FreeBSD : ImageMagick -- heap overflow vulnerability (19d35b0f-ba73-11e6-b1cf-14dae9d210b8)

Bastien Roucaries reports : Imagemagick before 3cbfb163cff9e5b8cdeace8312e9bfee810ed02b suffer from a heap overflow in WaveletDenoiseImage. This problem is easily trigerrable from a Perl script. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[] (4aae54be-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : x86 HVM guests running with shadow paging use a subset of the x86 emulator to handle the guest writing to its own pagetables. There are situations a guest can provoke which result in exceeding the space allocated for internal state. A malicious HVM guest administrator ca...

FreeBSD : xen-kernel -- x86 null segments not always treated as unusable (50ac2e96-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a...

FreeBSD : xen-kernel -- x86 64-bit bit test instruction emulation broken (56f0f11e-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : The x86 instructions BT, BTC, BTR, and BTS, when used with a destination memory operand and a source register rather than an immediate operand, access a memory location offset from that specified by the memory operand as specified by the high bits of the register source....

FreeBSD : xen-kernel -- x86 task switch to VM86 mode mis-handled (523bb0b7-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code. On SVM AMD hardware: a malicious unprivileged guest process can escalate its...

FreeBSD : xen-kernel -- x86 segment base write emulation lacking canonical address checks (53dbd096-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against GP...

FreeBSD : xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests (4d7cf654-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : Instructions touching FPU, MMX, or XMM registers are required to raise a Device Not Available Exception NM when either CR0.EM or CR0.TS are set. Their AVX or AVX-512 extensions would consider only CR0.TS. While during normal operation this is ensured by the hardware, if ...

FreeBSD : wireshark -- multiple vulnerabilities (7fff2b16-b0ee-11e6-86b8-589cfc054129)

Wireshark project reports : Wireshark project is releasing Wireshark 2.2.2, which addresses : - wnpa-sec-2016-58: Profinet I/O long loop - CVE-2016-9372 - wnpa-sec-2016-59: AllJoyn crash - CVE-2016-9374 - wnpa-sec-2016-60: OpenFlow crash - CVE-2016-9376 - wnpa-sec-2016-61: DCERPC crash -...

FreeBSD : p7zip -- NULL pointer dereference (48e83187-b6e9-11e6-b6cf-5453ed2e2b49)

MITRE reports : A NULL pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of NULL pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams, as used in the 7z.so library and in 7z applications, will cause a crash and a...

FreeBSD : Mozilla -- SVG Animation Remote Code Execution (18f39fb6-7400-4063-acaf-0806e92c094f)

The Mozilla Foundation reports : A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

FreeBSD : wget -- Access List Bypass / Race Condition (479c5b91-b6cc-11e6-a04e-3417eb99b9a0)

Dawid Golunski reports : GNU wget in version 1.17 and earlier, when used in mirroring/recursive mode, is affected by a Race Condition vulnerability that might allow remote attackers to bypass intended wget access list restrictions specified with -A parameter. %NASLMINLEVEL 70300 C Tenable Network...

FreeBSD : libwww -- multiple vulnerabilities (18449f92-ab39-11e6-8011-005056925db4)

Mitre reports : The HTBoundaryputblock function in HTBound.c for W3C libwww w3c-libwww allows remote servers to cause a denial of service segmentation fault via a crafted multipart/byteranges MIME message that triggers an out-of-bounds read. The big2toUtf8 function in lib/xmltok.c in libexpat in...

FreeBSD : subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s) (ac256985-b6a9-11e6-a3bf-206a8a720317)

The Apache Software Foundation reports : The moddontdothat module of subversion and subversion clients using https:// are vulnerable to a denial-of-service attack, caused by exponential XML entity expansion. The attack targets XML parsers causing targeted process to consume excessive amounts of...

FreeBSD : Roundcube -- arbitrary command execution (125f5958-b611-11e6-a9a5-b499baebfeaf)

The Roundcube project reports steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote...

FreeBSD : mozilla -- data: URL can inherit wrong origin after an HTTP redirect (f90fce70-ecfa-4f4d-9ee8-c476dbf4bf0e)

The Mozilla Foundation reports : Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies ha...

FreeBSD : phpMyAdmin -- multiple vulnerabilities (6fe72178-b2e3-11e6-8b2a-6805ca0b3d42)

Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in source VuXML and...

FreeBSD : Drupal Code -- Multiple Vulnerabilities (8db24888-b2f5-11e6-8153-00248c0c745d)

The Drupal development team reports : Inconsistent name for term access query Less critical - Drupal 7 and Drupal 8 Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities b...

FreeBSD : Remote-Code-Execution vulnerability in mysql and its variants CVE 2016-6662 (dc596a17-7a9e-11e6-b034-f0def167eeea)

LegalHackers' reports : RCE Bugs discovered in MySQL and its variants like MariaDB. It works by manipulating my.cnf files and using --malloc-lib. The bug seems fixed in MySQL 5.7.15 by Oracle %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

FreeBSD 8.0, 7.3 and 7.2 nfs_mount() denial of service vulnerability

No description provided by source. Local kernel exploit for FreeBSD 8.0, 7.3 and 7.2 include include include include include include include include include include include include include define BUFSIZE 272 define FSNAME "nfs" define DIRPATH "/tmp/nfs" unsigned char kernelcode =...

FreeBSD : ntp -- multiple vulnerabilities (8db8d62a-b08b-11e6-8eba-d050996490d0)

Network Time Foundation reports : NTF's NTP Project is releasing ntp-4.2.8p9, which addresses : - 1 HIGH severity vulnerability that only affects Windows - 2 MEDIUM severity vulnerabilities - 2 MEDIUM/LOW severity vulnerabilities - 5 LOW severity vulnerabilities - 28 other non-security fixes and...