OTRS -- Multiple vulnerabilities otrs 5.0.26

OTRS reports:

An attacker who is logged into OTRS as an agent can request special URLs from OTRS which can lead to the execution of shell commands with the permissions of the web server user.

An attacker who is logged into OTRS as a customer can use the ticket search form to disclose internal article information of their customer tickets.

An attacker who is logged into OTRS as an agent can manipulate form parameters and execute arbitrary shell commands with the permissions of the OTRS or web server user.

An attacker can send a specially prepared email to an OTRS system. If this system has cookie support disabled, and a logged in agent clicks a link in this email, the session information could be leaked to external systems, allowing the attacker to take over the agent’s session.

CVE-2017-16664 CVE-2017-16854 CVE-2017-16921 ports/224729 https://www.otrs.com/security-advisory-2017-07-security-update-otrs-framework/ https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/ https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/ https://www.otrs.com/security-advisory-2017-10-security-update-otrs-framework/ 2017-11-21 2017-12-30
The Bouncy Castle Crypto APIs: CVE-2017-13098 ("ROBOT") bouncycastle 1.59 bouncycastle15 1.59

The Legion of the Bouncy Castle reports:

Release: 1.59

CVE-2017-13098 ("ROBOT"), a Bleichenbacher oracle in TLS when RSA key exchange is negotiated. This potentially affected BCJSSE servers and any other TLS servers configured to use JCE for the underlying crypto - note the two TLS implementations using the BC lightweight APIs are not affected by this.

CVE-2017-13098 https://www.bouncycastle.org/releasenotes.html 2017-12-12 2017-12-29
mozilla -- multiple vulnerabilities thunderbird linux-thunderbird 52.5.2

Mozilla Foundation reports:

CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9

CVE-2017-7846: JavaScript Execution via RSS in mailbox:// origin

CVE-2017-7847: Local path string can be leaked from RSS feed

CVE-2017-7848: RSS Feed vulnerable to new line Injection

CVE-2017-7829: Mailsploit part 1: From address with encoded null character is cut off in message header display

CVE-2017-7829 CVE-2017-7845 CVE-2017-7846 CVE-2017-7847 CVE-2017-7848 https://www.mozilla.org/security/advisories/mfsa2017-30/ 2017-12-22 2017-12-25
phpMyAdmin -- XSRF/CSRF vulnerability phpMyAdmin 4.7.04.7.7

The phpMyAdmin team reports:

Description

By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.

Severity

We consider this vulnerability to be critical.

https://www.phpmyadmin.net/security/PMASA-2017-9/ 2017-12-23 2017-12-23
asterisk -- Crash in PJSIP resource when missing a contact header asterisk13 13.18.5

The Asterisk project reports:

A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled a user would have to first be authorized before reaching the crash point.

https://downloads.asterisk.org/pub/security/AST-2017-014.html CVE-2017-17850 2017-12-12 2017-12-23
MariaDB -- unspecified vulnerability mariadb101-client 10.1.30 mariadb102-client 10.2.10

The MariaDB project reports:

Fixes for the following security vulnerabilities: CVE-2017-15365

https://mariadb.com/kb/en/library/mariadb-10130-release-notes/ CVE-2017-15365 2017-12-23 2017-12-23
rsync -- multiple vulnerabilities rsync 3.1.23.1.2_7

Jeriko One reports:

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.

The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.

https://www.debian.org/security/2017/dsa-4068 CVE-2017-16548 CVE-2017-17433 CVE-2017-17434 ports/224477 2017-12-17 2017-12-20 2017-12-31
ruby -- Command injection vulnerability in Net::FTP ruby 2.2.0,12.2.9,1 2.3.0,12.3.6,1 2.4.0,12.4.3,1

Etienne Stalmans from the Heroku product security team reports:

There is a command injection vulnerability in Net::FTP bundled with Ruby.

Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the pipe character "|", the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/ CVE-2017-17405 2017-12-14 2017-12-14
rubygem-passenger -- arbitrary file read vulnerability rubygem-passenger 5.0.105.1.11

Phusion reports:

The cPanel Security Team discovered a vulnerability in Passenger that allows users to list the contents of arbitrary files on the system. CVE-2017-16355 has been assigned to this issue.

https://blog.phusion.nl/2017/10/13/passenger-security-advisory-5-1-11/ CVE-2017-16355 2017-10-13 2017-12-18
libXfont -- permission bypass when opening files through symlinks libXfont 1.5.4 libXfont2 2.0.3

the freedesktop.org project reports:

A non-privileged X client can instruct X server running under root to open any file by creating own directory with "fonts.dir", "fonts.alias" or any font file being a symbolic link to any other file in the system. X server will then open it. This can be issue with special files such as /dev/watchdog.

https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8 CVE-2017-16611 2017-11-25 2017-12-17
libXfont -- multiple memory leaks libXfont 1.5.3 libXfont2 2.0.2

The freedesktop.org project reports:

If a pattern contains '?' character, any character in the string is skipped, even if it is '\0'. The rest of the matching then reads invalid memory.

Without the checks a malformed PCF file can cause the library to make atom from random heap memory that was behind the `strings` buffer. This may crash the process or leak information.

https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d1e670a4a8704b8708e493ab6155589bcd570608 https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd CVE-2017-13720 CVE-2017-13722 2017-10-04 2017-12-17
libXcursor -- integer overflow that can lead to heap buffer overflow libXcursor 1.1.15

The freedesktop.org project reports:

It is possible to trigger heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments.

The integer overflow occurs because the chosen limit 0x10000 for dimensions is too large for 32 bit systems, because each pixel takes 4 bytes. Properly chosen values allow an overflow which in turn will lead to less allocated memory than needed for subsequent reads.

The signedness bug is triggered by reading the length of a comment as unsigned int, but casting it to int when calling the function XcursorCommentCreate. Turning length into a negative value allows the check against XCURSOR_COMMENT_MAX_LEN to pass, and the following addition of sizeof (XcursorComment) + 1 makes it possible to allocate less memory than needed for subsequent reads.

http://seclists.org/oss-sec/2017/q4/339 https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8 CVE-2017-16612 2017-11-28 2017-12-17
global -- gozilla vulnerability global 4.8.66.6.1

MITRE reports:

gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17531 http://lists.gnu.org/archive/html/info-global/2017-12/msg00001.html CVE-2017-17531 2017-12-11 2017-12-16
jenkins -- Two startup race conditions jenkins 2.95 jenkins-lts 2.89.2

The Jenkins project reports:

A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization.

On Jenkins 2.81 and newer, including LTS 2.89.1, this could in rare cases (we estimate less than 20% of new instances) result in failure to initialize the setup wizard on the first startup.

There is a very short window of time after startup during which Jenkins may no longer show the "Please wait while Jenkins is getting ready to work" message, but Cross-Site Request Forgery (CSRF) protection may not yet be effective.

https://jenkins.io/security/advisory/2017-12-14/ 2017-12-14 2017-12-15
node.js -- Data Confidentiality/Integrity Vulnerability, December 2017 node4 4.8.7 node6 6.12.2 node8 8.9.3 node 9.2.1

Node.js reports:

Data Confidentiality/Integrity Vulnerability - CVE-2017-15896

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

Uninitialized buffer vulnerability - CVE-2017-15897

Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

Also included in OpenSSL update - CVE 2017-3738

Note that CVE 2017-3738 of OpenSSL-1.0.2 affected Node but it was low severity.

https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ CVE-2017-15896 CVE-2017-15897 CVE-2017-3738 2017-12-08 2017-12-14
GitLab -- multiple vulnerabilities gitlab 4.2.010.0.6 10.1.010.1.4 10.2.010.2.3

GitLab reports:

User without access to private Wiki can see it on the project page

Matthias Burtscher reported that it was possible for a user to see a private Wiki on the project page without having the corresponding permission.

E-mail address disclosure through member search fields

Hugo Geoffroy reported via HackerOne that it was possible to find out the full e-mail address of any user by brute-forcing the member search field.

Groups API leaks private projects

An internal code review discovered that users were able to list private projects they had no access to by using the Groups API.

Cross-Site Scripting (XSS) possible by editing a comment

Sylvain Heiniger reported via HackerOne that it was possible for arbitrary JavaScript code to be executed when editing a comment.

Issue API allows any user to create a new issue even when issues are restricted or disabled

Mohammad Hasbini reported that any user could create a new issues in a project even when issues were disabled or restricted to team members in the project settings.

https://about.gitlab.com/2017/12/08/gitlab-10-dot-2-dot-4-security-release/ 2017-12-08 2017-12-14
tor -- Use-after-free in onion service v2 tor 0.3.1.9

The Torproject.org reports:

  • TROVE-2017-009: Replay-cache ineffective for v2 onion services
  • TROVE-2017-010: Remote DoS attack against directory authorities
  • TROVE-2017-011: An attacker can make Tor ask for a password
  • TROVE-2017-012: Relays can pick themselves in a circuit path
  • TROVE-2017-013: Use-after-free in onion service v2
https://blog.torproject.org/new-stable-tor-releases-security-fixes-0319-03013-02914-02817-02516 CVE-2017-8819 2017-12-01 2017-12-14
asterisk -- Remote Crash Vulnerability in RTCP Stack asterisk13 13.18.4

The Asterisk project reports:

If a compound RTCP packet is received containing more than one report (for example a Receiver Report and a Sender Report) the RTCP stack will incorrectly store report information outside of allocated memory potentially causing a crash.

https://downloads.asterisk.org/pub/security/AST-2017-012.html 2017-12-12 2017-12-13
libxml2 -- Multiple Issues libxml2 2.9.4

libxml2 developers report:

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.

https://bugzilla.gnome.org/show_bug.cgi?id=775200 http://www.openwall.com/lists/oss-security/2017/05/15/1 http://www.securityfocus.com/bid/98599 http://www.openwall.com/lists/oss-security/2017/05/15/1 http://www.securityfocus.com/bid/98556 http://www.openwall.com/lists/oss-security/2017/05/15/1 http://www.securityfocus.com/bid/98601 http://www.openwall.com/lists/oss-security/2017/05/15/1 http://www.securityfocus.com/bid/98568 CVE-2017-8872 CVE-2017-9047 CVE-2017-9048 CVE-2017-9049 CVE-2017-9050 2017-05-10 2017-12-13
FreeBSD -- OpenSSL multiple vulnerabilities FreeBSD 11.111.1_6 10.410.4_5 10.310.3_26

Problem Description:

Invoking SSL_read()/SSL_write() while in an error state causes data to be passed without being decrypted/encrypted directly from the SSL/TLS record layer.

In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. [CVE-2017-3737]

There is an overflow bug in the x86_64 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). [CVE-2017-3738] This bug only affects FreeBSD 11.x.

Impact:

Applications with incorrect error handling may inappropriately pass unencrypted data. [CVE-2017-3737]

Mishandling of carry propagation will produce incorrect output, and make it easier for a remote attacker to obtain sensitive private-key information. No EC algorithms are affected and analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely.

Attacks against DH1024 are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. [CVE-2017-3738]

CVE-2016-0701 CVE-2017-3737 CVE-2017-3738 SA-17:12.openssl 2017-12-09 2017-12-10
wireshark -- multiple security issues wireshark 2.2.02.2.10 2.4.02.4.2 wireshark-lite 2.2.02.2.10 2.4.02.4.2 wireshark-qt5 2.2.02.2.10 2.4.02.4.2 tshark 2.2.02.2.10 2.4.02.4.2 tshark-lite 2.2.02.2.10 2.4.02.4.2

wireshark developers reports:

wnpa-sec-2017-47: The IWARP_MPA dissector could crash. (CVE-2017-17084)

wnpa-sec-2017-48: The NetBIOS dissector could crash. Discovered by Kamil Frankowicz. (CVE-2017-17083)

wnpa-sec-2017-49: The CIP Safety dissector could crash. (CVE-2017-17085)

https://www.wireshark.org/security/ https://www.wireshark.org/security/wnpa-sec-2017-47.html https://www.wireshark.org/security/wnpa-sec-2017-48.html https://www.wireshark.org/security/wnpa-sec-2017-49.html CVE-2017-17083 CVE-2017-17084 CVE-2017-17085 2017-11-30 2017-12-10
OpenSSL -- multiple vulnerabilities openssl 1.0.21.0.2n

The OpenSSL project reports:

  • Read/write after SSL object in error state (CVE-2017-3737)
    OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer.
  • rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
    There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701.
https://www.openssl.org/news/secadv/20171207.txt CVE-2017-3737 CVE-2017-3738 2017-12-07 2017-12-07
FreeBSD -- OpenSSL multiple vulnerabilities FreeBSD 11.111.1_5 11.011.0_16 10.410.4_4 10.310.3_25

Problem Description:

If an X.509 certificate has a malformed IPAddressFamily extension, OpenSSL could do a one-byte buffer overread. [CVE-2017-3735]

There is a carry propagating bug in the x86_64 Montgomery squaring procedure. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. [CVE-2017-3736] This bug only affects FreeBSD 11.x.

Impact:

Application using OpenSSL may display erroneous certificate in text format. [CVE-2017-3735]

Mishandling of carry propagation will produce incorrect output, and make it easier for a remote attacker to obtain sensitive private-key information. No EC algorithms are affected, analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely.

Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. [CVE-2017-3736]

CVE-2017-3735 CVE-2017-3736 SA-17:11.openssl 2017-11-29 2017-12-06
FreeBSD -- Information leak in kldstat(2) FreeBSD-kernel 11.111.1_4 11.011.0_15 10.410.4_3 10.310.3_24

Problem Description:

The kernel does not properly clear the memory of the kld_file_stat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information from the kernel stack is possible.

Impact:

Some bytes from the kernel stack can be observed in userspace.

CVE-2017-1088 SA-17:10.kldstat 2017-11-15 2017-12-06
FreeBSD -- POSIX shm allows jails to access global namespace FreeBSD-kernel 10.410.4_3 10.310.3_24

Problem Description:

Named paths are globally scoped, meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system.

Impact:

A malicious user that has access to a jailed system is able to abuse shared memory by injecting malicious content in the shared memory region. This memory region might be executed by applications trusting the shared memory, like Squid.

This issue could lead to a Denial of Service or local privilege escalation.

CVE-2017-1087 SA-17:09.shm 2017-11-15 2017-12-06
FreeBSD -- Kernel data leak via ptrace(PT_LWPINFO) FreeBSD-kernel 11.111.1_4 11.011.0_15 10.410.4_3 10.310.3_24

Problem Description:

Not all information in the struct ptrace_lwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information of the kernel stack of the thread is possible from the debugger.

Impact:

Some bytes from the kernel stack of the thread using ptrace(PT_LWPINFO) call can be observed in userspace.

CVE-2017-1086 SA-17:08.ptrace 2017-11-15 2017-12-06
FreeBSD -- WPA2 protocol vulnerability FreeBSD 11.111.1_2 11.011.0_13 10.410.4_1 10.310.3_22

Problem Description:

A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys.

Impact:

Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used.

CVE-2017-1307 CVE-2017-1308 SA-17:07.wpa 2017-10-16 2017-12-06
mozilla -- multiple vulnerabilities firefox 57.0,157.0.1,1 56.0.2_11,1 waterfox 56.0.s20171130 seamonkey linux-seamonkey 2.49.2 firefox-esr 52.5.1,1 linux-firefox 52.5.1,2

Mozilla Foundation reports:

CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data

CVE-2017-7844: Visited history information leak through SVG image

CVE-2017-7843 CVE-2017-7844 https://www.mozilla.org/security/advisories/mfsa2017-27/ 2017-11-29 2017-12-05
varnish -- information disclosure vulnerability varnish4 4.1.9 varnish5 5.2.1

Varnish reports:

A wrong if statement in the varnishd source code means that synthetic objects in stevedores which over-allocate, may leak up to page size of data from a malloc(3) memory allocation.

https://varnish-cache.org/security/VSV00002.html CVE-2017-8807 2017-11-15 2017-12-02
mybb -- multiple vulnerabilities mybb 1.8.14

mybb Team reports:

High risk: Language file headers RCE

Low risk: Language Pack Properties XSS

https://blog.mybb.com/2017/11/28/mybb-1-8-14-released-security-maintenance-release/ 2017-11-27 2017-12-02
wordpress -- multiple issues wordpress fr-wordpress 4.9.1,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.9.1

wordpress developers reports:

Use a properly generated hash for the newbloguser key instead of a determinate substring.

Add escaping to the language attributes used on html elements.

Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.

Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.

https://wordpress.org/news/2017/11/wordpress-4-9-1-security-and-maintenance-release/ 2017-11-29 2017-12-01
asterisk -- DOS Vulnerability in Asterisk chan_skinny asterisk13 13.18.3

The Asterisk project reports:

If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing asterisk to stop processing requests of any kind.

https://downloads.asterisk.org/pub/security/AST-2017-013.html CVE-2017-17090 2017-11-30 2017-12-01 2017-12-13
exim -- remote DoS attack in BDAT processing exim 4.884.89.1

Exim developers team reports:

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

https://bugs.exim.org/show_bug.cgi?id=2199 CVE-2017-16944 2017-11-23 2017-11-30
xrdp -- local user can cause a denial of service xrdp-devel 0.9.3,1 0.9.3_1,10.9.4,1

xrdp reports:

The scp_v0s_accept function in the session manager uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.

CVE-2017-16927 2017-11-23 2017-11-29
cURL -- Multiple vulnerabilities curl 7.21.07.57.0 linux-c7-curl 7.21.07.29.0_4

The cURL project reports:

  • NTLM buffer overflow via integer overflow (CVE-2017-8816)
    libcurl contains a buffer overrun flaw in the NTLM authentication code. The internal function Curl_ntlm_core_mk_ntlmv2_hash sums up the lengths of the user name + password (= SUM) and multiplies the sum by two (= SIZE) to figure out how large storage to allocate from the heap.
  • FTP wildcard out of bounds read (CVE-2017-8817)
    libcurl contains a read out of bounds flaw in the FTP wildcard function. libcurl's FTP wildcard matching feature, which is enabled with the CURLOPT_WILDCARDMATCH option can use a built-in wildcard function or a user provided one. The built-in wildcard function has a flaw that makes it not detect the end of the pattern string if it ends with an open bracket ([) but instead it will continue reading the heap beyond the end of the URL buffer that holds the wildcard.
  • SSL out of buffer access (CVE-2017-8818)
    libcurl contains an out boundary access flaw in SSL related code. When allocating memory for a connection (the internal struct called connectdata), a certain amount of memory is allocated at the end of the struct to be used for SSL related structs. Those structs are used by the particular SSL library libcurl is built to use. The application can also tell libcurl which specific SSL library to use if it was built to support more than one.
https://curl.haxx.se/changes.html CVE-2017-8816 CVE-2017-8817 CVE-2017-8818 2017-11-29 2017-11-29 2017-12-11
borgbackup -- remote users can override repository restrictions py34-borgbackup py35-borgbackup py36-borgbackup 1.1.01.1.3

BorgBackup reports:

Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers. A user able to access a remote Borg SSH server is able to circumvent access controls post-authentication. Affected releases: 1.1.0, 1.1.1, 1.1.2. Releases 1.0.x are NOT affected.

CVE-2017-15914 https://github.com/borgbackup/borg/blob/1.1.3/docs/changes.rst#version-113-2017-11-27 2017-11-27 2017-11-29
palemoon -- multiple vulnerabilities palemoon 27.6.2

Pale Moon reports:

CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers

CVE-2017-7835: Mixed content blocking incorrectly applies with redirects

CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags

CVE-2017-7832 CVE-2017-7835 CVE-2017-7840 2017-11-14 2017-11-28
exim -- remote code execution, deny of service in BDAT exim 4.884.89_2

Exim team reports:

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

https://bugs.exim.org/show_bug.cgi?id=2199 2017-11-23 2017-11-27
mybb -- multiple vulnerabilities mybb 1.8.13

myBB Team reports:

High risk: Installer RCE on configuration file write

High risk: Language file headers RCE

Medium risk: Installer XSS

Medium risk: Mod CP Edit Profile XSS

Low risk: Insufficient moderator permission check in delayed moderation tools

Low risk: Announcements HTML filter bypass

Low risk: Language Pack Properties XSS.

https://blog.mybb.com/2017/11/07/mybb-1-8-13-released-security-maintenance-release/ 2017-11-07 2017-11-24
salt -- multiple vulnerabilities py27-salt py32-salt py33-salt py34-salt py35-salt py36-salt 2016.11.8 2017.7.02017.7.2

SaltStack reports:

Directory traversal vulnerability in minion id validation in SaltStack. Allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Credit for discovering the security flaw goes to: Julian Brost (julian@0x4a42.net). NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.

Remote Denial of Service with a specially crafted authentication request. Credit for discovering the security flaw goes to: Julian Brost (julian@0x4a42.net)

CVE-2017-14695 CVE-2017-14696 https://docs.saltstack.com/en/latest/topics/releases/2017.7.2.html https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.8.html https://github.com/saltstack/salt/commit/80d90307b07b3703428ecbb7c8bb468e28a9ae6d https://github.com/saltstack/salt/commit/5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b 2017-10-09 2017-11-23
codeigniter -- input validation bypass codeigniter 3.1.6

The CodeIgniter changelog reports:

Security: Fixed a potential object injection in Cache Library 'apc' driver when save() is used with $raw = TRUE.

https://www.codeigniter.com/user_guide/changelog.html 2017-09-25 2017-11-23
procmail -- Heap-based buffer overflow procmail 3.22_10

MITRE reports:

A remote attacker could use a flaw to cause formail to crash, resulting in a denial of service or data loss.

CVE-2017-16844 https://www.debian.org/security/2017/dsa-4041 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=876511 2017-11-16 2017-11-21 2017-12-08
frr -- BGP Mishandled attribute length on Error frr 3.0.2

FRR reports:

BGP Mishandled attribute length on Error

A vulnerability exists in the BGP daemon of FRR where a malformed BGP UPDATE packet can leak information from the BGP daemon and cause a denial of service by crashing the daemon.

CVE-2017-15865 https://frrouting.org/community/security/cve-2017-15865.html 2017-11-08 2017-11-21
cacti -- multiple vulnerabilities cacti 1.1.28

cacti reports:

Changelog

issue#1057: CVE-2017-16641 - Potential vulnerability in RRDtool functions

issue#1066: CVE-2017-16660 in remote_agent.php logging function

issue#1066: CVE-2017-16661 in view log file

issue#1071: CVE-2017-16785 in global_session.php Reflection XSS

CVE-2017-16641 CVE-2017-16660 CVE-2017-16661 CVE-2017-16785 https://sourceforge.net/p/cacti/mailman/message/36122745/ 2017-11-01 2017-11-20
mediawiki -- multiple vulnerabilities mediawiki127 1.27.3 mediawiki128 1.28.2 mediawiki129 1.29.1

mediawiki reports:

security fixes:

T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.

T165846: BotPasswords doesn't throttle login attempts.

T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.

T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.

T176247: It's possible to mangle HTML via raw message parameter expansion.

T125163: id attribute on headlines allow raw.

T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.

T119158: Language converter: unsafe attribute injection via glossary rules.

T180488: api.log contains passwords in plaintext wasn't correctly fixed.

T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.

CVE-2017-8808 CVE-2017-8809 CVE-2017-8810 CVE-2017-8811 CVE-2017-8812 CVE-2017-8814 CVE-2017-8815 CVE-2017-0361 CVE-2017-9841 https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html 2017-11-14 2017-11-19
Flash Player -- multiple vulnerabilities linux-flashplayer 27.0.0.187

Adobe reports:

  • These updates resolve out-of-bounds read vulnerabilities that could lead to remote code execution (CVE-2017-3112, CVE-2017-3114, CVE-2017-11213).
  • These updates resolve use after free vulnerabilities that could lead to remote code execution (CVE-2017-11215, CVE-2017-11225).
CVE-2017-3112 CVE-2017-3114 CVE-2017-11213 CVE-2017-11215 CVE-2017-11225 https://helpx.adobe.com/security/products/flash-player/apsb17-33.html 2017-11-14 2017-11-16
shibboleth2-sp -- "Dynamic" metadata provider plugin issue shibboleth2-sp 2.6.1

The Internet2 community reports:

The Shibboleth Service Provider software includes a MetadataProvider plugin with the plugin type "Dynamic" to obtain metadata on demand from a query server, in place of the more typical mode of downloading aggregates separately containing all of the metadata to load.

All the plugin types rely on MetadataFilter plugins to perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments.

Due to a coding error, the "Dynamic" plugin fails to configure itself with the filters provided to it and thus omits whatever checks they are intended to perform, which will typically leave deployments vulnerable to active attacks involving the substitution of metadata if the network path to the query service is compromised.

http://shibboleth.internet2.edu/secadv/secadv_20171115.txt 2017-11-15 2017-11-15
mozilla -- multiple vulnerabilities firefox 56.0.2_10,1 seamonkey linux-seamonkey 2.49.2 firefox-esr 52.5.0,1 linux-firefox 52.5.0,2 libxul thunderbird linux-thunderbird 52.5.0

Mozilla Foundation reports:

CVE-2017-7828: Use-after-free of PressShell while restyling layout

CVE-2017-7830: Cross-origin URL information leak through Resource Timing API

CVE-2017-7831: Information disclosure of exposed properties on JavaScript proxy objects

CVE-2017-7832: Domain spoofing through use of dotless 'i' character followed by accent markers

CVE-2017-7833: Domain spoofing with Arabic and Indic vowel marker characters

CVE-2017-7834: data: URLs opened in new tabs bypass CSP protections

CVE-2017-7835: Mixed content blocking incorrectly applies with redirects

CVE-2017-7836: Pingsender dynamically loads libcurl on Linux and OS X

CVE-2017-7837: SVG loaded as <img> can use meta tags to set cookies

CVE-2017-7838: Failure of individual decoding of labels in international domain names triggers punycode display of entire IDN

CVE-2017-7839: Control characters before javascript: URLs defeats self-XSS prevention mechanism

CVE-2017-7840: Exported bookmarks do not strip script elements from user-supplied tags

CVE-2017-7842: Referrer Policy is not always respected for <link> elements

CVE-2017-7827: Memory safety bugs fixed in Firefox 57

CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

CVE-2017-7826 CVE-2017-7827 CVE-2017-7828 CVE-2017-7830 CVE-2017-7831 CVE-2017-7832 CVE-2017-7833 CVE-2017-7834 CVE-2017-7835 CVE-2017-7836 CVE-2017-7837 CVE-2017-7838 CVE-2017-7839 CVE-2017-7840 CVE-2017-7842 https://www.mozilla.org/security/advisories/mfsa2017-24/ https://www.mozilla.org/security/advisories/mfsa2017-25/ 2017-11-14 2017-11-14
rubygem-geminabox -- XSS vulnerabilities rubygem-geminabox 0.13.10

NVD reports:

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.

https://nvd.nist.gov/vuln/detail/CVE-2017-16792 CVE-2017-16792 2017-11-13 2017-11-13
konversation -- crash in IRC message parsing konversation 1.7.3

KDE reports:

Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.

CVE-2017-15923 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15923 https://www.kde.org/info/security/advisory-20171112-1.txt 2017-10-27 2017-11-12
roundcube -- file disclosure vulnerability roundcube 1.3.3,1

MITRE reports:

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session.

https://github.com/roundcube/roundcubemail/issues/6026 https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 CVE-2017-16651 ports/223557 2017-11-06 2017-11-11 2017-12-31
chromium -- multiple vulnerabilities chromium 62.0.3202.89

Google Chrome Releases reports:

2 security fixes in this release, including:

  • [777728] Critical CVE-2017-15398: Stack buffer overflow in QUIC. Reported by Ned Williamson on 2017-10-24
  • [776677] High CVE-2017-15399: Use after free in V8. Reported by Zhao Qixun of Qihoo 360 Vulcan Team on 2017-10-20
CVE-2017-15398 CVE-2017-15399 https://chromereleases.googleblog.com/2017/11/stable-channel-update-for-desktop.html 2017-11-06 2017-11-10
PostgreSQL vulnerabilities postgresql92-server 9.2.09.2.24 postgresql93-server 9.3.09.3.20 postgresql94-server 9.4.09.4.15 postgresql95-server 9.5.09.5.10 postgresql96-server 9.6.09.6.6 postgresql10-server 10.010.1

The PostgreSQL project reports:

  • CVE-2017-15098: Memory disclosure in JSON functions
  • CVE-2017-15099: INSERT ... ON CONFLICT DO UPDATE fails to enforce SELECT privileges
CVE-2017-15099 CVE-2017-15098 2017-10-10 2017-11-09
jenkins -- multiple issues jenkins 2.89 jenkins-lts 2.73.3

Jenkins developers report:

Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems.

Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.

https://jenkins.io/security/advisory/2017-11-08/ 2017-11-08 2017-11-09
asterisk -- Memory/File Descriptor/RTP leak in pjsip session resource asterisk13 13.5.013.18.1

The Asterisk project reports:

A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. This then leads to file descriptors and RTP ports being leaked as well.

https://downloads.asterisk.org/pub/security/AST-2017-011.html CVE-2017-16672 2017-10-15 2017-11-09 2017-12-13
asterisk -- Buffer overflow in CDR's set user asterisk13 13.18.1

The Asterisk project reports:

No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. The earlier AST-2017-001 advisory for the CDR user field overflow was for the Party A buffer.

https://downloads.asterisk.org/pub/security/AST-2017-010.html CVE-2017-16671 2017-10-09 2017-11-09 2017-12-13
asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk asterisk13 13.18.1 pjsip 2.7.1 pjsip-extsrtp 2.7.1

The Asterisk project reports:

By carefully crafting invalid values in the Cseq and the Via header port, pjprojects packet parsing code can create strings larger than the buffer allocated to hold them. This will usually cause Asterisk to crash immediately. The packets do not have to be authenticated.

https://downloads.asterisk.org/pub/security/AST-2017-009.html 2017-10-05 2017-11-09 2017-11-15
OpenSSL -- Multiple vulnerabilities openssl 1.0.2m,1 openssl-devel 1.1.0g

The OpenSSL project reports:

bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
Severity: Moderate
There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline.

Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
Severity: Low
This issue was previously announced in security advisory https://www.openssl.org/news/secadv/20170828.txt, but the fix has not previously been included in a release due to its low severity.

https://www.openssl.org/news/secadv/20171102.txt CVE-2017-3735 CVE-2017-3736 2017-11-02 2017-11-02
wordpress -- multiple issues wordpress 4.8.3,1

wordpress developers reports:

WordPress versions 4.8.2 and earlier are affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we've added hardening to prevent plugins and themes from accidentally causing a vulnerability.

https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/ 2017-10-31 2017-11-01
wireshark -- multiple security issues wireshark 2.2.02.2.9 2.4.02.4.1

wireshark developers reports:

In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.

In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.

In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.

In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.

http://www.securityfocus.com/bid/101227 http://www.securityfocus.com/bid/101228 http://www.securityfocus.com/bid/101229 http://www.securityfocus.com/bid/101235 http://www.securityfocus.com/bid/101240 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080 https://code.wireshark.org/review/23470 https://code.wireshark.org/review/23537 https://code.wireshark.org/review/23591 https://code.wireshark.org/review/23635 https://code.wireshark.org/review/23663 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0 https://www.wireshark.org/security/wnpa-sec-2017-42.html https://www.wireshark.org/security/wnpa-sec-2017-43.html https://www.wireshark.org/security/wnpa-sec-2017-44.html https://www.wireshark.org/security/wnpa-sec-2017-45.html https://www.wireshark.org/security/wnpa-sec-2017-46.html CVE-2017-15189 CVE-2017-15190 CVE-2017-15191 CVE-2017-15192 CVE-2017-15193 2017-10-10 2017-10-30
PHP -- denial of service attack php56 5.6.32 php70 7.0.25 php71 7.1.11

The PHP project reports:

The PHP development team announces the immediate availability of PHP 5.6.32. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 7.0.25. This is a security release. Several security bugs were fixed in this release. All PHP 7.0 users are encouraged to upgrade to this version.

The PHP development team announces the immediate availability of PHP 7.1.11. This is a bugfix release, with several bug fixes included. All PHP 7.1 users are encouraged to upgrade to this version.

http://php.net/archive/2017.php#id2017-10-26-3 http://php.net/archive/2017.php#id2017-10-26-1 http://php.net/archive/2017.php#id2017-10-27-1 CVE-2016-1283 2017-10-26 2017-10-30 2017-11-14
chromium -- Stack overflow in V8 chromium 62.0.3202.75

Google Chrome Releases reports:

2 security fixes in this release, including:

  • [770452] High CVE-2017-15396: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30
  • [770450] Medium CVE-2017-15406: Stack overflow in V8. Reported by Yuan Deng of Ant-financial Light-Year Security Lab on 2017-09-30
CVE-2017-15396 CVE-2017-15406 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop_26.html 2017-10-26 2017-10-28 2018-01-23
wget -- Heap overflow in HTTP protocol handling wget 1.19.2

Antti Levomäki, Christian Jalio, Joonas Pihlaja:

Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of the user.

http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba CVE-2017-13090 2017-10-20 2017-10-27
wget -- Stack overflow in HTTP protocol handling wget 1.19.2

Antti Levomäki, Christian Jalio, Joonas Pihlaja:

Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of the user.

http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f CVE-2017-13089 2017-10-20 2017-10-27
Node.js -- remote DOS security vulnerability node 8.8.0 node6 6.10.26.11.5 node4 4.8.24.8.5

Node.js reports:

Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version)

https://nodejs.org/en/blog/vulnerability/oct-2017-dos/ CVE-2017-14919 2017-10-17 2017-10-25
GitLab -- multiple vulnerabilities gitlab 2.8.09.4.6 9.5.09.5.8 10.0.010.0.3

GitLab reports:

Cross-Site Scripting (XSS) vulnerability in the Markdown sanitization filter

Yasin Soliman via HackerOne reported a Cross-Site Scripting (XSS) vulnerability in the GitLab markdown sanitization filter. The sanitization filter was not properly stripping invalid characters from URL schemes and was therefore vulnerable to persistent XSS attacks anywhere Markdown was supported.

Cross-Site Scripting (XSS) vulnerability in search bar

Josh Unger reported a Cross-Site Scripting (XSS) vulnerability in the issue search bar. Usernames were not being properly HTML escaped inside the author filter would could allow arbitrary script execution.

Open redirect in repository git redirects

Eric Rafaloff via HackerOne reported that GitLab was vulnerable to an open redirect vulnerability when redirecting requests for repository names that include the git extension. GitLab was not properly removing dangerous parameters from the params field before redirecting which could allow an attacker to redirect users to arbitrary hosts.

Username changes could leave repositories behind

An internal code review discovered that a bug in the code that moves repositories during a username change could potentially leave behind projects, allowing an attacker who knows the previous username to potentially steal the contents of repositories on instances that are not configured with hashed namespaces.

https://about.gitlab.com/2017/10/17/gitlab-10-dot-0-dot-4-security-release/ 2017-10-17 2017-10-25
Apache OpenOffice -- multiple vulnerabilities apache-openoffice 4.1.4 apache-openoffice-devel 4.2.1810071_1,4

The Apache Openofffice project reports:

CVE-2017-3157: Arbitrary file disclosure in Calc and Writer

By exploiting the way OpenOffice renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to sent the document back to the attacker.

The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.

CVE-2017-9806: Out-of-Bounds Write in Writer's WW8Fonts Constructor

A vulnerability in the OpenOffice Writer DOC file parser, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

CVE-2017-12607: Out-of-Bounds Write in Impress' PPT Filter

A vulnerability in OpenOffice's PPT file parser, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

CVE-2017-12608: Out-of-Bounds Write in Writer's ImportOldFormatStyles

A vulnerability in OpenOffice Writer DOC file parser, and specifically in ImportOldFormatStyles, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution.

https://www.openoffice.org/security/cves/CVE-2017-3157.html https://www.openoffice.org/security/cves/CVE-2017-9806.html https://www.openoffice.org/security/cves/CVE-2017-12607.html https://www.openoffice.org/security/cves/CVE-2017-12608.html CVE-2017-3157 CVE-2017-9806 CVE-2017-12607 CVE-2017-12608 2016-09-11 2017-10-24 2017-10-26
cURL -- out of bounds read curl 7.207.56.1

The cURL project reports:

libcurl contains a buffer overrun flaw in the IMAP handler.
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function.
libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.

https://curl.haxx.se/docs/adv_20171023.html CVE-2017-1000257 2017-10-23 2017-10-23
h2o -- DoS in workers h2o 2.2.3

Frederik Deweerdt reports:

Multiple Denial-of-Service vulnerabilities exist in h2o workers - see references for full details.

CVE-2017-10868: Worker processes may crash when receiving a request with invalid framing.

CVE-2017-10869: The stack may overflow when proxying huge requests.

CVE-2017-10868 CVE-2017-10869 https://github.com/h2o/h2o/issues/1459 https://github.com/h2o/h2o/issues/1460 https://github.com/h2o/h2o/releases/tag/v2.2.3 2017-07-19 2017-10-17
irssi -- multiple vulnerabilities irssi 1.0.5,1

Irssi reports:

When installing themes with unterminated colour formatting sequences, Irssi may access data beyond the end of the string.

While waiting for the channel synchronisation, Irssi may incorrectly fail to remove destroyed channels from the query list, resulting in use after free conditions when updating the state later on.

Certain incorrectly formatted DCC CTCP messages could cause NULL pointer dereference.

Overlong nicks or targets may result in a NULL pointer dereference while splitting the message.

In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string.

https://irssi.org/security/irssi_sa_2017_10.txt CVE-2017-15721 CVE-2017-15722 CVE-2017-15723 CVE-2017-15227 CVE-2017-15228 ports/223169 2017-10-10 2017-10-22 2017-12-31
chromium -- multiple vulnerabilities chromium 62.0.3202.62

Google Chrome Releases reports:

35 security fixes in this release, including:

  • [762930] High CVE-2017-5124: UXSS with MHTML. Reported by Anonymous on 2017-09-07
  • [749147] High CVE-2017-5125: Heap overflow in Skia. Reported by Anonymous on 2017-07-26
  • [760455] High CVE-2017-5126: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-08-30
  • [765384] High CVE-2017-5127: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-09-14
  • [765469] High CVE-2017-5128: Heap overflow in WebGL. Reported by Omair on 2017-09-14
  • [765495] High CVE-2017-5129: Use after free in WebAudio. Reported by Omair on 2017-09-15
  • [718858] High CVE-2017-5132: Incorrect stack manipulation in WebAssembly. Reported by Gaurav Dewan of Adobe Systems India Pvt. Ltd. on 2017-05-05
  • [722079] High CVE-2017-5130: Heap overflow in libxml2. Reported by Pranjal Jumde on 2017-05-14
  • [744109] Medium CVE-2017-5131: Out of bounds write in Skia. Reported by Anonymous on 2017-07-16
  • [762106] Medium CVE-2017-5133: Out of bounds write in Skia. Reported by Aleksandar Nikolic of Cisco Talos on 2017-09-05
  • [752003] Medium CVE-2017-15386: UI spoofing in Blink. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-08-03
  • [756040] Medium CVE-2017-15387: Content security bypass. Reported by Jun Kokatsu on 2017-08-16
  • [756563] Medium CVE-2017-15388: Out of bounds read in Skia. Reported by Kushal Arvind Shah of Fortinet's FortiGuard Labs on 2017-08-17
  • [739621] Medium CVE-2017-15389: URL spoofing in Omnibox. Reported by xisigr of Tencent's Xuanwu Lab on 2017-07-06
  • [750239] Medium CVE-2017-15390: URL spoofing in Omnibox. Reported by Haosheng Wang on 2017-07-28
  • [598265] Low CVE-2017-15391: Extension limitation bypass in Extensions. Reported by Joao Lucas Melo Brasio on 2016-03-28
  • [714401] Low CVE-2017-15392: Incorrect registry key handling in PlatformIntegration. Reported by Xiaoyin Liu on 2017-04-22
  • [732751] Low CVE-2017-15393: Referrer leak in Devtools. Reported by Svyat Mitin on 2017-06-13
  • [745580] Low CVE-2017-15394: URL spoofing in extensions UI. Reported by Sam on 2017-07-18
  • [759457] Low CVE-2017-15395: Null pointer dereference in ImageCapture. Reported by Johannes Bergman on 2017-08-28
  • [775550] Various fixes from internal audits, fuzzing and other initiatives
CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129 CVE-2017-5132 CVE-2017-5130 CVE-2017-5131 CVE-2017-5133 CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html 2017-10-17 2017-10-21
cacti -- Cross Site Scripting issue cacti 1.1.26

cacti developers report:

The file include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.

http://www.securitytracker.com/id/1039569 https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd https://github.com/Cacti/cacti/issues/1010 CVE-2017-15194 2017-10-10 2017-10-19
arj -- multiple vulnerabilities arj 3.10.22_5

Several vulnerabilities: symlink directory traversal, absolute path directory traversal and buffer overflow were discovered in the arj archiver.

CVE-2015-0556 CVE-2015-0557 CVE-2015-2782 2015-04-08 2017-10-19
krb5 -- Multiple vulnerabilities krb5 1.14.6 1.151.15.2 krb5-devel 1.14.6 1.151.15.2 krb5-115 1.15.2 krb5-114 1.14.6 krb5-113 1.14.6

MIT reports:

CVE-2017-11368:

In MIT krb5 1.7 and later, an authenticated attacker can cause an assertion failure in krb5kdc by sending an invalid S4U2Self or S4U2Proxy request.

CVE-2017-11462:

RFC 2744 permits a GSS-API implementation to delete an existing security context on a second or subsequent call to gss_init_sec_context() or gss_accept_sec_context() if the call results in an error. This API behavior has been found to be dangerous, leading to the possibility of memory errors in some callers. For safety, GSS-API implementations should instead preserve existing security contexts on error until the caller deletes them.

All versions of MIT krb5 prior to this change may delete acceptor contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through 1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts on error.

https://nvd.nist.gov/vuln/detail/CVE-2017-11368 https://krbdev.mit.edu/rt/Ticket/Display.html?id=8599 https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970 https://nvd.nist.gov/vuln/detail/CVE-2017-11462 https://krbdev.mit.edu/rt/Ticket/Display.html?id=8598 https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf CVE-2017-11368 CVE-2017-11462 2017-07-14 2017-10-18
MySQL -- multiple vulnerabilities mariadb55-server 5.5.58 mariadb100-server 10.0.33 mariadb101-server 10.1.29 mariadb102-server 10.2.10 mysql55-server 5.5.58 mysql56-server 5.6.38 mysql57-server 5.7.20 percona55-server 5.5.58 percona56-server 5.6.38 percona57-server 5.7.20

Oracle reports:

Please reference CVE/URL list for details

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL CVE-2017-10155 CVE-2017-10379 CVE-2017-10384 CVE-2017-10276 CVE-2017-10167 CVE-2017-10378 CVE-2017-10277 CVE-2017-10203 CVE-2017-10283 CVE-2017-10313 CVE-2017-10296 CVE-2017-10311 CVE-2017-10320 CVE-2017-10314 CVE-2017-10227 CVE-2017-10279 CVE-2017-10294 CVE-2017-10165 CVE-2017-10284 CVE-2017-10286 CVE-2017-10268 CVE-2017-10365 2017-10-18 2017-10-18 2017-12-23
xorg-server -- Multiple Issues xorg-server 1.18.4_6,1 1.19.0,11.19.3,1

xorg-server developers reports:

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events.

Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.

http://www.securityfocus.com/bid/99546 https://bugzilla.suse.com/show_bug.cgi?id=1035283 https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455 http://www.securityfocus.com/bid/99543 https://bugzilla.suse.com/show_bug.cgi?id=1035283 https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced CVE-2017-10971 CVE-2017-10972 2017-07-06 2017-10-17 2018-05-20
Flash Player -- Remote code execution linux-flashplayer 27.0.0.170

Adobe reports:

  • This update resolves a type confusion vulnerability that could lead to remote code execution (CVE-2017-11292).
CVE-2017-11292 https://helpx.adobe.com/security/products/flash-player/apsb17-32.html 2017-10-16 2017-10-17
WPA packet number reuse with replayed messages and key reinstallation wpa_supplicant 2.6_1 hostapd 2.6

wpa_supplicant developers report:

A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys.

http://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt https://www.kb.cert.org/vuls/id/228519 CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13084 CVE-2017-13086 CVE-2017-13087 CVE-2017-13088 2017-10-16 2017-10-16
mercurial -- multiple issues mercurial 4.3

mercurial developers reports:

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

http://www.securityfocus.com/bid/100290 https://security.gentoo.org/glsa/201709-18 https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 http://www.securityfocus.com/bid/100290 https://security.gentoo.org/glsa/201709-18 https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 CVE-2017-1000115 CVE-2017-1000116 2017-10-05 2017-10-16
Multiple exploitable heap-based buffer overflow vulnerabilities exists in FreeXL 1.0.3 freexl 1.0.4

Cisco TALOS reports:

An exploitable heap based buffer overflow vulnerability exists in the read_biff_next_record function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.

An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.

https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430 CVE-2017-2923 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0431 CVE-2017-2924 2017-09-11 2017-10-13
FFmpeg -- multiple vulnerabilities ffmpeg 3.3.4 mythtv mythtv-frontend 29.1,1

FFmpeg security reports:

Multiple vulnerabilities have been fixed in FFmpeg 3.3.4. Please refer to the CVE list for details.

https://www.ffmpeg.org/security.html CVE-2017-14054 CVE-2017-14055 CVE-2017-14056 CVE-2017-14057 CVE-2017-14058 CVE-2017-14059 CVE-2017-14169 CVE-2017-14170 CVE-2017-14171 CVE-2017-14222 CVE-2017-14223 CVE-2017-14225 CVE-2017-14767 2017-09-11 2017-10-12 2018-03-25
xorg-server -- multiple vulnabilities xephyr 1.18.4_5,1 xorg-dmx 1.18.4_5,1 xorg-nestserver 1.19.1_2,2 xorg-server 1.18.4_5,1 xorg-vfbserver 1.19.1_2,1 xwayland 1.19.1_2

Adam Jackson reports:

One regression fix since 1.19.4 (mea culpa), and fixes for CVEs 2017-12176 through 2017-12187.

https://lists.x.org/archives/xorg-announce/2017-October/002814.html CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12179 CVE-2017-12180 CVE-2017-12181 CVE-2017-12182 CVE-2017-12183 CVE-2017-12184 CVE-2017-12185 CVE-2017-12186 CVE-2017-12187 2017-10-12 2017-10-13
solr -- Code execution via entity expansion apache-solr 5.16.6.1 7.0.07.1

Solr developers report:

Lucene XML parser does not explicitly prohibit doctype declaration and expansion of external entities which leads to arbitrary HTTP requests to the local SOLR instance and to bypass all firewall restrictions.

Solr "RunExecutableListener" class can be used to execute arbitrary commands on specific events, for example after each update query. The problem is that such listener can be enabled with any parameters just by using Config API with add-listener command.

http://lucene.472066.n3.nabble.com/Re-Several-critical-vulnerabilities-discovered-in-Apache-Solr-XXE-amp-RCE-td4358308.html https://marc.info/?l=apache-announce&m=150786685013286 CVE-2017-12629 2017-10-13 2017-10-13 2017-10-16
jenkins -- multiple issues jenkins 2.83 jenkins-lts 2.73.1

jenkins developers report:

A total of 11 issues are reported, please see reference URL for details.

https://jenkins.io/security/advisory/2017-10-11/ 2017-10-11 2017-10-13
xen-kernel -- multiple vulnerabilities xen-kernel 4.7.2_6

The Xen project reports multiple vulnerabilities.

http://xenbits.xen.org/xsa/advisory-237.html http://xenbits.xen.org/xsa/advisory-238.html http://xenbits.xen.org/xsa/advisory-239.html http://xenbits.xen.org/xsa/advisory-240.html http://xenbits.xen.org/xsa/advisory-241.html http://xenbits.xen.org/xsa/advisory-242.html http://xenbits.xen.org/xsa/advisory-243.html http://xenbits.xen.org/xsa/advisory-244.html 2017-10-12 2017-10-12
nss -- Use-after-free in TLS 1.2 generating handshake hashes nss 3.323.32.1 3.283.28.6 linux-c6-nss 3.283.28.4_2 linux-c7-nss 3.283.28.4_2

Mozilla reports:

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash.

https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/#CVE-2017-7805 https://hg.mozilla.org/projects/nss/rev/2d7b65b72290 https://hg.mozilla.org/projects/nss/rev/d3865e2957d0 CVE-2017-7805 2017-08-04 2017-10-12 2018-01-29
osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer libosip2 5.0.0

osip developers reports:

In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.

http://www.securityfocus.com/bid/97644 https://savannah.gnu.org/support/index.php?109265 CVE-2017-7853 2017-04-13 2017-10-11
ncurses -- multiple issues ncurses 6.0

ncurses developers reports:

There are multiple illegal address access issues and an infinite loop issue. Please refer to the CVE list for details.

https://bugzilla.redhat.com/show_bug.cgi?id=1484274 https://bugzilla.redhat.com/show_bug.cgi?id=1484276 https://bugzilla.redhat.com/show_bug.cgi?id=1484284 https://bugzilla.redhat.com/show_bug.cgi?id=1484285 https://bugzilla.redhat.com/show_bug.cgi?id=1484287 https://bugzilla.redhat.com/show_bug.cgi?id=1484290 https://bugzilla.redhat.com/show_bug.cgi?id=1484291 CVE-2017-13728 CVE-2017-13729 CVE-2017-13730 CVE-2017-13731 CVE-2017-13732 CVE-2017-13733 CVE-2017-13734 2017-08-29 2017-10-11
Python 2.7 -- multiple vulnerabilities python27 2.7.14

Python reports:

Multiple vulnerabilities have been fixed in Python 2.7.14. Please refer to the CVE list for details.

https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS CVE-2012-0876 CVE-2016-0718 CVE-2016-4472 CVE-2016-5300 CVE-2016-9063 CVE-2017-9233 2017-08-26 2017-10-11
node -- access to unintended files node 8.5.08.6.0

node developers report:

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

http://www.securityfocus.com/bid/101056 CVE-2017-14849 2017-09-27 2017-10-10
zookeeper -- Denial Of Service zookeeper 3.4.10

zookeeper developers report:

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.

https://lists.apache.org/thread.html/58170aeb7a681d462b7fa31cae81110cbb749d2dc83c5736a0bb8370@%3Cdev.zookeeper.apache.org%3E CVE-2017-5637 2017-10-09 2017-10-10
libtiff -- Improper Input Validation libtiff 4.0.8

libtiff developers report:

There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.

There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will lead to a remote denial of service attack.

http://bugzilla.maptools.org/show_bug.cgi?id=2727 http://bugzilla.maptools.org/show_bug.cgi?id=2728 http://www.securityfocus.com/bid/100524 CVE-2017-13726 CVE-2017-13727 2017-08-29 2017-10-10
rubygems -- deserialization vulnerability ruby22-gems ruby23-gems ruby24-gems 2.6.14

oss-security mailing list:

There is a possible unsafe object desrialization vulnerability in RubyGems. It is possible for YAML deserialization of gem specifications to bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.

http://www.openwall.com/lists/oss-security/2017/10/10/2 http://blog.rubygems.org/2017/10/09/2.6.14-released.html CVE-2017-0903 2017-10-09 2017-10-10
xorg-server -- multiple vulnabilities xephyr 1.18.4_4,1 xorg-dmx 1.18.4_4,1 xorg-nestserver 1.19.1_1,2 xorg-server 1.18.4_4,1 xorg-vfbserver 1.19.1_1,1 xwayland 1.19.1_1

Alan Coopersmith reports:

X.Org thanks Michal Srb of SuSE for finding these issues and bringing them to our attention, Julien Cristau of Debian for getting the fixes integrated, and Adam Jackson of Red Hat for publishing the release.

https://lists.x.org/archives/xorg-announce/2017-October/002809.html CVE-2017-13721 CVE-2017-13723 2017-10-04 2017-10-09
tomcat -- Remote Code Execution tomcat 7.0.07.0.81 8.0.08.0.46 8.5.08.5.22 9.0.09.0.1

tomcat developers reports:

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

http://www.securityfocus.com/bid/100954 https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E CVE-2017-12617 2017-10-04 2017-10-06
cURL -- out of bounds read curl 7.56.0

The cURL project reports:

FTP PWD response parser out of bounds read

libcurl may read outside of a heap allocated buffer when doing FTP.

When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the PWD command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses.

Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path.

A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault.

https://curl.haxx.se/docs/adv_20171004.html CVE-2017-1000254 2017-10-04 2017-10-04
FreeBSD -- OpenSSH Denial of Service vulnerability FreeBSD 11.111.1_1 11.011.0_12 10.310.3_21

Problem Description:

There is no limit on the password length.

Impact:

A remote attacker may be able to cause an affected SSH server to use excessive amount of CPU by sending very long passwords, when PasswordAuthentication is enabled by the system administrator.

CVE-2016-6515 SA-17:06.openssh 2017-08-10 2017-10-03
FreeBSD -- heimdal KDC-REP service name validation vulnerability FreeBSD 11.011.0_11 10.310.3_20

Problem Description:

There is a programming error in the Heimdal implementation that used an unauthenticated, plain-text version of the KDC-REP service name found in a ticket.

Impact:

An attacker who has control of the network between a client and the service it talks to will be able to impersonate the service, allowing a successful man-in-the-middle (MITM) attack that circumvents the mutual authentication.

CVE-2017-1110 SA-17:05.heimdal 2017-07-12 2017-10-03
dnsmasq -- multiple vulnerabilities dnsmasq 2.78,1 dnsmasq-devel 2.78

Google Project Zero reports:

  • CVE-2017-14491: Heap based overflow (2 bytes). Before 2.76 and this commit overflow was unrestricted.
  • CVE-2017-14492: Heap based overflow.
  • CVE-2017-14493: Stack Based overflow.
  • CVE-2017-14494: Information Leak
  • CVE-2017-14495: Lack of free()
  • CVE-2017-14496: Invalid boundary checks. Integer underflow leading to a huge memcpy.
  • CVE-2017-13704: Crash on large DNS query
https://security.googleblog.com/2017/10/behind-masq-yet-more-dns-and-dhcp.html CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 CVE-2017-13704 2017-10-02 2017-10-02
phpmyfaq -- multiple issues phpmyfaq 2.9.8

phpmyfaq developers report:

Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.

Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.

https://www.exploit-db.com/exploits/42761/ https://github.com/thorsten/phpMyFAQ/commit/30b0025e19bd95ba28f4eff4d259671e7bb6bb86 CVE-2017-14618 CVE-2017-14619 2017-09-20 2017-09-29
wordpress -- multiple issues wordpress 4.8.2

wordpress developers report:

Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.

Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.

Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.

http://www.securityfocus.com/bid/100912 https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ https://core.trac.wordpress.org/changeset/41393 https://core.trac.wordpress.org/changeset/41395 https://core.trac.wordpress.org/changeset/41397 https://core.trac.wordpress.org/changeset/41412 https://core.trac.wordpress.org/changeset/41448 https://core.trac.wordpress.org/changeset/41457 https://wpvulndb.com/vulnerabilities/8911 https://wpvulndb.com/vulnerabilities/8912 https://wpvulndb.com/vulnerabilities/8913 https://wpvulndb.com/vulnerabilities/8914 CVE-2017-14718 CVE-2017-14719 CVE-2017-14720 CVE-2017-14721 CVE-2017-14722 CVE-2017-14724 CVE-2017-14726 2017-09-23 2017-09-29
mozilla -- multiple vulnerabilities firefox 56.0,1 seamonkey linux-seamonkey 2.49.1 firefox-esr 52.4.0,1 linux-firefox 52.4.0,2 libxul thunderbird linux-thunderbird 52.4.0

Mozilla Foundation reports:

CVE-2017-7793: Use-after-free with Fetch API

CVE-2017-7817: Firefox for Android address bar spoofing through fullscreen mode

CVE-2017-7818: Use-after-free during ARIA array manipulation

CVE-2017-7819: Use-after-free while resizing images in design mode

CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE

CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes

CVE-2017-7812: Drag and drop of malicious page content to the tab bar can open locally stored files

CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

CVE-2017-7813: Integer truncation in the JavaScript parser

CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces

CVE-2017-7815: Spoofing attack with modal dialogs on non-e10s installations

CVE-2017-7816: WebExtensions can load about: URLs in extension UI

CVE-2017-7821: WebExtensions can download and open non-executable files without user interaction

CVE-2017-7823: CSP sandbox directive did not create a unique origin

CVE-2017-7822: WebCrypto allows AES-GCM with 0-length IV

CVE-2017-7820: Xray wrapper bypass with new tab and web console

CVE-2017-7811: Memory safety bugs fixed in Firefox 56

CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7811 CVE-2017-7812 CVE-2017-7813 CVE-2017-7814 CVE-2017-7815 CVE-2017-7816 CVE-2017-7817 CVE-2017-7818 CVE-2017-7819 CVE-2017-7820 CVE-2017-7821 CVE-2017-7822 CVE-2017-7823 CVE-2017-7824 CVE-2017-7825 https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/ 2017-09-28 2017-09-29 2017-10-03
sam2p -- multiple issues sam2p 0.49.3,1

sam2p developers report:

In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.

In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element.

In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.

In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.

Because of an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. However, this also causes memory corruption because of an attempted write to the invalid d[0xfffffffe] array element.

In sam2p 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. However, this can also cause a write to an illegal address.

https://github.com/pts/sam2p/issues/14 CVE-2017-14628 CVE-2017-14629 CVE-2017-14630 CVE-2017-14631 CVE-2017-14636 CVE-2017-14637 2017-09-21 2017-09-28
libraw -- Out-of-bounds Read libraw 0.18.4

libraw developers report:

In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.

https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21 https://github.com/LibRaw/LibRaw/issues/101 CVE-2017-14608 2017-09-20 2017-09-28
OpenVPN -- out-of-bounds write in legacy key-method 1 openvpn-polarssl 2.3.18 openvpn-mbedtls 2.4.02.4.4 openvpn 2.4.02.4.4 2.3.18

Steffan Karger reports:

The bounds check in read_key() was performed after using the value, instead of before. If 'key-method 1' is used, this allowed an attacker to send a malformed packet to trigger a stack buffer overflow. [...]

Note that 'key-method 1' has been replaced by 'key method 2' as the default in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4 and marked for removal in 2.5. This should limit the amount of users impacted by this issue.

https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html CVE-2017-12166 2017-09-21 2017-09-27
ImageMagick -- denial of service via a crafted font file ImageMagick7 7.0.7.4 ImageMagick7-nox11 7.0.7.4 ImageMagick 6.9.8.9_1 ImageMagick-nox11 6.9.8.9_1

MITRE reports:

The ReadCAPTIONImage function in coders/caption.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via a crafted font file.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14741 https://github.com/ImageMagick/ImageMagick/issues/771 https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d CVE-2017-14741 2017-09-21 2017-09-26
libofx -- exploitable buffer overflow libofx 0.9.11_1

Talos developers report:

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability.

http://www.securityfocus.com/bid/100828 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317 CVE-2017-2816 2017-09-13 2017-09-27
sugarcrm -- multiple vulnerabilities sugarcrm 6.5.26

sugarcrm developers report:

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a query string. Proper input validation has been added to mitigate this issue.

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along.

https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006/ https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-007/ https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities/ https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-008/ CVE-2017-14508 CVE-2017-14509 CVE-2017-14510 2017-09-17 2017-09-26
libzip -- denial of service libzip 1.1.13_1

libzip developers report:

The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ https://github.com/nih-at/libzip/commit/9b46957ec98d85a572e9ef98301247f39338a3b5 CVE-2017-14107 2017-09-01 2017-09-27
libbson -- Denial of Service libbson 1.8.0

mongodb developers report:

In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.

http://www.securityfocus.com/bid/100825 https://bugzilla.redhat.com/show_bug.cgi?id=1489355 https://bugzilla.redhat.com/show_bug.cgi?id=1489356 https://bugzilla.redhat.com/show_bug.cgi?id=1489362 CVE-2017-14227 2017-09-09 2017-09-26
tcpdump -- multiple vulnerabilities tcpdump 4.9.2

tcpdump developers report:

Too many issues to detail, see CVE references for details.

CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 CVE-2017-12893 CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902 CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989 CVE-2017-12990 CVE-2017-12991 CVE-2017-12992 CVE-2017-12993 CVE-2017-12994 CVE-2017-12995 CVE-2017-12996 CVE-2017-12997 CVE-2017-12998 CVE-2017-12999 CVE-2017-13000 CVE-2017-13001 CVE-2017-13002 CVE-2017-13003 CVE-2017-13004 CVE-2017-13005 CVE-2017-13006 CVE-2017-13007 CVE-2017-13008 CVE-2017-13009 CVE-2017-13010 CVE-2017-13011 CVE-2017-13012 CVE-2017-13013 CVE-2017-13014 CVE-2017-13015 CVE-2017-13016 CVE-2017-13017 CVE-2017-13018 CVE-2017-13019 CVE-2017-13020 CVE-2017-13021 CVE-2017-13022 CVE-2017-13023 CVE-2017-13024 CVE-2017-13025 CVE-2017-13026 CVE-2017-13027 CVE-2017-13028 CVE-2017-13029 CVE-2017-13030 CVE-2017-13031 CVE-2017-13032 CVE-2017-13033 CVE-2017-13034 CVE-2017-13035 CVE-2017-13036 CVE-2017-13037 CVE-2017-13038 CVE-2017-13039 CVE-2017-13040 CVE-2017-13041 CVE-2017-13042 CVE-2017-13043 CVE-2017-13044 CVE-2017-13045 CVE-2017-13046 CVE-2017-13047 CVE-2017-13048 CVE-2017-13049 CVE-2017-13050 CVE-2017-13051 CVE-2017-13052 CVE-2017-13053 CVE-2017-13054 CVE-2017-13055 CVE-2017-13687 CVE-2017-13688 CVE-2017-13689 CVE-2017-13690 CVE-2017-13725 2017-07-22 2017-09-26
libraw -- buffer overflow libraw 0.18.4

libraw developers report:

LibRaw before 0.18.4 has a heap-based Buffer Overflow in the processCanonCameraInfo function via a crafted file.

http://www.securityfocus.com/bid/100866 https://github.com/LibRaw/LibRaw/issues/100 CVE-2017-14348 2017-09-12 2017-09-26
libraw -- denial of service and remote code execution libraw 0.18.3

libraw developers report:

A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack.

https://github.com/LibRaw/LibRaw/issues/99 CVE-2017-14265 2017-09-11 2017-09-26
libgd -- Denial of servica via double free libgd 2.2.5

libgd developers report:

Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denial of service via vectors related to a palette with no colors.

http://www.debian.org/security/2017/dsa-3961 https://github.com/libgd/libgd/issues/381 https://github.com/libgd/libgd/releases/tag/gd-2.2.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N2BLXX7KNRE7ZVQAKGTHHWS33CUCXVUP/ CVE-2017-6362 2017-09-07 2017-09-26
php-gd and gd -- Buffer over-read into uninitialized memory libgd 2.2.5 php70-gd 7.0.21 php71-gd 7.1.7

PHP developers report:

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

https://bugs.php.net/bug.php?id=74435 CVE-2017-7890 2017-08-02 2017-09-26
ledger -- multiple vulnerabilities ledger 3.1.1

Talos reports:

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.

An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.

http://www.securityfocus.com/bid/100543 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303 http://www.securityfocus.com/bid/100546 https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304 CVE-2017-2808 CVE-2017-2807 2017-09-05 2017-09-26
aacplusenc -- denial of service aacplusenc 0.17.5_2

Gentoo developers report:

DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of service (invalid memory write, SEGV on unknown address 0x000000000030, and application crash) or possibly have unspecified other impact via a crafted .wav file, aka a NULL pointer dereference.

https://blogs.gentoo.org/ago/2017/09/07/aacplusenc-null-pointer-dereference-in-deletebitbuffer-bitbuffer-c/ https://github.com/teknoraver/aacplusenc/issues/1 CVE-2017-14181 2017-09-07 2017-09-25
ansible -- information disclosure flaw ansible 2.2.3

ansible developers report:

Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.

https://github.com/ansible/ansible/issues/22505 CVE-2017-7473 2017-07-21 2017-09-25
weechat -- crash in logger plugin weechat 1.9.1

WeeChat reports:

security problem: a crash can happen in logger plugin when converting date/time specifiers in file mask.

https://weechat.org/news/98/20170923-Version-1.9.1-security-release/ CVE-2017-14727 2017-09-23 2017-09-25
perl -- multiple vulnerabilities perl5 5.24.05.24.3 5.26.05.26.1

SO-AND-SO reports:

CVE-2017-12814: $ENV{$key} stack buffer overflow on Windows

A possible stack buffer overflow in the %ENV code on Windows has been fixed by removing the buffer completely since it was superfluous anyway.

CVE-2017-12837: Heap buffer overflow in regular expression compiler

Compiling certain regular expression patterns with the case-insensitive modifier could cause a heap buffer overflow and crash perl. This has now been fixed.

CVE-2017-12883: Buffer over-read in regular expression parser

For certain types of syntax error in a regular expression pattern, the error message could either contain the contents of a random, possibly large, chunk of memory, or could crash perl. This has now been fixed.

https://metacpan.org/changes/release/SHAY/perl-5.24.3 https://metacpan.org/changes/release/SHAY/perl-5.26.1 CVE-2017-12814 CVE-2017-12837 CVE-2017-12883 2017-09-19 2017-09-24
chromium -- multiple vulnerabilities chromium 61.0.3163.100

Google Chrome releases reports:

3 security fixes in this release, including:

  • [765433] High CVE-2017-5121: Out-of-bounds access in V8. Reported by Jordan Rabet, Microsoft Offensive Security Research and Microsoft ChakraCore team on 2017-09-14
  • [752423] High CVE-2017-5122: Out-of-bounds access in V8. Reported by Choongwoo Han of Naver Corporation on 2017-08-04
  • [767508] Various fixes from internal audits, fuzzing and other initiatives
CVE-2017-5121 CVE-2017-5122 https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html 2017-09-21 2017-09-22
asterisk -- RTP/RTCP information leak asterisk11 11.25.3 asterisk13 13.17.2

The Asterisk project reports:

This is a follow up advisory to AST-2017-005.

Insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the "nat" and "symmetric_rtp" options allow redirecting where Asterisk sends the next RTCP report.

The RTP stream qualification to learn the source address of media always accepted the first RTP packet as the new source and allowed what AST-2017-005 was mitigating. The intent was to qualify a series of packets before accepting the new source address.

The RTP/RTCP stack will now validate RTCP packets before processing them.

https://downloads.asterisk.org/pub/security/AST-2017-008.html CVE-2017-14099 2017-09-01 2017-09-19
ruby -- multiple vulnerabilities ruby 2.2.02.2.8 2.3.02.3.5 2.4.02.4.2

Ruby blog:

CVE-2017-0898: Buffer underrun vulnerability in Kernel.sprintf

If a malicious format string which contains a precious specifier (*) is passed and a huge minus value is also passed to the specifier, buffer underrun may be caused. In such situation, the result may contains heap, or the Ruby interpreter may crash.

CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick

When using the Basic authentication of WEBrick, clients can pass an arbitrary string as the user name. WEBrick outputs the passed user name intact to its log, then an attacker can inject malicious escape sequences to the log and dangerous control characters may be executed on a victim’s terminal emulator.

This vulnerability is similar to a vulnerability already fixed, but it had not been fixed in the Basic authentication.

CVE-2017-14033: Buffer underrun vulnerability in OpenSSL ASN1 decode

If a malicious string is passed to the decode method of OpenSSL::ASN1, buffer underrun may be caused and the Ruby interpreter may crash.

CVE-2017-14064: Heap exposure vulnerability in generating JSON

The generate method of JSON module optionally accepts an instance of JSON::Ext::Generator::State class. If a malicious instance is passed, the result may include contents of heap.

https://www.ruby-lang.org/en/security/ https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/ https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/ https://www.ruby-lang.org/en/news/2017/09/14/openssl-asn1-buffer-underrun-cve-2017-14033/ https://www.ruby-lang.org/en/news/2017/09/14/json-heap-exposure-cve-2017-14064/ CVE-2017-0898 CVE-2017-10784 CVE-2017-14033 CVE-2017-14064 2017-09-14 2017-09-19
rubygem-geminabox -- XSS & CSRF vulnerabilities rubygem-geminabox 0.13.8

Gem in a box XSS vulenrability - CVE-2017-14506:

Malicious attacker create GEM file with crafted homepage value (gem.homepage in .gemspec file) includes XSS payload.

The attacker access geminabox system and uploads the gem file (or uses CSRF/SSRF attack to do so).

From now on, any user access Geminabox web server, executes the malicious XSS payload, that will delete any gems on the server, and won't let users use the geminabox anymore. (make victim's browser crash or redirect them to other hosts).

https://baraktawily.blogspot.com/2017/09/gem-in-box-xss-vulenrability-cve-2017.html CVE-2017-14506 CVE-2017-14683 2017-09-18 2017-09-19 2017-09-27
Apache -- HTTP OPTIONS method can leak server memory apache24 2.4.27_1 apache22 2.2.34_1

The Fuzzing Project reports:

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

https://nvd.nist.gov/vuln/detail/CVE-2017-9798 CVE-2017-9798 2017-09-18 2017-09-19
GitLab -- multiple vulnerabilities gitlab 1.0.09.3.10 9.4.09.4.5 9.5.09.5.3

GitLab reports:

Please reference CVE/URL list for details

https://about.gitlab.com/2017/09/07/gitlab-9-dot-5-dot-4-security-release/ CVE-2017-5029 CVE-2016-4738 2017-09-07 2017-09-14
Flash Player -- multiple vulnerabilities linux-flashplayer 27.0.0.130

Adobe reports:

  • These updates resolve memory corruption vulnerabilities that could lead to remote code execution (CVE-2017-11281, CVE-2017-11282).
CVE-2017-11281 CVE-2017-11282 https://helpx.adobe.com/security/products/flash-player/apsb17-28.html 2017-09-12 2017-09-12
emacs -- enriched text remote code execution vulnerability emacs25 emacs-nox11 25.3,3 emacs-devel 26.0.50.20170912,2

Paul Eggert reports:

Charles A. Roelli has found a security flaw in the enriched mode in GNU Emacs.

When Emacs renders MIME text/enriched data (Internet RFC 1896), it is vulnerable to arbitrary code execution. Since Emacs-based mail clients decode "Content-Type: text/enriched", this code is exploitable remotely. This bug affects GNU Emacs versions 19.29 through 25.2.

http://seclists.org/oss-sec/2017/q3/422 https://bugs.gnu.org/28350 2017-09-04 2017-09-12 2017-09-13
cyrus-imapd -- broken "other users" behaviour cyrus-imapd30 3.0.03.0.4

Cyrus IMAP 3.0.4 Release Notes states:

Fixed Issue #2132: Broken "Other Users" behaviour

CVE-2017-14230 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14230 2017-09-07 2017-09-10
Django -- possible XSS in traceback section of technical 500 debug page py27-django110 py34-django110 py35-django110 py36-django110 1.10.8 py27-django111 py34-django111 py35-django111 py36-django111 1.11.5

Django blog:

In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with DEBUG = True (which makes this page accessible) in your production settings.

CVE-2017-12794 https://www.djangoproject.com/weblog/2017/sep/05/security-releases/ 2017-09-05 2017-09-06
chromium -- multiple vulnerabilities chromium 61.0.3163.79

Google Chrome releases reports:

22 security fixes in this release, including:

  • [737023] High CVE-2017-5111: Use after free in PDFium. Reported by Luat Nguyen on KeenLab, Tencent on 2017-06-27
  • [740603] High CVE-2017-5112: Heap buffer overflow in WebGL. Reported by Tobias Klein on 2017-07-10
  • [747043] High CVE-2017-5113: Heap buffer overflow in Skia. Reported by Anonymous on 2017-07-20
  • [752829] High CVE-2017-5114: Memory lifecycle issue in PDFium. Reported by Ke Liu of Tencent's Xuanwu LAB on 2017-08-07
  • [744584] High CVE-2017-5115: Type confusion in V8. Reported by Marco Giovannini on 2017-07-17
  • [759624] High CVE-2017-5116: Type confusion in V8. Reported by Anonymous on 2017-08-28
  • [739190] Medium CVE-2017-5117: Use of uninitialized value in Skia. Reported by Tobias Klein on 2017-07-04
  • [747847] Medium CVE-2017-5118: Bypass of Content Security Policy in Blink. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-07-24
  • [725127] Medium CVE-2017-5119: Use of uninitialized value in Skia. Reported by Anonymous on 2017-05-22
  • [718676] Low CVE-2017-5120: Potential HTTPS downgrade during redirect navigation. Reported by Xiaoyin Liu on 2017-05-05
  • [762099] Various fixes from internal audits, fuzzing and other initiatives
CVE-2017-5111 CVE-2017-5112 CVE-2017-5113 CVE-2017-5114 CVE-2017-5115 CVE-2017-5116 CVE-2017-5117 CVE-2017-5118 CVE-2017-5119 CVE-2017-5120 https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html 2017-09-05 2017-09-06
gdk-pixbuf -- multiple vulnerabilities gtk-pixbuf2 2.36.7

TALOS reports:

  • An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality.

  • An exploitable heap-overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality.

http://blog.talosintelligence.com/2017/08/vuln-spotlight-multiple-gdk.html CVE-2017-2862 CVE-2017-2870 2017-08-30 2017-09-01
asterisk -- Remote Crash Vulerability in res_pjsip asterisk13 13.17.1

The Asterisk project reports:

A carefully crafted URI in a From, To or Contact header could cause Asterisk to crash.

https://downloads.asterisk.org/pub/security/AST-2017-007.html CVE-2017-14098 2017-08-31 2017-09-01
asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm asterisk11 11.25.2 asterisk13 13.17.1

The Asterisk project reports:

AST-2017-005 - A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected the new code allowed a new source address to be learned at all times.

AST-2017-006 - The app_minivm module has an "externnotify" program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source, a crafted caller-id name or number allows an arbitrary shell command injection.

https://downloads.asterisk.org/pub/security/AST-2017-005.html CVE-2017-14099 https://downloads.asterisk.org/pub/security/AST-2017-006.html CVE-2017-14100 2017-08-31 2017-09-01
libgcrypt -- side-channel attack vulnerability libgcrypt 1.8.1

GnuPG reports:

Mitigate a local side-channel attack on Curve25519 dubbed "May the Fourth Be With You".

CVE-2017-0379 https://eprint.iacr.org/2017/806 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0379 2017-08-27 2017-08-30
rubygems -- multiple vulnerabilities ruby22-gems ruby23-gems ruby24-gems 2.6.13

Official blog of RubyGems reports:

The following vulnerabilities have been reported: a DNS request hijacking vulnerability, an ANSI escape sequence vulnerability, a DoS vulnerability in the query command, and a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files.

https://www.ruby-lang.org/en/news/2017/08/29/multiple-vulnerabilities-in-rubygems/ 2017-08-29 2017-08-29
kanboard -- multiple privilege escalation vulnerabilities kanboard 1.0.46

chbi reports:

an authenticated standard user could reset the password of another user (including admin) by altering form data.

https://kanboard.net/news/version-1.0.46 CVE-2017-12850 CVE-2017-12851 2017-08-15 2017-08-26
poppler -- multiple denial of service issues poppler 0.56.0

Poppler developers report:

Poppler is prone to a stack-based buffer-overflow vulnerability.

Successful exploits may allow attackers to crash the affected application, resulting in denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.

http://www.securityfocus.com/bid/99241/discuss CVE-2017-9865 CVE-2017-9775 2017-06-21 2017-08-24
phpmailer -- XSS in code example and default exeception handler phpmailer 5.2.24

PHPMailer reports:

Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The code_generator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.

https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.24 CVE-2017-11503 2017-07-27 2017-08-23
salt -- Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master py27-salt py32-salt py33-salt py34-salt py35-salt py36-salt 2016.11.7 2017.7.02017.7.1

SaltStack reports:

Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Credit for discovering the security flaw goes to: Vernhk@qq.com

CVE-2017-12791 https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html https://docs.saltstack.com/en/latest/topics/releases/2016.11.7.html 2017-08-16 2017-08-22
dnsdist -- multiple vulnerabilities dnsdist 1.2.0

PowerDNS Security Advisory reports:

The first issue can lead to a denial of service on 32-bit if a backend sends crafted answers, and the second to an alteration of dnsdist's ACL if the API is enabled, writable and an authenticated user is tricked into visiting a crafted website.

CVE-2016-7069 CVE-2017-7557 https://dnsdist.org/security-advisories/index.html 2017-08-21 2017-08-22
evince and atril -- command injection vulnerability in CBT handler evince 3.24.0 evince-lite 3.24.0 atril 1.18.1 1.19.01.19.1 atril-lite 1.18.1 1.19.01.19.1

GNOME reports:

The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.

The same vulnerability affects atril, the Evince fork.

https://bugzilla.gnome.org/show_bug.cgi?id=784630 https://github.com/mate-desktop/atril/issues/257 CVE-2017-1000083 2017-07-06 2017-07-13
SquirrelMail -- post-authentication remote code execution squirrelmail 20170705

SquirrelMail developers report:

SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692 2017-04-19 2017-08-22
pspp -- multiple vulnerabilities pspp 1.0.1

CVE Details reports:

  • There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).
  • There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).
  • There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).
  • There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).
  • There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).
  • There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).
CVE-2017-10791 CVE-2017-10792 CVE-2017-12958 CVE-2017-12959 CVE-2017-12960 CVE-2017-12961 https://www.cvedetails.com/vulnerability-list/vendor_id-72/product_id-38732/year-2017/GNU-Pspp.html 2017-08-18 2017-08-22 2017-08-30
drupal -- Drupal Core - Multiple Vulnerabilities drupal8 8.3.7

Drupal Security Team:

CVE-2017-6923: Views - Access Bypass - Moderately Critical

CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica

CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical

CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 2017-08-16 2017-08-19
libsoup -- stack based buffer overflow libsoup 2.52.2_1

Tobias Mueller reports:

libsoup is susceptible to a stack based buffer overflow attack when using chunked encoding. Regardless of libsoup being used as a server or client.

http://seclists.org/oss-sec/2017/q3/304 CVE-2017-2885 2017-08-17 2017-08-17 2017-08-20
Zabbix -- Remote code execution zabbix2-server zabbix2-proxy 2.0.20 zabbix22-server zabbix22-proxy 2.2.19 zabbix3-server zabbix3-proxy 3.0.10 zabbix32-server zabbix32-proxy 3.2.7

mitre reports:

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

CVE-2017-2824 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2824 https://support.zabbix.com/browse/ZBX-12349 2017-07-05 2017-08-16
Supervisord -- An authenticated client can run arbitrary shell commands via malicious XML-RPC requests py27-supervisor 3.3.3,1

mnaberez reports:

supervisord can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. The HTTP server is how supervisorctl communicates with supervisord. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root.

This vulnerability can only be exploited by an authenticated client or if supervisord has been configured to run an HTTP server without authentication. If authentication has not been enabled, supervisord will log a message at the critical level every time it starts.

http://supervisord.org/changes.html https://github.com/Supervisor/supervisor/issues/964#issuecomment-317551606 CVE-2017-11610 2017-07-24 2017-08-15
FreeRadius -- Multiple vulnerabilities freeradius3 3.0.15

Guido Vranken reports:

Multiple vulnerabilities found via fuzzing: FR-GV-201 (v2,v3) Read / write overflow in make_secret() FR-GV-202 (v2) Write overflow in rad_coalesce() FR-GV-203 (v2) DHCP - Memory leak in decode_tlv() FR-GV-204 (v2) DHCP - Memory leak in fr_dhcp_decode() FR-GV-205 (v2) DHCP - Buffer over-read in fr_dhcp_decode_options() FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 FR-GV-207 (v2) Zero-length malloc in data2vp() FR-GV-301 (v3) Write overflow in data2vp_wimax() FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() FR-GV-305 (v3) Decode 'signed' attributes correctly FR-AD-001 (v2,v3) Use strncmp() instead of memcmp() for string data FR-AD-002 (v3) String lifetime issues in rlm_python FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare

http://freeradius.org/security/fuzzer-2017.html 2017-06-17 2017-08-14
Mercurial -- multiple vulnerabilities mercurial 4.3

Mercurial Release Notes:

CVE-2017-1000115

Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository.

CVE-2017-1000116

Mercurial was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a hostname starting with -oProxyCommand. This is also present in Git (CVE-2017-1000117) and Subversion (CVE-2017-9800), so please patch those tools as well if you have them installed.

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 CVE-2017-1000115 CVE-2017-1000116 2017-08-10 2017-08-12
subversion -- Arbitrary code execution vulnerability subversion 1.9.01.9.6 subversion18 1.0.01.8.18 subversion-static 1.0.01.8.18 1.9.01.9.6

subversion team reports:

A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL argument.

A maliciously constructed svn+ssh:// URL would cause Subversion clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.

The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.

An exploit has been tested.

http://subversion.apache.org/security/CVE-2017-9800-advisory.txt 2017-08-10 2017-08-11
GitLab -- two vulnerabilities gitlab 7.9.08.17.8 9.0.09.0.12 9.1.09.1.9 9.2.09.2.9 9.3.09.3.9 9.4.09.4.3

GitLab reports:

Remote Command Execution in git client

An external code review performed by Recurity-Labs identified a remote command execution vulnerability in git that could be exploited via the "Repo by URL" import option in GitLab. The command line git client was not properly escaping command line arguments in URLs using the SSH protocol before invoking the SSH client. A specially crafted URL could be used to execute arbitrary shell commands on the GitLab server.
To fully patch this vulnerability two fixes were needed. The Omnibus versions of GitLab contain a patched git client. For source users who may still be running an older version of git, GitLab now also blocks import URLs containing invalid host and usernames.
This issue has been assigned CVE-2017-12426.

Improper sanitization of GitLab export files on import

GitLab versions 8.13.3, 8.12.8, 8.11.10, 8.10.13, and 8.9.12 contained a patch for a critical directory traversal vulnerability in the GitLab export feature that could be exploited by including symlinks in the export file and then re-importing it to a GitLab instance. This vulnerability was patched by checking for and removing symlinks in these files on import.
Recurity-Labs also determined that this fix did not properly remove symlinks for hidden files. Though not as dangerous as the original vulnerability hidden file symlinks could still be used to steal copies of git repositories belonging to other users if the path to the git repository was known by the attacker. An updated fix has been included in these releases that properly removes all symlinks.
This import option was not made available to non-admin users until GitLab 8.13.0.

https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/ CVE-2017-12426 2017-08-10 2017-08-11
PostgreSQL vulnerabilities postgresql92-server 9.2.09.2.22 postgresql93-server 9.3.09.3.18 postgresql94-server 9.4.09.4.13 postgresql95-server 9.5.09.5.8 postgresql96-server 9.6.09.6.4

The PostgreSQL project reports:

  • CVE-2017-7546: Empty password accepted in some authentication methods
  • CVE-2017-7547: The "pg_user_mappings" catalog view discloses passwords to users lacking server privileges
  • CVE-2017-7548: lo_put() function ignores ACLs
CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 2017-08-10 2017-08-10
Flash Player -- multiple vulnerabilities linux-flashplayer 26.0.0.151

Adobe reports:

  • These updates resolve security bypass vulnerability that could lead to information disclosure (CVE-2017-3085).
  • These updates resolve type confusion vulnerability that could lead to remote code execution (CVE-2017-3106).
CVE-2017-3085 CVE-2017-3106 https://helpx.adobe.com/security/products/flash-player/apsb17-23.html 2017-08-08 2017-08-10
cURL -- multiple vulnerabilities curl 7.55.0

The cURL project reports:

  • FILE buffer read out of bounds
  • TFTP sends more than buffer size
  • URL globbing out of bounds read
https://curl.haxx.se/docs/security.html CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 2017-08-09 2017-08-09
Axis2 -- Security vulnerability on dependency Apache Commons FileUpload axis2 1.7.6

Apache Axis2 reports:

The commons-fileupload dependency has been updated to a version that fixes CVE-2016-1000031 (AXIS2-5853).

http://axis.apache.org/axis2/java/core/release-notes/1.7.6.html https://issues.apache.org/jira/browse/AXIS2-5853 https://issues.apache.org/jira/browse/FILEUPLOAD-279 CVE-2016-1000031 2016-11-14 2017-08-09
mozilla -- multiple vulnerabilities firefox 55.0,1 seamonkey linux-seamonkey 2.49.1 firefox-esr 52.3.0,1 linux-firefox 52.3.0,2 libxul thunderbird linux-thunderbird 52.3.0

Mozilla Foundation reports:

Please reference CVE/URL list for details

CVE-2017-7753 CVE-2017-7779 CVE-2017-7780 CVE-2017-7781 CVE-2017-7782 CVE-2017-7783 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7788 CVE-2017-7789 CVE-2017-7790 CVE-2017-7791 CVE-2017-7792 CVE-2017-7794 CVE-2017-7796 CVE-2017-7797 CVE-2017-7798 CVE-2017-7799 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7804 CVE-2017-7806 CVE-2017-7807 CVE-2017-7808 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/ 2017-08-08 2017-08-08
sqlite3 -- heap-buffer overflow sqlite3 3.20.0

Google reports:

A heap-buffer overflow (sometimes a crash) can arise when running a SQL request on malformed sqlite3 databases.

https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937 CVE-2017-10989 2017-08-08 2017-08-08 2017-09-19
Varnish -- Denial of service vulnerability varnish4 4.0.14.0.5 4.1.04.1.8 varnish5 5.0.1 5.1.05.1.3

phk reports:

A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert.

https://varnish-cache.org/security/VSV00001.html 2017-08-02 2017-08-02
chromium -- multiple vulnerabilities chromium chromium-pulse 60.0.3112.78

Google Chrome releases reports:

40 security fixes in this release

Please reference CVE/URL list for details

CVE-2017-5091 CVE-2017-5092 CVE-2017-5093 CVE-2017-5094 CVE-2017-5095 CVE-2017-5096 CVE-2017-5097 CVE-2017-5098 CVE-2017-5099 CVE-2017-5100 CVE-2017-5101 CVE-2017-5102 CVE-2017-5103 CVE-2017-5104 CVE-2017-7000 CVE-2017-5105 CVE-2017-5106 CVE-2017-5107 CVE-2017-5108 CVE-2017-5109 CVE-2017-5110 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html 2017-07-25 2017-08-01
Cacti -- Cross-site scripting (XSS) vulnerability in auth_profile.php cacti 1.1.13

kimiizhang reports:

Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.

https://github.com/Cacti/cacti/issues/867 https://www.cacti.net/release_notes.php?version=1.1.14 CVE-2017-11691 2017-07-20 2017-07-29
proftpd -- user chroot escape vulnerability proftpd 1.3.5e

NVD reports:

ProFTPD ... controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link.

http://bugs.proftpd.org/show_bug.cgi?id=4295 CVE-2017-7418 2017-03-06 2017-07-27
jabberd -- authentication bypass vulnerability jabberd 2.6.1

SecurityFocus reports:

JabberD is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867032 http://www.securityfocus.com/bid/99511 CVE-2017-10807 2017-07-03 2017-07-26
webkit2-gtk3 -- multiple vulnerabilities webkit2-gtk3 2.16.6

The Webkit gtk team reports:

Please reference CVE/URL list for details

https://webkitgtk.org/security/WSA-2017-0006.html CVE-2017-7006 CVE-2017-7011 CVE-2017-7012 CVE-2017-7018 CVE-2017-7019 CVE-2017-7020 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7038 CVE-2017-7039 CVE-2017-7040 CVE-2017-7041 CVE-2017-7042 CVE-2017-7043 CVE-2017-7046 CVE-2017-7048 CVE-2017-7049 CVE-2017-7052 CVE-2017-7055 CVE-2017-7056 CVE-2017-7059 CVE-2017-7061 CVE-2017-7064 2017-07-24 2017-07-25 2018-03-28
gsoap -- remote code execution via via overflow gsoap 2.8.47

Senrio reports:

Genivia gSOAP is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

A remote attacker may exploit this issue to execute arbitrary code in the context of the affected device. Failed attempts will likely cause a denial-of-service condition.

http://www.securityfocus.com/bid/99868/discuss http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions http://blog.senr.io/devilsivy.html https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29 https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29 CVE-2017-9765 2017-07-18 2017-07-25
GitLab -- Various security issues gitlab 8.0.08.17.6 9.0.09.0.10 9.1.09.1.7 9.2.09.2.7 9.3.09.3.7

GitLab reports:

Please reference CVE/URL list for details

https://about.gitlab.com/2017/07/19/gitlab-9-dot-3-dot-8-released/ CVE-2017-11438 2017-07-20 2017-07-20 2017-08-15
MySQL -- multiple vulnerabilities mariadb55-server 5.5.57 mariadb100-server 10.0.32 mariadb101-server 10.1.26 mariadb102-server 10.2.6 mysql55-server 5.5.57 mysql56-server 5.6.37 mysql57-server 5.7.19 percona55-server 5.5.57 percona56-server 5.6.37 percona57-server 5.7.19

Oracle reports:

Please reference CVE/URL list for details

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixMSQL CVE-2017-3529 CVE-2017-3633 CVE-2017-3634 CVE-2017-3635 CVE-2017-3636 CVE-2017-3637 CVE-2017-3638 CVE-2017-3639 CVE-2017-3640 CVE-2017-3641 CVE-2017-3642 CVE-2017-3643 CVE-2017-3644 CVE-2017-3645 CVE-2017-3646 CVE-2017-3647 CVE-2017-3648 CVE-2017-3649 CVE-2017-3650 CVE-2017-3651 CVE-2017-3652 CVE-2017-3653 2017-07-19 2017-07-19 2017-08-12
collectd5 -- Denial of service by sending a signed network packet to a server which is not set up to check signatures collectd5 5.7.2

marcinguy reports:

After sending this payload, collectd seems to be entering endless while() loop in packet_parse consuming high CPU resources, possibly crash/gets killed after a while.

https://github.com/collectd/collectd/issues/2174 CVE-2017-7401 2017-02-13 2017-07-19
strongswan -- multiple vulnerabilities strongswan 4.4.05.5.2

strongSwan security team reports:

  • RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception. [CVE-2017-9022]
  • ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when parsing X.509 certificates with extensions that use such types. This could lead to infinite looping of the thread parsing a specifically crafted certificate.
https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9022).html CVE-2017-9022 https://www.strongswan.org/blog/2017/05/30/strongswan-vulnerability-(cve-2017-9023).html CVE-2017-9023 2017-05-30 2017-07-19
Cacti -- Cross-site scripting (XSS) vulnerability in link.php cacti 1.0.01.1.13

kimiizhang reports:

Cross-site scripting (XSS) vulnerability in link.php in Cacti
1.1.12 allows remote anonymous users to inject arbitrary web
script or HTML via the id parameter.

https://github.com/Cacti/cacti/issues/838 https://www.cacti.net/release_notes.php?version=1.1.13 CVE-2017-10970 2017-07-05 2017-07-17
Apache httpd -- multiple vulnerabilities apache24 2.4.27

The Apache httpd project reports:

important: Read after free in mod_http2 (CVE-2017-9789)
When under stress, closing many connections, the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.

important: Uninitialized memory reflection in mod_auth_digest (CVE-2017-9788)
The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments. by mod_auth_digest.
Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault.

https://httpd.apache.org/security/vulnerabilities_24.html CVE-2017-9789 CVE-2017-9788 2017-07-11 2017-07-13
Flash Player -- multiple vulnerabilities linux-flashplayer 26.0.0.137

Adobe reports:

  • These updates resolve security bypass vulnerability that could lead to information disclosure (CVE-2017-3080).
  • These updates resolve memory corruption vulnerability that could lead to remote code execution (CVE-2017-3099).
  • These updates resolve memory corruption vulnerability that could lead to memory address disclosure (CVE-2017-3100).
CVE-2017-3080 CVE-2017-3099 CVE-2017-3100 https://helpx.adobe.com/security/products/flash-player/apsb17-21.html 2017-07-11 2017-07-13
samba -- Orpheus Lyre mutual authentication validation bypass samba42 4.2.15 samba43 4.3.14 samba44 4.4.15 samba45 4.5.12 samba46 4.6.6

The samba project reports:

A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by returning malicious replication or authorization data.

https://www.samba.org/samba/security/CVE-2017-11103.html CVE-2017-11103 2017-07-12 2017-07-12
node.js -- multiple vulnerabilities node 8.1.4 node4 4.8.4 node6 6.11.1

Updates are now available for all active Node.js release lines as well as the 7.x line. These include the fix for the high severity vulnerability identified in the initial announcement, one additional lower priority Node.js vulnerability in the 4.x release line, as well as some lower priority fixes for Node.js dependencies across the current release lines.

Constant Hashtable Seeds (CVE pending)

Node.js was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup. Thanks to Jann Horn of Google Project Zero for reporting this vulnerability.

This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line.

http.get with numeric authorization options creates uninitialized buffers

Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string.

This is a low severity defect and only applies to the 4.x release line.

https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/ 2017-06-27 2017-07-12
nginx -- a specially crafted request might result in an integer overflow nginx 0.5.61.12.1,2 nginx-devel 0.5.61.13.3

Maxim Dounin reports:

A security issue was identified in nginx range filter. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak (CVE-2017-7529).

http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html CVE-2017-7529 2017-07-11 2017-07-11
codeigniter -- input validation bypass codeigniter 3.1.5

The CodeIgniter changelog reports:

Form Validation Library rule valid_email could be bypassed if idn_to_ascii() is available.

https://www.codeigniter.com/user_guide/changelog.html 2017-06-19 2017-07-08
irssi -- multiple vulnerabilities irssi 1.0.4,1

irssi reports:

When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.

While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in use-after-free conditions on each access of the hash table.

https://irssi.org/security/irssi_sa_2017_07.txt CVE-2017-10965 CVE-2017-10966 ports/220544 2017-07-05 2017-07-08
oniguruma -- multiple vulnerabilities libevhtp 1.2.14 oniguruma4 4.7.2 oniguruma5 5.9.7 oniguruma6 6.4.0 php56-mbstring 5.6.31 php70-mbstring 7.0.21 php71-mbstring 7.1.7

the PHP project reports:

  • A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer (CVE-2017-9224).
  • A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption (CVE-2017-9226).
  • A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer (CVE-2017-9227).
  • A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption (CVE-2017-9228).
  • A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition (CVE-2017-9228).
http://php.net/ChangeLog-7.php CVE-2017-9224 CVE-2017-9226 CVE-2017-9227 CVE-2017-9228 CVE-2017-9228 2017-07-06 2017-07-07 2018-01-04
drupal -- Drupal Core - Multiple Vulnerabilities drupal7 7.56 drupal8 8.3.4

Drupal Security Team Reports:

CVE-2017-6920: PECL YAML parser unsafe object handling.

CVE-2017-6921: File REST resource does not properly validate

CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users.

CVE-2017-6920 CVE-2017-6921 CVE-2017-6922 2017-06-21 2017-07-06
Dropbear -- two vulnerabilities dropbear 2017.75

Matt Johnston reports:

Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user.

Fix information disclosure with ~/.ssh/authorized_keys symlink. Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys.

https://matt.ucc.asn.au/dropbear/CHANGES CVE-2017-9078 CVE-2017-9079 2017-05-18 2017-07-03
smarty3 -- shell injection in math smarty3 3.1.30

The smarty project reports:

bugfix {math} shell injection vulnerability

https://github.com/smarty-php/smarty/blob/v3.1.30/change_log.txt 2016-07-19 2017-07-03
libgcrypt -- side-channel attack on RSA secret keys libgcrypt 1.7.8

GnuPG reports:

Mitigate a flush+reload side-channel attack on RSA secret keys dubbed "Sliding right into disaster".

CVE-2017-7526 https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html 2017-06-29 2017-06-30
GitLab -- Various security issues gitlab 4.0.09.0.9 9.1.09.1.6 9.2.09.2.4

GitLab reports:

Please reference CVE/URL list for details

https://about.gitlab.com/2017/06/07/gitlab-9-dot-2-dot-5-security-release/ 2017-06-07 2017-06-30
tor -- security regression tor 0.3.0.9 tor-devel 0.3.1.4.a

The Tor Project reports:

Tor 0.3.0.9 fixes a path selection bug that would allow a client to use a guard that was in the same network family as a chosen exit relay. This is a security regression; all clients running earlier versions of 0.3.0.x or 0.3.1.x should upgrade to 0.3.0.9 or 0.3.1.4-alpha.

https://blog.torproject.org/blog/tor-0309-released-security-update-clients https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients https://lists.torproject.org/pipermail/tor-announce/2017-June/000133.html CVE-2017-0377 2017-06-29 2017-06-30
exim -- Privilege escalation via multiple memory leaks exim 4.89_1

Qualsys reports:

Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369 2017-06-19 2017-06-21
pear-Horde_Image -- DoS vulnerability pear-Horde_Image 2.3.02.5.0

Michael J Rubinsky reports:

The second vulnerability (CVE-2017-9773) is a DOS vulnerability. This only affects Horde installations that do not have a configured image handling backend, and thus use the "Null" image driver. It is exploitable by a logged in user clicking on a maliciously crafted URL.

https://lists.horde.org/archives/announce/2017/001234.html CVE-2017-9773 2017-06-21 2017-06-21
pear-Horde_Image -- remote code execution vulnerability pear-Horde_Image 2.0.02.5.0

Michael J Rubinsky reports:

The fist vulnerability (CVE-2017-9774) is a Remote Code Execution vulnerability and is exploitable by a logged in user sending a maliciously crafted GET request to the Horde server.

https://lists.horde.org/archives/announce/2017/001234.html CVE-2017-9774 2017-06-21 2017-06-21
OpenVPN -- several vulnerabilities openvpn 2.3.17 2.4.02.4.3 openvpn-mbedtls 2.4.3 openvpn-polarssl 2.3.17

Samuli Seppänen reports:

In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.

This is a list of fixed important vulnerabilities:

  • Remotely-triggerable ASSERT() on malformed IPv6 packet
  • Pre-authentication remote crash/information disclosure for clients
  • Potential double-free in --x509-alt-username
  • Remote-triggerable memory leaks
  • Post-authentication remote DoS when using the --x509-track option
  • Null-pointer dereference in establish_http_proxy_passthru()
https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 CVE-2017-7508 CVE-2017-7512 CVE-2017-7520 CVE-2017-7521 CVE-2017-7522 2017-05-19 2017-06-21
Apache httpd -- several vulnerabilities apache22 2.2.33 apache24 2.4.26

The Apache httpd project reports:

  • ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167):
    Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
  • mod_ssl Null Pointer Dereference (CVE-2017-3169):
    mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
  • mod_http2 Null Pointer Dereference (CVE-2017-7659):
    A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process.
  • ap_find_token() Buffer Overread (CVE-2017-7668):
    The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
  • mod_mime Buffer Overread (CVE-2017-7679):
    mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
https://httpd.apache.org/security/vulnerabilities_24.html https://httpd.apache.org/security/vulnerabilities_22.html CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 2017-06-20 2017-06-20
chromium -- multiple vulnerabilities chromium chromium-pulse 59.0.3071.104

Google Chrome releases reports:

5 security fixes in this release, including:

  • [725032] High CVE-2017-5087: Sandbox Escape in IndexedDB. Reported by Ned Williamson on 2017-05-22
  • [729991] High CVE-2017-5088: Out of bounds read in V8. Reported by Xiling Gong of Tencent Security Platform Department on 2017-06-06
  • [714196] Medium CVE-2017-5089: Domain spoofing in Omnibox. Reported by Michal Bentkowski on 2017-04-21
  • [732498] Various fixes from internal audits, fuzzing and other initiatives
CVE-2017-5087 CVE-2017-5088 CVE-2017-5089 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html 2017-06-15 2017-06-16
cURL -- URL file scheme drive letter buffer overflow curl 7.53.07.54.1

cURL security advisory:

When libcurl is given either

1. a file: URL that doesn't use two slashes following the colon, or

2. is told that file is the default scheme to use for URLs without scheme

... and the given path starts with a drive letter and libcurl is built for Windows or DOS, then libcurl would copy the path with a wrong offset, so that the end of the given path would write beyond the malloc buffer. Up to seven bytes too much.

We are not aware of any exploit of this flaw.

CVE-2017-9502 https://curl.haxx.se/docs/adv_20170614.html 2017-06-14 2017-06-15
rt and dependent modules -- multiple security vulnerabilities rt42 4.2.04.2.13_1 rt44 4.4.04.4.1_1 p5-RT-Authen-ExternalAuth 0.90.27

BestPractical reports:

Please reference CVE/URL list for details

http://lists.bestpractical.com/pipermail/rt-announce/2017-June/000297.html CVE-2015-7686 CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 2017-06-15 2017-06-15
Flash Player -- multiple vulnerabilities linux-flashplayer 26.0.0.126

Adobe reports:

  • These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3075, CVE-2017-3081, CVE-2017-3083, CVE-2017-3084).
  • These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-3076, CVE-2017-3077, CVE-2017-3078, CVE-2017-3079, CVE-2017-3082).
CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 https://helpx.adobe.com/security/products/flash-player/apsb17-17.html 2017-06-13 2017-06-15
mozilla -- multiple vulnerabilities firefox 54.0,1 seamonkey linux-seamonkey 2.49.1 firefox-esr 52.2.0,1 linux-firefox 52.2.0,2 libxul thunderbird linux-thunderbird 52.2.0

Mozilla Foundation reports:

Please reference CVE/URL list for details

CVE-2017-5470 CVE-2017-5471 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7755 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7759 CVE-2017-7760 CVE-2017-7761 CVE-2017-7762 CVE-2017-7763 CVE-2017-7764 CVE-2017-7765 CVE-2017-7766 CVE-2017-7767 CVE-2017-7768 CVE-2017-7778 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/ 2017-06-13 2017-06-13 2017-09-19
roundcube -- arbitrary password resets roundcube 1.2.5,1

Roundcube reports:

Roundcube Webmail allows arbitrary password resets by authenticated users. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 CVE-2017-8114 2017-04-28 2017-06-09
GnuTLS -- Denial of service vulnerability gnutls 3.5.13

The GnuTLS project reports:

It was found using the TLS fuzzer tools that decoding a status response TLS extension with valid contents could lead to a crash due to a null pointer dereference. The issue affects GnuTLS server applications.

https://gnutls.org/security.html#GNUTLS-SA-2017-4 2017-06-07 2017-06-08
irssi -- remote DoS irssi 1.0.3

Joseph Bisch reports:

When receiving a DCC message without source nick/host, Irssi would attempt to dereference a NULL pointer.

When receiving certain incorrectly quoted DCC files, Irssi would try to find the terminating quote one byte before the allocated memory.

CVE-2017-9468 CVE-2017-9469 https://irssi.org/security/irssi_sa_2017_06.txt 2017-06-06 2017-06-08
chromium -- multiple vulnerabilities chromium chromium-pulse 59.0.3071.86

Google Chrome releases reports:

30 security fixes in this release

Please reference CVE/URL list for details

CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5086 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081 CVE-2017-5082 CVE-2017-5083 CVE-2017-5085 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html 2017-06-05 2017-06-06
ansible -- Input validation flaw in jinja2 templating system ansible 2.3.1

RedHat security team reports:

An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, result in code execution.

https://access.redhat.com/security/cve/cve-2017-7481 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7481 2017-05-09 2017-06-02
duo -- Two-factor authentication bypass duo 1.9.21

The duo security team reports:

An untrusted user may be able to set the http_proxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success.

https://duo.com/labs/psa/duo-psa-2017-002 2017-05-19 2017-06-01
FreeRADIUS -- TLS resumption authentication bypass freeradius freeradius2 freeradius3 3.0.14

Stefan Winter reports:

The TLS session cache in FreeRADIUS before 3.0.14 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAP or TTLS.

CVE-2017-9148 http://freeradius.org/security.html http://seclists.org/oss-sec/2017/q2/342 http://www.securityfocus.com/bid/98734 2017-02-03 2017-06-01
heimdal -- bypass of capath policy heimdal 7.1.0_3

Viktor Dukhovni reports:

Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm to not be added to the transit path of issued tickets. This may, in some cases, enable bypass of capath policy in Heimdal versions 1.5 through 7.2. Note, this may break sites that rely on the bug. With the bug some incomplete [capaths] worked, that should not have. These may now break authentication in some cross-realm configurations. (CVE-2017-6594)

CVE-2017-6594 ports/219657 2017-04-13 2017-05-31
FreeBSD -- ipfilter(4) fragment handling panic FreeBSD-kernel 11.011.0_10 10.310.3_19

Problem Description:

ipfilter(4), capable of stateful packet inspection, using the "keep state" or "keep frags" rule options, will not only maintain the state of connections, such as TCP streams or UDP communication, it also maintains the state of fragmented packets. When a packet fragments are received they are cached in a hash table (and linked list). When a fragment is received it is compared with fragments already cached in the hash table for a match. If it does not match the new entry is used to create a new entry in the hash table. If on the other hand it does match, unfortunately the wrong entry is freed, the entry in the hash table. This results in use after free panic (and for a brief moment prior to the panic a memory leak due to the wrong entry being freed).

Impact:

Carefully feeding fragments that are allowed to pass by an ipfilter(4) firewall can be used to cause a panic followed by reboot loop denial of service attack.

CVE-2017-1081 SA-17:04.ipfilter 2017-04-27 2017-05-26
FreeBSD -- Multiple vulnerabilities of ntp FreeBSD 11.011.0_9 10.310.3_18

Problem Description:

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6464]

A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. [CVE-2017-6462]

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6463]

A vulnerability was found in NTP, affecting the origin timestamp check function. [CVE-2016-9042]

Impact:

A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. [CVE-2017-6463, CVE-2017-6464]

A malicious device could send crafted messages, causing ntpd to crash. [CVE-2017-6462]

An attacker able to spoof messages from all of the configured peers could send crafted packets to ntpd, causing later replies from those peers to be discarded, resulting in denial of service. [CVE-2016-9042]

CVE-2016-9042 CVE-2017-6462 CVE-2017-6463 CVE-2017-6464 SA-17:03.ntp 2017-04-12 2017-05-26
vlc -- remote code execution via crafted subtitles vlc 2.2.6,4 vlc-qt4 2.2.6,4

Check Point research team reports:

Remote code execution via crafted subtitles

http://blog.checkpoint.com/2017/05/23/hacked-in-translation/ 2017-05-23 2017-05-26
OpenEXR -- multiple remote code execution and denial of service vulnerabilities OpenEXR 2.2.1

Brandon Perry reports:

[There] is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0).

  • CVE-2017-9110 In OpenEXR 2.2.0, an invalid read of size 2 in the hufDecode function in ImfHuf.cpp could cause the application to crash.
  • CVE-2017-9111 In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
  • CVE-2017-9112 In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
  • CVE-2017-9113 In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute arbitrary code.
  • CVE-2017-9114 In OpenEXR 2.2.0, an invalid read of size 1 in the refill function in ImfFastHuf.cpp could cause the application to crash.
  • CVE-2017-9115 In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
  • CVE-2017-9116 In OpenEXR 2.2.0, an invalid read of size 1 in the uncompress function in ImfZip.cpp could cause the application to crash.
http://www.openwall.com/lists/oss-security/2017/05/12/5 CVE-2017-9110 CVE-2017-9111 CVE-2017-9112 CVE-2017-9113 CVE-2017-9114 CVE-2017-9115 CVE-2017-9116 https://github.com/openexr/openexr/issues/232 2017-01-12 2017-05-25
ImageMagick -- multiple vulnerabilities ImageMagick ImageMagick-nox11 6.9.6.4_2,1 6.9.7.0,16.9.8.8,1 ImageMagick7 ImageMagick7-nox11 7.0.5.9

Please reference CVE/URL list for details

https://nvd.nist.gov/vuln/search/results?query=ImageMagick CVE-2017-5506 CVE-2017-5507 CVE-2017-5508 CVE-2017-5509 CVE-2017-5510 CVE-2017-5511 CVE-2017-6497 CVE-2017-6498 CVE-2017-6499 CVE-2017-6500 CVE-2017-6501 CVE-2017-6502 CVE-2017-7275 CVE-2017-7606 CVE-2017-7619 CVE-2017-7941 CVE-2017-7942 CVE-2017-7943 CVE-2017-8343 CVE-2017-8344 CVE-2017-8345 CVE-2017-8346 CVE-2017-8347 CVE-2017-8348 CVE-2017-8349 CVE-2017-8350 CVE-2017-8351 CVE-2017-8352 CVE-2017-8353 CVE-2017-8354 CVE-2017-8355 CVE-2017-8356 CVE-2017-8357 CVE-2017-8765 CVE-2017-8830 CVE-2017-9141 CVE-2017-9142 CVE-2017-9143 CVE-2017-9144 2017-03-05 2017-05-25 2017-05-29
samba -- remote code execution vulnerability samba42 4.2.15 samba43 4.3.14 samba44 4.4.14 samba45 4.5.10 samba46 4.6.4

The samba project reports:

Remote code execution from a writable share.

All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

https://www.samba.org/samba/security/CVE-2017-7494.html CVE-2017-7494 2017-05-24 2017-05-24
NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler nvidia-driver 375.66

NVIDIA Unix security team reports:

NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where not correctly validated user input, NULL pointer dereference, and incorrect access control may lead to denial of service or potential escalation of privileges.

CVE-2017-0350 CVE-2017-0351 CVE-2017-0352 http://nvidia.custhelp.com/app/answers/detail/a_id/4462 2017-05-15 2017-05-23
miniupnpc -- integer signedness error miniupnpc 2.0.20170509

Tintinweb reports:

An integer signedness error was found in miniupnp's miniwget allowing an unauthenticated remote entity typically located on the local network segment to trigger a heap corruption or an access violation in miniupnp's http response parser when processing a specially crafted chunked-encoded response to a request for the xml root description url.

CVE-2017-8798 https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798 2017-05-09 2017-05-22
Wordpress -- multiple vulnerabilities wordpress fr-wordpress 4.7.5,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.5

WordPress versions 4.7.4 and earlier are affected by six security issues

  • Insufficient redirect validation in the HTTP class.
  • Improper handling of post meta data values in the XML-RPC API.
  • Lack of capability checks for post meta data in the XML-RPC API.
  • A Cross Site Request Forgery (CRSF) vulnerability was discovered in the filesystem credentials dialog.
  • A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.
https://wordpress.org/news/2017/05/wordpress-4-7-5/ 2017-05-16 2017-05-21
asterisk -- Memory exhaustion on short SCCP packets asterisk13 13.15.1

The Asterisk project reports:

A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with "chan_skinny" enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packet doesn't detect that the call to read() returned end-of-file before the expected number of bytes and continues infinitely. The "partial data" message logging in that tight loop causes Asterisk to exhaust all available memory.

http://downloads.asterisk.org/pub/security/AST-2017-004.html 2017-04-13 2017-05-19
asterisk -- Buffer Overrun in PJSIP transaction layer asterisk13 13.15.1 pjsip 2.6_1 pjsip-extsrtp 2.6_1

The Asterisk project reports:

A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By overrunning the buffer, the memory allocation table becomes corrupted, leading to an eventual crash.

The multi-part body parser in PJSIP contains a logical error that can make certain multi-part body parts attempt to read memory from outside the allowed boundaries. A specially-crafted packet can trigger these invalid reads and potentially induce a crash.

This issues is in PJSIP, and so the issue can be fixed without performing an upgrade of Asterisk at all. However, we are releasing a new version of Asterisk with the bundled PJProject updated to include the fix.

If you are running Asterisk with chan_sip, this issue does not affect you.

http://downloads.asterisk.org/pub/security/AST-2017-002.html http://downloads.asterisk.org/pub/security/AST-2017-003.html 2017-04-12 2017-05-19
Joomla3 -- SQL Injection joomla3 3.7.0

JSST reports:

Inadequate filtering of request data leads to a SQL Injection vulnerability.

CVE-2017-8917 https://developer.joomla.org/security-centre/692-20170501-core-sql-injection.html 2017-05-11 2017-05-18
gitlab -- Various security issues gitlab 6.6.08.17.5 9.0.09.0.6 9.1.09.1.2

GitLab reports:

Please reference CVE/URL list for details

https://about.gitlab.com/2017/05/08/gitlab-9-dot-1-dot-3-security-release/ 2017-05-08 2017-05-18 2017-05-30
gitlab -- Various security issues gitlab 8.7.08.15.7 8.16.08.16.7 8.17.08.17.3

GitLab reports:

Information Disclosure in Issue and Merge Request Trackers

During an internal code review a critical vulnerability in the GitLab Issue and Merge Request trackers was discovered. This vulnerability could allow a user with access to assign ownership of an issue or merge request to another user to disclose that user's private token, email token, email address, and encrypted OTP secret. Reporter-level access to a GitLab project is required to exploit this flaw.

SSRF when importing a project from a Repo by URL

GitLab instances that have enabled project imports using "Repo by URL" were vulnerable to Server-Side Request Forgery attacks. By specifying a project import URL of localhost an attacker could target services that are bound to the local interface of the server. These services often do not require authentication. Depending on the service an attacker might be able craft an attack using the project import request URL.

Links in Environments tab vulnerable to tabnabbing

edio via HackerOne reported that user-configured Environment links include target=_blank but do not also include rel: noopener noreferrer. Anyone clicking on these links may therefore be subjected to tabnabbing attacks where a link back to the requesting page is maintained and can be manipulated by the target server.

Accounts with email set to "Do not show on profile" have addresses exposed in public atom feed

Several GitLab users reported that even with "Do not show on profile" configured for their email addresses those addresses were still being leaked in Atom feeds if they commented on a public project.

CVE-2017-0882 https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/ 2017-03-20 2017-05-18 2017-05-30
freetype2 -- buffer overflows freetype2 2.8

Werner Lemberg reports:

CVE-2017-8105, CVE-2017-8287: Older FreeType versions have out-of-bounds writes caused by heap-based buffer overflows related to Type 1 fonts.

http://lists.nongnu.org/archive/html/freetype-announce/2017-05/msg00000.html CVE-2017-8105 CVE-2017-8287 2017-05-17 2017-05-17
OpenVPN -- two remote denial-of-service vulnerabilities openvpn 2.3.15 2.4.02.4.2 openvpn23 2.3.15 openvpn-mbedtls 2.4.02.4.2 openvpn-polarssl 2.3.15 openvpn23-polarssl 2.3.15

Samuli Seppänen reports:

OpenVPN v2.4.0 was audited for security vulnerabilities independently by Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by Private Internet Access) between December 2016 and April 2017. The primary findings were two remote denial-of-service vulnerabilities. Fixes to them have been backported to v2.3.15.

An authenticated client can do the 'three way handshake' (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet is the first that is allowed to carry payload. If that payload is too big, the OpenVPN server process will stop running due to an ASSERT() exception. That is also the reason why servers using tls-auth/tls-crypt are protected against this attack - the P_CONTROL packet is only accepted if it contains the session ID we specified, with a valid HMAC (challenge-response). (CVE-2017-7478)

An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT() and stop running. To make the server hit the ASSERT(), the client must first cause the server to send it 2^32 packets (at least 196 GB).

https://openvpn.net/index.php/open-source/downloads.html CVE-2017-7478 CVE-2017-7479 https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits https://ostif.org/?p=870&preview=true https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-2-fixes-critical-issues-discovered-openvpn-audit-reports/ 2017-05-10 2017-05-11
PostgreSQL vulnerabilities postgresql92-client 9.2.09.2.20 postgresql93-client 9.3.09.3.16 postgresql94-client 9.4.09.4.11 postgresql95-client 9.5.09.5.6 postgresql96-client 9.6.09.6.2 postgresql92-server 9.2.09.2.20 postgresql93-server 9.3.09.3.16 postgresql94-server 9.4.09.4.11 postgresql95-server 9.5.09.5.6 postgresql96-server 9.6.09.6.2

The PostgreSQL project reports:

Security Fixes nested CASE expressions + database and role names with embedded special characters

  • CVE-2017-7484: selectivity estimators bypass SELECT privilege checks.
  • CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable
  • CVE-2017-7486: pg_user_mappings view discloses foreign server passwords. This applies to new databases, see the release notes for the procedure to apply the fix to an existing database.
CVE-2016-5423 CVE-2016-5424 2017-05-11 2017-05-11
kauth: Local privilege escalation kdelibs 4.14.30_4 kf5-kauth 5.33.0_1

Albert Astals Cid reports:

KAuth contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account.

CVE-2017-8422 http://www.openwall.com/lists/oss-security/2017/05/10/3 https://www.kde.org/info/security/advisory-20170510-1.txt 2017-05-10 2017-05-10
libetpan -- null dereference vulnerability in MIME parsing component libetpan 1.8

rwhitworth reports:

I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the mime-parse test program. Is fixing these crashes something you're interested in? The input files can be found here: https://github.com/rwhitworth/libetpan-fuzz/. The files can be executed as ./mime-parse id_filename to cause seg faults.

CVE-2017-8825 http://cve.circl.lu/cve/CVE-2017-8825 2017-04-29 2017-05-09
chromium -- race condition vulnerability chromium 58.0.3029.96

Google Chrome Releases reports:

1 security fix in this release:

CVE-2017-5068 https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html 2017-05-02 2017-05-03
dovecot -- Dovecot DoS when passdb dict was used for authentication dovecot dovecot2 2.2.25_62.2.29

Timo Sirainen reports:

passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS.

CVE-2017-2669 https://dovecot.org/list/dovecot-news/2017-April/000341.html https://dovecot.org/list/dovecot-news/2017-April/000342.html 2016-12-01 2017-04-30
LibreSSL -- TLS verification vulnerability libressl 2.5.12.5.3_1 libressl-devel 2.5.12.5.3_1

Jakub Jirutka reports:

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx.

http://seclists.org/oss-sec/2017/q2/145 https://github.com/libressl-portable/portable/issues/307 CVE-2017-8301 2017-04-27 2017-04-28
jenkins -- multiple vulnerabilities jenkins 2.57 jenkins-lts 2.46.2

Jenkins Security Advisory:

Description

SECURITY-412 through SECURITY-420 / CVE-2017-1000356

CSRF: Multiple vulnerabilities

SECURITY-429 / CVE-2017-1000353

CLI: Unauthenticated remote code execution

SECURITY-466 / CVE-2017-1000354

CLI: Login command allowed impersonating any Jenkins user

SECURITY-503 / CVE-2017-1000355

XStream: Java crash when trying to instantiate void/Void

CVE-2017-1000356 CVE-2017-1000353 CVE-2017-1000354 CVE-2017-1000355 https://jenkins.io/security/advisory/2017-04-26/ 2017-04-26 2017-04-27
codeigniter -- multiple vulnerabilities codeigniter 3.1.4

The CodeIgniter changelog reports:

Fixed a header injection vulnerability in common function set_status_header() under Apache (thanks to Guillermo Caminer from Flowgate).

Fixed byte-safety issues in Encrypt Library (DEPRECATED) when mbstring.func_overload is enabled.

Fixed byte-safety issues in Encryption Library when mbstring.func_overload is enabled.

Fixed byte-safety issues in compatibility functions password_hash(), hash_pbkdf2() when mbstring.func_overload is enabled.

Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv() with MCRYPT_DEV_URANDOM.

https://www.codeigniter.com/user_guide/changelog.html 2017-03-23 2017-04-25
weechat -- multiple vulnerabilities weechat 1.7.1

Common Vulnerabilities and Exposures:

WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow.

https://weechat.org/download/security/ CVE-2017-8073 2017-04-23 2017-04-24
drupal8 -- Drupal Core - Critical - Access Bypass drupal8 8.3.1

Drupal Security Team Reports:

CVE-2017-6919: Access bypass

CVE-2017-6919 2017-04-19 2017-04-21
chromium -- multiple vulnerabilities chromium chromium-pulse 58.0.3029.81

Google Chrome Releases reports:

29 security fixes in this release, including:

  • [695826] High CVE-2017-5057: Type confusion in PDFium. Credit to Guang Gong of Alpha Team, Qihoo 360
  • [694382] High CVE-2017-5058: Heap use after free in Print Preview. Credit to Khalil Zhani
  • [684684] High CVE-2017-5059: Type confusion in Blink. Credit to SkyLined working with Trend Micro's Zero Day Initiative
  • [683314] Medium CVE-2017-5060: URL spoofing in Omnibox. Credit to Xudong Zheng
  • [672847] Medium CVE-2017-5061: URL spoofing in Omnibox. Credit to Haosheng Wang (@gnehsoah)
  • [702896] Medium CVE-2017-5062: Use after free in Chrome Apps. Credit to anonymous
  • [700836] Medium CVE-2017-5063: Heap overflow in Skia. Credit to Sweetchip
  • [693974] Medium CVE-2017-5064: Use after free in Blink. Credit to Wadih Matar
  • [704560] Medium CVE-2017-5065: Incorrect UI in Blink. Credit to Khalil Zhani
  • [690821] Medium CVE-2017-5066: Incorrect signature handing in Networking. Credit to Prof. Zhenhua Duan, Prof. Cong Tian, and Ph.D candidate Chu Chen (ICTT, Xidian University)
  • [648117] Medium CVE-2017-5067: URL spoofing in Omnibox. Credit to Khalil Zhani
  • [691726] Low CVE-2017-5069: Cross-origin bypass in Blink. Credit to Michael Reizelman
  • [713205] Various fixes from internal audits, fuzzing and other initiatives
CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-desktop.html 2017-04-19 2017-04-21
icu -- multiple vulnerabilities icu 58.2_2,1 linux-c6-icu linux-c7-icu 59.0

NVD reports:

International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_setNativeIndex* function.

International Components for Unicode (ICU) for C/C++ before 2017-02-13 has an out-of-bounds write caused by a heap-based buffer overflow related to the utf8TextAccess function in common/utext.cpp and the utext_moveIndex32* function.

CVE-2017-7867 CVE-2017-7868 http://bugs.icu-project.org/trac/changeset/39671 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437 2017-01-21 2017-04-20 2017-05-04
tiff -- multiple vulnerabilities tiff linux-f8-tiff linux-f10-tiff linux-c6-tiff linux-c7-tiff 4.0.8

NVD reports:

Please reference CVE/URL list for details

CVE-2017-5225 CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 https://github.com/vadz/libtiff/commit/5c080298d59e https://github.com/vadz/libtiff/commit/48780b4fcc42 https://github.com/vadz/libtiff/commit/d60332057b95 https://github.com/vadz/libtiff/commit/2ea32f7372b6 https://github.com/vadz/libtiff/commit/8283e4d1b7e5 https://github.com/vadz/libtiff/commit/47f2fb61a3a6 https://github.com/vadz/libtiff/commit/3cfd62d77c2a https://github.com/vadz/libtiff/commit/3144e57770c1 https://github.com/vadz/libtiff/commit/0a76a8c765c7 https://github.com/vadz/libtiff/commit/66e7bd595209 2017-04-01 2017-04-20
libsamplerate -- multiple vulnerabilities libsamplerate linux-c6-libsamplerate linux-c7-libsamplerate 0.1.9

NVD reports:

In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.

CVE-2017-7697 https://github.com/erikd/libsamplerate/commit/c3b66186656d 2017-04-11 2017-04-20
libsndfile -- multiple vulnerabilities libsndfile linux-c6-libsndfile linux-c7-libsndfile 1.0.28_2

NVD reports:

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.

In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.

CVE-2017-7585 CVE-2017-7586 CVE-2017-7741 CVE-2017-7742 https://github.com/erikd/libsndfile/commit/60b234301adf https://github.com/erikd/libsndfile/commit/708e996c87c5 https://github.com/erikd/libsndfile/commit/f457b7b5ecfe https://github.com/erikd/libsndfile/commit/60b234301adf 2017-04-07 2017-04-20
cURL -- TLS session resumption client cert bypass (again) curl 7.52.07.54.0

cURL security advisory:

libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate).

libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster.

This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.

CVE-2017-7468 https://curl.haxx.se/docs/adv_20170419.html 2017-04-19 2017-04-20
graphite2 -- out-of-bounds write with malicious font graphite2 1.3.9_1 linux-c7-graphite2 1.3.10

Mozilla Foundation reports:

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products.

CVE-2017-5436 https://github.com/silnrsi/graphite/commit/1ce331d5548b 2017-04-19 2017-04-19 2017-04-20
libevent -- multiple vulnerabilities libevent libevent2 linux-c6-libevent2 linux-c7-libevent 2.1.6

Debian Security reports:

CVE-2016-10195: The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.

CVE-2016-10196: Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.

CVE-2016-10197: The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.

CVE-2016-10195 CVE-2016-10196 CVE-2016-10197 http://www.openwall.com/lists/oss-security/2017/01/31/17 https://github.com/libevent/libevent/issues/317 https://github.com/libevent/libevent/issues/318 https://github.com/libevent/libevent/issues/332 https://github.com/libevent/libevent/issues/335 2017-01-31 2017-04-19
NSS -- multiple vulnerabilities nss linux-f10-nss linux-c6-nss linux-c7-nss 3.303.30.1 3.293.29.5 3.223.28.4 3.21.4

Mozilla Foundation reports:

An out-of-bounds write during Base64 decoding operation in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox 53 has been updated with NSS version 3.29.5.

CVE-2017-5461 CVE-2017-5462 https://hg.mozilla.org/projects/nss/rev/99a86619eac9 https://hg.mozilla.org/projects/nss/rev/e126381a3c29 2017-03-17 2017-04-19
mozilla -- multiple vulnerabilities firefox 53.0_2,1 seamonkey linux-seamonkey 2.49.1 firefox-esr 46.0,152.1.0_2,1 45.9.0,1 linux-firefox 46.0,252.1.0,2 45.9.0,2 libxul 46.052.1.0 45.9.0 thunderbird linux-thunderbird 46.052.1.0 45.9.0

Mozilla Foundation reports:

Please reference CVE/URL list for details

CVE-2017-5433 CVE-2017-5435 CVE-2017-5436 CVE-2017-5461 CVE-2017-5459 CVE-2017-5466 CVE-2017-5434 CVE-2017-5432 CVE-2017-5460 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5464 CVE-2017-5443 CVE-2017-5444 CVE-2017-5446 CVE-2017-5447 CVE-2017-5465 CVE-2017-5448 CVE-2017-5437 CVE-2017-5454 CVE-2017-5455 CVE-2017-5456 CVE-2017-5469 CVE-2017-5445 CVE-2017-5449 CVE-2017-5450 CVE-2017-5451 CVE-2017-5462 CVE-2017-5463 CVE-2017-5467 CVE-2017-5452 CVE-2017-5453 CVE-2017-5458 CVE-2017-5468 CVE-2017-5430 CVE-2017-5429 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/ 2017-04-19 2017-04-19 2017-09-19
MySQL -- multiple vulnerabilities mariadb55-server 5.5.55 mariadb100-server 10.0.31 mariadb101-server 10.1.23 mysql55-server 5.5.55 mysql56-server 5.6.36 mysql57-server 5.7.18

Oracle reports:

This Critical Patch Update contains 39 new security fixes for Oracle MySQL. 11 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html CVE-2017-3308 CVE-2017-3309 CVE-2017-3450 CVE-2017-3599 CVE-2017-3329 CVE-2017-3600 CVE-2017-3331 CVE-2017-3453 CVE-2017-3452 CVE-2017-3454 CVE-2017-3455 CVE-2017-3305 CVE-2017-3460 CVE-2017-3456 CVE-2017-3458 CVE-2017-3457 CVE-2017-3459 CVE-2017-3463 CVE-2017-3462 CVE-2017-3461 CVE-2017-3464 CVE-2017-3465 CVE-2017-3467 CVE-2017-3468 2017-04-19 2017-04-19
BIND -- multiple vulnerabilities bind99 9.9.9P8 bind910 9.10.4P8 bind911 9.11.0P5 bind9-devel 9.12.0.a.2017.03.25

ISC reports:

A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate.

An attacker could deliberately construct a query, enabling denial-of-service against a server if it was configured to use the DNS64 feature and other preconditions were met.

Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could lead to a situation in which named would exit with an assertion failure when processing a response in which records occurred in an unusual order.

named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a control channel, using a utility program such as rndc.

A regression introduced in a recent feature change has created a situation under which some versions of named can be caused to exit with a REQUIRE assertion failure if they are sent a null command string.

CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 https://kb.isc.org/article/AA-01465/0 https://kb.isc.org/article/AA-01466/0 https://kb.isc.org/article/AA-01471/0 2017-04-12 2017-04-13 2017-04-13
id Tech 3 -- remote code execution vulnerability ioquake3 1.36_16 ioquake3-devel g2930 iourbanterror 4.3.2,1 openarena 0.8.8.s1910_3,1

The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks.

CVE-2017-6903 https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/ 2017-03-14 2017-04-07
xen-kernel -- broken check in memory_exchange() permits PV guest breakout xen-kernel 4.7.2_1

The Xen Project reports:

The XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks.

CVE-2017-7228 https://xenbits.xen.org/xsa/advisory-212.html 2017-04-04 2017-04-06
cURL -- potential memory disclosure curl 6.57.53.1_1

The cURL project reports:

There were two bugs in curl's parser for the command line option --write-out (or -w for short) that would skip the end of string zero byte if the string ended in a % (percent) or \ (backslash), and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that memory to the terminal or the target file etc..

This flaw only exists in the command line tool.

We are not aware of any exploit of this flaw.

https://curl.haxx.se/docs/adv_20170403.html CVE-2017-7407 2017-04-03 2017-04-05 2017-04-06
django -- multiple vulnerabilities py27-django py33-django py34-django py35-django py36-django 1.8.18 py27-django18 py33-django18 py34-django18 py35-django18 py36-django18 1.8.18 py27-django19 py33-django19 py34-django19 py35-django19 py36-django19 1.9.13 py27-django110 py33-django110 py34-django110 py35-django110 py36-django110 1.10.7

Django team reports:

These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

  • Open redirect and possible XSS attack via user-supplied numeric redirect URLs
  • Open redirect vulnerability in django.views.static.serve()
https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ CVE-2017-7233 CVE-2017-7234 2017-04-04 2017-04-04
asterisk -- Buffer overflow in CDR's set user asterisk13 13.14.1

The Asterisk project reports:

No size checking is done when setting the user field on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. This allows the possibility of remote code injection.

http://downloads.asterisk.org/pub/security/AST-2017-001.html https://issues.asterisk.org/jira/browse/ASTERISK-26897 2017-03-27 2017-04-04
NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler nvidia-driver 375.39 nvidia-driver-340 340.102 nvidia-driver-304 304.135

NVIDIA Unix security team reports:

NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where multiple integer overflows, improper access control, and improper validation of a user input may cause a denial of service or potential escalation of privileges.

CVE-2017-0309 CVE-2017-0310 CVE-2017-0311 CVE-2017-0318 CVE-2017-0321 http://nvidia.custhelp.com/app/answers/detail/a_id/4398 2017-02-14 2017-04-04
chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 57.0.2987.133

Google Chrome Releases reports:

5 security fixes in this release, including:

  • [698622] Critical CVE-2017-5055: Use after free in printing. Credit to Wadih Matar
  • [699166] High CVE-2017-5054: Heap buffer overflow in V8. Credit to Nicolas Trippar of Zimperium zLabs
  • [662767] High CVE-2017-5052: Bad cast in Blink. Credit to JeongHoon Shin
  • [705445] High CVE-2017-5056: Use after free in Blink. Credit to anonymous
  • [702058] High CVE-2017-5053: Out of bounds memory access in V8. Credit to Team Sniper (Keen Lab and PC Mgr) reported through ZDI (ZDI-CAN-4587)
CVE-2017-5055 CVE-2017-5054 CVE-2017-5052 CVE-2017-5056 CVE-2017-5053 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop_29.html 2017-03-29 2017-03-30
xen-tools -- xenstore denial of service via repeated update xen-tools 4.7.2_1

The Xen Project reports:

Unprivileged guests may be able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host.

http://xenbits.xen.org/xsa/advisory-206.html 2017-03-28 2017-03-30
phpMyAdmin -- bypass 'no password' restriction phpMyAdmin 4.7.0

The phpMyAdmin team reports:

Summary

Bypass $cfg['Servers'][$i]['AllowNoPassword']

Description

A vulnerability was discovered where the restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions. This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default).

This behavior depends on the PHP version used (it seems PHP 5 is affected, while PHP 7.0 is not).

Severity

We consider this vulnerability to be of moderate severity.

Mitigation factor

Set a password for all users.

https://www.phpmyadmin.net/security/PMASA-2017-8/ 2017-03-28 2017-03-29
samba -- symlink race allows access outside share definition samba36 3.6.03.6.25_4 samba4 4.0.04.0.26 samba41 4.1.04.1.23 samba42 4.2.04.2.14 samba43 4.3.04.3.13 samba44 4.4.04.4.12 samba45 4.5.04.5.7 samba46 4.6.04.6.1

Samba team reports:

A time-of-check, time-of-use race condition can allow clients to access non-exported parts of the file system via symlinks.

https://www.samba.org/samba/security/CVE-2017-2619.html CVE-2017-2619 2017-03-23 2017-03-24
xen-tools -- Cirrus VGA Heap overflow via display refresh xen-tools 4.7.2

The Xen Project reports:

A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process.

CVE-2016-9603 http://xenbits.xen.org/xsa/advisory-211.html 2017-03-14 2017-03-23
irssi -- use-after-free potential code execution irssi 0.8.21,11.0.2,1

The irssi project reports:

Use after free while producing list of netjoins (CWE-416). This issue was found and reported to us by APic. This issue usually leads to segmentation faults. Targeted code execution should be difficult.

https://irssi.org/security/irssi_sa_2017_03.txt CVE-2017-7191 2017-03-11 2017-03-18
mysql -- denial of service vulnerability mariadb55-client 5.5.54 mariadb100-client 10.0.30 mariadb101-client 10.1.22 mysql55-client 5.5.54 mysql56-client 5.6.21 mysql57-client 5.7.5

Openwall reports:

C client library for MySQL (libmysqlclient.so) has use-after-free defect which can cause crash of applications using that MySQL client.

http://www.openwall.com/lists/oss-security/2017/02/11/11 CVE-2017-3302 2017-01-27 2017-03-18
firefox -- integer overflow in createImageBitmap() firefox 52.0.1,1

The Mozilla Foundation reports:

An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer.

CVE-2017-5428 https://www.mozilla.org/security/advisories/mfsa2017-08/ 2017-03-17 2017-03-18
moodle -- multiple vulnerabilities moodle29 2.9.9 moodle30 3.0.9 moodle31 3.1.5 moodle32 3.2.2

Marina Glancy reports:

In addition to a number of bug fixes and small improvements, security vulnerabilities have been discovered and fixed. We highly recommend that you upgrade your sites as soon as possible. Upgrading should be very straightforward. As per our usual policy, admins of all registered Moodle sites will be notified of security issue details directly via email and we'll publish details more widely in a week.

https://moodle.org/news/#p1408104 2017-03-13 2017-03-18
moodle -- multiple vulnerabilities moodle29 2.9.9 moodle30 3.0.8 moodle31 3.1.4 moodle32 3.2.1

Marina Glancy reports:

  • MSA-17-0001: System file inclusion when adding own preset file in Boost theme

  • MSA-17-0002: Incorrect sanitation of attributes in forums

  • MSA-17-0003: PHPMailer vulnerability in no-reply address

  • MSA-17-0004: XSS in assignment submission page

CVE-2017-2576 CVE-2017-2578 CVE-2016-10045 https://moodle.org/security/ 2017-01-17 2017-03-18 2020-06-24
drupal8 -- multiple vulnerabilities drupal8 8.2.7

Drupal Security Team reports:

CVE-2017-6377: Editor module incorrectly checks access to inline private files

CVE-2017-6379: Some admin paths were not protected with a CSRF token

CVE-2017-6381: Remote code execution

CVE-2017-6377 CVE-2017-6379 CVE-2017-6381 https://www.drupal.org/SA-2017-001 2017-03-15 2017-03-17
PuTTY -- integer overflow permits memory overwrite by forwarded ssh-agent connections putty 0.68

Simon G. Tatham reports:

Many versions of PuTTY prior to 0.68 have a heap-corrupting integer overflow bug in the ssh_agent_channel_data function which processes messages sent by remote SSH clients to a forwarded agent connection. [...]

This bug is only exploitable at all if you have enabled SSH agent forwarding, which is turned off by default. Moreover, an attacker able to exploit this bug would have to have already be able to connect to the Unix-domain socket representing the forwarded agent connection. Since any attacker with that capability would necessarily already be able to generate signatures with your agent's stored private keys, you should in normal circumstances be defended against this vulnerability by the same precautions you and your operating system were already taking to prevent untrusted people from accessing your SSH agent.

http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-agent-fwd-overflow.html CVE-2017-6542 2017-01-29 2017-03-16
Flash Player -- multiple vulnerabilities linux-flashplayer 25.0.0.127

Adobe reports:

  • These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2017-2997).
  • These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2998, CVE-2017-2999).
  • These updates resolve a random number generator vulnerability used for constant blinding that could lead to information disclosure (CVE-2017-3000).
  • These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-3001, CVE-2017-3002, CVE-2017-3003).
CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 https://helpx.adobe.com/security/products/flash-player/apsb17-07.html 2017-03-14 2017-03-16
mbed TLS (PolarSSL) -- multiple vulnerabilities mbedtls 2.4.2 polarssl13 1.3.19

Janos Follath reports:

  • If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.
  • If the client and the server both support MD5 and the client can be tricked to authenticate to a malicious server, then the malicious server can impersonate the client. To launch this man in the middle attack, the adversary has to compute a chosen-prefix MD5 collision in real time. This is very expensive computationally, but can be practical. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.
  • A bug in the logic of the parsing of a PEM encoded Certificate Revocation List in mbedtls_x509_crl_parse() can result in an infinite loop. In versions before 1.3.10 the same bug results in an infinite recursion stack overflow that usually crashes the application. Methods and means of acquiring the CRLs is not part of the TLS handshake and in the strict TLS setting this vulnerability cannot be triggered remotely. The vulnerability cannot be triggered unless the application explicitly calls mbedtls_x509_crl_parse() or mbedtls_x509_crl_parse_file()on a PEM formatted CRL of untrusted origin. In which case the vulnerability can be exploited to launch a denial of service attack against the application.
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 2017-03-11 2017-03-12
chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 57.0.2987.98

Google Chrome Releases reports:

36 security fixes in this release

Please reference CVE/URL list for details

CVE-2017-5030 CVE-2017-5031 CVE-2017-5032 CVE-2017-5029 CVE-2017-5034 CVE-2017-5035 CVE-2017-5036 CVE-2017-5037 CVE-2017-5039 CVE-2017-5040 CVE-2017-5041 CVE-2017-5033 CVE-2017-5042 CVE-2017-5038 CVE-2017-5043 CVE-2017-5044 CVE-2017-5045 CVE-2017-5046 https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html 2017-03-09 2017-03-12
Several Security Defects in the Bouncy Castle Crypto APIs bouncycastle15 1.511.56

The Legion of the Bouncy Castle reports:

Release: 1.56

2.1.4 Security Related Changes and CVE's Addressed by this Release: (multiple)

ports/215507 https://www.bouncycastle.org/releasenotes.html 2016-12-23 2017-03-12
kde-runtime -- kdesu: displayed command truncated by unicode string terminator kde-runtime 4.14.3_5

Albert Aastals Cid reports:

A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.

CVE-2016-7787 http://www.openwall.com/lists/oss-security/2016/09/29/7 https://www.kde.org/info/security/advisory-20160930-1.txt 2016-09-30 2017-03-11
kdepimlibs -- directory traversal on KTNEF kdepimlibs 4.14.10_7

Albert Aastals Cid reports:

A directory traversal issue was found in KTNEF which can be exploited by tricking a user into opening a malicious winmail.dat file. The issue allows to write files with the permission of the user opening the winmail.dat file during extraction.

https://www.kde.org/info/security/advisory-20170227-1.txt 2017-02-27 2017-03-11
kio: Information Leak when accessing https when using a malicious PAC file kdelibs 4.14.29_10 kf5-kio 5.31.0_1

Albert Astals Cid reports:

Using a malicious PAC file, and then using exfiltration methods in the PAC function FindProxyForURL() enables the attacker to expose full https URLs.

This is a security issue since https URLs may contain sensitive information in the URL authentication part (user:password@host), and in the path and the query (e.g. access tokens).

This attack can be carried out remotely (over the LAN) since proxy settings allow "Detect Proxy Configuration Automatically". This setting uses WPAD to retrieve the PAC file, and an attacker who has access to the victim's LAN can interfere with the WPAD protocols (DHCP/DNS+HTTP) and inject his/her own malicious PAC instead of the legitimate one.

https://www.kde.org/info/security/advisory-20170228-1.txt 2017-02-28 2017-03-11
wordpress -- multiple vulnerabilities wordpress 4.7.3,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.3

WordPress versions 4.7.2 and earlier are affected by six security issues.

  • Cross-site scripting (XSS) via media file metadata.
  • Control characters can trick redirect URL validation.
  • Unintended files can be deleted by administrators using the plugin deletion functionality.
  • Cross-site scripting (XSS) via video URL in YouTube embeds.
  • Cross-site scripting (XSS) via taxonomy term names.
  • Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources.
http://www.openwall.com/lists/oss-security/2017/03/07/3 https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance-release/ 2017-03-07 2017-03-07
mozilla -- multiple vulnerabilities firefox 52.0_1,1 seamonkey linux-seamonkey 2.49 firefox-esr 46.0,152.0,1 45.8.0_1,1 linux-firefox 46.0,252.0,2 45.8.0_1,2 libxul 46.052.0 45.8.0_1 thunderbird linux-thunderbird 46.052.0 45.8.0

Mozilla Foundation reports:

Please reference CVE/URL list for details

CVE-2017-5400 CVE-2017-5401 CVE-2017-5402 CVE-2017-5403 CVE-2017-5404 CVE-2017-5406 CVE-2017-5407 CVE-2017-5410 CVE-2017-5411 CVE-2017-5409 CVE-2017-5408 CVE-2017-5412 CVE-2017-5413 CVE-2017-5414 CVE-2017-5415 CVE-2017-5416 CVE-2017-5417 CVE-2017-5425 CVE-2017-5426 CVE-2017-5427 CVE-2017-5418 CVE-2017-5419 CVE-2017-5420 CVE-2017-5405 CVE-2017-5421 CVE-2017-5422 CVE-2017-5399 CVE-2017-5398 https://www.mozilla.org/security/advisories/mfsa2017-05/ https://www.mozilla.org/security/advisories/mfsa2017-06/ 2017-03-07 2017-03-07
codeigniter -- multiple vulnerabilities codeigniter 3.1.3

The CodeIgniter changelog reports:

Fixed an XSS vulnerability in Security Library method xss_clean().

Fixed a possible file inclusion vulnerability in Loader Library method vars().

Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used (thanks to Paul Buonopane from NamePros).

Added protection against timing side-channel attacks in Security Library method csrf_verify().

Added protection against BREACH attacks targeting the CSRF token field generated by Form Helper function form_open().

https://www.codeigniter.com/user_guide/changelog.html 2017-01-09 2017-03-05
ikiwiki -- authentication bypass vulnerability ikiwiki 3.20170111

ikiwiki reports:

The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646 in the passwordauth plugin's use of CGI::FormBuilder, with a more serious impact:

An attacker who can log in to a site with a password can log in as a different and potentially more privileged user.

An attacker who can create a new account can set arbitrary fields in the user database for that account

CVE-2017-0356 https://ikiwiki.info/security/#index48h2 2017-01-11 2017-03-05
ikiwiki -- multiple vulnerabilities ikiwiki 3.20161229

Mitre reports:

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

When CGI::FormBuilder->field("foo") is called in list context (and in particular in the arguments to a subroutine that takes named arguments), it can return zero or more values for foo from the CGI request, rather than the expected single value. This breaks the usual Perl parsing convention for named arguments, similar to CVE-2014-1572 in Bugzilla (which was caused by a similar API design issue in CGI.pm).

CVE-2016-10026 CVE-2016-9645 CVE-2016-9646 https://ikiwiki.info/security/#index46h2 https://ikiwiki.info/security/#index47h2 2016-12-19 2017-03-05
potrace -- multiple memory failure potrace 1.13

potrace reports:

CVE-2016-8685: invalid memory access in findnext

CVE-2016-8686: memory allocation failure

https://sourceforge.net/p/potrace/news/2017/02/potrace-114-released/ CVE-2016-8685 CVE-2016-8686 2016-10-15 2017-02-28
MPD -- buffer overflows in http output musicpd 0.20.5

The MPD project reports:

httpd: fix two buffer overflows in IcyMetaData length calculation

http://git.musicpd.org/cgit/master/mpd.git/plain/NEWS?h=v0.20.5 2017-02-18 2017-02-26
cURL -- ocsp status validation error curl 7.52.07.53.0

The cURL project reports:

SSL_VERIFYSTATUS ignored
curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension (using the CURLOPT_SSL_VERIFYSTATUS option). When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server doesn't support the extension, or fails to provide said proof, curl is expected to return an error.
Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work.
This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality.

https://curl.haxx.se/docs/adv_20170222.html CVE-2017-2629 2017-02-22 2017-02-22
xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe xen-tools 4.7.1_4

The Xen Project reports:

In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo fails to check whether the specified memory region is safe. A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation.

CVE-2017-2620 http://xenbits.xen.org/xsa/advisory-209.html 2017-02-21 2017-02-22
fbsdmon -- information disclosure vulnerability fbsdmon 0

Alan Somers reports:

The web site used by this port, http://fbsdmon.org, has been taken over by cybersquatters. That means that users are sending their system info to an unknown party.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217099 2017-02-14 2017-02-21
wavpack -- multiple invalid memory reads wavpack 5.1.0

David Bryant reports:

global buffer overread in read_code / read_words.c

heap out of bounds read in WriteCaffHeader / caff.c

heap out of bounds read in unreorder_channels / wvunpack.c

heap oob read in read_new_config_info / open_utils.c

http://www.openwall.com/lists/oss-security/2017/01/23/4 CVE-2016-10169 CVE-2016-10170 CVE-2016-10171 CVE-2016-10172 https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc 2017-01-21 2017-02-18
optipng -- multiple vulnerabilities optipng 0.7.6

ifread.c in gif2png, as used in OptiPNG before 0.7.6, allows remote attackers to cause a denial of service (uninitialized memory read) via a crafted GIF file.

The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delta escapes in a crafted BMP image.

Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.

Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.

CVE-2015-7802 CVE-2016-2191 CVE-2016-3981 CVE-2016-3982 2015-10-09 2017-02-16
openssl -- crash on handshake openssl-devel 1.1.0e

The OpenSSL project reports:

Severity: High
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.
This issue does not affect OpenSSL version 1.0.2.

https://www.openssl.org/news/secadv/20170216.txt CVE-2017-3733 2017-02-16 2017-02-16
diffoscope -- arbitrary file write py34-diffoscope py35-diffoscope py36-diffoscope 6776

Ximin Luo reports:

[v67] introduced a security hole where diffoscope may write to arbitrary locations on disk depending on the contents of an untrusted archive.

CVE-2017-0359 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723 2017-02-09 2017-02-14 2017-02-16
ffmpeg -- heap overflow in lavf/mov.c ffmpeg 3.2.4,1 mythtv mythtv-frontend 29.1,1

FFmpeg security reports:

FFmpeg 3.2.4 fixes the following vulnerabilities: CVE-2017-5024, CVE-2017-5025

CVE-2017-5024 https://www.ffmpeg.org/security.html https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html CVE-2017-5025 https://www.ffmpeg.org/security.html https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html 2017-01-25 2017-02-12 2018-03-25
gtk-vnc -- bounds checking vulnerabilities gtk-vnc 0.7.0

Daniel P. Berrange reports:

CVE-2017-5884 - fix bounds checking for RRE, hextile and copyrect encodings

CVE-2017-5885 - fix color map index bounds checking.

https://mail.gnome.org/archives/ftp-release-list/2017-February/msg00015.html CVE-2017-5884 CVE-2017-5885 2017-02-09 2017-02-11
xen-tools -- oob access in cirrus bitblt copy xen-tools 4.7.1_2

The Xen Project reports:

When doing bitblt copy backwards, qemu should negate the blit width. This avoids an oob access before the start of video memory.

A malicious guest administrator can cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation.

CVE-2017-2615 http://xenbits.xen.org/xsa/advisory-208.html 2017-02-10 2017-02-11
tiff -- multiple vulnerabilities tiff 4.0.7 linux-c6-libtiff linux-c6-tiff 3.9.4_5 linux-c7-libtiff linux-c7-tiff 4.0.3_3

libtiff project reports:

Multiple flaws have been discovered in libtiff library and utilities.

http://simplesystems.org/libtiff/v4.0.7.html CVE-2016-9533 CVE-2016-9534 CVE-2016-9535 CVE-2015-8870 CVE-2016-5652 CVE-2016-9540 CVE-2016-9537 CVE-2016-9536 2016-11-19 2017-02-06
mantis -- XSS vulnerability mantis 1.2.19

wdollman reports:

The value of the view_type parameter on the view_all_bug_page.php page is not encoded before being displayed on the page.

https://mantisbt.org/bugs/view.php?id=21611 CVE-2016-6837 ports/216662 2016-08-15 2017-02-04
guile2 -- multiple vulnerabilities guile2 2.0.13

Ludovic Courtès reports:

The REPL server is vulnerable to the HTTP inter-protocol attack

The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions.

http://www.openwall.com/lists/oss-security/2016/10/11/1 http://www.openwall.com/lists/oss-security/2016/10/12/2 CVE-2016-8605 CVE-2016-8606 ports/216663 2016-10-12 2017-02-04
chicken -- multiple vulnerabilities chicken 4.12,1

Peter Bex reports:

A buffer overflow error was found in the POSIX unit's procedures process-execute and process-spawn.

Additionally, a memory leak existed in this code, which would be triggered when an error is raised during argument and environment processing.

Irregex versions before 0.9.6 contain a resource exhaustion vulnerability: when compiling deeply nested regexes containing the "+" operator due to exponential expansion behaviour.

http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg00001.html CVE-2016-6830 CVE-2016-6831 CVE-2016-9954 ports/216661 2016-08-12 2017-02-04 2017-03-05
libebml -- multiple vulnerabilities libebml 1.3.3

Mortiz Bunkus reports:

Multiple invalid memory accesses vulnerabilities.

https://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html CVE-2015-8789 CVE-2015-8790 CVE-2015-8791 ports/216659 2015-10-20 2017-02-04
freeimage -- code execution vulnerability freeimage 3.16.0_4

TALOS reports:

An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library.

http://www.talosintelligence.com/reports/TALOS-2016-0189/ CVE-2016-5684 ports/216657 2016-10-03 2017-02-04 2018-04-14
shotwell -- failure to encrypt authentication shotwell 0.24.5

Jens Georg reports:

I have just released Shotwell 0.24.5 and 0.25.4 which turn on HTTPS encryption all over the publishing plugins.

Users using Tumblr and Yandex.Fotki publishing are strongly advised to change their passwords and reauthenticate Shotwell to those services after upgrade.

Users of Picasa and Youtube publishing are strongly advised to reauthenticate (Log out and back in) Shotwell to those services after upgrade.

https://mail.gnome.org/archives/shotwell-list/2017-January/msg00048.html 2017-01-31 2017-02-01
jenkins -- multiple vulnerabilities jenkins 2.44 jenkins-lts 2.32.2

Jenkins Security Advisory:

Please reference CVE/URL list for details

CVE-2017-2598 CVE-2017-2599 CVE-2017-2600 CVE-2011-4969 CVE-2017-2601 CVE-2015-0886 CVE-2017-2602 CVE-2017-2603 CVE-2017-2604 CVE-2017-2605 CVE-2017-2606 CVE-2017-2607 CVE-2017-2608 CVE-2017-2609 CVE-2017-2610 CVE-2017-2611 CVE-2017-2612 CVE-2017-2613 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017-02-01 2017-02-01 2017-02-01
wordpress -- multiple vulnerabilities wordpress 4.7.2,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.2

Aaron D. Campbell reports:

WordPress versions 4.7.1 and earlier are affected by three security issues:

  • The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it.
  • WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability.
  • A cross-site scripting (XSS) vulnerability was discovered in the posts list table.
  • An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint.
CVE-2017-5610 CVE-2017-5611 CVE-2017-5612 http://www.openwall.com/lists/oss-security/2017/01/28/5 https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ https://make.wordpress.org/core/2017/02/01/disclosure-of-additional-security-fix-in-wordpress-4-7-2/ 2017-01-26 2017-01-29
nfsen -- remote command execution nfsen 1.3.7

Peter Haag reports:

A remote attacker with access to the web interface to execute arbitrary commands on the host operating system.

https://sourceforge.net/p/nfsen/mailman/message/35623845/ 2017-01-24 2017-01-27
chromium -- multiple vulnerabilities chromium chromium-npapi chromium-pulse 56.0.2924.76

Google Chrome Releases reports:

51 security fixes in this release

Please reference CVE/URL list for details

CVE-2017-5007 CVE-2017-5006 CVE-2017-5008 CVE-2017-5010 CVE-2017-5011 CVE-2017-5009 CVE-2017-5012 CVE-2017-5013 CVE-2017-5014 CVE-2017-5015 CVE-2017-5019 CVE-2017-5016 CVE-2017-5017 CVE-2017-5018 CVE-2017-2020 CVE-2017-2021 CVE-2017-2022 CVE-2017-2023 CVE-2017-2024 CVE-2017-2025 CVE-2017-2026 https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-desktop.html 2017-01-25 2017-01-26
OpenSSL -- multiple vulnerabilities openssl 1.0.2k,1 openssl-devel 1.1.0d linux-c6-openssl 1.0.1e_13 linux-c7-openssl-libs 1.0.1e_3 FreeBSD 11.011.0_8 10.310.3_17

The OpenSSL project reports:

  • Truncated packet could crash via OOB read (CVE-2017-3731)
  • Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
  • BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
  • Montgomery multiplication may produce incorrect results (CVE-2016-7055)
https://www.openssl.org/news/secadv/20170126.txt CVE-2016-7055 CVE-2017-3730 CVE-2017-3731 CVE-2017-3732 SA-17:02.openssl 2017-01-26 2017-01-26 2017-05-26
mozilla -- multiple vulnerabilities firefox 51.0_1,1 seamonkey linux-seamonkey 2.48 firefox-esr 45.7.0,1 linux-firefox 45.7.0,2 libxul thunderbird linux-thunderbird 45.7.0

Mozilla Foundation reports:

Please reference CVE/URL list for details

CVE-2017-5373 CVE-2017-5374 CVE-2017-5375 CVE-2017-5376 CVE-2017-5377 CVE-2017-5378 CVE-2017-5379 CVE-2017-5380 CVE-2017-5381 CVE-2017-5382 CVE-2017-5383 CVE-2017-5384 CVE-2017-5385 CVE-2017-5386 CVE-2017-5387 CVE-2017-5388 CVE-2017-5389 CVE-2017-5390 CVE-2017-5391 CVE-2017-5392 CVE-2017-5393 CVE-2017-5394 CVE-2017-5395 CVE-2017-5396 https://www.mozilla.org/security/advisories/mfsa2017-01/ https://www.mozilla.org/security/advisories/mfsa2017-02/ 2017-01-24 2017-01-24
phpMyAdmin -- Multiple vulnerabilities phpMyAdmin 4.6.04.6.6

The phpMyAdmin development team reports:

Open redirect

php-gettext code execution

DOS vulnerability in table editing

CSS injection in themes

Cookie attribute injection attack

SSRF in replication

DOS in replication status

https://www.phpmyadmin.net/security/PMASA-2017-1 https://www.phpmyadmin.net/security/PMASA-2017-2 https://www.phpmyadmin.net/security/PMASA-2017-3 https://www.phpmyadmin.net/security/PMASA-2017-4 https://www.phpmyadmin.net/security/PMASA-2017-5 https://www.phpmyadmin.net/security/PMASA-2017-6 https://www.phpmyadmin.net/security/PMASA-2017-7 CVE-2015-8980 2017-01-24 2017-01-24
Intel(R) NVMUpdate -- Intel(R) Ethernet Controller X710/XL710 NVM Security Vulnerability intel-nvmupdate 5.05

Intel Corporation reports:

A security vulnerability in the Intel(R) Ethernet Controller X710 and Intel(R) Ethernet Controller XL710 family of products (Fortville) has been found in the Non-Volatile Flash Memory (NVM) image.

https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr CVE-2016-8106 2017-01-09 2017-01-23
PHP -- undisclosed vulnerabilities php56 5.6.30 php70 7.0.15

The PHP project reports:

The PHP development team announces the immediate availability of PHP 7.0.15. This is a security release. Several security bugs were fixed in this release.

The PHP development team announces the immediate availability of PHP 5.6.30. This is a security release. Several security bugs were fixed in this release.

http://php.net/archive/2017.php#id2017-01-19-2 http://php.net/archive/2017.php#id2017-01-19-3 2017-01-19 2017-01-19 2017-01-20
icoutils -- check_offset overflow on 64-bit systems icoutils 0.31.1

Choongwoo Han reports:

An exploitable crash exists in the wrestool utility on 64-bit systems where the result of subtracting two pointers exceeds the size of int.

CVE-2017-5208 CVE-2017-5331 CVE-2017-5332 CVE-2017-5333 http://seclists.org/oss-sec/2017/q1/38 2017-01-03 2017-01-19
mysql -- multiple vulnerabilities mariadb55-server 5.5.54 mariadb100-server 10.0.30 mariadb101-server 10.1.22 mysql55-server 5.5.54 mysql56-server 5.6.35 mysql57-server 5.7.17

Oracle reports:

No further details have been provided in the Critical Patch Update

http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html#AppendixMSQL CVE-2016-8318 CVE-2017-3312 CVE-2017-3258 CVE-2017-3273 CVE-2017-3244 CVE-2017-3257 CVE-2017-3238 CVE-2017-3256 CVE-2017-3291 CVE-2017-3265 CVE-2017-3251 CVE-2017-3313 CVE-2017-3243 CVE-2016-8327 CVE-2017-3317 CVE-2017-3318 CVE-2017-3319 CVE-2017-3320 2017-01-18 2017-01-18 2017-03-14
powerdns -- multiple vulnerabilities powerdns 3.4.11 4.0.04.0.2 powerdns-recursor 3.7.4 4.0.04.0.4

PowerDNS reports:

2016-02: Crafted queries can cause abnormal CPU usage

2016-03: Denial of service via the web server

2016-04: Insufficient validation of TSIG signatures

2016-05: Crafted zone record can cause a denial of service

CVE-2016-7068 CVE-2016-7072 CVE-2016-7073 CVE-2016-7074 CVE-2016-2120 ports/216135 ports/216136 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/ https://blog.powerdns.com/2017/01/13/powerdns-authoritative-server-4-0-2-released/ https://blog.powerdns.com/2017/01/13/powerdns-recursor-4-0-4-released/ 2016-12-15 2017-01-18
groovy -- remote execution of untrusted code/DoS vulnerability groovy 1.7.02.4.8

The Apache Groovy project reports:

When an application with Groovy on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it is possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability. This is similar to CVE-2015-3253 but this exploit involves extra wrapping of objects and catching of exceptions which are now safe guarded against.

CVE-2016-6814 http://groovy-lang.org/security.html 2016-09-20 2017-01-15
RabbitMQ -- Authentication vulnerability rabbitmq 3.0.03.5.8 3.6.03.6.6

Pivotal.io reports:

MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.

CVE-2016-9877 https://pivotal.io/security/cve-2016-9877 https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_6 2016-12-06 2017-01-15
wordpress -- multiple vulnerabilities wordpress 4.7.1,1 de-wordpress ja-wordpress ru-wordpress zh-wordpress-zh_CN zh-wordpress-zh_TW 4.7.1

Aaron D. Campbell reports:

WordPress versions 4.7 and earlier are affected by eight security issues...

CVE-2017-5487 CVE-2017-5488 CVE-2017-5489 CVE-2017-5490 CVE-2017-5491 CVE-2017-5492 CVE-2017-5493 http://www.openwall.com/lists/oss-security/2017/01/14/6 https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/ 2017-01-11 2017-01-15
mysql -- multiple vulnerabilities mysql57-client mysql57-server 5.7.15

Oracle reports:

Local security vulnerability in 'Server: Packaging' sub component.

93617 CVE-2016-5625 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html 2016-10-18 2017-01-14 2017-01-15
MySQL -- multiple vulnerabilities mariadb55-client mariadb55-server 5.5.52 mariadb100-client mariadb100-server 10.0.28 mariadb101-client mariadb101-server 10.1.18 mysql55-client mysql55-server 5.5.52 mysql56-client mysql56-server 5.6.33 mysql57-client mysql57-server 5.7.15 percona55-client percona55-server 5.5.51.38.2 percona56-client percona56-server 5.6.32.78.1

The MySQL project reports:

  • CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' sub component.
  • CVE-2016-5616, CVE-2016-6663: Race condition allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.
  • CVE-2016-5617, CVE-2016-6664: mysqld_safe, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.
  • CVE-2016-5624: Remote security vulnerability in 'Server: DML' sub component.
  • CVE-2016-5626: Remote security vulnerability in 'Server: GIS' sub component.
  • CVE-2016-5629: Remote security vulnerability in 'Server: Federated' sub component.
  • CVE-2016-8283: Remote security vulnerability in 'Server: Types' sub component.
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL https://mariadb.com/kb/en/mariadb/mariadb-10028-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-5552-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10118-release-notes/ CVE-2016-3492 CVE-2016-5616 CVE-2016-5617 CVE-2016-5624 CVE-2016-5626 CVE-2016-5629 CVE-2016-6663 CVE-2016-6664 CVE-2016-8283 2016-09-13 2017-01-14
Ansible -- Command execution on Ansible controller from host ansible 1.9.6_12.2.0.0_2

Computest reports:

Computest found and exploited several issues that allow a compromised host to execute commands on the Ansible controller and thus gain access to other hosts controlled by that controller.

CVE-2016-9587 https://www.computest.nl/advisories/CT-2017-0109_Ansible.txt https://lwn.net/Articles/711357/ 2017-01-09 2017-01-12
phpmailer -- Remote Code Execution phpmailer 5.2.22 tt-rss 2017.01.16

SecurityFocus reports:

PHPMailer is prone to an local information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

http://www.securityfocus.com/bid/95328/discuss CVE-2017-5223 2017-01-10 2017-01-12
BIND -- multiple vulnerabilities bind99 9.9.9P5 bind910 9.10.4P5 bind911 9.11.0P2 bind9-devel 9.12.0.a.2016.12.28 FreeBSD 9.310.0

ISC reports:

A malformed query response received by a recursive server in response to a query of RTYPE ANY could trigger an assertion failure while named is attempting to add the RRs in the query response to the cache.

Depending on the type of query and the EDNS options in the query they receive, DNSSEC-enabled authoritative servers are expected to include RRSIG and other RRsets in their responses to recursive servers. DNSSEC-validating servers will also make specific queries for DS and other RRsets. Whether DNSSEC-validating or not, an error in processing malformed query responses that contain DNSSEC-related RRsets that are inconsistent with other RRsets in the same query response can trigger an assertion failure. Although the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer.

An unusually-formed answer containing a DS resource record could trigger an assertion failure. While the combination of properties which triggers the assertion should not occur in normal traffic, it is potentially possible for the assertion to be triggered deliberately by an attacker sending a specially-constructed answer having the required properties.

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes.

CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 CVE-2016-9778 https://kb.isc.org/article/AA-01439/0 https://kb.isc.org/article/AA-01440/0 https://kb.isc.org/article/AA-01441/0 https://kb.isc.org/article/AA-01442/0 2017-01-11 2017-01-12
FreeBSD -- OpenSSH multiple vulnerabilities openssh-portable 7.3.p1_5,1 FreeBSD 11.011.0_7 10.310.3_16

Problem Description:

The ssh-agent(1) agent supports loading a PKCS#11 module from outside a trusted whitelist. An attacker can request loading of a PKCS#11 module across forwarded agent-socket. [CVE-2016-10009]

When privilege separation is disabled, forwarded Unix domain sockets would be created by sshd(8) with the privileges of 'root' instead of the authenticated user. [CVE-2016-10010]

Impact:

A remote attacker who have control of a forwarded agent-socket on a remote system and have the ability to write files on the system running ssh-agent(1) agent can run arbitrary code under the same user credential. Because the attacker must already have some control on both systems, it is relatively hard to exploit this vulnerability in a practical attack. [CVE-2016-10009]

When privilege separation is disabled (on FreeBSD, privilege separation is enabled by default and has to be explicitly disabled), an authenticated attacker can potentially gain root privileges on systems running OpenSSH server. [CVE-2016-10010]

CVE-2016-10009 CVE-2016-10010 SA-17:01.openssh 2017-01-11 2017-01-11 2017-01-13
openssl -- timing attack vulnerability openssl 1.0.2 libressl 2.4.4_1 libressl-devel 2.5.0_1

Cesar Pereida Garcia reports:

The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL versions and forks is vulnerable to timing attacks when signing with the standardized elliptic curve P-256 despite featuring constant-time curve operations and modular inversion. A software defect omits setting the BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in the BN_mod_inverse method and therefore resulting in a cache-timing attack vulnerability.
A malicious user with local access can recover ECDSA P-256 private keys.

http://seclists.org/oss-sec/2017/q1/52 CVE-2016-7056 2017-01-10 2017-01-11 2017-01-11
flash -- multiple vulnerabilities linux-flashplayer 24.0.0.194

Adobe reports:

These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2017-2938).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937).

These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931).

CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 https://helpx.adobe.com/security/products/flash-player/apsb17-02.html 2017-01-10 2017-01-11
moinmoin -- XSS vulnerabilities moinmoin 1.9.9

Thomas Waldmann reports:

  • fix XSS in AttachFile view (multifile related) CVE-2016-7148

  • fix XSS in GUI editor's attachment dialogue CVE-2016-7146

  • fix XSS in GUI editor's link dialogue CVE-2016-9119

http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES CVE-2016-7148 CVE-2016-7146 CVE-2016-9119 ports/214937 2016-10-31 2017-01-09
libvncserver -- multiple buffer overflows libvncserver 0.9.11

libvnc server reports:

Two unrelated buffer overflows can be used by a malicious server to overwrite parts of the heap and crash the client (or possibly execute arbitrary code).

https://github.com/LibVNC/libvncserver/pull/137 CVE-2016-9941 CVE-2016-9942 ports/215805 2016-11-24 2017-01-09
libdwarf -- multiple vulnerabilities libdwarf 20161124

Christian Rebischke reports:

libdwarf is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

https://lwn.net/Articles/708092/ CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030 CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5035 CVE-2016-5037 CVE-2016-5040 CVE-2016-5041 CVE-2016-5043 CVE-2016-5044 CVE-2016-7510 CVE-2016-7511 CVE-2016-8679 CVE-2016-8680 CVE-2016-8681 CVE-2016-9275 CVE-2016-9276 CVE-2016-9480 CVE-2016-9558 2016-12-04 2017-01-09
lynx -- multiple vulnerabilities lynx 2.8.8.2_5,1

Oracle reports:

Lynx is vulnerable to POODLE by still supporting vulnerable version of SSL. Lynx is also vulnerable to URL attacks by incorrectly parsing hostnames ending with an '?'.

https://hg.java.net/hg/solaris-userland~gate/file/bc5351dcb9ac/components/lynx/patches/02-init-openssl.patch https://hg.java.net/hg/solaris-userland~gate/file/0a979060f73b/components/lynx/patches/05-fix-CVE-2016-9179.patch CVE-2014-3566 CVE-2016-9179 ports/215464 2016-10-26 2017-01-09
hdf5 -- multiple vulnerabilities hdf5 1.10.0 hdf5-18 1.8.18

Talos Security reports:

  • CVE-2016-4330 (TALOS-2016-0176) - HDF5 Group libhdf5 H5T_ARRAY Code Execution Vulnerability

  • CVE-2016-4331 (TALOS-2016-0177) - HDF5 Group libhdf5 H5Z_NBIT Code Execution Vulnerability

  • CVE-2016-4332 (TALOS-2016-0178) - HDF5 Group libhdf5 Shareable Message Type Code Execution Vulnerability

  • CVE-2016-4333 (TALOS-2016-0179) - HDF5 Group libhdf5 H5T_COMPOUND Code Execution Vulnerability

http://blog.talosintel.com/2016/11/hdf5-vulns.html CVE-2016-4330 CVE-2016-4331 CVE-2016-4332 CVE-2016-4333 2016-11-17 2017-01-09
End of Life Ports py27-django16 py33-django16 py34-django16 py35-django16 0 drupal6 0

These packages have reached End of Life status and/or have been removed from the Ports Tree. They may contain undocumented security issues. Please take caution and find alternative software as soon as possible.

ports/211975 2017-01-06 2017-01-06
Use-After-Free Vulnerability in pcsc-lite pcsc-lite 1.6.01.8.20

Peter Wu on Openwall mailing-list reports:

The issue allows a local attacker to cause a Denial of Service, but can potentially result in Privilege Escalation since the daemon is running as root. while any local user can connect to the Unix socket. Fixed by patch which is released with hpcsc-lite 1.8.20.

CVE-2016-10109 http://www.openwall.com/lists/oss-security/2017/01/03/2 2017-01-03 2017-01-06 2017-01-10
GnuTLS -- Memory corruption vulnerabilities gnutls 3.5.8

The GnuTLS project reports:

  • It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead to heap and stack overflows. (GNUTLS-SA-2017-2)
  • It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted X.509 certificate with Proxy Certificate Information extension present could lead to a double free. (GNUTLS-SA-2017-1)
http://www.gnutls.org/news.html#2017-01-09 http://www.gnutls.org/security.html#GNUTLS-SA-2017-2 http://www.gnutls.org/security.html#GNUTLS-SA-2017-1 2017-01-09 2017-01-09
tomcat -- information disclosure vulnerability tomcat 6.0.49 tomcat7 7.0.74 tomcat8 8.0.40

The Apache Software Foundation reports:

Important: Information Disclosure CVE-2016-8745

CVE-2016-8745 ports/215865 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40 2017-01-05 2017-01-07 2017-03-18
tomcat -- multiple vulnerabilities tomcat 6.0.48 tomcat7 7.0.73 tomcat8 8.0.39

The Apache Software Foundation reports:

Important: Remote Code Execution CVE-2016-8735

Important: Information Disclosure CVE-2016-6816

CVE-2016-8735 CVE-2016-6816 ports/214599 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 2016-11-22 2017-01-07 2017-03-18
tomcat -- multiple vulnerabilities tomcat 6.0.47 tomcat7 7.0.72 tomcat8 8.0.37

The Apache Software Foundation reports:

Low: Unrestricted Access to Global Resources CVE-2016-6797

Low: Security Manager Bypass CVE-2016-6796

Low: System Property Disclosure CVE-2016-6794

Low: Security Manager Bypass CVE-2016-5018

Low: Timing Attack CVE-2016-0762

CVE-2016-6797 CVE-2016-6796 CVE-2016-6794 CVE-2016-5018 CVE-2016-0762 http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37 2016-10-27 2017-01-07 2017-03-18
Irssi -- multiple vulnerabilities irssi 0.8.21

Irssi reports:

Five vulnerabilities have been located in Irssi

  • A NULL pointer dereference in the nickcmp function found by Joseph Bisch. (CWE-690)
  • Use after free when receiving invalid nick message (Issue #466, CWE-146)
  • Out of bounds read in certain incomplete control codes found by Joseph Bisch. (CWE-126)
  • Out of bounds read in certain incomplete character sequences found by Hanno Böck and independently by J. Bisch. (CWE-126)
  • Out of bounds read when Printing the value '%['. Found by Hanno Böck. (CWE-126)

These issues may result in denial of service (remote crash).

CVE-2017-5193 CVE-2017-5194 CVE-2017-5195 CVE-2017-5196 CVE-2017-5356 ports/215800 https://irssi.org/security/irssi_sa_2017_01.txt 2017-01-03 2017-01-05 2017-01-15
codeigniter -- multiple vulnerabilities codeigniter 3.1.2

The CodeIgniter changelog reports:

Fixed a number of new vulnerabilities in Security Library method xss_clean().

https://www.codeigniter.com/user_guide/changelog.html 2016-10-28 2017-01-06
codeigniter -- multiple vulnerabilities codeigniter 3.1.0

The CodeIgniter changelog reports:

Fixed an SQL injection in the ‘odbc’ database driver.

Updated set_realpath() Path Helper function to filter-out php:// wrapper inputs.

https://www.codeigniter.com/user_guide/changelog.html 2016-07-26 2017-01-06
w3m -- multiple vulnerabilities w3m w3m-img ja-w3m ja-w3m-img 0.5.3.20170102

Multiple remote code execution and denial of service conditions present.

http://seclists.org/oss-sec/2016/q4/452 http://seclists.org/oss-sec/2016/q4/516 CVE-2016-9422 CVE-2016-9423 CVE-2016-9424 CVE-2016-9425 CVE-2016-9426 CVE-2016-9428 CVE-2016-9429 CVE-2016-9430 CVE-2016-9431 CVE-2016-9432 CVE-2016-9433 CVE-2016-9434 CVE-2016-9435 CVE-2016-9436 CVE-2016-9437 CVE-2016-9438 CVE-2016-9439 CVE-2016-9440 CVE-2016-9441 CVE-2016-9442 CVE-2016-9443 CVE-2016-9622 CVE-2016-9623 CVE-2016-9624 CVE-2016-9625 CVE-2016-9626 CVE-2016-9627 CVE-2016-9628 CVE-2016-9629 CVE-2016-9630 CVE-2016-9631 CVE-2016-9632 CVE-2016-9633 2016-11-03 2017-01-01 2017-01-09