FreeBSD : Matrix clients -- several vulnerabilities (93eb0e48-14ba-11ec-875e-901b0e9408dc)

Matrix developers report : Today we are disclosing a critical security issue affecting multiple Matrix clients and libraries including Element Web/Desktop/Android, FluffyChat, Nheko, Cinny, and SchildiChat. Specifically, in certain circumstances it may be possible to trick vulnerable clients into...

FreeBSD : go -- archive/zip: overflow in preallocation check can cause OOM panic (4ea1082a-1259-11ec-b4fa-dd5a552bdd17)

The Go project reports : An oversight in the previous fix still allows for an OOM panic when the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, effectively bypassing the check that the number of files in the archive is...

FreeBSD : consul -- rpc: authorize raft requests (376df2f1-1295-11ec-859e-000c292ee6b8)

Hashicorp reports : HashiCorp Consul Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

FreeBSD : Python -- multiple vulnerabilities (145ce848-1165-11ec-ac7e-08002789875b)

Python reports : bpo-42278: Replaced usage of tempfile.mktemp with TemporaryDirectory to avoid a potential race condition. bpo-44394: Update the vendored copy of libexpat to 2.4.1 from 2.2.8 to get the fix for the CVE-2013-0340 'Billion Laughs' vulnerability. This copy is most used on Windows and...

FreeBSD : MPD5 PPPoE Server remotely exploitable crash (f55921aa-10c9-11ec-8647-00e0670f2660)

Version 5.92 contains security fix for PPPoE servers. Insufficient validation of incoming PPPoE Discovery request specially crafted by unauthenticated user might lead to unexpected termination of the process. The problem affects mpd versions since 5.0. Installations not using PPPoE server...

FreeBSD : Python -- multiple vulnerabilities (0e561173-0fa9-11ec-a2fa-080027948c12)

Python reports : bpo-44394: Update the vendored copy of libexpat to 2.4.1 from 2.2.8 to get the fix for the CVE-2013-0340 'Billion Laughs' vulnerability. This copy is most used on Windows and macOS. bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of \r and \n...

Tuxera NTFS-3G Out-of-Bounds Read Vulnerability (CNVD-2021-72262)

NTFS-3G is a stable, full-featured, read/write NTFS driver for Linux, Android, Mac OS X, FreeBSD, NetBSD, OpenSolaris, QNX, Haiku and other operating systems. An out-of-bounds read vulnerability exists in ntfsielookup in versions prior to NTFS-3G 2021.8.22. An attacker can exploit this...

Tuxera NTFS-3G integer overflow vulnerability

NTFS-3G is a stable, full-featured, read-write NTFS driver for Linux, Android, Mac OS X, FreeBSD, NetBSD, OpenSolaris, QNX, Haiku, and other operating systems. memmove in versions prior to NTFS-3G 2021.8.22 is vulnerable to integer overflow vulnerability. An attacker can exploit this vulnerabilit...

Tuxera NTFS-3G null pointer dereference vulnerability

NTFS-3G is a stable, full-featured, read/write NTFS driver for Linux, Android, Mac OS X, FreeBSD, NetBSD, OpenSolaris, QNX, Haiku, and other operating systems. ntfs extentinodeopen is vulnerable to a null pointer dereference. An attacker could exploit the vulnerability to cause null pointer...

Tuxera NTFS-3G out-of-bounds read vulnerability

NTFS-3G is a stable, full-featured, read-write NTFS driver for Linux, Android, Mac OS X, FreeBSD, NetBSD, OpenSolaris, QNX, Haiku, and other operating systems. NTFS-3G versions prior to 2021.8.22 are vulnerable to an out-of-bounds read vulnerability. The vulnerability stems from an invalid...

Tuxera NTFS-3G out-of-bounds read vulnerability (CNVD-2021-72263)

NTFS-3G is a stable, full-featured, read/write NTFS driver for Linux, Android, Mac OS X, FreeBSD, NetBSD, OpenSolaris, QNX, Haiku, and other operating systems. ntfsrunlistsmergei in versions prior to NTFS-3G 2021.8.22 is vulnerable to an out-of-bounds read. runlistsmergei is vulnerable to...

FreeBSD : Python -- multiple vulnerabilities (032643d7-0ba7-11ec-a689-080027e50e6d)

Python reports : bpo-42278: Replaced usage of tempfile.mktemp with TemporaryDirectory to avoid a potential race condition. bpo-41180: Add auditing events to the marshal module, and stop raising code.init events for every unmarshalled code object. Directly instantiated code objects will continue t...

FreeBSD : cyrus-imapd -- multiple-minute daemon hang via input that is mishandled during hash-table interaction (3d915d96-0b1f-11ec-8d9f-080027415d17)

Cyrus IMAP 3.4.2 Release Notes states : Fixed CVE-2021-33582: Certain user inputs are used as hash table keys during processing. A poorly chosen string hashing algorithm meant that the user could control which bucket their data was stored in, allowing a malicious user to direct many inputs to a...

FreeBSD : chromium -- multiple vulnerabilities (a7732806-0b2a-11ec-836b-3065ec8fd3ec)

Chrome Releases reports : This release contains 27 security fixes, including : - 1233975 High CVE-2021-30606: Use after free in Blink. Reported by Nan Wang @eternalsakura13 and koocola @alocook of 360 Alpha Lab on 2021-07-28 - 1235949 High CVE-2021-30607: Use after free in Permissions. Reported b...

FreeBSD : py-matrix-synapse -- several vulnerabilities (a67e358c-0bf6-11ec-875e-901b0e9408dc)

Matrix developers report : This release patches two moderate severity issues which could reveal metadata about private rooms : - CVE-2021-39164: Enumerating a private room's list of members and their display names. - CVE-2021-39163: Disclosing a private room's name, avatar, topic, and number of...

FreeBSD : WeeChat -- Crash when decoding a malformed websocket frame in relay plugin. (65f05b71-0e3c-11ec-b335-d4c9ef517024)

The WeeChat project reports : Crash when decoding a malformed websocket frame in relay plugin. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and...

Security update for spectre-meltdown-checker (moderate)

openSUSE Security Update: Security update for spectre-meltdown-checker Announcement ID: openSUSE-SU-2021:1212-1 Rating: moderate References: 1189477 Cross-References: CVE-2017-5753 CVSS scores: CVE-2017-5753 NVD : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2017-5753 SUSE: 7.1...

CVE-2021-29630

In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a...

CVE-2021-29630

In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a...

CVE-2021-29630

In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a...