FreeBSD : mozilla -- multiple vulnerabilities (f78eac48-c3d1-4666-8de5-63ceea25a578)

Mozilla Foundation reports : CVE-2017-7828: Use-after-free of PressShell while restyling layout CVE-2017-7830: Cross-origin URL information leak through Resource Timing API CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects CVE-2017-7832: Domain spoofing throu...

FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO)

Problem Description: Not all information in the struct ptracelwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of informatio...

Unsupervised Coverage-Guided Kernel Fuzzer: syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer. Linux kernel fuzzing has the most support, akaros, freebsd, fuchsia, netbsd and windows are supported to varying degrees. Initially, syzkaller was developed with Linux kernel fuzzing in mind, but now it’s being extended to support other ...

FreeBSD : rubygem-geminabox -- XSS vulnerabilities (27b38d85-c891-11e7-a7bd-cd1209e563f2)

NVD reports : Stored cross-site scripting XSS vulnerability in 'geminabox' Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the 'homepage' value of a '.gemspec' file, related to views/gem.erb and views/index.erb. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

FreeBSD : konversation -- crash in IRC message parsing (795ccee1-c7ed-11e7-ad7d-001e2a3f778d)

KDE reports : Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks i...

FreeBSD : roundcube -- file disclosure vulnerability (f622608c-c53c-11e7-a633-009c02a2ab30)

MITRE reports : Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target...

FreeBSD : chromium -- multiple vulnerabilities (f8e72cd4-c66a-11e7-bb17-e8e0b747a45a)

Google Chrome Releases reports : 2 security fixes in this release, including : - 777728 Critical CVE-2017-15398: Stack buffer overflow in QUIC. Reported by Ned Williamson on 2017-10-24 - 776677 High CVE-2017-15399: Use after free in V8. Reported by Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-2...

FreeBSD : asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk (19b052c9-c533-11e7-8da5-001999f8d30b)

The Asterisk project reports : By carefully crafting invalid values in the Cseq and the Via header port, pjprojects packet parsing code can create strings larger than the buffer allocated to hold them. This will usually cause Asterisk to crash immediately. The packets do not have to be...

FreeBSD : asterisk -- Buffer overflow in CDR's set user (ab04cb0b-c533-11e7-8da5-001999f8d30b)

The Asterisk project reports : No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. The earlier AST-2017-001 advisory for the CDR user field overflow...

FreeBSD : PostgreSQL vulnerabilities (1f02af5d-c566-11e7-a12d-6cc21735f730)

The PostgreSQL project reports : - CVE-2017-15098: Memory disclosure in JSON functions - CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

FreeBSD : asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource (be261737-c535-11e7-8da5-001999f8d30b)

The Asterisk project reports : A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. This then leads to file descriptors and RTP ports being leake...

FreeBSD : jenkins -- multiple issues (1c2a9d76-9d98-43c3-8f5d-8c059b104d99)

Jenkins developers report : Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially...

FreeBSD : OpenSSL -- Multiple vulnerabilities (f40f07aa-c00f-11e7-ac58-b499baebfeaf)

The OpenSSL project reports : bnsqrx8xinternal carry bug on x8664 CVE-2017-3736 Severity: Moderate There is a carry propagating bug in the x8664 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be ver...

FreeBSD : wordpress -- multiple issues (cee3d12f-bf41-11e7-bced-00e04c1ea73d)

wordpress developers reports : WordPress versions 4.8.2 and earlier are affected by an issue where $wpdb-prepare can create unexpected and unsafe queries leading to potential SQL injection SQLi. WordPress core is not directly vulnerable to this issue, but we've added hardening to prevent plugins...

FreeBSD : PHP -- denial of service attack (de7a2b32-bd7d-11e7-b627-d43d7e971a1b)

The PHP project reports : The PHP development team announces the immediate availability of PHP 5.6.32. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version. The PHP development team announces the immediate...

FreeBSD : chromium -- Stack overflow in V8 (3cd46257-bbc5-11e7-a3bc-e8e0b747a45a)

Google Chrome Releases reports : 2 security fixes in this release, including : - 770452 High CVE-2017-15396: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30 - 770450 Medium CVE-2017-15406: Stack overflow in V8. Reported by Yuan Deng of...

FreeBSD : wget -- Heap overflow in HTTP protocol handling (d77ceb8c-bb13-11e7-8357-3065ec6f3643)

Antti Levomaki, Christian Jalio, Joonas Pihlaja : Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of...

FreeBSD : wget -- Stack overflow in HTTP protocol handling (09849e71-bb12-11e7-8357-3065ec6f3643)

Antti Levomaki, Christian Jalio, Joonas Pihlaja : Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of...

FreeBSD : Node.js -- remote DOS security vulnerability (d7d1cc94-b971-11e7-af3a-f1035dd0da62)

Node.js reports : Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception depending on the version %NASLMINLEVEL 70300 C Tenabl...

FreeBSD : GitLab -- multiple vulnerabilities (418c172b-b96f-11e7-b627-d43d7e971a1b)

GitLab reports : Cross-Site Scripting XSS vulnerability in the Markdown sanitization filter Yasin Soliman via HackerOne reported a Cross-Site Scripting XSS vulnerability in the GitLab markdown sanitization filter. The sanitization filter was not properly stripping invalid characters from URL...