Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listeners.
As per upstream samba advisory:
All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon.
A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges.
A weakness was found in the Linux ASLR implementation. Any user able to running 32-bit applications in a x86 machine can disable the ASLR by setting the RLIMITSTACK resource to unlimited.
External references:
http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html http://seclists.org/bugtraq/2016/Apr/34
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb
fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls.
A vulnerability was found in Linux kernel. There is an information leak in file "sound/core/timer.c" of the latest mainline Linux kernel, the stack object “tread” has a total size of 32 bytes. It contains a 8-bytes padding, which is not initialized but sent to user via copytouser(), resulting a kernel leak.
Destroy of network interface with huge number of ipv4 addresses keeps rtnllock for a very long time (up to hour). It blocks many network related operations, including for example creation of new incoming ssh connections.
The problem is especially important for containers, container owner have enough permission to enable this trigger and then can block network access on whole host node.
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/davem/net-next.git/commit/?id=fbd40ea0180a2d328c5adc61414dc8bab9335ce2
References:
http://seclists.org/oss-sec/2016/q1/643
CVE assignment:
http://seclists.org/oss-sec/2016/q1/647
A vulnerability was found in the Linux kernel. Payloads of NM entries are not supposed to contain NUL. When such entry is processed, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries). The process stops when the amount collected so far + the claimed amount in the current NM entry exceed 254.
However, the value returned as the total length is the sum of claimed sizes, not the actual amount collected. And that can grow pretty large - not unlimited, since you'd need to put CE entries in between to be able to get more than the maximum that could be contained in one isofs directory entry / continuation chunk and the process stops once it had encountered 32 CEs, but you can get about 8Kb easily. And that's what will be passed to readdir callback as the name length. 8Kb copytouser() from a buffer allocated by getfreepage()
References, CVE-ID request and response:
http://seclists.org/oss-sec/2016/q2/363
http://seclists.org/oss-sec/2016/q2/365
Upstream fix:
https://git.kernel.org/linus/99d825822eade8d827a1817357cbf3f889a552d6
Last updated 24 July 2024
Buffer overflow in the picolcdrawevent function in devices/hid/hid-picolcdcore.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.
It was found that routing packets to too many different dsts/too fast can lead to a excessive resource consumption.
A remote attacker can use this flaw to crash the system.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f88649721268999bdff09777847080a52004f691
Acknowledgements:
This issue was found by Marcelo Ricardo Leitner of Red Hat.
A vulnerability was found in the usbnet Linux kernel driver.
The bug allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have other impact by inserting a USB device with an invalid USB descriptor.
Upstream fixes:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4d06dd537f95683aba3651098ae288b7cbff8274 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1666984c8625b3db19a9abc298931d35ab7bc64b
External references:
https://www.spinics.net/lists/netdev/msg367669.html https://bugzilla.novell.com/showbug.cgi?id=974418
Reference and CVE assignment:
http://seclists.org/oss-sec/2016/q2/19
An information leak vulnerability in [llc] module was found in "net/llc/afllc.c". The stack object "info" has a total size of 12 bytes. Its last byte is padding which is not initialized and leaked via putcmsg().
Public via:
http://marc.info/?l=linux-kernel&m=146230753506235&w=2
http://marc.info/?l=linux-netdev&m=146230754406241&w=2
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q2/233
http://seclists.org/oss-sec/2016/q2/236
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b8670c09f37bdf2847cc44f36511a53afc6161fd
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b8670c09f37bdf2847cc44f36511a53afc6161fd
An information leak vulnerability in rtnetlink subsystem in Linux kernel was found in "net/core/rtnetlink.c". The stack object "map" has a total size of 32 bytes. Its last 4 bytes are padding generated by compiler. These padding bytes are not initialized and sent out via nlaput().
Public via:
http://marc.info/?l=linux-kernel&m=146230821206492&w=2
http://marc.info/?l=linux-netdev&m=146230822606494&w=2
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q2/234
http://seclists.org/oss-sec/2016/q2/237
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=5f8e44741f9f216e33736ea4ec65ca9ac03036e6
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5f8e44741f9f216e33736ea4ec65ca9ac03036e6
Last updated 24 July 2024
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required cypressm8 driver. The kernel would panic causing null pointer dereference.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283368
A flaw was found in the Linux kernel handling when a buggy USB device is attached attempting to use the cdcacm kernel module. This flaw would cause the kernel to panic by a null pointer dereference.
Public via:
http://seclists.org/bugtraq/2016/Mar/54
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/605
http://seclists.org/oss-sec/2016/q1/622
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8835ba4a39cf53f705417b3b3a94eb067673f2c9
Kernel crash occurs when presented a buggy USB device which requires digiacceleport driver, causing null pointer dereference.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283378
An out-of-bounds heap memory access, leading to a Denial of Service or possibly heap disclosure or further impact was found in setsockopt(). The particular setsockopt() call is normally restricted to root, however some processes with capsysadmin may also be able to trigger this flaw.
Upstream fixes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968
Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5
Buffer overflow in virt/kvm/irqcomm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setuproutingentry function before invoking the kvmsetirq function.
Heap-based buffer overflow in the wdmincallback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.
It was discovered that the glibc DNS resolver dereferenced a NULL pointer when processing a specific, but valid resource record type.
Acknowledgements:
Name: Florian Weimer (Red Hat Product Security)
Use-after-free vulnerability in the nsEditor::FindNextLeafNode function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict calls to DOMWindowUtils (aka nsDOMWindowUtils) methods, which allows remote attackers to bypass intended access restrictions via crafted JavaScript code.
Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
Use-after-free vulnerability in the nsSMILAnimationController::DoSample function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
The AutoWrapperChanger class in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly interact with garbage collection, which allows remote attackers to execute arbitrary code via a crafted HTML document referencing JavaScript objects.
Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with multiple bindings that have SVG content.
Use-after-free vulnerability in the nsDisplayBoxShadowOuter::Paint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.