6752 matches found
asterisk -- Crash in PJSIP resource when missing a contact header
The Asterisk project reports: A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is...
wget -- Heap overflow in HTTP protocol handling
Antti Levomäki, Christian Jalio, Joonas Pihlaja: Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of...
phpmyfaq -- multiple issues
phpmyfaq developers report: Cross-site scripting XSS vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action. Cross-site scripting XSS vulnerability in phpMyFAQ through 2.9.8 allow...
libgcrypt -- side-channel attack vulnerability
GnuPG reports: Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You"...
GitLab -- two vulnerabilities
GitLab reports: Remote Command Execution in git client An external code review performed by Recurity-Labs identified a remote command execution vulnerability in git that could be exploited via the "Repo by URL" import option in GitLab. The command line git client was not properly escaping command...
SquirrelMail -- post-authentication access privileges
Florian Grunow reports: An attacker able to exploit this vulnerability can extract files of the server the application is running on. This may include configuration files, log files and additionally all files that are readable for all users on the system. This issue is post-authentication. That...
BIND -- multiple vulnerabilities
ISC reports: A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other...
gtk-vnc -- bounds checking vulnerabilities
Daniel P. Berrange reports: CVE-2017-5884 - fix bounds checking for RRE, hextile and copyrect encodings CVE-2017-5885 - fix color map index bounds checking...
PHP -- undisclosed vulnerabilities
The PHP project reports: The PHP development team announces the immediate availability of PHP 7.0.15. This is a security release. Several security bugs were fixed in this release. The PHP development team announces the immediate availability of PHP 5.6.30. This is a security release. Several...
file-roller -- path traversal vulnerability
reports: File Roller 3.5.4 through 3.20.2 was affected by a path traversal bug that could result in deleted files if a user were tricked into opening a malicious archive...
chicken -- multiple vulnerabilities
Peter Bex reports: A buffer overflow error was found in the POSIX unit's procedures process-execute and process-spawn. Additionally, a memory leak existed in this code, which would be triggered when an error is raised during argument and environment processing. Irregex versions before 0.9.6 conta...
The GIMP -- Use after Free vulnerability
The GIMP team reports: A Use-after-free vulnerability was found in the xcfloadimage function...
jansson -- local denial of service vulnerabilities
QuickFuzz reports: A crash caused by stack exhaustion parsing a JSON was found...
mercurial -- multiple vulnerabilities
Mercurial reports: CVE-2016-3630: Remote code execution in binary delta decoding CVE-2016-3068: Arbitrary code execution with Git subrepos CVE-2016-3069: Arbitrary code execution when converting Git repos...
PostgreSQL -- minor security problems.
PostgreSQL project reports: Security Fixes for RLS, BRIN This release closes security hole CVE-2016-2193 https://access.redhat.com/security/cve/CVE-2016-2193, where a query plan might get reused for more than one ROLE in the same session. This could cause the wrong set of Row Level Security RLS...
chromium -- same origin bypass
Google Chrome Releases reports: 583431 Critical CVE-2016-1629: Same-origin bypass in Blink and Sandbox escape in Chrome. Credit to anonymous...
h2o -- directory traversal vulnerability
Yakuzo OKU reports: When redirect directive is used, this flaw allows a remote attacker to inject response headers into an HTTP redirect response...
nghttp2 -- use after free
nghttp2 reports: This release fixes heap-use-after-free bug in idle stream handling code. We strongly recommend to upgrade the older installation to this latest version as soon as possible...
passenger -- client controlled header overwriting
Daniel Knoppel reports: It was discovered by the SUSE security team that it was possible, in some cases, for clients to overwrite headers set by the server, resulting in a medium level security issue. CVE-2015-7519 has been assigned to this issue. Affected use-cases: Header overwriting may occur ...
bind -- multiple vulnerabilities
ISC reports: Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193. Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. RT40945 Insufficient testing when...
quassel -- remote denial of service
Pierre Schweitzer reports: Any client sending the command "/op " in a query will cause the Quassel core to crash...
libsrtp -- DoS via crafted RTP header vulnerability
libsrtp reports: Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue...
firefox -- Cross-origin restriction bypass using Fetch
Firefox Developers report: Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reporte...
shutter -- arbitrary code execution
Luke Farone reports: In the "Shutter" screenshot application, I discovered that using the "Show in folder" menu option while viewing a file with a specially-crafted path allows for arbitrary code execution with the permissions of the user running Shutter...
powerdns -- denial of service
PowerDNS reports: A bug was found in our DNS packet parsing/generation code, which, when exploited, can cause individual threads disabling service or whole processes allowing a supervisor to restart them to crash with just one or a few query packets...
devel/ipython -- multiple vulnerabilities
Matthias Bussonnier reports: Summary: Local folder name was used in HTML templates without escaping, allowing XSS in said pages by carefully crafting folder name and URL to access it. URI with issues: GET /tree/ Benjamin RK reports: Vulnerability: A maliciously forged file opened for editing can...
mozilla -- multiple vulnerabilities
The Mozilla Project reports: MFSA 2015-78 Same origin violation and local file stealing via PDF reader...
FreeBSD -- routed(8) remote denial of service vulnerability
Problem Description: The input path in routed8 will accept queries from any source and attempt to answer them. However, the output path assumes that the destination address for the response is on a directly connected network. Impact: Upon receipt of a query from a source which is not on a directl...
FreeBSD -- shell injection vulnerability in patch(1)
Problem Description: Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch1 to run commands in addition to the desired SCCS or RCS commands. Impact: This issue could be exploited to execute arbitrary commands as the user invoking patch1 against...
devel/ipython -- CSRF possible remote execution vulnerability
Kyle Kelley reports: Summary: POST requests exposed via the IPython REST API are vulnerable to cross-site request forgery CSRF. Web pages on different domains can make non-AJAX POST requests to known IPython URLs, and IPython will honor them. The user's browser will automatically send IPython...
powerdns -- Label decompression bug can cause crashes or CPU spikes
The PowerDNS project reports: A bug was discovered in our label decompression code, making it possible for names to refer to themselves, thus causing a loop during decompression. On some platforms, this bug can be abused to cause crashes. On all platforms, this bug can be abused to cause...
privoxy -- multiple vulnerabilities
Privoxy Developers reports: Fixed a memory leak when rejecting client connections due to the socket limit being reached CID 66382. This affected Privoxy 3.0.21 when compiled with IPv6 support on most platforms this is the default. Fixed an immediate-use-after-free bug CID 66394 and two additional...
Dulwich -- Remote code execution
MITRE reports: Buffer overflow in the C implementation of the applydelta function in pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file...
WebKit-gtk -- Multiple vulnerabilities
Webkit release team reports: This release fixes the following security issues: CVE-2014-1344, CVE-2014-1384, CVE-2014-1385, CVE-2014-1386, CVE-2014-1387, CVE-2014-1388, CVE-2014-1389, CVE-2014-1390...
OpenVPN -- denial of service security vulnerability
The OpenVPN project reports: In late November 2014 Dragana Damjanovic notified OpenVPN developers of a critical denial of service security vulnerability CVE-2014-8104. The vulnerability allows an tls-authenticated client to crash the server by sending a too-short control channel packet to the...
FreeBSD -- rtsold(8) remote buffer overflow vulnerability
Problem Description: Due to a missing length check in the code that handles DNS parameters, a malformed router advertisement message can result in a stack buffer overflow in rtsold8. Impact: Receipt of a router advertisement message with a malformed DNSSL option, for instance from a compromised...
FreeBSD -- memory leak in sandboxed namei lookup
Problem Description: The namei facility will leak a small amount of kernel memory every time a sandboxed process looks up a nonexistent path name. Impact: A remote attacker that can cause a sandboxed process for instance, a web server to look up a large number of nonexistent path names can cause...
mplayer -- potential buffer overrun when processing malicious lzo compressed input
Michael Niedermayer and Luca Barbato report in upstream ffmpeg: avutil/lzo: Fix integer overflow...
FreeBSD -- TCP reassembly vulnerability
Problem Description: FreeBSD may add a reassemble queue entry on the stack into the segment list when the reassembly queue reaches its limit. The memory from the stack is undefined after the function returns. Subsequent iterations of the reassembly function will attempt to access this entry...
otrs -- XSS Issue
The OTRS Project reports: An attacker could send a specially prepared HTML email to OTRS. If he can then trick an agent into following a special link to display this email, JavaScript code would be executed...
otrs -- multiple vulnerabilities
The OTRS Project reports: SQL injection issue An attacker that managed to take over the session of a logged in customer could create tickets and/or send follow-ups to existing tickets due to missing challenge token checks...
qt4-xml -- XML Entity Expansion Denial of Service
Richard J. Moore reports: QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted data then the application...
varnish -- DoS vulnerability in Varnish HTTP cache
Varnish Cache Project reports: If Varnish receives a certain illegal request, and the subroutine 'vclerror' restarts the request, the varnishd worker process will crash with an assert. The varnishd management process will restart the worker process, but there will be a brief interruption of servi...
pycrypto -- PRNG reseed race condition
Dwayne Litzenberger reports: In PyCrypto before v2.6.1, the Crypto.Random pseudo-random number generator PRNG exhibits a race condition that may cause it to generate the same 'random' output in multiple processes that are forked from each other. Depending on the application, this could reveal...
FreeBSD -- Cross-mount links between nullfs(5) mounts
Problem Description: The nullfs5 implementation of the VOPLINK9 VFS operation does not check whether the source and target of the link are both in the same nullfs instance. It is therefore possible to create a hardlink from a location in one nullfs instance to a file in another, as long as the...
ansible -- local symlink exploits
MITRE reports: runner/connectionplugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. lib/ansible/playbook/init.py in Ansible 1.2.x before 1.2.3, when playbook does no...
gallery -- multiple vulnerabilities
Red Hat Security Response Team reports: Gallery upstream has released 3.0.9 version, correcting two security flaws: Issue 1 - Improper stripping of URL fragments in flowplayer SWF file might lead to reply attacks a different flaw than CVE-2013-2138. Issue 2 - gallery3: Multiple information exposu...
apache-xml-security-c -- heap overflow during XPointer evaluation
The Apache Software Foundation reports: The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code...
apache-xml-security-c -- heap overflow
The Apache Software Foundation reports: A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitary code execution. If verification of the signature occurs prior to actual evaluation of a signin...