A cross-origin bypass flaw was found in the extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=598165

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A heap use-after-free flaw was found in the V8 bindings component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=606390

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

An out-of-bounds read flaw was found in the PDFium component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=601362

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

A reference counter leak in ipxitfioctl function was found which results into use after free vulnerability that's triggerable from unprivileged userspace when IPX interface is configured.

References:

http://seclists.org/oss-sec/2017/q2/251

https://patchwork.ozlabs.org/patch/757549/

Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee0d8d8482345ff97a75a7d747efc309f13b0d80

An issue was found in the Linux kernel ipv6 implementation of GRE tunnels which allows a remote attacker to trigger an out-of-bounds access. At this time we understand no trust barrier has been crossed and there is no security implications in this flaw.

References:

http://seclists.org/oss-sec/2017/q1/323

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=7892032cfe67f4bde6fc2ee967e45a8fbaf33756

A flaw was found in the linux kernels implementation of DCCP protocol in which a local user could create influence timing in which a skbuff could be used after it had been freed by the kernel. An attacker is able to craft structures allocated in this free memory will be able to create memory corruption, privilege escalation or crash the system. An attacker must have a local account access on the system, this is not a remote attack. An attack requires IPV6 support to be enabled in the system.

Initial message:

https://groups.google.com/forum/#!topic/syzkaller/vGUxJLcdKY

Proposed patch:

https://patchwork.ozlabs.org/patch/728808/

A buffer overflow was discovered in tpacketrcv() function in the Linux kernel since v4.6-rc1 through v4.13. A number of socket-related syscalls can be made to set up a configuration when each packet received by a network interface can cause writing up to 10 bytes to a kernel memory outside of a kernel buffer. This can cause unspecified kernel data corruption effects, including damage of in-memory and on-disk XFS data.

References:

https://marc.info/?l=linux-kernel&m=150394500728906&w=2

https://marc.info/?t=150394517700001&r=1&w=2

http://seclists.org/oss-sec/2017/q3/476

A kernel patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=edbd58be15a957f6a760c4a514cd475217eb97fd

Last updated 24 July 2024

The parsecharstrings function in type1/t1load.c in FreeType 2 before 2.7 does not ensure that a font contains a glyph name, which allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly have unspecified other impact via a crafted file.

A flaw was found in the Linux kernels function pathopenat() in which would incorrectly clear up twice (as part of pathlookupat() called by dotmpfile(). Doing so again can lead to double fput(). This can lead to a use-after free condition.

CVE assignment: http://seclists.org/oss-sec/2015/q3/270

Introduced in this commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bb458c644a59dbba3a1fe59b27106c5e68e1c4bd

Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f15133df088ecadd141ea1907f2c96df67c729f0

OSS-SEC request: http://seclists.org/oss-sec/2015/q3/371

Chromium: CVE-2023-3422 Use after free in Guest View

Chromium: CVE-2023-3420 Type Confusion in V8

The cdfcountchain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

Invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash.

tcpdump. Multiple issues were addressed by updating to version 4.9.2.

tcpdump. Multiple issues were addressed by updating to version 4.9.2.

tcpdump. Multiple issues were addressed by updating to version 4.9.2.

tcpdump. Multiple issues were addressed by updating to version 4.9.2.

tcpdump. Multiple issues were addressed by updating to version 4.9.2.

tcpdump. Multiple issues were addressed by updating to version 4.9.2.

tcpdump. Multiple issues were addressed by updating to version 4.9.2.

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpzpowmsec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.

An issue was discovered in Arm Mbed TLS before 2.23.0. Because of a side channel in modular exponentiation, an RSA private key used in a secure enclave could be disclosed.

A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtlspkcs12derivation function when an input password's length is 0.

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues.

When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems.

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash.

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk.

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1.

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.