An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.
Bodo Möller, Thai Duong and Krzysztof Kotowicz of Google discovered a flaw in the design of SSL version 3.0 that would allow an attacker to calculate the plaintext of secure connections, allowing, for example, secure HTTP cookies to be stolen.
References: http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html https://www.openssl.org/~bodo/ssl-poodle.pdf
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required sndusbaudio driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bugs:
https://bugzilla.redhat.com/showbug.cgi?id=1283355 https://bugzilla.redhat.com/showbug.cgi?id=1283358
A local kernel crash on invalid USB device requiring the visor driver was reported. The clie5attach function of the visor driver, which is called during the driver initialization process, expects an OUT-Bulk-Endpoint. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.
Vulnerable code:
CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 607 608 pipe = usbsndbulkpipe(serial->dev, port->bulkoutendpointAddress); 609 for (j = 0; j < ARRAYSIZE(port->writeurbs); ++j) 610 port->writeurbs[j]->pipe = pipe; / if there is no configured OUT-bulk-endpoint, the kernel tries to dereference null-pointers / 611 612 return 0; 613 } ...
Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283371
Proposed upstream patch: http://marc.info/?l=linux-usb&m=145260786729359&w=2
Upstream commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c
Bugtraq: http://seclists.org/bugtraq/2016/Mar/58
Unspecified vulnerability in ia32el (aka the IA 32 emulation functionality) before 70427022-0.4.2 in SUSE Linux Enterprise (SLE) 10 SP2 on Itanium IA64 machines allows local users to cause a denial of service (system crash) via a 32-bit x86 application.
Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.
Sun Sun Ray Server Software 3.1 through 4.0 does not properly restrict access, which allows remote attackers to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vectors.
Sun Sun Ray Server Software 3.x and 4.0 and Sun Ray Windows Connector 1.1 and 2.0 expose the LDAP password during a configuration step, which allows local users to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vectors related to the utconfig component of the Server Software and the uttscadm component of the Windows Connector.
Kernel crash occurs when presented a buggy USB device which requires wacom driver, causing null pointer dereference.
Product bugs:
https://bugzilla.redhat.com/showbug.cgi?id=1283375 https://bugzilla.redhat.com/showbug.cgi?id=1283377