A memory leak was found in the way libpng processed malformed Portable Network Graphics (PNG) images with Physical Scale (sCAL) extension. A remote attacker could create a specially-crafted PNG image and trick the local user into opening it in an application, using the libpng library, leading to denial of service (relevant libpng-based application crash).

References: [1] http://www.libpng.org/pub/png/libpng.html

CVE Request: [2] http://www.openwall.com/lists/oss-security/2010/06/28/2

Description of problem: When transmitting L2TP frames, we derive the outgoing interface's UDP checksum hardware assist capabilities from the tunnel dst dev. This can sometimes be NULL, especially when routing protocols are used and routing changes occur. This patch just checks for NULL dst or dev pointers when checking for netdev hardware assist features. BUG: unable to handle kernel NULL pointer dereference at 0000000c IP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] pde = 00000000 Oops: 0000 [#1] SMP last sysfs file: /sys/class/net/lo/operstate Modules linked in: pppol2tp pppox pppgeneric slhc ipv6 dummy loop sndhdacodecatihdmi sndhdaintel sndhdacodec snd [...] Code: 8d 45 08 f0 ff 45 08 89 6b 08 c7 43 68 7e fb 9c f8 8a 45 24 83 e0 0c 3c 04 75 09 80 63 64 f3 e9 b4 00 00 00 8b 43 1 EIP: [<f89d074c>] pppol2tpxmit+0x341/0x4da [pppol2tp] SS:ESP 0068:f70a9cac CR2: 000000000000000c

Introduced in ffcebb16 (v2.6.29-rc1~581), fixed in 3feec909 (fixed in v2.6.34-rc2).

Upstream commit: http://git.kernel.org/linus/ffcebb16 http://git.kernel.org/linus/3feec909

Description of problem: CIFS has the ability to chase MS-DFS referrals. In order to do this it has to be able to resolve hostnames into IP addresses. For this, it uses the keys API to upcall to the cifs.upcall userspace helper. It then resolves the name and hands the address back to the kernel.

The dnsresolver upcall currently used by CIFS is susceptible to cache stuffing. It's possible for a malicious user to stuff the keyring with the results of a lookup, and then trick the server into mounting a server of his choosing.

Description of problem: On a 32-bit machine, info.rulecnt >= 0x40000000 leads to integer overflow and the buffer may be smaller than needed. Since ETHTOOLGRXCLSRLALL is unprivileged, this can presumably be used for at least denial of service.

Reference: http://thread.gmane.org/gmane.linux.network/164869

Last updated 24 July 2024

Description of problem: Changes to tty to use struct pid happened here: ab521dc0f8e117fd808d3e425216864d60390500

mrg-1/rhel-6 are missing: 1) redo locking of tty->pgrp 47f86834bbd4193139d61d659bebf9ab9d691e37 2) tty: fix race in ttyfasync 703625118069f9f8960d356676662d3db5a9d116 3) fnctl: fmodown should call writelockirqsave/restore b04da8bfdfbbd79544cab2fadfdc12e87eb01600

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.

Description of problem: User "foo" can use the SWAPEXT ioctl to swap a write-only file owned by user "bar" into a file owned by "foo" and subsequently reading it. It does so by checking that the file descriptors passed to the ioctl are also opened for reading.

References: http://archives.free.net.ph/message/20100616.130710.301704aa.en.html http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html

Description of problem: If the donor file is an append-only file, we should not allow the operation to proceed, lest we end up overwriting the contents of an append-only file.

Upstream commit: http://git.kernel.org/linus/1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

Devin Carraway of the Debian Security Team discovered that the upstream fix for the CVE-2008-2079 is incomplete and still makes it possible for local users to create tables via INDEX/DATA DIRECTORY directives in the MySQL data directory (/var/lib/mysql) via directory symlinks.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=480292#25

CVE-2008-2079 was tracked via bug bug #445222.

An attacker needs following to exploit this issue: - MySQL database account with privileges to create tables - shell access to the host running MySQL database with write access to a directory accessible by the mysqld daemon process

Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.

Will Drewry of the Google Security Team created a set of fuzzed OGG test files to test OGG Vorbis and Tremor implementations. Some of them were causing memory corruption and crash on old libvorbis versions (prior to 1.0).

Crash / corruption occurred in makedecodetree(). This function was removed prior to the release of upstream version 1.0 in following changes:

https://trac.xiph.org/changeset/2959 https://trac.xiph.org/changeset/2960

Test files do not crash libvobis revision 2960 or later.

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4484 to the following vulnerability:

Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote attackers to execute arbitrary code via crafted data to TCP port 3306, as demonstrated by the vdmysql5 module in VulnDisco Pack Professional 8.11. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.

References: http://intevydis.blogspot.com/2010/01/jan-4-2010-mysql-exploit-demo.html http://intevydis.com/vd-list.shtml http://isc.sans.org/diary.html?storyid=7900 http://www.securityfocus.com/bid/37640

More details about the issue may be disclosed in about 2 weeks: http://intevydis.blogspot.com/2010/01/jan-72010-0day-awareness.html

The pollmodeio file for the megaraidsas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

The connector layer in the Linux kernel before 2.6.31.5 does not require the CAPSYSADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.

net/unix/afunix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AFUNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc//fd/ pathname.

Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information.

Quote from http://patchwork.ozlabs.org/patch/35412/: Commit 9ef1d4c7c7aca1cd436612b6ca785b726ffb8ed8 introduced a typo in initialization.

Quoting from the upstream commit: Almost all r128's private ioctls require that the CCE state has already been initialised. However, most do not test that this has been done, and will proceed to dereference a null pointer. This may result in a security vulnerability, since some ioctls are unprivileged.

This adds a macro for the common initialisation test and changes all ioctl implementations that require prior initialisation to use that macro.

Also, r128doinitcce() does not test that the CCE state has not been initialised already. Repeated initialisation may lead to a crash or resource leak. This adds that test.

http://git.kernel.org/linus/7dc482dfeeeefcfd000d4271c4626937406756d7

Other references: http://secunia.com/advisories/36707/

The getrandomint function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

Description of problem: Three bytes of uninitialized kernel memory are currently leaked to user.

Upstream proposed patch: http://patchwork.ozlabs.org/patch/32830/

CVE request: http://article.gmane.org/gmane.comp.security.oss.general/2060

pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.

Quoting upstream PostgreSQL security page: http://www.postgresql.org/support/security.html

If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.

Affected versions: 8.3, 8.2

Fixed in versions: 8.3.8, 8.2.14

Severity: A - A vulnerability that is exploitable for privilege escalation without requiring a prior login.

The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AFAPPLETALK socket, related to the atalkgetname function in net/appletalk/ddp.c; (2) an AFIRDA socket, related to the irdagetname function in net/irda/afirda.c; (3) an AFECONET socket, related to the econetgetname function in net/econet/afeconet.c; (4) an AFNETROM socket, related to the nrgetname function in net/netrom/afnetrom.c; (5) an AFROSE socket, related to the rosegetname function in net/rose/afrose.c; or (6) a raw CAN socket, related to the rawgetname function in net/can/raw.c.

Array index error in the gdthreadevent function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request.

Description of problem: 1) NET: llc, zero sockaddrllc struct sllcarphrd member of sockaddrllc might not be changed. Zero sllc before copying to the above layer's structure.

http://git.kernel.org/linus/3480c63bdf008e9289aab94418f43b9592978fff http://git.kernel.org/linus/28e9fc592cb8c7a43e4d3147b38be6032a0e81bc http://milw0rm.com/exploits/9513

Note that LLC sockets are restricted to root since v2.6.25-rc9 (see commit 3480c63b).

2) can: Fix rawgetname() leak rawgetname() can leak 10 bytes of kernel memory to user

http://git.kernel.org/linus/e84b90ae5eb3c112d1f208964df1d8156a538289

Note that this was introduced in v2.6.25-rc1.

3) irda: Fix irdagetname() leak irdagetname() can leak kernel memory to user.

http://git.kernel.org/linus/09384dfc76e526c3993c09c42e016372dc9dd22c

4) appletalk: fix atalkgetname() leak atalkgetname() can leak 8 bytes of kernel memory to user

http://git.kernel.org/linus/3d392475c873c10c10d6d96b94d092a34ebd4791 http://milw0rm.com/exploits/9521

5) netrom: Fix nrgetname() leak nrgetname() can leak kernel memory to user.

http://git.kernel.org/linus/f6b97b29513950bfbf621a83d85b6f86b39ec8db

6) econet: Fix econetgetname() leak econetgetname() can leak kernel memory to user.

http://git.kernel.org/linus/80922bbb12a105f858a8f0abb879cb4302d0ecaa

7) rose: Fix rosegetname() leak rosegetname() can leak kernel memory to user.

http://git.kernel.org/linus/17ac2e9c58b69a1e25460a568eae1b0dc0188c25

CVE request: http://article.gmane.org/gmane.comp.security.oss.general/2029 http://article.gmane.org/gmane.comp.security.oss.general/2033

arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x8664 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.