FreeBSD : LibreOffice -- Remote arbitrary file disclosure vulnerability via WEBSERVICE formula (289269f1-0def-11e8-99b0-d017c2987f9a)

LibreOffice reports : LibreOffice Calc supports a WEBSERVICE function to obtain data by URL. Vulnerable versions of LibreOffice allow WEBSERVICE to take a local file URL e.g file:// which can be used to inject local files into the spreadsheet without warning the user. Subsequent formulas can...

FreeBSD : cvs -- Remote code execution via ssh command injection (d9fe59ea-1940-11e8-9eb8-5404a68ad561)

Hank Leininger reports : Bugs in Git, Subversion, and Mercurial were just announced and patched which allowed arbitrary local command execution if a malicious name was used for the remote server, such as starting with - to pass options to the ssh client : git clone...

FreeBSD : squid -- Vulnerable to Denial of Service attack (d5b6d151-1887-11e8-94f7-9c5c8e75236a)

Louis Dion-Marcil reports : Due to incorrect pointer handling Squid is vulnerable to denial of service attack when processing ESI responses. This problem allows a remote server delivering certain ESI response syntax to trigger a denial of service for all clients accessing the Squid service. Due t...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (57580fcc-1a61-11e8-97e0-00e04c1ea73d)

Drupal Security Team reports : CVE-2017-6926: Comment reply form allows access to restricted content CVE-2017-6927: JavaScript cross-site scripting prevention is incomplete CVE-2017-6928: Private file access bypass - Moderately Critical CVE-2017-6929: jQuery vulnerability with untrusted domains -...

FreeBSD : asterisk and pjsip -- multiple vulnerabilities (f9f5c5a2-17b5-11e8-90b8-001999f8d30b)

The Asterisk project reports : AST-2018-002 - By crafting an SDP message with an invalid media format description Asterisk crashes when using the pjsip channel driver because pjproject's sdp parsing algorithm fails to catch the invalid media format description. AST-2018-003 - By crafting an SDP...

FreeBSD : asterisk -- multiple vulnerabilities (933654ce-17b8-11e8-90b8-001999f8d30b)

The Asterisk project reports : AST-2018-004 - When processing a SUBSCRIBE request the respjsippubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed despite having a fixed limit of 32. If more than 32 Acce...

FreeBSD : phpMyAdmin -- self XSS in central columns feature (261ca31c-179f-11e8-b8b9-6805ca0b3d42)

The phpMyAdmin team reports : Summary Self XSS in central columns feature Description A self-cross site scripting XSS vulnerability has been reported relating to the central columns feature. Severity We consider this vulnerability to be of moderate severity. Mitigation factor A valid token must b...

FreeBSD : GitLab -- multiple vulnerabilities (86291013-16e6-11e8-ae9f-d43d7e971a1b)

GitLab reports : SnippetFinder information disclosure The GitLab SnippetFinder component contained an information disclosure which allowed access to snippets restricted to Only team members or configured as disabled. The issue is now resolved in the latest version. LDAP API authorization issue An...

FreeBSD : bro -- integer overflow allows remote DOS (044cff62-ed8b-4e72-b102-18a7d58a669f)

Philippe Antoine of Catena cyber : This is a security release that fixes an integer overflow in code generated by binpac. This issue can be used by remote attackers to crash Bro i.e. a DoS attack. There also is a possibility this can be exploited in other ways. CVE pending. C Tenable Network...

FreeBSD : Bugzilla security issues (22283b8c-13c5-11e8-a861-20cf30e32f6d)

Bugzilla Security Advisory A CSRF vulnerability in report.cgi would allow a third-party site to extract confidential information from a bug the victim had access to. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : p5-Mojolicious -- cookie-handling vulnerability (a183acb5-1414-11e8-9542-002590acae31)

Upstream commit : Vulnerabilities existed in cookie handling. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

FreeBSD : irssi -- multiple vulnerabilities (7afc5e56-156d-11e8-95f2-005056925db4)

Irssi reports : Use after free when server is disconnected during netsplits. Found by Joseph Bisch. Use after free when SASL messages are received in unexpected order. Found by Joseph Bisch. NULL pointer dereference when an 'empty' nick has been observed by Irssi. Found by Joseph Bisch. When the...

FreeBSD : quagga -- several security issues (e15a22ce-f16f-446b-9ca7-6859350c2e75)

Quagga reports : The Quagga BGP daemon, bgpd, does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or it may crash. The Quagga BGP daemon, bgpd, can double-free memo...

FreeBSD : libraw -- multiple DoS vulnerabilities (6f0b0cbf-1274-11e8-8b5b-4ccc6adda413)

Secunia Research reports : CVE-2018-5800: An off-by-one error within the 'LibRaw::kodakycbcrloadraw' function internal/dcrawcommon.cpp can be exploited to cause a heap-based buffer overflow and subsequently cause a crash. CVE-2017-5801: An error within the 'LibRaw::unpack' function...

FreeBSD : bro -- out of bounds write allows remote DOS (746d04dc-507e-4450-911f-4c41e48bb07a)

Frank Meier : Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service crash and possibly other exploitation. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD : libraw -- multiple DoS vulnerabilities (c60804f1-126f-11e8-8b5b-4ccc6adda413)

Secunia Research reports : CVE-2017-16909: An error related to the 'LibRaw::panasonicloadraw' function dcrawcommon.cpp can be exploited to cause a heap-based buffer overflow and subsequently cause a crash via a specially crafted TIFF image. CVE-2017-16910: An error within the...

FreeBSD : consul -- vulnerability in embedded DNS library (ad2eeab6-ca68-4f06-9325-1937b237df60)

Consul developers report : A flaw was found in the embedded DNS library used in consul which may allow a denial of service attack. Consul was updated to include the fixed version. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeB...

FreeBSD : jenkins -- Path traversal vulnerability allows access to files outside plugin resources (5d374fbb-bae3-45db-afc0-795684ac7353)

Jenkins developers report : Jenkins did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. C Tenable Network...

FreeBSD : bitmessage -- remote code execution vulnerability (1a75c84a-11c8-11e8-83e7-485b3931c969)

Bitmessage developers report : A remote code execution vulnerability has been spotted in use against some users running PyBitmessage v0.6.2. The cause was identified and a fix has been added and released as 0.6.3.2. Will be updated if/when CVE will be available. C Tenable Network Security, Inc. T...

FreeBSD : bchunk -- heap-based buffer overflow and crash (1ec1c59b-0e98-11e8-83e7-485b3931c969)

Mitre reports : bchunk 1.2.0 and 1.2.1 vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE .cue file. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacqu...