CVE-2017-4970: Static file buildpack ignores basic authentication when misconfigured | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release v255 Staticfile buildpack versions v1.4.0 – v1.4.3 Description A regression introduced in the Staticfile buildpack causes the Staticfile.auth configuration to be ignored when the Staticfile file is not present in the...

file: Use-of-uninitialized-value in match

Detailed report: https://oss-fuzz.com/testcase?key=6203080456536064 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzermsanfile Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: match filesoftmagic mget Sanitizer:...

file: Heap-buffer-overflow in cdf_file_property_info

Project: https://github.com/file/file.git Detailed report: https://oss-fuzz.com/testcase?key=5417710252982272 Project: file Fuzzer: libFuzzerfilemagicfuzzer Fuzz target binary: magicfuzzer Job Type: libfuzzerasanfile Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

WebKit: Use-After-Free via Document::adoptNode (CVE-2017-2468)

This is a regression test from: https://crbug.com/541206. But I think it seems not possible to turn it into an UXSS in WebKit. PoC: var s = document.body.appendChilddocument.createElement'script'; s.type = '0'; s.textContent = 'document.body.appendChildparent.i0'; var i0 =...

[SECURITY] [DSA 3816-2] samba regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3816-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3816-2] samba regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3816-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2017 https://www.debian.org/security/faq -...

Ubuntu 14.04 LTS / 16.04 LTS : Samba regression (USN-3242-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3242-2 advisory. USN-3242-1 fixed a vulnerability in Samba. The upstream fix introduced a regression when Samba is configured to disable following symbolic links. This...

grpc: Heap-buffer-overflow in grpc_base64_decode

Detailed report: https://oss-fuzz.com/testcase?key=5595941564317696 Project: grpc Fuzzer: libFuzzergrpcserverfuzzer Job Type: libfuzzerasangrpc Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x608000000172 Crash State: grpcbase64decode serverfilterincomingmetadata hsonrec...

USN-3242-2: Samba regression

USN-3242-1 fixed a vulnerability in Samba. The upstream fix introduced a regression when Samba is configured to disable following symbolic links. This update fixes the problem. Original advisory details: Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacke...

USN-3242-2 samba regression

USN-3242-1 fixed a vulnerability in Samba. The upstream fix introduced a regression when Samba is configured to disable following symbolic links. This update fixes the problem. Original advisory details: Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacke...

Fixed in Apache Tomcat 8.5.13

Important: Information Disclosure CVE-2017-5651 The refactoring of the HTTP connectors for 8.5.x onwards, introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could resu...

[SECURITY] [DSA 3798-2] tnef regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3798-2 [email protected] https://www.debian.org/security/ Sebastien Delafond March 29, 2017 https://www.debian.org/security/faq -...

DSA-3798-2 tnef - regression update

Bulletin has no description...

[SECURITY] [DLA 547-2] graphicsmagick regression update

Package : graphicsmagick Version : 1.3.16-1.1+deb7u6 CVE ID : CVE-2016-5240 Debian Bug : N/A The fix for CVE-2016-5240 was improperly applied which resulted in GraphicsMagick crashing instead of entering an infinite loop with the given proof of concept. Furthermore, the original announcement...

DLA-547-2 graphicsmagick - regression update

Bulletin has no description...

samba security and bug fix update

3.6.23-41.0.1 - Remove use-after-free talloctos inlined function problem John Haxby orabug 18253258 3.6.23-41 - resolves: 1413672 - Auth regression after secret changed 3.6.23-40 - resolves: 1405356 - CVE-2016-2125 CVE-2016-2126 3.6.23-39 - resolves: 1297805 - Fix issues with printer unpublishing...

[SECURITY] [DLA 839-2] tnef regression update

Package : tnef Version : 1.4.9-1+deb7u2 CVE ID : CVE-2017-6307 CVE-2017-6308 CVE-2017-6309 CVE-2017-6310 Debian Bug : 857342 While fixing the above mentioned CVEs, upstream introduced a regression. The new patches added for this upload take care of that. For Debian 7 "Wheezy", these problems have...

Ubuntu 12.04 LTS : eglibc regression (USN-3239-3)

USN-3239-1 fixed vulnerabilities in the GNU C Library. Unfortunately, the fix for CVE-2016-3706 introduced a regression that in some circumstances prevented IPv6 addresses from resolving. This update reverts the change in Ubuntu 12.04 LTS. We apologize for the error. It was discovered that the GN...

[SECURITY] [DSA 3796-2] sitesummary regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3796-2 [email protected] https://www.debian.org/security/ Sebastien Delafond March 20, 2017 https://www.debian.org/security/faq -...

CVE-2015-8985

The popfailstack function in the GNU C Library aka glibc or libc6 allows context-dependent attackers to cause a denial of service assertion failure and application crash via vectors related to extended regular expression processing...