A type confusion flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=602970
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A cross-origin bypass flaw was found in the extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=598165
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An out-of-bounds access flaw was found in the libxslt component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=583156
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
The following flaw was identified in the Chromium browser: csp bypass for serviceworker.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=579801
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A heap overflow flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=613160
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An out-of-bounds read flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=604897
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A heap use-after-free flaw was found in the Skia component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=589848
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A heap use-after-free flaw was found in the V8 bindings component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=606390
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An information leak flaw was found in the extensions component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=603748
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An out-of-bounds read flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=603518
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An out-of-bounds read flaw was found in the PDFium component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=601362
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A cross-origin bypass flaw was found in the extension bindings component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=590118
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
A cross-origin bypass flaw was found in the Blink component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=597532
External References:
http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html
An integer overflow flaw, leading to a buffer overflow, was found in the way the EVPEncodeUpdate() function of OpenSSL parsed very large amounts of input data. A remote attacker could use this flaw to crash an application using OpenSSL or, possibly, execute arbitrary code with the permissions of the user running that application.
A man-in-the-middle (MITM) attacker may be able to execute a padding oracle attack to decrypt traffic when a connection uses an AES-CBC cipher and the server runs on an Intel CPU supporting AES-NI. This is a common configuration for TLS servers.
The OpenSSL project has labelled this vulnerability high severity.
An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.
An old inffast.c optimization turns out to not be optimal anymore with modern compilers, and furthermore was not compliant with the C standard, for which decrementing a pointer before its allocated memory is undefined.
External References:
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7
Upstream patch:
https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb
CVE assignment:
http://seclists.org/oss-sec/2016/q4/602
A vulnerability was found in icoutils in extract.c. It is possible to access unallocated memory via wrestool while parsing maliciously crafted file which would make the application crash or possibly allow code execution.
References:
http://seclists.org/oss-sec/2017/q1/56
Upstream patch:
http://git.savannah.gnu.org/cgit/icoutils.git/commit/?id=1aa9f28f7bcbdfff6a84a15ac8d9a87559b1596a
idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.
A vulnerability was found in Linux kernel. There is an information leak in file sound/core/timer.c of the latest mainline Linux kernel. The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized.
ISSUE DESCRIPTION =================
Xen PCI backend driver does not perform proper sanity checks on the device's state.
Which in turn allows the generic MSI code (called by Xen PCI backend) to be called incorrectly leading to hitting BUG conditions or causing NULL pointer exceptions in the MSI code.
To exploit this the guest can craft specific sequence of XENPCIOP operations which will trigger this.
Furthermore the frontend can also craft an continous stream of XENPCIOPenablemsi which will trigger an continous stream of WARN() messages triggered by the MSI code leading to the logging in the initial domain to exhaust disk space.
Lastly there is also missing check to verify whether the device has memory decoding enabled set at the start of the day leading the initial domain "accesses to the respective MMIO or I/O port ranges would - - on PCI Express devices - [which can] lead to Unsupported Request responses. The treatment of such errors is platform specific." (from XSA-120). Note that if XSA-120 'addendum' patch has been applied this particular sub-issue is not exploitable.
IMPACT ======
Malicious guest administrators can cause denial of service. If driver domains are not in use, the impact is a host crash.
Only x86 systems are vulnerable. ARM systems are not vulnerable.
VULNERABLE SYSTEMS ==================
This bug affects systems using Linux as the driver domain, including non-disaggregated systems using Linux as dom0.
Linux versions v3.1 and onwards are vulnerable due to supporting PCI pass-through backend driver.
PV and HVM guests which have been granted access to physical PCI devices (PCI passthrough') can take advantage of this vulnerability.
Furthermore, the vulnerability is only applicable when the passed-through PCI devices are MSI-capable or MSI-X. (Most modern devices are).
MITIGATION ==========
Not using PCI passthrough for PV and HVM guests. Note that for HVM guests QEMU is used for PCI passthrough - however the toolstack sets up also the 'PV' PCI which the guest can utilize if it chooses to do so.
External References:
http://xenbits.xen.org/xsa/advisory-157.html
Acknowledgements:
Red Hat would like to thank the Xen project for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
It was reported [1] that the Linux kernel suffered from a flaw when doing key garbage collection. The patch [1] describes the issue as:
""" When a key is being garbage collected, it's key->user would get put before the ->destroy() callback is called, where the key is removed from it's respective tracking structures.
This leaves a key hanging in a semi-invalid state which leaves a window open for a different task to try an access key->user. An example is findkeyringbyname() which would dereference key->user for a key that is in the process of being garbage collected (where key->user was freed but ->destroy() wasn't called yet - so it's still present in the linked list).
"""
An unprivileged local user could use this flaw to crash the system.
[1] http://marc.info/?l=linux-kernel&m=141986398232547&w=2
It was reported [1] that iptables can allow protocols that do not have a protocol handler kernel module loaded.
Given following iptables ruleset: -P FORWARD DROP -A FORWARD -m sctp --dport 9 -j ACCEPT -A FORWARD -p tcp --dport 80 -j ACCEPT -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT
One would assume that this allows SCTP on port 9 and TCP on port 80. Unfortunately, if the SCTP conntrack module is not loaded, this allows all SCTP communication to pass through, i.e. -p sctp -j ACCEPT
[1]: http://www.spinics.net/lists/netfilter-devel/msg33430.html
The modtls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
Bug description
OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes sizes arguments to an internal memmove call to be sign-extended from 32 to 64-bits before being passed to the memmove function.
This leads arguments between 2GiB and 4GiB to be interpreted as larger than they are (specifically, a bit below 2^64), causing a buffer overflow.
Arguments between 4GiB and 6GiB are interpreted as 4GiB smaller than they should be, causing a possible information leak.
This commit fixes the bug: https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762 The function camlbitstring is called indirectly from such functions as String.copy. String.copy for instance is supposed to be a "safe" function for which OCaml's memory safety guarantees apply.
SQL injection vulnerability in libraries/centralcolumns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.