Samba: Multiple vulnerabilities

Background Samba is a suite of SMB and CIFS client/server programs. Description Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code with root privileges, cause a Deni...

phpMyAdmin: Multiple vulnerabilities

Background phpMyAdmin is a web-based management tool for MySQL databases. Description Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers and phpMyAdmin Security Advisories referenced below for details. Impact Remote attackers might be able to insert and...

FasterXML jackson-databind: Multiple vulnerabilities

Background FasterXML jackson-databind is a general data-binding package for Jackson 2.x which works on streaming API core implementations. Description Multiple vulnerabilities have been discovered in FasterXML jackson-databind. Please review the CVE identifiers referenced below for details. Impac...

PostgreSQL: Multiple vulnerabilities

Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly obtain sensitive information, alte...

SQLite: Multiple vulnerabilities

Background SQLite is a C library that implements an SQL database engine. Description Multiple vulnerabilities have been discovered in SQLite. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no kno...

RabbitMQ C client: Arbitrary code execution

Background A C-language AMQP client library for use with v2.0+ of the RabbitMQ broker. Description It was discovered that RabbitMQ C client incorrectly handled certain inputs. Impact A remote attacker, by sending a specially crafted request, could possibly execute arbitrary code with the privileg...

virglrenderer: Multiple vulnerabilities

Background A virtual 3D GPU library, that allows the guest operating system to use the host GPU to accelerate 3D rendering. Description Multiple vulnerabilities have been discovered in virglrenderer. Please review the CVE identifiers referenced below for details. Impact A local attacker could cau...

Oracle JDK/JRE: Multiple vulnerabilities

Background Java Platform, Standard Edition Java SE lets you develop and deploy Java applications on desktops and servers, as well as in today’s demanding embedded environments. Java offers the rich user interface, performance, versatility, portability, and security that today’s applications...

DBD::mysql: Multiple vulnerabilities

Background MySQL driver for the Perl5 Database Interface DBI Description Multiple vulnerabilities have been discovered in DBD::mysql. Please review the CVE identifiers referenced below for details. Impact An attacker could cause a Denial of Service condition, execute arbitrary code, or have other...

OpenMotif: Multiple vulnerabilities in libXpm

Background OpenMotif provides a free version of the Motif toolkit for open source applications. Description Multiple vulnerabilities, such as buffer overflows, out of bounds memory access or directory traversals, have been discovered in libXpm that is shipped as a part of the X Window System see...

AWStats: Remote code execution

Background AWStats is an advanced log file analyzer and statistics generator. Description When 'awstats.pl' is run as a CGI script, it fails to validate specific inputs which are used in a Perl open function call. Furthermore, a user could read log file content even when plugin rawlog was not...

HTMLDOC: Multiple Vulnerabilities

Background HTMLDOC is a HTML indexer and HTML to PS and PDF converter. Description Multiple vulnerabilities have been discovered in HTMLDOC. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no know...

IcedTeaWeb: Multiple vulnerabilities

Background FOSS Java browser plugin and Web Start implementation. Description Multiple vulnerabilities have been discovered in IcedTeaWeb. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

ConnMan: Multiple vulnerabilities

Background ConnMan provides a daemon for managing Internet connections. Description Multiple vulnerabilities have been discovered in connman. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no kno...

Dovecot: Multiple vulnerabilities

Background Dovecot is an open source IMAP and POP3 email server. Description Multiple vulnerabilities have been discovered in Dovecot. Please review the CVE identifiers referenced below for details. Impact A remote attacker could send a specially crafted mail or send a specially crafted IMAP...

Xen: Buffer overflow

Background Xen is a bare-metal hypervisor. Description An out-of-bounds read/write access issue was found in the USB emulator when using QEMU. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround There...

BIND: Multiple vulnerabilities

Background BIND Berkeley Internet Name Domain is a Name Server. Description Multiple vulnerabilities have been discovered in BIND. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workarou...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla Project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Scala: Privilege escalation

Background Scala combines object-oriented and functional programming in one concise, high-level language. Description It was discovered that Scala’s compilation daemon does not properly manage permissions for private files. Impact A local attacker could escalate privileges. Workaround There is no...

Dnsmasq: Multiple vulnerabilities

Background Dnsmasq is a lightweight and easily-configurable DNS forwarder and DHCP server. Description Multiple vulnerabilities have been discovered in Dnsmasq. Please review the references below for details. Impact A remote attacker could execute arbitrary code or cause a Denial of Service...

Gajim: Information disclosure

Background Gajim is a Jabber/XMPP client which uses GTK+. Description Gajim unconditionally implements the “XEP-0146: Remote Controlling Clients” extension. Impact Remote attackers, by enticing a user to connect to a malicious XMPP server, could extract plaintext from Off The Record OTR encrypted...

MongoDB: Denial of service

Background MongoDB from “humongous” is a scalable, high-performance, open source, schema-free, document-oriented database. Description MongoDB’s ‘mongod’ server fails to validate some cases of malformed BSON. Impact A remote attacker could send a specially crafted BSON request possibly resulting ...

Openfire: Multiple vulnerabilities

Background Ignite Realtime Openfire is a fast real-time collaboration server. Description Two vulnerabilities have been reported by Federico Muttis, from CORE IMPACT's Exploit Writing Team: Multiple missing or incomplete input validations in several .jsps CVE-2009-0496. Incorrect input validation...

Mozilla Firefox: Various vulnerabilities

Background Mozilla Firefox is the popular next-generation browser from the Mozilla project. Description The following vulnerabilities were found and fixed in Mozilla Firefox: Michael Krax reported that plugins can be used to load privileged content and trick the user to interact with it...

ISC BIND: Multiple Vulnerabilities

Background ISC BIND is the Internet Systems Consortium implementation of the Domain Name System DNS protocol. Description Multiple vulnerabilities have been discovered in ISC BIND. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers...

Mozilla Thunderbird: Multiple Vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...

PJSIP: Multiple vulnerabilities

Background PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Description Multiple vulnerabilities have been discovered in PJSIP. Please review the CVE identifiers referenced belo...

Tar: Denial of service

Background The Tar program provides the ability to create and manipulate tar archives. Description It was discovered that GNU Tar had a memory leak when processing archive headers. Impact A remote attacker could entice a user to open a specially crafted archive using Tar, possibly resulting in a...

phpMyAdmin: Multiple vulnerabilities

Background phpMyAdmin is a web-based management tool for MySQL databases. Description Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is n...

GnuTLS: Multiple vulnerabilities

Background GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. Description Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers referenced below for details. Impact Please review the CVE...

PostgreSQL: Multiple vulnerabilities

Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the referenced CVE identifiers for details. Impact A remote attacker could escalate privileges, cause a Denial of Service...

Git: Command injection

Background Git is a small and fast distributed version control system designed to handle small and large projects. Description Specially crafted ‘ssh://...’ URLs may allow the owner of the repository to execute arbitrary commands on client’s machine if those commands are already installed on the...

IcedTea: Multiple vulnerabilities

Background IcedTea’s aim is to provide OpenJDK in a form suitable for easy configuration, compilation and distribution with the primary goal of allowing inclusion in GNU/Linux distributions. Description Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers...

Python: Multiple vulnerabilities

Background Python is an interpreted, interactive, object-oriented programming language. Description Multiple vulnerabilities have been discovered in Python. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted ind...

Oracle JRE/JDK: Multiple vulnerabilities

Background Oracle’s Java SE Development Kit and Runtime Environment Description Multiple vulnerabilities have been discovered in Oracle’s Java SE Development Kit and Runtime Environment. Please review the CVE identifiers referenced below for details. Impact A context-dependent attacker may be abl...

Sun JDK/JRE: Multiple vulnerabilities

Background The Sun Java Development Kit JDK and the Sun Java Runtime Environment JRE provide the Sun Java platform. Description Multiple vulnerabilities have been reported in the Sun Java implementation. Please review the CVE identifiers referenced below and the associated Sun Alerts for details...

FreeRDP: Multiple Vulnerabilities

Background FreeRDP is a free implementation of the remote desktop protocol. Description Multiple vulnerabilities have been discovered in FreeRDP. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no...

Exiv2: Multiple Vulnerabilities

Background Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images. Exif, the Exchangeable image file format, specifies the addition of metadata tags to JPEG, TIFF and RIFF files. Description Multiple vulnerabilities have been discovered in Exiv2...

OpenDoas: Insufficient environment filtering

Background OpenDoas allows users to run commands as other users. Description OpenDoas does not properly filter the PATH variable from the resulting shell after escalating privileges. Impact A local attacker with control of a user’s PATH variable could escalate privileges if that user uses OpenDoa...

SpamAssassin: Arbitrary command execution

Background SpamAssassin is an extensible email filter used to identify junk email. Description It was discovered that SpamAssassin incorrectly handled certain CF files. Impact A remote attacker could entice a user or automated system to process a specially crafted CF file using SpamAssassin,...

Salt: Multiple vulnerabilities

Background Salt is a fast, intelligent and scalable automation engine. Description Multiple vulnerabilities have been discovered in Salt. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary commands via salt-api, cause a Denial...

ProFTPD: Remote code execution

Background ProFTPD is an advanced and very configurable FTP server. Description It was discovered that ProFTPD’s “modcopy” module does not properly restrict privileges for anonymous users. Impact A remote attacker, by anonymously uploading a malicious file, could possibly execute arbitrary code...

GNOME applet for NetworkManager: Arbitrary file read/write

Background GNOME applet for NetworkManager is a GTK+ 3 front-end which works under Xorg environments with a systray. Description Frederic Bardy and Quentin Biguenet discovered that GNOME applet for NetworkManager incorrectly checked permissions when connecting to certain wireless networks. Impact...

cURL: Multiple vulnerabilities

Background cURL is a tool and libcurl is a library for transferring data with URL syntax. Description Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly obtain sensitive information, or cau...

Libav: Multiple vulnerabilities

Background Libav is a complete solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to open a specially crafted media...

sudo: Privilege escalation

Background sudo allows a system administrator to give users the ability to run commands as other users. Access to commands may also be granted on a range to hosts. Description Multiple vulnerabilities have been found in sudo: sudo does not correctly validate the controlling terminal on a system...

Okular: Arbitrary code execution

Background Okular is a universal document viewer based on KPDF for KDE 4. Description Okular contains a heap-based buffer overflow in the RLE decompression functionality in the TranscribePalmImageToJPEG function in generators/plucker/inplug/image.cpp. Impact A remote attacker could entice a user ...

Ganglia: Execution of arbitrary code

Background Ganglia is a scalable distributed monitoring system for clusters and grids. Description Spike Spiegel reported a stack-based buffer overflow in the processpath function when processing overly long pathnames in gmetad/server.c. Impact A remote attacker could send a specially crafted...

SeaMonkey: Multiple vulnerabilities

Background The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the 'Mozilla Application Suite'. Description An anonymous researcher found evidence of memory corruption in the way SeaMonkey handles certain types ...

ProFTPD Access Control List bypass vulnerability

Background ProFTPD is an FTP daemon. Description ProFTPD 1.2.9 introduced a vulnerability that allows CIDR-based ACLs such as 10.0.0.1/24 to be bypassed. The CIDR ACLs are disregarded, with the net effect being similar to an "AllowAll" directive. Impact This vulnerability may allow unauthorized...