Out-of-bounds

Improper bounds checking of the obuf variable in the linkntoa function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depends on the method of exploit and how the library is used by applications. According to analysis by...

CVE-2016-6559

CVE-2016-6559 concerns the BSD libc function link_ntoa() in linkaddr.c, where the obuf bounds are mishandled. The root cause is improper bounds checking, which could allow memory read/write. Public analyses from FreeBSD indicate it is unlikely that applications expose an exploitable use of link_n...

CVE-2016-6559 The BSD libc library's link_ntoa() function may be vulnerable to a classic buffer overflow

Improper bounds checking of the obuf variable in the linkntoa function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depends on the method of exploit and how the library is used by applications. According to analysis by...

FreeBSD : couchdb -- multiple vulnerabilities (1e54d140-8493-11e8-a795-0028f8d09152)

Apache CouchDB PMC reports : Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases. C Tenable Network Security, Inc. The descriptive text and...

FreeBSD : Flash Player -- multiple vulnerabilities (e78732b2-8528-11e8-9c42-6451062f0f7a)

Adobe reports : - This update resolves an out-of-bounds read vulnerability that could lead to information disclosure CVE-2018-5008. - This update resolves a type confusion vulnerability that could lead to arbitrary code execution CVE-2018-5007. C Tenable Network Security, Inc. The descriptive tex...

FreeBSD : Libgit2 -- multiple vulnerabilities (3c9b7698-84da-11e8-8c75-d8cb8abf62dd)

The Git community reports : Out-of-bounds reads when reading objects from a packfile C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use...

FreeBSD : zziplib - multiple vulnerabilities (7764b219-8148-11e8-aa4d-000e0cd7b374)

NIST reports by search in the range 2017/01/01 - 2018/07/06 : 17 security fixes in this release : - Heap-based buffer overflow in the zzipget32 function in fetch.c. - Heap-based buffer overflow in the zzipget64 function in fetch.c. - Heap-based buffer overflow in the zzipmementryextrablock functi...

FreeBSD : clamav -- multiple vulnerabilities (d1e9d8c5-839b-11e8-9610-9c5c8e75236a)

Joel Esler reports : 3 security fixes in this release : - CVE-2017-16932: Vulnerability in libxml2 dependency affects ClamAV on Windows only. - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera. - CVE-2018-0361: ClamAV PDF object length chec...

FreeBSD : mybb -- vulnerabilities (bfd5d004-81d4-11e8-a29a-00e04c1ea73d)

mybb Team reports : High risk: Image and URL MyCode Persistent XSS Medium risk: Multipage Reflected XSS Low risk: ACP logs XSS Low risk: Arbitrary file deletion via ACP's Settings Low risk: Login CSRF Low risk: Non-video content embedding via Video MyCode C Tenable Network Security, Inc. The...

FreeBSD : wordpress -- multiple issues (4740174c-82bb-11e8-a29a-00e04c1ea73d)

wordpressdevelopers reports : Taxonomy: Improve cache handling for term queries. Posts, Post Types: Clear post password cookie when logging out. Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen. Community Events Dashboard: Always show the nearest WordCamp if one is...

FreeBSD : expat -- multiple vulnerabilities (e375ff3f-7fec-11e8-8088-28d244aee256)

Mitre reports : An integer overflow during the parsing of XML using the Expat library. XML External Entity vulnerability in libexpat 2.2.0 and earlier Expat XML Parser Library allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD....

FreeBSD : h2o -- heap buffer overflow during logging (ce39379f-7eb7-11e8-ab03-00bd7f19ff09)

Marlies Ruck reports : Fix heap buffer overflow while trying to emit access log - see references for full details. CVE-2018-0608: Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service DoS via unspecified vectors. C Tenable...

Github Account of Gentoo Linux Hacked, Code Replaced With Malware

Downloaded anything from Gentoo's GitHub account yesterday? Consider those files compromised and dump them now—as an unknown group of hackers or an individual managed to gain access to the GitHub account of the Gentoo Linux distribution on Thursday and replaced the original source code with a...

patch: Malicious patch files cause ed to execute arbitrary commands

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...

patch: Malicious patch files cause ed to execute arbitrary commands

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...

patch: Malicious patch files cause ed to execute arbitrary commands

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...

FreeBSD : Gitlab -- multiple vulnerabilities (b950a83b-789e-11e8-8545-d8cb8abf62dd)

Gitlab reports : Wiki XSS Sanitize gem updates XSS in urlforparams Content injection via username Activity feed publicly displaying internal project names Persistent XSS in charts C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeB...

Quest KACE Systems Management - Command Injection Exploit

Exploit for unix platform in category remote exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Quest KACE Systems Management Command Injection', 'Description' = %q This module exploits a...

Quest KACE Systems Management - Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Quest KACE Systems Management Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Quest KACE Systems...

FreeBSD : mailman -- hardening against malicious listowners injecting evil HTML scripts (739948e3-78bf-11e8-b23c-080027ac955c)

Mark Sapiro reports : Existing protections against malicious listowners injecting evil scripts into listinfo pages have had a few more checks added. A few more error messages have had their values HTML escaped. The hash generated when SUBSCRIBEFORMSECRET is set could have been the same as one...