FreeBSD : Tor -- remote denial of service (c1dc55dc-9556-11e6-b154-3065ec8fd3ec)

The Tor Blog reports : Prevent a class of security bugs caused by treating the contents of a buffer chunk as if they were a NUL-terminated string. At least one such bug seems to be present in all currently used versions of Tor, and would allow an attacker to remotely crash most Tor instances,...

FreeBSD : Rails 4 -- Possible XSS Vulnerability in Action View (43f1c867-654a-11e6-8286-00248c0c745d)

Ruby Security team reports : There is a possible XSS vulnerability in Action View. Text declared as 'HTML safe' will not have quotes escaped when used as attribute values in tag helpers. This vulnerability has been assigned the CVE identifier CVE-2016-6316. %NASLMINLEVEL 70300 C Tenable Network...

FreeBSD : PHP -- multiple vulnerabilities (8d5180a6-86fe-11e6-8d93-00248c0c745d)

PHP reports : - Fixed bug 73007 add locale length check - Fixed bug 72293 Heap overflow in mysqlnd related to BIT fields - Fixed bug 72928 Out of bound when verify signature of zip phar in pharparsezipfile - Fixed bug 73029 Missing type check when unserializing SplArray - Fixed bug 73052 Memory...

FreeBSD : Rails 4 -- Unsafe Query Generation Risk in Active Record (7e61cf44-6549-11e6-8286-00248c0c745d)

Ruby Security team reports : There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability has been assigned the CVE identifier CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155. %NASLMINLEVEL 70300 ...

FreeBSD : PHP -- multiple vulnerabilities (f471032a-8700-11e6-8d93-00248c0c745d)

PHP reports : - Fixed bug 73007 add locale length check - Fixed bug 72293 Heap overflow in mysqlnd related to BIT fields - Fixed bug 72928 Out of bound when verify signature of zip phar in pharparsezipfile - Fixed bug 73029 Missing type check when unserializing SplArray - Fixed bug 73052 Memory...

FreeBSD : ImageMagick -- multiple vulnerabilities (10f7f782-901c-11e6-a590-14dae9d210b8)

Debian reports : Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service or the execution of arbitrary code if malformed SIXEL, PDB, MAP, SGI, TIFF and CALS files are processed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : libgd -- integer overflow which could lead to heap buffer overflow (2a526c78-84ab-11e6-a4a1-60a44ce6887b)

LibGD reports : An integer overflow issue was found in function gdImageWebpCtx of file gdwebp.c which could lead to heap buffer overflow. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database :...

FreeBSD : openoffice -- information disclosure vulnerability (ab947396-9018-11e6-a590-14dae9d210b8)

Apache reports : The exposure exploits the way OLE previews are generated to embed arbitrary file data into a specially crafted document when it is opened. Data exposure is possible if the updated document is distributed to other parties. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : openjpeg -- multiple vulnerabilities (b7d56d0b-7a11-11e6-af78-589cfc0654e1)

Tencent's Xuanwu LAB reports : A Heap Buffer Overflow Out-of-Bounds Write issue was found in function opjdwtinterleavev of dwt.c. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OpenJPEG. An integer overflow issue exists in function...

FreeBSD : file-roller -- path traversal vulnerability (ad479f89-9020-11e6-a590-14dae9d210b8)

reports : File Roller 3.5.4 through 3.20.2 was affected by a path traversal bug that could result in deleted files if a user were tricked into opening a malicious archive. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

FreeBSD : libvncserver -- multiple security vulnerabilities (cb3f036d-8c7f-11e6-924a-60a44ce6887b)

Nicolas Ruff reports : Integer overflow in MallocFrameBuffer on client side. Lack of malloc return value checking on client side. Server crash on a very large ClientCutText message. Server crash when scaling factor is set to zero. Multiple stack overflows in File Transfer feature. %NASLMINLEVEL...

FreeBSD : mupdf -- multiple vulnerabilities (47157c14-9013-11e6-a590-14dae9d210b8)

Tobias Kortkamp reports : Heap-based buffer overflow in the pdfloadmeshparams function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service crash or execute arbitrary code via a large decode array. Use-after-free vulnerability in the pdfloadxref function in...

FreeBSD : redis -- sensitive information leak through command history file (fa175f30-8c75-11e6-924a-60a44ce6887b)

Redis team reports : The redis-cli history file in linenoise is created with the default OS umask value which makes it world readable in most systems and could potentially expose authentication credentials to other users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

FreeBSD : VirtualBox -- undisclosed vulnerabilities (7d40edd1-901e-11e6-a590-14dae9d210b8)

Oracle reports reports : Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core. Unspecified...

FreeBSD : FreeBSD -- Multiple portsnap vulnerabilities (e7dcd69d-8ee6-11e6-a590-14dae9d210b8)

Flaws in portsnap's verification of downloaded tar files allows additional files to be included without causing the verification to fail. Portsnap may then use or execute these files. Impact : An attacker who can conduct man in the middle attack on the network at the time when portsnap is run can...

FreeBSD : FreeBSD -- Multiple libarchive vulnerabilities (1a71a972-8ee7-11e6-a590-14dae9d210b8)

Flaws in libarchive's handling of symlinks and hard links allow overwriting files outside the extraction directory, or permission changes to a directory outside the extraction directory. Impact : An attacker who can control freebsd-update's or portsnap's input to tar1 can change file content or...

FreeBSD : FreeBSD -- Heap overflow vulnerability in bspatch (ce808022-8ee6-11e6-a590-14dae9d210b8)

The implementation of bspatch is susceptible to integer overflows with carefully crafted input, potentially allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was partially addressed in FreeBSD-SA-16:25.bspatch, but some possible integer...

FreeBSD : X.org libraries -- multiple vulnerabilities (1cf65085-a760-41d2-9251-943e1af62eb8)

Matthieu Herrb reports : Tobias Stoeckmann from the OpenBSD project has discovered a number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues. These issue come in...

FreeBSD : mkvtoolnix -- code execution via specially crafted files (aeb7874e-8df1-11e6-a082-5404a68ad561)

Moritz Bunkus reports : most of the bugs fixed on 2016-09-06 and 2016-09-07 for issue 1780 are potentially exploitable. The scenario is arbitrary code execution with specially crafted files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

FreeBSD-SA-16:30.portsnap

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:30.portsnap Security Advisory The FreeBSD Project Topic: Multiple portsnap vulnerabilities Category: core Module: portsnap Announced: 2016-10-10 Affects: All...