Several vulnerabilities in libav

The libav project reports: utvideodec: Handle sliceheight being zero CVE-2014-9604 tiff: Check that there is no aliasing in pixel format selection CVE-2014-8544...

rest-client -- session fixation vulnerability

Andy Brody reports: When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration...

freexl -- multiple vulnerabilities

Jodie Cunningham reports: 1: A flaw was found in the way FreeXL reads sectors from the input file. A specially crafted file could possibly result in stack corruption near freexl.c:3752. 2: A flaw was found in the function allocatecells. A specially crafted file with invalid workbook dimensions...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory: Description SECURITY-171, SECURITY-177 Reflective XSS vulnerability An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls...

qemu -- denial of service vulnerability

Daniel P. Berrange reports: The VNC server websockets decoder will read and buffer data from websockets clients until it sees the end of the HTTP headers, as indicated by \r\n\r\n. In theory this allows a malicious to trick QEMU into consuming an arbitrary amount of RAM...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA-2015-28 Privilege escalation through SVG navigation MFSA-2015-29 Code execution through incorrect JavaScript bounds checking elimination...

mysql -- SSL Downgrade

Duo Security reports: Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently...

Several vulnerabilities found in PHP

The PHP project reports: The PHP development team announces the immediate availability of PHP 5.6.7. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.6 users are encouraged to upgrade to this version. The PHP development team announces the immediat...

OpenSSL -- multiple vulnerabilities

OpenSSL project reports: Reclassified: RSA silently downgrades to EXPORTRSA Client CVE-2015-0204. OpenSSL only. Segmentation fault in ASN1TYPEcmp CVE-2015-0286 ASN.1 structure reuse memory corruption CVE-2015-0287 PKCS7 NULL pointer dereferences CVE-2015-0289 Base64 decode CVE-2015-0292. OpenSSL...

django -- multiple vulnerabilities

The Django project reports: In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and 1.8c1. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We...

libzip -- integer overflow

libzip developers report: Avoid integer overflow. Fixed similarly to patch used in PHP copy of libzip...

libXfont -- BDF parsing issues

Alan Coopersmith reports: Ilja van Sprundel, a security researcher with IOActive, has discovered an issue in the parsing of BDF font files by libXfont. Additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop afl tool uncovered two more issues in the parsing of BDF...

osc -- shell command injection via crafted _service files

SUSE Security Update reports: osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a service file...

libuv -- incorrect revocation order while relinquishing privileges

Nodejs releases reports: CVE-2015-0278 This may potentially allow an attacker to gain elevated privileges...

xen-tools -- HVM qemu unexpectedly enabling emulated VGA graphics backends

The Xen Project reports: When instantiating an emulated VGA device for an x86 HVM guest qemu will by default enable a backend to expose that device, either SDL or VNC depending on the version of qemu and the build time configuration. The libxl toolstack library does not explicitly disable these...

ffmpeg -- multiple vulnerabilities

Please reference CVE/URL list for details...

Adobe Flash Player -- critical vulnerabilities

Adobe reports: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. These updates resolve memory corruption vulnerabilities that could lea...

xen-kernel -- Hypervisor memory corruption due to x86 emulator flaw

The Xen Project reports: Instructions with register operands ignore eventual segment overrides encoded for them. Due to an insufficiently conditional assignment such a bogus segment override can, however, corrupt a pointer used subsequently to store the result of the instruction. A malicious gues...

mono -- TLS bugs

The Mono project reports: Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in SKIP-TLS post. Mono’s implementation of SSL/TLS also contained...

xen-kernel -- Information leak via internal x86 system device emulation

The Xen Project reports: Emulation routines in the hypervisor dealing with certain system devices check whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that...

xen-kernel -- Information leak through version information hypercall

The Xen Project reports: The code handling certain sub-operations of the HYPERVISORxenversion hypercall fails to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents are copied into the destination of the operation, thus becomin...

phpMyAdmin -- Risk of BREACH attack due to reflected parameter

The phpMyAdmin development team reports: Risk of BREACH attack due to reflected parameter. With a large number of crafted requests it was possible to infer the CSRF token by a BREACH attack. Mitigation factor: this vulnerability can only be exploited in the presence of another vulnerability that...

chromium -- multiple vulnerabilities

Chrome Releases reports: 51 security fixes in this release, including: 456516 High CVE-2015-1212: Out-of-bounds write in media. Credit to anonymous. 448423 High CVE-2015-1213: Out-of-bounds write in skia filters. Credit to cloudfuzzer. 445810 High CVE-2015-1214: Out-of-bounds write in skia filter...

jenkins -- multiple vulnerabilities

Kohsuke Kawaguchi from Jenkins team reports: Description SECURITY-125 Combination filter Groovy script unsecured This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master. SECURITY-162 directory traversal...

PuTTY -- fails to scrub private keys from memory after use

Simon Tatham reports: When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is th...

cryptopp -- multiple vulnerabilities

Multiple sources report: CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack...

rt -- Remote DoS, Information disclosure and Session Hijackingvulnerabilities

Best Practical reports: RT 3.0.0 and above, if running on Perl 5.14.0 or higher, are vulnerable to a remote denial-of-service via the email gateway; any installation which accepts mail from untrusted sources is vulnerable, regardless of the permissions configuration inside RT. This...

FreeBSD -- Integer overflow in IGMP protocol

Problem Description: An integer overflow in computing the size of IGMPv3 data buffer can result in a buffer which is too small for the requested operation. Impact: An attacker who can send specifically crafted IGMP packets could cause a denial of service situation by causing the kernel to crash...

krb5 1.11 -- New release/fix multiple vulnerabilities

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.11.6: Handle certain invalid RFC 1964 GSS tokens correctly to avoid invalid memory reference vulnerabilities. CVE-2014-4341 Fix memory management vulnerabilities in GSSAPI SPNEGO. CVE-2014-4343 CVE-2014-4344 Fix buffer...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA-2015-11 Miscellaneous memory safety hazards rv:36.0 / rv:31.5 MFSA-2015-12 Invoking Mozilla updater will load locally stored DLL files MFSA-2015-13 Appended period to hostnames can bypass HPKP and HSTS protections MFSA-2015-14 Malicious WebGL content crash when...

samba -- Unexpected code execution in smbd

Samba development team reports: All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon. A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent...

qt4-gui, qt5-gui -- DoS vulnerability in the BMP image handler

Richard J. Moore reports: The builtin BMP decoder in QtGui prior to Qt 5.5 contained a bug that would lead to a division by zero when loading certain corrupt BMP files. This in turn would cause the application loading these hand crafted BMPs to crash...

krb5 1.12 -- New release/fix multiple vulnerabilities

The MIT Kerberos team announces the availability of MIT Kerberos 5 Release 1.12.3: Fix multiple vulnerabilities in the LDAP KDC back end. CVE-2014-5354 CVE-2014-5353 Fix multiple kadmind vulnerabilities, some of which are based in the gssrpc library. CVE-2014-5352 CVE-2014-5352 CVE-2014-9421...

redmine -- potential XSS vulnerability

Redmine reports: Potential XSS vulnerability when rendering some flash messages...

php5 -- multiple vulnerabilities

The PHP Project reports: Use after free vulnerability in unserialize with DateTimeZone. Mitigation for CVE-2015-0235 -- GHOST: glibc gethostbyname buffer overflow...

cabextract -- directory traversal with UTF-8 symbols in filenames

Cabextract ChangeLog reports: It was possible for cabinet files to extract to absolute file locations, and it was possible on Cygwin to get around cabextract's absolute and relative path protections by using backslashes...

bind -- denial of service vulnerability

ISC reports: When configured to perform DNSSEC validation, named can crash when encountering a rare set of conditions in the managed trust anchors...

chrony -- multiple vulnerabilities

Chrony News reports: CVE-2015-1853: DoS attack on authenticated symmetric NTP associations CVE-2015-1821: Heap-based buffer overflow in access configuration CVE-2015-1822: Use of uninitialized pointer in command processing...

unzip -- heap based buffer overflow in iconv patch

Ubuntu Security Notice USN-2502-1 reports: unzip could be made to run programs if it opened a specially crafted file...

krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092

The MIT Kerberos team reports: CVE-2014-5353: The krb5ldapgetpasswordpolicyfromdn function in plugins/kdb/ldap/libkdbldap/ldappwdpolicy.c in MIT Kerberos 5 aka krb5 before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service daemon crash via a successful...

xen-kernel -- arm: vgic-v2: GICD_SGIR is not properly emulated

The Xen Project reports: When decoding a guest write to a specific register in the virtual interrupt controller Xen would treat an invalid value as a critical error and crash the host. By writing an invalid value to the GICD.SGIR register a guest can crash the host, resulting in a Denial of Servi...

elasticsearch -- remote OS command execution via Groovy scripting engine

Elastic reports: Vulnerability Summary: Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine that were introduced in 1.3.0. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the...

mini_httpd -- buffer overflow via snprintf

ACME Updates reports: minihttpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long protocol string, which triggers an incorrect response size calculation and an out-of-bounds read. rene ACME, the author, claims that the...

xorg-server -- Information leak in the XkbSetGeometry request of X servers.

Peter Hutterer reports: Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request. The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string...

libidn -- out-of-bounds read issue with invalid UTF-8 input

Simon Josefsson reports: stringpreputf8toucs4 now rejects invalid UTF-8. This function has always been documented to not validate that the input UTF-8 string is actually valid UTF-8...

librsvg2 -- denial of service vulnerability

Adam Maris, Red Hat Product Security, reports: CVE-2015-7557: Out-of-bounds heap read in librsvg2 was found when parsing SVG file...

e2fsprogs -- potential buffer overflow in closefs()

Theodore Ts'o reports: On a carefully crafted filesystem that gets modified through tune2fs or debugfs, it is possible to trigger a buffer overrun when the file system is closed via closefs...

chromium -- multiple vulnerabilities

Chrome Releases reports: 11 security fixes in this release, including: 447906 High CVE-2015-1209: Use-after-free in DOM. Credit to Maksymillian. 453979 High CVE-2015-1210: Cross-origin-bypass in V8 bindings. Credit to anonymous. 453982 High CVE-2015-1211: Privilege escalation using service worker...

PostgreSQL -- multiple buffer overflows and memory issues

PostgreSQL Project reports: This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list...

apache24 -- multiple vulnerabilities

Jim Jagielski reports: CVE-2015-3183 cve.mitre.org core: Fix chunk header parsing defect. Remove aprbrigadeflatten, buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized...