FreeBSD : php -- multiple vulnerabilities (5764c634-10d2-11e6-94fa-002590263bf5)

The PHP Group reports : - BCMath : - Fixed bug 72093 bcpowmod accepts negative scale and corrupts one definition. - Exif : - Fixed bug 72094 Out of bounds heap read access in exif header processing. - GD : - Fixed bug 71912 libgd: signedness vulnerability. CVE-2016-3074 - Intl : - Fixed bug 72061...

FreeBSD : libksba -- local denial of service vulnerabilities (a1134048-10c6-11e6-94fa-002590263bf5)

Martin Prpic, Red Hat Product Security Team, reports : Denial of Service due to stack overflow in src/ber-decoder.c. Integer overflow in the BER decoder src/ber-decoder.c. Integer overflow in the DN decoder src/dn.c. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

FreeBSD : MySQL -- multiple vulnerabilities (8c2b2f11-0ebe-11e6-b55e-b499baebfeaf)

Oracle reports reports : Critical Patch Update contains 31 new security fixes for Oracle MySQL 5.5.48, 5.6.29, 5.7.11 and earlier %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

FreeBSD : wireshark -- multiple vulnerabilities (7e36c369-10c0-11e6-94fa-002590263bf5)

Wireshark development team reports : The following vulnerabilities have been fixed : - wnpa-sec-2016-19 The NCP dissector could crash. Bug 11591 - wnpa-sec-2016-20 TShark could crash due to a packet reassembly bug. Bug 11799 - wnpa-sec-2016-21 The IEEE 802.11 dissector could crash. Bug 11824, Bug...

FreeBSD : mercurial -- arbitrary code execution vulnerability (78abc022-0fee-11e6-9a1c-0014a5a57822)

Mercurial reports : CVE-2016-3105: Arbitrary code execution when converting Git repos %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

FreeBSD-SA-16:16.ntp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:16.ntp Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities of ntp Category: contrib Module: ntp Announced: 2016-04-29 Credits: Network Time...

FreeBSD : logstash -- password disclosure vulnerability (f2d4f879-0d7c-11e6-925f-6805ca0b3d42)

Logstash developers report : Passwords Printed in Log Files under Some Conditions It was discovered that, in Logstash 2.1.0+, log messages generated by a stalled pipeline during shutdown will print plaintext contents of password fields. While investigating this issue we also discovered that debug...

FreeBSD : subversion -- multiple vulnerabilities (c8174b63-0d3a-11e6-b06e-d43d7eed0ce2)

Subversion project reports : svnserve, the svn:// protocol server, can optionally use the Cyrus SASL library for authentication, integrity protection, and encryption. Due to a programming oversight, authentication against Cyrus SASL would permit the remote user to specify a realm string which is ...

FreeBSD : mozilla -- multiple vulnerabilities (92d44f83-a7bf-41cf-91ee-3d1b8ecf579f)

Mozilla Foundation reports : MFSA 2016-39 Miscellaneous memory safety hazards rv:46.0 / rv:45.1 / rv:38.8 MFSA 2016-42 Use-after-free and buffer overflow in Service Workers MFSA 2016-44 Buffer overflow in libstagefright with CENC offsets MFSA 2016-45 CSP not applied to pages sent with...

FreeBSD : phpmyfaq -- cross-site request forgery vulnerability (f87a9376-0943-11e6-8fc4-00a0986f28c4)

The phpMyFAQ team reports : The vulnerability exists due to application does not properly verify origin of HTTP requests in 'Interface Translation' functionality.: A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrato...

FreeBSD : proftpd -- vulnerability in mod_tls (a733b5ca-06eb-11e6-817f-3085a9a4510d)

MITRE reports : The modtls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman DH key to be used and consequently allow attackers to have unspecified impact via unknown vectors...

FreeBSD : squid -- multiple vulnerabilities (e05bfc92-0763-11e6-94fa-002590263bf5)

Squid security advisory 2016:5 reports : Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid. This problem allows any client to seed the Squid manager reports with data that will cause a...

FreeBSD : ansible -- use of predictable paths in lxc_container (253c6889-06f0-11e6-925f-6805ca0b3d42)

Ansible developers report : CVE-2016-3096: do not use predictable paths in lxccontainer - do not use a predictable filename for the LXC attach script - don't use predictable filenames for LXC attach script logging - don't set a predictable archivepath this should prevent symlink attacks which cou...

FreeBSD : libtasn1 -- denial of service parsing malicious DER certificates (1b0d2938-0766-11e6-94fa-002590263bf5)

GNU Libtasn1 NEWS reports : Fixes to avoid an infinite recursion when decoding without the ASN1DECODEFLAGSTRICTDER flag. Reported by Pascal Cuoq. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

FreeBSD : chromium -- multiple vulnerabilities (6d8505f0-0614-11e6-b39c-00262d5ed8ee)

Google Chrome Releases reports : 20 security fixes in this release, including : - 590275 High CVE-2016-1652: Universal XSS in extension bindings. Credit to anonymous. - 589792 High CVE-2016-1653: Out-of-bounds write in V8. Credit to Choongwoo Han. - 591785 Medium CVE-2016-1651: Out-of-bounds read...

FreeBSD : hostapd and wpa_supplicant -- multiple vulnerabilities (976567f6-05c5-11e6-94fa-002590263bf5)

Jouni Malinen reports : wpasupplicant unauthorized WNM Sleep Mode GTK control. 2015-6 - CVE-2015-5310 EAP-pwd missing last fragment length validation. 2015-7 - CVE-2015-5315 EAP-pwd peer error path failure on unexpected Confirm message. 2015-8 - CVE-2015-5316 %NASLMINLEVEL 70300 C Tenable Network...

FreeBSD : dhcpcd -- remote code execution/denial of service (092156c9-04d7-11e6-b1ce-002590263bf5)

MITRE reports : The getoption function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of...

FreeBSD : PJSIP -- TCP denial of service in PJProject (e21474c6-031a-11e6-aa86-001999f8d30b)

The Asterisk project reports : PJProject has a limit on the number of TCP connections that it can accept. Furthermore, PJProject does not close TCP connections it accepts. By default, this value is approximately 60. An attacker can deplete the number of allowed TCP connections by opening TCP...

FreeBSD : dhcpcd -- remote code execution/denial of service (6ec9f210-0404-11e6-9aee-bc5ff4fb5ea1)

MITRE reports : The printoption function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of...

FreeBSD : asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk (ee50726e-0319-11e6-aa86-001999f8d30b)

The Asterisk project reports : Asterisk may crash when processing an incoming REGISTER request if that REGISTER contains a Contact header with a lengthy URI. This crash will only happen for requests that pass authentication. Unauthenticated REGISTER requests will not result in a crash occurring...