Vulnerability in OpenSSL - CMS Null dereference

Applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings...

openssl -- multiple vulnerabilities

OpenSSL reports: ChaCha20/Poly1305 heap-buffer-overflow CVE-2016-7054 Severity: High TLS connections using -CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a Do...

krb5 security, bug fix, and enhancement update

1.14.1-26 - Use responder in non-preauth AS reqs - Resolves: 1363690 1.14.1-25 - Fix bad debuglog call in selinux handling - Resolves: 1292153 1.14.1-24 - Fix KKDCPP with TLS SNI by always presenting 'Host:' header - Resolves: 1364993 1.14.1-23 - Add dependency on libkadm5 to krb5-devel - Resolve...

openSUSE Security Update : ghostscript (openSUSE-2016-1237)

This update for ghostscript fixes the following issues : - CVE-2016-8602: Fixes a NULL dereference in .sethalftone5 boo1004237. - CVE-2013-5653, CVE-2016-7978, CVE-2016-7979: Fix multiple -dsafer related CVE's boo1001951. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Security update for ghostscript (important)

This update for ghostscript fixes the following issues: - CVE-2016-8602: Fixes a NULL dereference in .sethalftone5 boo1004237. - CVE-2013-5653, CVE-2016-7978, CVE-2016-7979: Fix multiple -dsafer related CVE's boo1001951...

Fedora 23 : php (2016-0729e59542)

13 Oct 2016 - PHP version 5.6.27 Core: - Fixed bug php73025 Heap Buffer Overflow in virtualpopen of zendvirtualcwd.c. cmb - Fixed bug php73058 crypt broken when salt is 'too' long. Anatol - Fixed bug php72703 Out of bounds global memory read in BFcrypt triggered by passwordverify. Anatol - Fixed...

Fedora 23 : openssh (2016-bb007a4097)

Fix NULL dereference 1380297 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Internet Bug Bounty: CachingIterator null dereference when convert to string

https://bugs.php.net/bug.php?id=73073 Please feel free to ask for more technical details if necessary. Thank you for your consideration...

CVE-2016-7118

fs/fcntl.c in the "aufs 3.2.x+setfl-debian" patch in the linux-image package 3.2.0-4 kernel 3.2.81-1 in Debian wheezy mishandles FSETFL fcntl calls on directories, which allows local users to cause a denial of service NULL pointer dereference and system crash via standard filesystem operations, a...

Internet Bug Bounty: wddx_deserialize null dereference in php_wddx_pop_element

Upstream Bug --- https://bugs.php.net/bug.php?id=72799 Summary -- If we add an element to boolean leaf of XML struct, a null pointer dereference will happen when the element is popped. Source code: https://github.com/php/php-src/blob/PHP-5.6.24/ext/wddx/wddx.cL985 static void phpwddxpopelementvoi...

UBUNTU-CVE-2016-6888

Integer overflow in the nettxpktinit function in hw/net/nettxpkt.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service QEMU process crash via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference...

Apple Mac OSX - Kernel Exploitable NULL Dereference in CoreCaptureResponder Due to Unchecked Return

Exploit for macOS platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=777 Pretty much all the external methods of CoreCaptureUserClient call CoreCaptureUserClient::stashGet passing an attacker controlled key. If that key isn't in the list of stashed...

Apple Mac OSX Kernel - NULL Dereference in CoreCaptureResponder Due to Unchecked Return Value

Apple Mac OSX Kernel - NULL Dereference in CoreCaptureResponder Due to Unchecked Return Value / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=777 Pretty much all the external methods of CoreCaptureUserClient call CoreCaptureUserClient::stashGet passing an attacker controlled...

Apple Mac OSX Kernel - NULL Dereference in IOAccelSharedUserClient2::page_off_resource

Apple Mac OSX Kernel - NULL Dereference in IOAccelSharedUserClient2::pageoffresource / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=778 IOAccelerator external method IOAccelSharedUserClient2::pageoffresource uses the pointer at this+0x100 without checking if it's NULL. A seri...

Apple Mac OSX Kernel - NULL Dereference in IOAccelSharedUserClient2::page_off_resource

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=778 IOAccelerator external method IOAccelSharedUserClient2::pageoffresource uses the pointer at this+0x100 without checking if it's NULL. A series of dereferences from this pointer lead to trivial RIP control. We can race two...

Unbreakable Enterprise kernel security update

kernel-uek 2.6.32-400.37.17 - net: add validation for the socket syscall protocol argument Hannes Frederic Sowa Orabug: 23267965 CVE-2015-8543 CVE-2015-8543 - ext4: Fix null dereference in ext4fillsuper Ben Hutchings Orabug: 23263398 CVE-2015-8324 CVE-2015-8324 - ipv6: addrconf: validate new MTU...

Fedora 23 : krb5-1.14.1-3.fc23 (2016-56840babc3)

CVE-2016-3119, NULL dereference in LDAP module. ---- Fix an issue with return codes on gssinquireattrsformech. This resolves an issue with gss-ntlmssp, and anything else that is interposing but not implementing the corresponding mechglue function. Note that Tenable Network Security has extracted...

Apple Mac OSX - IOSCSIPeripheralDeviceType00 Userclient Type 12 Kernel NULL Dereference

Apple Mac OSX - IOSCSIPeripheralDeviceType00 Userclient Type 12 Kernel NULL Dereference / Source: https://code.google.com/p/google-security-research/issues/detail?id=562 Opening userclient type 12 of IOSCSIPeripheralDeviceType00 leads to an exploitable kernel NULL dereference. Tested on OS X 10.1...

Apple Mac OSX - IntelAccelerator::gstqConfigure Kernel NULL Dereference

Apple Mac OSX - IntelAccelerator::gstqConfigure Kernel NULL Dereference / Source: https://code.google.com/p/google-security-research/issues/detail?id=595 The field at IntelAccelerator+0xe60 is a pointer to a GSTContextKernel allocated in the ::gstqCreateInfoMethod. In the ::start method this fiel...

Apple Mac OSX - IntelAccelerator::gstqConfigure Exploitable Kernel NULL Dereference

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=595 The field at IntelAccelerator+0xe60 is a pointer to a GSTContextKernel allocated in the ::gstqCreateInfoMethod. In the ::start method this field is initialized to NUL...