6659 matches found
fontconfig -- insufficiently cache file validation
Debian security team reports: Tobias Stoeckmann discovered that cache files are insufficiently validated in fontconfig, a generic font configuration library. An attacker can trigger arbitrary free calls, which in turn allows double free attacks and therefore arbitrary code execution. In combinati...
asterisk -- Crash on ACK from unknown endpoint
The Asterisk project reports: Asterisk can be crashed remotely by sending an ACK to it from an endpoint username that Asterisk does not recognize. Most SIP request types result in an "artificial" endpoint being looked up, but ACKs bypass this lookup. The resulting NULL pointer results in a crash...
Vulnerabilities in Curl
Curl security team reports: CVE-2016-5419 - TLS session resumption client cert bypass CVE-2016-5420 - Re-using connections with wrong client cert CVE-2016-5421 - use of connection struct after free...
Joomla! -- multiple vulnerabilities
The JSST and the Joomla! Security Center report: 20160801 - Core - ACL Violation Inadequate ACL checks in comcontent provide potential read access to data which should be access restricted to users with editown level. 20160802 - Core - XSS Vulnerability Inadequate escaping leads to XSS...
piwik -- XSS vulnerability
Piwik reports: We have identified and fixed several XSS security issues in this release...
chromium -- multiple vulnerabilities
Google Chrome Releases reports: 10 security fixes in this release, including: 629542 High CVE-2016-5141 Address bar spoofing. Credit to anonymous 626948 High CVE-2016-5142 Use-after-free in Blink. Credit to anonymous 625541 High CVE-2016-5139 Heap overflow in pdfium. Credit to GiWan Go of Stealie...
Mozilla -- multiple vulnerabilities
Mozilla Foundation reports: Please reference CVE/URL list for details...
openssh -- sshd -- remote valid user discovery and PAM /bin/login attack
The OpenSSH project reports: sshd8: Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. CVE-2016-6210, reported by EddieEzra.Harari ...
lighttpd - multiple vulnerabilities
Lighttpd Project reports: Security fixes for Lighttpd: security: encode quoting chars in HTML and XML security: ensure gid != 0 if server.username is set, but not server.groupname security: disable statcache if server.follow-symlink = “disable” security: httpoxy defense: do not emit HTTPPROXY to...
lives -- insecure files permissions
Debian reports: smogrify script creates insecure temporary files. lives creates and uses world-writable directory...
xen-tools -- virtio: unbounded memory allocation issue
The Xen Project reports: A guest can submit virtio requests without bothering to wait for completion and is therefore not bound by virtqueue size... A malicious guest administrator can cause unbounded memory allocation in QEMU, which can cause an Out-of-Memory condition in the domain running qemu...
wireshark -- multiple vulnerabilities
Wireshark development team reports: The following vulnerabilities have been fixed: wnpa-sec-2016-41 PacketBB crash. Bug 12577 wnpa-sec-2016-42 WSP infinite loop. Bug 12594 wnpa-sec-2016-44 RLC long loop. Bug 12660 wnpa-sec-2016-45 LDSS dissector crash. Bug 12662 wnpa-sec-2016-46 RLC dissector...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed an SQL injection in the ‘odbc’ database driver. Updated setrealpath Path Helper function to filter-out php:// wrapper inputs...
xen-kernel -- x86: Privilege escalation in PV guests
The Xen Project reports: The PV pagetable code has fast-paths for making updates to pre-existing pagetable entries, to skip expensive re-validation in safe cases e.g. clearing only Access/Dirty bits. The bits considered safe were too broad, and not actually safe. A malicious PV guest administrato...
collectd -- Network plugin heap overflow
The collectd Project reports: Emilien Gaspar has identified a heap overflow in collectd's network plugin which can be triggered remotely and is potentially exploitable...
xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery
The Xen Project reports: Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exceptio...
FreeBSD -- Heap vulnerability in bspatch
Problem Description: The implementation of bspatch does not check for a negative value on numbers of bytes read from the diff and extra streams, allowing an attacker who can control the patch file to write at arbitrary locations in the heap. This issue was first discovered by The Chromium Project...
kdelibs -- directory traversal vulnerability
David Faure reports: A maliciously crafted archive .zip or .tar.bz2 with "../" in the file paths could be offered for download via the KNewStuff framework e.g. on www.kde-look.org, and upon extraction would install files anywhere in the user's home directory...
gd -- multiple vulnerabilities
Pierre Joye reports: fix php bug 72339, Integer Overflow in gd2GetHeader CVE-2016-5766 gd: Buffer over-read issue when parsing crafted TGA file CVE-2016-6132 Integer overflow error within gdContributionsAlloc CVE-2016-6207 fix php bug 72494, invalid color index not handled, can lead to crash...
php -- multiple vulnerabilities
PHP reports: Fixed bug 69975 PHP segfaults when accessing nvarcharmax defined columns Fixed bug 72479 Use After Free Vulnerability in SNMP with GC and unserialize. Fixed bug 72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access. Fixed bug 72519 imagegif/output out-of-bounds acces...
perl -- local arbitrary code execution
Sawyer X reports: Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . period characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory...
MySQL -- Multiple vulnerabilities
Oracle reports: The quarterly Critical Patch Update contains 22 new security fixes for Oracle MySQL 5.5.49, 5.6.30, 5.7.13 and earlier...
krb5 -- KDC denial of service vulnerability
Major changes in krb5 1.14.3 and krb5 1.13.6: Fix a rare KDC denial of service vulnerability when anonymous client principals are restricted to obtaining TGTs only CVE-2016-3120...
chromium -- multiple vulnerabilities
Google Chrome Releases reports: 48 security fixes in this release, including: 610600 High CVE-2016-1706: Sandbox escape in PPAPI. Credit to Pinkie Pie xisigr of Tencent's Xuanwu Lab 613949 High CVE-2016-1708: Use-after-free in Extensions. Credit to Adam Varsan 614934 High CVE-2016-1709:...
libidn -- multiple vulnerabilities
Simon Josefsson reports: libidn: Fix out-of-bounds stack read in idnatoascii4i. idn: Solve out-of-bounds-read when reading one zero byte as input. Also replaced fgets with getline. libidn: stringpreputf8nfkcnormalize reject invalid UTF-8. It was always documented to only accept UTF-8 data, but no...
smarty3 -- shell injection in math
The smarty project reports: bugfix math shell injection vulnerability...
moodle -- multiple vulnerabilities
Marina Glancy reports: MSA-16-0019: Glossary search displays entries without checking user permissions to view them MSA-16-0020: Text injection in email headers MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course...
bind -- denial of service vulnerability
ISC reports: A query name which is too long can cause a segmentation fault in lwresd...
Multiple ports -- Proxy HTTP header vulnerability (httpoxy)
httpoxy.org reports: httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It comes down to a simple namespace conflict:. RFC 3875 CGI puts the HTTP Proxy header from a request into the environment variables as HTTPPROXY HTTPPROXY is a popular...
Apache OpenOffice 4.1.2 -- Memory Corruption Vulnerability (Impress Presentations)
The Apache OpenOffice Project reports: An OpenDocument Presentation .ODP or Presentation Template .OTP file can contain invalid presentation elements that lead to memory corruption when the document is loaded in Apache OpenOffice Impress. The defect may cause the document to appear as corrupted a...
p7zip -- Null pointer dereference
MITRE reports: A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams, as used in the 7z.so library and in 7z applications, will cause a crash and a...
dropbear -- multiple vulnerabilities
Matt Johnston reports: If specific usernames including "%" symbols can be created on a system validated by getpwnam then an attacker could run arbitrary code as root when connecting to Dropbear server. A dbclient user who can control username or host arguments could potentially run arbitrary code...
flash -- multiple vulnerabilities
Adobe reports: These updates resolve a race condition vulnerability that could lead to information disclosure CVE-2016-4247. These updates resolve type confusion vulnerabilities that could lead to code execution CVE-2016-4223, CVE-2016-4224, CVE-2016-4225. These updates resolve use-after-free...
xtrlock -- xtrlock does not block multitouch events
Debian reports: xtrlock did not block multitouch events so an attacker could still input and thus control various programs such as Chromium, etc. via so-called "multitouch" events including pan scrolling, "pinch and zoom" or even being able to provide regular mouse clicks by depressing the touchp...
samba -- client side SMB2/3 required signing can be downgraded
Samba team reports: A man in the middle attack can disable client signing over SMB2/3, even if enforced by configuration parameters...
BIND,Knot,NSD,PowerDNS -- denial over service via oversized zone transfers
ISC reports: DNS protocols were designed with the assumption that a certain amount of trust could be presumed between the operators of primary and secondary servers for a given zone. However, in current practice some organizations have scenarios which require them to accept zone data from sources...
atutor -- multiple vulnerabilities
ATutor reports: Security Fixes: Added a new layer of security over all php superglobals, fixed several XSS, CSRF, and SQL injection vulnerabilities...
apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used
Apache Software Foundation reports: The Apache HTTPD web server from 2.4.18-2.4.20 did not validate a X509 client certificate correctly when experimental module for the HTTP/2 protocol is used to access a resource. The net result is that a resource that should require a valid client certificate i...
SQLite3 -- Tempdir Selection Vulnerability
KoreLogic security reports: Affected versions of SQLite reject potential tempdir locations if they are not readable, falling back to '.'. Thus, SQLite will favor e.g. using cwd for tempfiles on such a system, even if cwd is an unsafe location. Notably, SQLite also checks the permissions of '.', b...
p5-XSLoader -- local arbitrary code execution
Jakub Wilk reports: XSLoader tries to load code from a subdirectory in the cwd when called inside a string eval...
tiff -- buffer overflow
Mathias Svensson reports: potential buffer write overrun in PixarLogDecode on corrupted/unexpected images...
libreoffice -- use-after-free vulnerability
Talos reports: An exploitable Use After Free vulnerability exists in the RTF parser LibreOffice. A specially crafted file can cause a use after free resulting in a possible arbitrary code execution. To exploit the vulnerability a malicious file needs to be opened by the user via vulnerable...
ruby-saml -- XML signature wrapping attack
RubySec reports: ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements but past the scheme validator process since 1 of the element was inside the encrypted assertion...
phpMyAdmin -- multiple vulnerabilities
Please reference CVE/URL list for details...
php -- multiple vulnerabilities
The PHP Group reports: Please reference CVE/URL list for details...
icingaweb2 -- remote code execution
Eric Lippmann reports: Possibility of remote code execution via the remote command transport...
libarchive -- multiple vulnerabilities
Hanno Bock and Cisco Talos report: Out of bounds heap read in RAR parser Signed integer overflow in ISO parser TALOS-2016-0152 CVE-2016-4300: 7-Zip readSubStreamsInfo Integer Overflow TALOS-2016-0153 CVE-2016-4301: mtree parsedevice Stack Based Buffer Overflow TALOS-2016-0154 CVE-2016-4302:...
Apache Commons FileUpload -- denial of service
Jochen Wiedmann reports: A malicious client can send file upload requests that cause the HTTP server using the Apache Commons Fileupload library to become unresponsive, preventing the server from servicing other requests...
Apache Commons FileUpload -- denial of service (DoS) vulnerability
Mark Thomas reports: CVE-2016-3092 is a denial of service vulnerability that has been corrected in the Apache Commons FileUpload component. It occurred when the length of the multipart boundary was just below the size of the buffer 4096 bytes used to read the uploaded file. This caused the file...