policy enforcement flaw was found in the audio component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=990867
External References:
https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. Luigi Gubello demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents.
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
It was found that systemd fails an assertion in managerinvokenotifymessage() when a zero-length message is received over its notification socket, causing it to no longer perform it's expected functionality. This issue was assigned CVE-2016-7795 and is tracked via bug 1380286. Upstream bug report is:
https://github.com/systemd/systemd/issues/4234
Older systemd versions either don't include the assert that is triggered in managerinvokenotifymessage(), or have managerprocessnotifyfd() function return error before calling managerinvokenotifymessage(). That error return still causes systemd to exit its main loop and freeze its execution in a similar way it's done in newer versions after failed assertion.
https://github.com/systemd/systemd/issues/4234#issuecomment-250441246
The managerinvokenotifymessage() function with assert was introduced in version v209:
https://github.com/systemd/systemd/commit/5ba6985b6c8ef85a8bcfeb1b65239c863436e75b#diff-ab78220e12703ee63fa1e6a2caa16bebR1319
However, the assertion was not reachable before the error return was removed in v219:
https://github.com/systemd/systemd/commit/d875aa8ce10b458dc218c0d98f4a82c8904d6d03
The systemd versions in Red Hat Enterprise Linux 7.0 and 7.1 are based on upstream v208, but include managerinvokenotifymessage() added via a separate backported patch. The assertion is not reachable, so those versions are affected by CVE-2016-7796, but not affected by CVE-2016-7795. Red Hat Enterprise Linux 7.2 rebased systemd to version v219. Therefore, those packages are no longer affected by CVE-2016-7796, but are now affected by CVE-2016-7795.
An unspecified low-severity Node.js HTTP processing vulnerability was found and will be fixed in latest update. Details are currently embargoed until new releases are available.
https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/
An out-of-bounds read flaw was found in the Skia component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=609260
External References:
http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
A parameter sanitization failure flaw was found in the DevTools component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=607939
External References:
http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
An information leak flaw was found in the Extension bindings component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=603725
External References:
http://googlechromereleases.blogspot.com/2016/06/stable-channel-update.html
browser/browsingdata/browsingdataremover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority.
An out-of-bounds read flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=604897
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A limited cross-origin bypass flaw was found in the ServiceWorker component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=598077
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A heap buffer overflow flaw was found in the media component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=606185
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
browser/safebrowsing/srtfieldtrialwin.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Removal Tool, which allows remote attackers to spoof the chromecleanuptool.exe (aka CCT) file via a man-in-the-middle attack on an HTTP session.
An out-of-bounds read flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=603518
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An out-of-bounds read flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=601362
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
The following flaw was identified in the Chromium browser: csp bypass for serviceworker.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=579801
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An information leak flaw was found in the extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=603748
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A type confusion flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=602970
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A vulnerability was found in Linux kernel. There is an information leak in file "sound/core/timer.c" of the latest mainline Linux kernel, the stack object “tread” has a total size of 32 bytes. It contains a 8-bytes padding, which is not initialized but sent to user via copytouser(), resulting a kernel leak.
Last updated 24 July 2024
The tmreclaimthread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tmreclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/modulesystem.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to cause a denial of service (invalid read operation) via unknown vectors.
A vulnerability was found in the usbnet Linux kernel driver.
The bug allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have other impact by inserting a USB device with an invalid USB descriptor.
Upstream fixes:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4d06dd537f95683aba3651098ae288b7cbff8274 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1666984c8625b3db19a9abc298931d35ab7bc64b
External references:
https://www.spinics.net/lists/netdev/msg367669.html https://bugzilla.novell.com/showbug.cgi?id=974418
Reference and CVE assignment:
http://seclists.org/oss-sec/2016/q2/19
A vulnerability was found in the Linux kernel. A device pretending to be a device driven by the ims-pcu driver but leaving out either of the two interfaces present on the genuine device will oops the driver.
Reference with proposed fix:
https://bugzilla.novell.com/showbug.cgi?id=971628
Linux-input maintainer tree patch:
https://kernel.googlesource.com/pub/scm/linux/kernel/git/dtor/input/+/a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff
An upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ad220c96692eda76b2e3fd7279f3dcd1d8a8ff
CVE-ID request: http://seclists.org/oss-sec/2016/q1/715
CVE-ID assignment: http://seclists.org/oss-sec/2016/q1/717
Destroy of network interface with huge number of ipv4 addresses keeps rtnllock for a very long time (up to hour). It blocks many network related operations, including for example creation of new incoming ssh connections.
The problem is especially important for containers, container owner have enough permission to enable this trigger and then can block network access on whole host node.
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git/commit/?id=fbd40ea0180a2d328c5adc61414dc8bab9335ce2
References:
http://seclists.org/oss-sec/2016/q1/643
CVE assignment:
http://seclists.org/oss-sec/2016/q1/647
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required iowarrior driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283390
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required powermate driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283384
Public via:
http://seclists.org/bugtraq/2016/Mar/85
This was assigned CVE-2016-2186 by Red Hat.
A flaw was found in in the Linux kernel's USB device management code which could cause a kernel panic when a device which required atiremote2 kernel module. The kernel would panic causing null pointer dereference attempting to access a non existent interface descriptor. The atiremote2 driver assumes that there will be at least two interface-descriptors with associated endpoint-descriptors.
Product bugs:
https://bugzilla.redhat.com/showbug.cgi?id=1283362 https://bugzilla.redhat.com/showbug.cgi?id=1283363
Public via:
http://seclists.org/bugtraq/2016/Mar/90
Red Hat assigned CVE-2016-2185 to this issue.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required mctu232 driver. The kernel would panic caused by a null pointer dereference.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283370